ML20236Q788
| ML20236Q788 | |
| Person / Time | |
|---|---|
| Site: | Prairie Island  |
| Issue date: | 07/14/1998 |
| From: | Sorensen J NORTHERN STATES POWER CO. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| NUDOCS 9807210045 | |
| Download: ML20236Q788 (32) | |
Text
-e -
- a Northern states Power Company 1717 Wakonade Dr. E.
Welch, MN 55089 Telephone 612-388-1121 July 14,1998 10 CFR Part 50.59 U S Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555 PRAIRIE ISLAND NUCLEAR GENERATING PLANT Docket Nos. 50-282 License Nos. DPR-42 50-306 DPR-60 Response to July 2,1998, Request for Additional Information on License Amendment Request dated February 27,1998 ATWS Mitigating System Actuating Circuitry / Diverse Scram System The information in Attachment 1 is provided in response to an NRC staff request dated July 2,1998, for additional information related to our License Amendment Request dated February 27,1998.
j l
The need for a separate reset switch has been identified during further design development. The information in Attacilment 2 is provided to update the design
//
description provided in our License Amendment Request dated February 27,1998.
\\
information about system time delays requested verbally during the April 29,1998, meeting with NRC is provided in Attachment 3.
l-As identified in the cover letter transmitting our License Amendment Request dated February 27,1998, this modification is intended to be installed in Unit 2 in conjunction with the refueling oLtage that is now scheduled to begin on November 7,1998.
Approval of this amendment two months prior to this date is necessary to provide sufficient time to review and approve the modification package and then complete all 4
pre-outage work activities. To facilitate approval of this amendment within this time
,.- 4 9907210045 990714 PDR ADOCK 05000282 p
USNRC NORTHERN STATES POWER COMPANY July 14,1998 Page 2 frame, NSP staff are available to discuss the contents of this response in a meeting at NRC staff offices or in teleconferences.
In this submittal we have made no new NRC commitments, if you have any questions related to this matter, please contact John Stanton at 612-388-1121,
/
W Joel P. Sorensen Plant Manager Prairie Island Nuclear Generating Plant Attachments:
Response to July 2,1998, Request for Additional Information on License Amendment Request dated February 27,1998,
Replacement Sections for License Amendment Request dated February 27,1998,
Supplemental Information for License Amendment Request dated February 27,1998 c:
Regional Administrator-111, NRC NRR Project Manager, NRC Senior Resident Inspector, NRC Kris Sanda, State of Minnesota J E Silberg b__
l UNITED STATES NUCLEAR REGULATORY COMMISSION NdRTHERN STATES POWER COMPANY PRAIRIE ISLAND NUCLEAR GENERATING PLANT DOCKET Nos. 50-282 50-306 Response to July 2,1998, Request for Additional Information on License Amendment Request dated February 27,1998 ATWS Mitigating System Actuating Circuitry / Diverse Scram System j
i Northem States Power Company, a Minnesota corporation, with this letter is providing a response to the July 2,1998, NRC request for addition information on the License Amendment Request dated February 27,1998. This letter and its attachments contain
{
no restricted or other defense information.
I f
i NORTHERN STATES POWER COMPANY By dif/el P. So'rensen Plant Manager Prairie Island Nuclear Generating Plant h
1 i
On this eday of s
before me a notary public in and 'for said County, pers'/ially appeiieRJoel P. Sorensen, Plant Manager, l
o Prairie Island Nuclear GeneratingPlant, and baing first duly sworn acknowledged that he is authorized to execute this document on behalf of Northern States Power Company, that he knows the contents thereof, and that to the best of his knowledge, information, and belief the statements made in it are true and that it is not interposed for delay.
'N l
\\
t G:'":.;;..:::::::: :::::^ :^^G MARCLA K. LaCORE NOTARYPUBUFAAINNESOTA ',
HENNEPIN COUNTY L
Wy Commission Expires Jan.31,2000
-::.:::::::^::::: ::^.::::::::.::::
^
j
July 14,1998 NORTHERN STATES POWER COMPANY Response to July 2,1998, Request for Additional Information on License Amendment Request dated February 27,1998 ATWS Mitigating System Actuating Circuitry / Diverse Scram System Question 1.1:
Responses to the Prairie Island plant specific questions contained in the NRC Safety Evaluation Report (SER) of WCAP-10858P-A,("ATWS Mitigating System Actuation Circuitry Generic Design Package"), Revision 1 (Proprietary information. Not publicly available.), need to be provided for the new AMSAC design. Please note that the technical attributes required to be discussed include: Diversity, Logic Power Supplies, Safety Related Interface, Quality Assurance, Maintenance Bypasses, Operating Bypasses, Means for Bypassing, Manual lnitiation, Electrical Independence, Physical Separation, Environmental Qua0fication, Testability at Power, Completion of Mitigative Action, and Technical Specifications.
Response
Diversity The actuation outputs from the AMSAC/ DSS for turbine trip and auxiliary feedwater actuation remain unchanged from the original AMSAC design. A new actuation output for a diverse reactor trip provides relay contacts to the rod control system. During normal operations the rod control system maintains power to at least one gripper coil per control rod to keep the control rods from dropping into the reactor core. AMSAC/ DSS provides signals to the rod control system to de-energize all control rod gripper coils. This releases the control rods, allowing them to drop into the reactor core.
Inputs to the AMSAC/ DSS consist of SG Wide Range level signals, derived from existing transmitters and isolation amplifiers, and RCP breaker position switch contacts. The transmitters and isolation amplifiers used for the SG Wide Range level signals are not diverse from protection equipment nor are the position switches used for the RCP breaker position inputs. This is acceptable since diversity is only required from the sensor output' to the final actuation device. The SG Wide Range level signals are not used in the reactor protection or control systems.
A new control switch on the control board is provided to manually actuate the AMSAC/ DSS function. This new control switch is diverse from the existing Reactor Trip control switch used in the Control Room. The new switch is from a different rnanufacturer than the Westinghouse W2 switch used in the reactor protection system. The control switch causes a diverse reactor trip, a turbine trip, and an initiation of auxiliary feedwater flow. Use of the manual actuation control 1 solation arnplifier outputs are considered the sensor output for the wide range SG level signal. RCP breaker I
position switch is considered the sensor for the breaker position signal.
I
July 14,1998 NORTHERN STATES POWER COMPANY Attachm nt 1 Page 2 l
switch will be directed in the plant emergency operating procedure for response to an ATWS l
eve,nt.
The system interface for actuation of the AMSAC/ DSS function is accomplished by use of energize-to-actuate relay logic. The actuation relays are wired into the device actuation circuit to trip the reactor, trip the turbine, and initiate auxiliary feedwater. The auxiliary feedwater actuation circuit relays are unchanged and meet 1E requirements for an isolation device. The outputs to the plant systems: are in the form of relay contacts, using existing diverse relays, wired into existing circuitry which provide the system actuation.
The method of tripping the reactor with the AMSAC/ DSS is diverse from the existing reactor protection system. The reactor protection system utilizes circuit breakers to trip the reactor by removing power to the rod control system. The AMSAC/ DSS diverse reactor trip function utilizes relay contacts to send a signal to the rod control system to de-energize all control rod gripper coils.
l l
Logic Power Supplies The AMSAC/ DSS electronics cabinet is powered from a non-safeguards uninterruptible power supply (UPS) in the Service Building (Computer) power distribution system. This UPS is totally l
independent from the reactor protection system. The UPS has a non-safeguards DC supply l
backup, and is powered from an AC bus which can be supplied from a non-safeguards diesel generator. AMSAC/ DSS output relay power and the operator manual actuation switch power are also supplied from Service Building power.
i l
Safety-Related Interface The steam generator level signals are taken from existing wide range level transmitters, two l
safety-related Event Monitoring transmitters and two non-safety-related feedwater control transmitters. Each safety-related SG wide range level signal loop in the Event Monitoring System contains signal isolators to isolate the non-1E section of the loop from the safety-related portion of the loop. The revised AMSAC/ DSS utilizes the same type of signal isolators for isolation of the two steam generator level signals before the signals are sent to the feedwater control system.
l i
I l
The digital inputs from the Reactor Coolant Pump breakers are input to separate cards in the AMSAC/ DSS digital control system (DCS). The breaker position inputs utilize spare auxiliary contacts in the switchgear cubicles for each pump, separate from the auxiliary contacts used for reactor protection.
I The system interface for actuation is accomplished by use of energize-to-actuate relay logic.
The actuation relays remain wired into the device actuation circuit to trip the turbine, initiate auxiliary feedwater and are wired into the actuation circuit for diverse scram. The auxiliary feedwater actuation circuit relays meet 1E requirements for an isolation device as detailed in a 2 Auxiliary Feedwater, Main Turbine, and Rod Control.
July 14,1998 NORTHERN STATES POWER COMPANY Attachrnent 1 Pcge 3 letter from NSP to NRC " Supplemental Information -Final AMSAC Design" dated May 12,1988 and revie,wed by the NRC in SER dated August 17,1988.
Quality Assurance The quality assurance requirements for AMSAC/ DSS are described in Generic Letter 85-06.
The quality controls imposed in the plant design change process and the testing and calibration programs applied to plant instrumentation and control systems satisfy the guidance expressed in Generic Letter 85-06. The design, installation and testing of the AMSAC/ DSS system is controlled by the plant's design change process.
Maintenance Bypasses The AMSAC/ DSS has a new three position switch (Manual Actuate, Auto, Block) on the Control Room main control board. Maintenance on the AMSAC/ DSS system can be accomplished at power, by placing the new three position switch to ' Block'. With the output blocked, it is possible to test, calibrate, or repair the software logic and analog portions of the system without affecting plant operations. When the system is in the ' Block' mode, the system status annunciator panel in the Control Room will continuously indicate that the AMSAC/ DSS is blocked. In addition, a plant process computer alarm will indicate that the system is blocked.
Operating Bypasses There is no automatic bypass of the AMSAC/ DSS function and the system is not bypassed during normal power operations, except for testing and maintenance. The AMSAC/ DSS function can be bypassed only by the administratively controlled new three position switch. Once the new three position switch is placed in the ' Block' position, the AMSAC/ DSS functionality is disabled.
The system will procedurally be blocked during a shutdown prior to stopping the reactor coolant pumps, by use of the new three position switch.
Means for Bypassing Bypass capabilities are provided by a new three position switch (Manual Actuate, Auto, Block) on the control room main control board. Bypass capability is provided without the use of lifted leads, pulled fuses, tripped breakers, or physica!!y blocked relays. The requirement to provide continuous indication in the Control Room when the AMSAC/ DSS is bypassed for surveillance testing is retained in the existing control room status panel alarm to indicate that the syctem is unavailable.
l
[
Manual Initiation A new three position control switch on the control board is provided to manually actuate the AMSAC/ DSS function. The new three position control switch causes a diverse reactor trip, a turbine trip, and an initiation of auxiliary feedwater flow, when the new three position switch is i
l i
..o l-July 14,1998 NORTHERN STATES POWER COMPANY l
PCge 4 placed in the ' Manual Actuate' position. This use of the new three position switch will be directed in the plant emergency operating procedure for response to an ATWS event.
Electrical Independence from Existing Reactor Protection System All wiring for signals to the AMSAC/ DSS racks use cable tray or conduit separate from those used for reactor protection system wiring. The existing reactor protection system is unaffected by the AMSAC/ DSS installation. The steam generator wide range level analog signals do not l
input to the reactor protection system. The RCP digital signals originate from an auxiliary contact l
in the RCP motor breaker cubicle. The system interface for actuation of the AMSAC/ DSS function is accomplished by use of energize-to-actuate relay logic. The actuation relays are wired into the device actuation circuit to trip the reactor, trip the turbine, and initiate auxiliary feedwater The auxiliary feedwater actuation circuit relays are unchanged and meet IEEE 323 Class 1E requirements for an isolation device.
Physical Separation from the existing Reactor Protection System The implementation of the AMSAC/ DSS does not degrade the physical separation of the existing reactor protection system. The AMSAC/ DSS rack is physically separated from the l
reactor protection system instrument racks.
Environmental Qualification 1
The AMSAC/ DSS rack and internals are designed to operate in the mild environment of the -
i relay room area in which the rack is located.
l Testability at Power Periodic testing of thi., system hardware and software is accomplished at power using the ' Block' position of the new three position switch to prevent the system output from initiating turbine trip, reactor trip, and auxiliary feedwater flow. In this mode, test signals can be injected into the system to verify correct bistable operation and actuation logic functions. The test will verify l
operation of the system up to, but not including, the actuation relays. Testing is alarmed in the l
Control Room, and the frequency of testing is in accordance with present Prairie Island l
Surveillance Program guidelines.
I Completion of Mitigative Action The AMSAC/ DSS is required to trip the turbine, initiate auxiliary feedwater flow, and provide a diverse reactor trip. When the AMSAC/ DSS digital control system actuation logic is satisfied, an actuation signalis supplied to the output cards. Actuation of the output cards will energize two separate relay trains. The auxiliary feedwater actuation relay provides the 1E isolation required by this circuit. The AMSAC/ DSS relays are configured in an energize-to-actuate logic to avoid L------_------------
.o July 14,1998 NORTHERN STATES POWER COMPANY
' Page 5 inadvertent actuation. The specific interface designs ensure that when AMSAC/ DSS actuation occurs, the action goes to completion.
Technical Specifications No technical specifications are required for the AMSAC/ DSS system.
Question 1.2:
Description of pre-operational test methods and criteria for the systems hardware and sofdvare testing.
Response
j The AMSAC/ DSS system will be tested upon completion of installation, prior to tumover, consistent with the design change process used by Northem States Power Company. This testing will verify that the installation has been accomplished as designed, and that the system is operating properly. This testing willinclude allinputs to the software, all branches of the software logic and all outputs along with verification of acceptable time response and function of the final actuation devices (AFW Pump breaker / valve operation, turbine trip solenoid operation, rod control card operation).
Question 1.3.A:
Please confirm the following in your final submittal:
That in no circumstances, the stipulations of IEEE 278 are violated since the proposed design modification interfaces with existing safety-related equipment.
r
Response
The interfaces between the AMSAC/ DSS equipment and safety-related equipment are limited to:
l Input signals from post-accident monitoring wide range steam generator level channels 1LT-487 (2LT-487) and 1LT-488 (2LT-488).
Input signals from the reactor coolant pump breakers (note that the reactor coolant pump breakers are not safety-related however, signals from these breakers are inputs to the I
. Outputs to initiate auxiliary feedwater.
[.
--__y-Att chment 1 P:ge 6 I
The input signals from the post-accident monitoring wide range steam generator level channels are isolat,ed using existing safety-related isolation amplifiers to prevent any interaction between thb' safety-related and nonsafety-related portions of the instrument loop. (See simplified loop diagrams on the next page.)
The input signals from the reactor coolant pump breakers use separate spare contacts on each breaker's position indication switch and the cabling will be routed to comply with the cable separation requirements contained in our USAR.
j The outputs from the AMSAC/ DSS system to the auxiliary feedwater pumps use an existing safety-related isolation relay providing isolation between the safety-related and nonsafety-j related portions of the circuit.
Since each interface between the AMSAC/ DSS system and safety-related equipment is designed to provide adequate isolation and these isolation devices are considered part of the safety-related system, installation of the AMSAC/ DSS system does not violate the stipulations of IEEE 279 for the protection systems.
Question 1.3.B:
Please confirm the following in your final submittal:
That the quality of hardware, software, installation, testing, documentation and record maintenance is according to the guidance provided in GL 85-06 (" Quality Assurance Guidance for ATWS Equipment That is Not Safety-Related").
Response
The quality controls imposed in the plant design change process and the testing and calibration programs applied to plant instrumentation and control systems are sufficient to satisfy the guidance expressed in Generic Letter 85-06 for hardware, software, testing, documentation and record maintenance.
]!l.c]l!)1ll!lIlIji!
j!
m r
e S
t t pump a
d ei 3
A g
i S
n r
W D
A 0
3 l
C
/
3 9
5 0
ia 0
2 r e 5
4 Y
5 D
o v A
T-O O
Y e
t r
L S
p a e S
L L
L ta getr C
w o
rl M
vm W
F d
o e
e e
L n e A
L X D
e eg A
F n
d de Ga e
!am it e s
igt f
mR o
s Dy ilp a
p S
d m
e o
eicm i
S P
t r
nte n S
v o dc r
A t
tpu mp S
n cI 2
A C
A 0
2 F
2 9
5 0
D 0
0 5
4 Y-5 A
O Q
Y y
T L
L S WL L
t let ed r
C f
e at vm F
e Sa LX D
l n e A
oR N
_l j,I I
IIl11liIl1lIlllI l
lIlil,ll L
D 8
8 4
yd t e M
n L
wl Y
et f a le t
oe w
vd odn N
al e n
A S R eI Ht a L
uP h
P S
IW O
A C
C 8
8 8
8 8
8 R
4 4
4 E
T-L M
M W
let C
L L
S r
O vm W
(w y F e
8 T
8 A
4O 8
rI i
lllIiJ_
T L
8 S
84 N
M led 7
_ d 0
R L
r E
w v o
- d
_t 4
e e
H x
a L R R e ie L
ta _
T R
R B
le _
7 R
y O
8 t
N 4
ty _ e f
a e _
S_
M led 6 a N
0 f
L r
v 4 S _ n w
a c
eR R
_ u L
A C
7II IiliiL 7
7 7
8 8
8 4
4 4
M T
M N)wJL C
L S
r L
let vm W
y F e
D LX A
A 78 4
D L
7 O
8 4
n M
le t
L wt oe w
vd odn n
a
$i H t unP S
81 9
t 9n 1 e m7 4
h 1
ce lyag ut a t
' JAP
n July 14,1998 NORTHERN STATES POWER COMPANY Att chment 1 Page 8 l
Question 1.3.C:
Pfease confirm the following in your final submittal:
i That guidance of ISA 67-04,1992 and RG 1.105 (" Instrument Setpoints for Safety -Related Systems") Rev. 2 is followed for setpoint calculations including the calculations for the steam generator (SG) level setpoints.
l
Response
l At this time calculations to determine actual setpoints have not been performed. The transient analysis performed assumed a nominal, low wide range steam generator level setpoint of 40%.
An addinonal conservatism of 5% was subtracted from this setpoint to arrive at the value of 35%
level which was used in the analysis. Calculations will be performed prior to tumover of the design change to determine actual setpoints for the AMSAC/ DSS software which will ensure that the trip actuation occurs before steam generator wide range level decreases below 40%. These calculations will be completed in accordance with the NSP PINGP Setpoint Methodology Rev.1, which implements the applicable guidance contained in the ISA 67-04 documents and l
Question 1.3.D:
Please confirm the following in your final submittal:
That the new solid state logic card designed to perform the reactor scram to mitigate an ATWS event is adequately immunized for conducted and radiated EMI/RFI and will not become a source j
of harmful EMI/RFI which could affect operation of other safety-related equipment.
Response
Resistance to conducted and radiated electromagnetic /radiofrequency interference (EMI/RFI),
l consistent with the installed equipment, has been incorporated into the specification for procurement of this logic card. Design measures have been specified to minimize the potential for introduction of EMl/RFI into the Rod Control cabinets. Additionally, the Rod Control cabinets do not contain any safety-related equipment.
I L_ __. _ _ _ _ _
l July 14,1998 NORTHERN STATES POWER COMPANY -
Page 9 -
I Question 1.3.E:
Please confirm the following in your final submittal:
l*
That the proposed AMSAC/ DSS meets all requirements as stated in 10CFR 50.62 including the l
rollability requirements for both hardware and software designs.
Response
i 10CFR 50.62 paragraph c(1) requires "Each pressurized water reactor must have equipment
]
from sensor output to final actuation device, that is diverse from the reactor trip system, to i
automatically initiate the auxiliary (or emergency) feedwater system and initiate a turbine trip under conditions indicative of an ATWS. This equipment must be designed to perform its function in a reliable manner and be independent (from sensor output to the final actuation device) from the existing reactoi (rip system."
The proposed AMSAC/ DSS system will meet these requirements of 10CFR50.62 in that it will consist of equipment which is independent and diverse, from the sensor output to the final actuation device, from the reactor trip system, which will trip the turbine and initiate auxiliary l
feedwater. This equipment is designed to function in a reliable manner.
In addition, the " Guidance Regarding System and Equipment Specifications" published with the rule in the June 26,1984 Federal Register contains the following guidance:
Diverse Reactor Trip Mitigating Systems Proposed AMSAC/ DSS System System Safety Related Not required, but the Not required, but the Not safety related. See (IEEE 279) implementation must be implementation must be response to question 3.A such that the existing such that the existing l
protection system protection system continues to meet all continues to meet all applicable safety related applicable safety related
- criteria, criteria.
Redundancy Not required.
Not required.
Not redundant.
l t
i
July 14,1998 NORTHERN STATES POWER COMPANY Page 10 1
Diverse Reactor Trip Mitigating Systems Proposed AMSAC/ DSS i
System System l
Diversity from Equipment diversity to the Equipment diversity to the The proposed existing extent reasonable and extent reasonable and AMSAC/ DSS system is Reactor Trip practicable to minimize the practicable to minimize the diverse from the sensor System potential for common cause potential for common cause output to the final actuation failures is required from the failures is required from the device, including the sensors to and including sensors to, but not components used to the components used to including, the final interrupt power to the interrupt control rod power actuation device--e.g.,
control rods but not l
or vent the scram air exiting circuit breakers may including the final actuation header. Circuit breakers be used for auxiliary components used to initiate from different feedwater initiation. The AFW and turbine trip. The manufacturers alone is not sensors need not be of a existing isolation amplifier 3
sufficient to provide the diverse design or outputs are considered the required diversity for manufacturer. Existing sensor output for the wide interruption of control rod protection system range SG levelinput signal power. The sensors need instrument sensing lines and the RCP breaker not be of a diverse design may be used. Sensors and position switch is or manufacturer. Existing instruments-sensing lines considered the sensor for j
protection system should be selected such the breaker position input instrument sensing lines that adverse interactions signal. The AFW steam may be used. Sensors and with r~isting control control valves and circuit instruments-sensing lines systems are avoided.
breakers along with their should be selected such control components are that adverse interactions considered the final with existing control actuation components for systems are avoided.
AFW initiation and the auto-stop trip and emergency trip solenoids are considered the final actuation components for j
the turbine trip actuation. A diverse solid state circuit card designed to provide the reactor trip function through the rod control l
system is used for the diverse reactor trip actuation. See answer to question 1.
i Electrical Required from sensor Required from sensor See answer to question 1.
Independence output to the final actuation output to the final actuation i
from existing device at which point non-device at which point non-Reactor Trip safety related circuits must safety related circuits must System be isolated from safety-be isolated from safety-related circuits.
related circuits.
July 14,1998 NORTHERN STATES POWER COMPANY
{
Att3hment 1 Page 11 i
i Diverse Reactor Trip Mitigating Systems Proposed AMSAC/ DSS System System Physical Not required, unless Not required, unless The implementation of the l
Separation redundant divisions and redundant divisions and AMSAC/ DSS does not from existing channels in the existing channels in the existing degrade the physical Reactor Trip reactor trip syntem are not reactor trip system are not separation of the existing System physically separated. The physically separated. The reactor protection system.
implementation must be implementation must be The AMSAC/ DSS rack is j
such that separation criteria such that separation criteria physically sepmated from applied to the existing applied to the existing the reactor protedion protection system are not protection system are not system instrument tacks.
violated.
violated.
l Environmental For anticipated operational For anticipated operational The AMSAC/ DSS rack and j
Qualification occurrences only, not for occurrences only, not for internals are designed to 1
l accidents.
accidents.
operate in the mild environment of the relay room area in which the rack is located.
l Quality Explicit guloance will be Explicit guidance will be The quality assurance l
Assurance for issued in a letter.
issued in a letter, requirements for l
- Test, AMSAC/ DSS are described l
Maintenance, in Generic Letter 85-06.
and The quality controls Surveillance imposed in the plant design i
change process and the j
testing and calibration 1
l programs applied to plant l
instrumentation and control systems are sufficient to j
satisfy the guidance expressed in Generic Letter l
85-06.
1
.r---
3, July 14,1998 NORTHERN STATES POWER COMPANY Pag)12 Diverse Reactor Trip Mitigating Systems Proposed AMSAC/ DSS System System Safety Related Not required, but must be Not required, but must be The AMSAC/ DSS (1E) Power capable of performing capab!e of performing electronics cabinet is i
Supply safety functions with loss of safety functions with loss of powered from a non-offsite power. Logic and offsite power. Logic power safeguards uninterruptibio actuation device power power supply (UPS)in the must be from an instrument, must be from an instrument power supply independent Service Building power supply independent from the power supplies for (Computer) power from the power supplies for the existing reactor trip distribution system. This the existing reactor trip system. Existing RTS UPS is totally independent system. Existing RTS sensor and instrument from the reactor protection sensor and instrument channel power supplies system. The UPS has a channel power supplies may be used provided the non-safeguards DC supply may be used provided the possibility of common backup, and is powered i
possibility of common mode failure is prevented from an AC bus which can mode failure is prevented.
be supplied from a non-safeguards diesel generator. AMSAC/ DSS I
output relay power and the operator manual actuation switch power are also supplied from Service i
l Building power.
j l
Testability at Required Required included in the design Power l
Inadvertent De design should be such The design should be such The proposed Actuation that the frequency of that the frequency of AMSAC/ DSS system is inadvertent reactor trips inadvertent reactor trips designed to minimize the l
and challenges to other and challenges to other potential for inadvertent l
safety systems is safety systems is actuations minimized, minimized.
l Question 1.3.F:
Please confirm the following in your final submittal:
1 That the software and setpoints relating to the AMSAC/ DSS will be subjected to adequate l
administrative control such that no unauthorized changes to these features can be performed.
l l
t
Response
Changes to the AMSAC/ DSS will be controlled by the plant design change and setpoint change
{
processes. These processes provide administrative controls to ensure that no unauthorized changes can be performed.
I l
i w__-_-________________.
July 14,1998 NORTHERN STATES POWER COMPANY Page 13 Question 11.1:
NSP has used the DYNODE-P and VIPER-1 codes to perform the ATWS analyses in support of the adequacy of the diverse scram system (DSS) design. Both codes were approved by the NRC for use in the design basis analysis for the Prairie Island plant. However, the codes have not been specifically submitted by the licensee and approved by the NRC for ATWS analyses. Address the l
acceptability of the DYNODE-P and VIPER 1 codes for use in the ATWS analysis for the Prairie Island plant by showing that the system responses and thermal-hydraulic conditions of the ATWS analysis are within the applicable ranges of the approved codes.
Response
DYNODE-P is an HEM (Homogeneous Equilibrium Model) code; therefore, it is not qualified for two phase flow regimes. The design of the Diverse Scram system and the choice of setpoints ensured that the transients analyzed did not enter into two phase flow; therefore, DYNODE-P is appropriate for the AMSAC/ DSS analysis. The NRC stated 8 that acceptance of the computer codes referenced in the licensee's report, NSPNAD-8102P Rev.1, is limited to analyzing only the type of accidents listed and described in the report.
The " type of accidents" in the referenced topical report are Condition ll, Condition ill, and Condition IV events. The type of transients analyzed for the AMSAC/ DSS Project [Feb.
1998 submittal] are Condition ll events. The control rods are assumed to insert into the reactor core, via the Diverse Scram System [ DSS], and insert negative reactivity to shutdown the core. The inclusion of this non-safety grade system ensures that the progression of the transients are functionally similar to Reload Safety Evaluation (RSE)
Condition ll events, except the electrical portion of the Reactor Protection System [RPS]
fails, and the DSS provides backup scram functions.
VIPRE is a subchannel critical heat flux (CHF) analysis code. The utilization of the VIPRE code for application to this analysis does not compromise the validity of the results. The VIPRE limitations presented for Question 11.2 demonstrate that this analysis remains within the computational abilities of the VIPRE code.
The Condition 11 events analyzed for the AMSAC/ DSS project are the following:
{1}
{2}
Uncontrolled Boron Dilution
{3}
Loss of AC
{4)
Isolation of the Condenser (Loss of Condenser Vacuum)
{5}
Loss of 1 out of 2 Reactor Coolant Pumps i
i 3 Safety evaluation report [SER) of topical report [TR] NSPNAD-8102P/ Prairie Island Nuclear Power Plant Reload Safety Evaluation Methods For Application to PI Units" w-__-
.o July 14,1998 NORTHERN STATES POWER COMPANY l
AttachrrEnt 1 Pcge 14 l
The events listed above are functionally Condition ll events where it is assumed that the DSS provides,a delayed backup scram function. Clearly without the inclusion of the DSS (control rod inksrtion), the transients would experience significant two phase flow (as evident in the l
Westinghouse analysis); however, the actuation of the DSS ensures subcooled conditions in the l
RCS throughout the progression of the events.
i 1
Question 11.2:
l l
As a result of the findings from the Maine Yankee Lessons Learned Task Force, the staff has taken I
a position that it requires licensees to verify conformance with the NRC safety evaluation report (SER) for a topical report (TR) whenever the methodologies discussed in the TR are to be used for l
licensing applications. Accordingly, NSP is required to evaluate its compliance with the conditions specified in the SERs for TRs referenced in the ATWS analysis to support the DSS l
design and show that the SER conditions for the TRs have been met. Provide the results of these assessments.
l
Response
The following restrictions have been identified for the RSE methods as applied to the Prairie j
lsland units. The AMSAC/ DSS analysis inputs and assumptions comply with these restrictions.
REACTOR PHYSICS
[ RESTRICTION]- Steady state reaClor physics calculations shall be performed using the following Advanced Recycle Methodology Program (ARMP) computer codes:
EPRI-CELL, PDQ7/ HARMONY, N3P, CPM, and CASMO II. Note that the DPS computer code identified in NSPNAD-8101-A Revision 1 has been replaced with the N3P computer code. The two l
computer codes are considered to be equivalent with respect to the qualification of the reactor physics methods. [Ref.1,3]
l
[APPLICABILrrY]- The physics parameters utilized for the AMSAC/ DSS supporting analysis were generated with the N3P and CASMO ll computer codes. These codes are used by NSP for Reload Safety Evaluation (RSE] Analyses.
[ RESTRICTION] - The reactor physics methods in NSPNAD 8101-A Revision 1 may be used to calculate the following physics parameters used in safety related calculations for Prairie Island:
i
[Ref.1,3]
(a) control rod worths (b) temperature coefficients I
(c) Doppler coefficients (d) burnup dependent isotopic compositions (e) power distributions i
(f) critical boron concentrations 4
I L___________________________
.e 1
July 14,1998 NORTHERN STATES POWER COMPANY l
Psge 15 1
(g) delayed neutron parameters I
. [APPLICAB LITY) - No additional reactor physics parameters were used in the AMSAC/ DSS supporting analysis. The reactor physics methods do not include the calculation of a density reactivity coefficient. A density reactivity coefficient was conservatively ignored in the NSP AMSAC/ DSS analysis.
[ RESTRICTION)-The application of the reliability factors and biases for each physics parameter will be consistent with Table 3.0.1 of NSPNAD-8101-A Revision 1. NSP will continue to compare the measured and calculated physics parameters during each reload cycle in order to provide continued assurance of the model applicability.
The results of this comparison will be documented in the reload safety evaluation for the specific reload. Any updates to the reliability factors will be in accordance with the methods outlined in Section 3 and Appendix A of NSPNAD-8101-A Revision 1. [Ref.1,3)
(APPLICABILITY) - The application of the biases were consistent with Table 3.0.1 of NSPNAD-8101-A Revision 1; however, the reliability factors were not applied which is consistent with the assumption of nominal inputs as per Regulatory Guide 1.70. Comparisons between measured and analytical physics parameters are performed and documented during the reload safety evaluation each reload. No updates have been made to the reliability factors.
[ RESTRICTION] - The applicability of the existing reload physics methods and the benchmarked results presented in NSPNAD-8101-A Revision 1, including reliability factors and biases, shall i
be evaluated for all changes in NRC criteria or regulations. Should this evaluation conclude that the existing methods or results are no longer valid, the reload physics methods topical report shall be revised and resubmitted to the NRC for approval. Justification for the continued effective applicability of the existing methods may be submitted for NRC review in addition to or in place of a topical report revision.
[ APPLICABILITY]- NSP Nuclear Analysis and Design staff review all NRC notices and bulletins for the applicability of the existing reload physics methods, including reliability factors and biases, and will do so for the AMSAC/ DSS supporting analysis.
DYNODE-P and CONTEMPT-LT i
[ RESTRICTION]- The mass and energy release data from DYNODE-P is not qualified to be used as input to CONTEMPT for analyzing the containment pressure transient during a steam line break accident. [Ref. 2,3) 1 (APPLICABILITY]- This continues to be a limitation upon our Reload Safety Evaluation (RSE);
however, this limitation has no impact upon the Condition ll events analyzed. NSP has a new Main Steam Line Break analysis - pending NRC approval-which addresses this limitation.
.o July 14,1998 NORTHERN STATES POWER COMPANY Attachmint 1 l
Page 16 VIPRE-01
[ RESTRICTION]- Since NSP has chosen to disassociate its modified version of VIPRE-01 from the EPRI developed code, any changes to the NSP version of the code that significantly changes the final results will require NRC approval prior to use in a licensing application. [Ref. 5)
[ APPLICABILITY] - The NRC letter (no date) accepting Revision 4 to NSPNAD-8102 authorized NSP to apply NSP's QA program, rather than EPRI's OA program, to VIPRE version control.
Proposed changes to VIPRE, such as to correct a newly identified error, are handled with NAD's methodology change procedure. This procedure runs a test matrix of problems through the new VIPRE version and compares the results to the results produced by the NRC SER approved version. Significant changes will be reported to the NRC.
l l
[ RESTRICTION]- NSP must provide documentation to the NRC justifying the input selection, default parameters, modeling assumptions, choice of two-phase flow models, turbulent mixing and grid loss coefficients, slip ratio, and selection of correlations for VIPRE-01 licensing applications.
Changes to the existing input parameters, assumptions, coefficients, or correlations must be l
Justified and supporting documentation transmitted to the NRC. [Ref. 4,6,8]
[ APPLICABILITY]- This statement is in reference to the NRC review of the EPRI generic topical, NP-2511-CCM, VIPRE-01. NSP has complied with this stipulation by performing Prairie Island i
specific benchmarks with VIPRE-01 in topical report, NSPNAD-8102P, Revision 3. The analysis
- in support of AMSAC/ DSS utilizes models previously approved for Reload Safety Evaluation (RSE) methods. See the License Request dated February 27,1998, submittal for a presentation ofinput assumptions
[ RESTRICTION] - The use is limited to heat transfer modes up to critical heat flux (CHF) provided j
the CHF correlation and limit have been approved by the NRC. Post-CHF calculations will require prior NRC approval. [Ref. 4,6,8]
[ APPLICABILITY]- All transients analyzed in NSPNAD-8102 and analyzed to support the Pl AMSAC/ DSS modification remain in heat transfer modes below the critical heat flux (CHF) predicted by the WRB-1 correlation. The WRB-1 CHF correlation was accepted in Revision 3 to NSPNAD-8102.
[P.ESTRICTioN1 - The application is in the range of applicability of the correlation including fuel assembly geometry, spacer grid design, pressure, coolant mass velocity, and quality. Use of a CHF correlation approved for use in another application will require an analysis demonstrating that VIPRE-01 gives the same or a conservative safety limit, or a higher DNBR limit must be used based on the results of the analysis. [Ref. 6]
APPLICABILITY]. An analysis was performed for Revision 3 to NSPNAD-8102 to demonstrate the applicability of the WRB-1 CHF correlation with VIPRE-01.
I 1
i
____._a
9 l
July 14,1998 NORTHERN STATES POWER COMPANY l
Pag) 17 l
j
[ RESTRICTION 1 - VIPRE-01 should not be used for the following applications: [Ref. 7,8]
l (a), tracking of pressure waves (b) applications involving blowdown or other rapid pressure changes l
(c) low pressures (d) BWR transient flow instability simulations (e) LOCA analysis with rapid depressurization (f) geometries in which the lateral flow resistance is small relative to the axial flow resistance and the wall friction is not significant
[APPLICABIL TY]- These phenomena are not present in the transient conditions predicted by any of l
the AMSAC/ DSS modification supporting analyses.
RESTRICTION]- VIPRE-01 should not be used for the following flow conditions: [Ref. 7]
(a) low-flow boil-off l
(b) annular flow (c) phase separation involving sharp liquid / vapor interface (d) countercurrent flow
[ APPLICABILITY]- These flow conditions are not predicted for any of the AMSAC/ DSS modification supporting analyses.
[ RESTRICTION] - VIPRE-01 has the following model limitations: (Ref. 7,8]
(a) cannot consider reflood or hot wall rewet problems l
(b) correlations may have a narrow range of applicability l
(c) correlations are derived from water only (d) correlations for different phenomena are not necessarily compatible l
(e) correlations are based on steady-state data (f) internal water properties functions are only useful in the enthalpy range from 200-1500 BTU /lbm (g) A profile fit subcooled boiling model based on steady state data should be used with caution in boiling transients. Depending on the time step, a Courant number less than 1 may occur.
[ APPLICABILITY]- These model limitations do not invalidate the AMSAC/ DSS CHF analysis.
l l
RELOAD SAFETY EVALUATIONS
[ RESTRICTION]- The use of the computer codes identified in NSPNAD-8102-A Revision 6 is limited to the type of events identified in the topical report. The use of the qualified computer codes for licensing analysis beyond the type of events discussed in NSPNAD-8102-A Revision 6 shall require NRC approval. The range of events evaluated in the topical report are summarized below. [Ref. 3]
(a)
Uncontrolled RCCA Withdrawal from Subcritical (b)
Uncontrolled RCCA Withdrawal at Power (c)
Control Rod Misalignment
July 14,1998 NORTHERN STATES POWER COMPANY Page 18 (d) Dropped Control Rod (see limitations below)
(e)' Uncontrolled Boron Dilution (d) Startup of an inactive Loop (e) Feedwater System Malfunction (f)
Excessive Load increase (g) Loss of Extemal Load - Turbine Trip (h) Loss of Normal Feedwater (i)
Loss of Reactor Coolant-Pump Trip (J)
Loss of Reactor Coolant - Locked Rotor (k)
Main Steam Line Break (I)
Ejected Rod (m) Fuel Misloading
[ APPLICABILITY)- The NRC stated that acceptance of the computer codes referenced in the licensee's report, NSPNAD-8102P Rev.1, is limited to analyzing only the type of accidents listed and described in the report. The " type of accidents"in the referenced topical report are Condition 11. Condition lil, and Condition IV events. The type of transients analyzed for the AMSAC/ DSS Project (Feb.1998 submittal) are Condition ll events. The control rods are assumed to insert into the reactor core, via the Diverse Scram System [ DSS), and insert negative reactivity to shutdown the core. The inclusion of this non-safety grade system ensures that the progression of the transients are functionally similar to Reload Safety Evaluation (RSE) Condition ll events, except the electrical portion of the Reactor Protection System (RPS) fails, and the DSS provides backup scram functions.
i l
CONTROL ROD DROP
[ RESTRICTION)- Multiple rod drops were not examined in NSPNAD-8102-A Revision 6. A single failure could result in multiple rods falling into the core, however, it was found that only the lowest worth single RCCA drops did not cause a flux trip. If this condition were to change, multiple rod drops would need to be examined. [Ref. 9)
[APPLICABlWTY]- Identified in NSPNAD-8102P Rev. 2. These provisions continue to be part of NSP's Rod Drop methodology. The Rod Drop event was evaluated and deemed non-limiting for the AMSAC/ DSS supporting analysis. As stated in the February 27,1998, AMSAC/ DSS submittal the Rod Drop event is bounded by the Uncontrolled Boron Dilution event.
i
[ RESTRICTION]- Three xenon conditions (equilibrium, top-skewed, and bottom-skewed) are examined for each control rod in the Control Rod Drop event. If these three xenon conditions do not produce the same result (reactor trip or no trip), a sensitivity study must be performed to find l
the highest rod worth not resulting in a reactor trip. [Ref. 9]
[ APPLICABILITY)- Identified in NSPNAD-8102P Rev. 2. These provisions continue to be part of i
NSP's Rod Drop methodology. The Rod Drop event was evaluated and deemed non-limiting for the AMSAC/ DSS supporting analysis. As stated in the February 27,1998, AMSAC/ DSS submittal the Rod Drop event is bounded by the Uncontrolled Boron Dilution event.
l f
L
July 14,1998 NORTHERN STATES POWER COMPANY AttIchment 1 Page 19 RADIOLOGICAL CONSEQUENCES
[ RESTRICTION 1 - The methods for evaluating radiological consequences of any accident with fuel failure is predicated on NSP submitting information on the release rates and effects of nuclides for bumups up to and beyond 37,000 MWD /MTU batch average exposure. This information should include any increases in fuel assembly specific power from those analyzed in NSPNAC-8102-A Revision 6. [Ref. 3)
IAPPUCABILITY]- The most recent radiological consequences analysis is contained in the Fluor Daniel calculation GEN-Pl-0023,
- Prairie Island Off-Site and Control Room Habitability LOCA Dose for Vantage Plus Fuel", approved by NSP on October 6,1995. No fuel failures are predicted by the AMSAC/ DSS supporting analyses, and therefore there will be no radiological consequences.
NRC CRITERIA AND REGULATIONS
[ RESTRICTION 1 - The applicability of the existing Reload Safety Evaluation methods and the benchmarked results presented in NSPNAD-8102-A Revision 6 shall be evaluated for all changes in NRC criteria or regulations. Should this evaluation conclude that the existing methods or results are no longer valid, the RSE methods topical report shall be revised and resubmitted to the NRC for approval. Justification for the continued effective applicability of the existing methods may be submitted for NRC review in addition to or in place of a topical report revision.
[APPUCABluTY]- NSP Nuclear Analysis and Design staff review all NRC Notices and Bulletins for the applicability of the existing Reload Safety Evaluation [RSE) methodology, and will do so for the AMSAC/ DSS supporting analysis.
i REFERENCES 1.
NSPNAD-8101-A, Rev.1, " Qualification of Reactor Physics Methods for Application to PI Units," December 1982 2.
NSPNAD-8102-A, Rev. 6, " Reload Safety Evaluation Methods for Application to PI Units,"
August 1995 3.
Safety Evaluation Report (SER) for NSPNAD-8101-A, Rev.1, " Qualification of Reactor Physics Methods for Application to PI Units," and NSPNAD-8102-A, Rev.1, " Reload Safety Evaluation Methods for Application to PI Units," December 1982 4.
SER for NSPNAD-8102-A, Rev. 3 " Reload Safety Evaluation Methods for Application to PI Units," March 1985 l
S.
SER for NSPNAD-8102-A, Rev. 4," Reload Safety Evaluation Methods for Application to PI Units," May 1986 6.
SER for EPRI-NP-2511-CCM-A, Rev. O, "VIPRE-01 [ Mod-01): A Thermal Hydraulic Code for Reactor Cores," December 1984
July 14,1998 NORTHERN STATES POWER COMPANY P;ge 20 7.
EPRI-NP-2511-CCM-A, Rev. 3, "VIPRE-01 [ Mod-02): A Thermal Hydraulic Code for Reactor Cores, Volume 5," March 1988 8.
SER for EPRI-NP-2511-CCM-A, Rev. 3, "VIPRE-01 [ Mod-02): A Thermal Hydraulic Code for Reactor Cores," March 1988 9.
NSPNAD-8102-A, Rev. 2 " Reload Safety Evaluation Methods for Application to PI Question 11.3:
In the ATWS analysis, the DSS was credited for accident mitigation. Provide a probabilistic safety assessroent to show that the total core damage frequency (CDF) for the ATWS cases with the proposed ATWS Mitigating System Actuation Circuitry (AMSAC) design is very low, and the addition of the DSS will significantly reduce the CDP to justify that its use of the DSS in the ATWS analysis for accident mitigation is acceptable.
Response
In July of 1983 the NRC issued SECY 83-293 which evaluated the regulatory options available to resolve the ATWS issue. This report included,in Appendix D, a risk analysis of ATWS events for each of the reactor types grouped by NSSS manufacturer. Table 7 of this Appendix D lists f
the results for Westinghouse plants. In this table the base case (without AMSAC or DSS installed) probability of failure due to ATWS events (Pam3 yr) is 3.7x104 This table also
/
specifies the AMSAC case P ms/yr is 5.8x104 and the AMSAC and DSS P,ws/yr is 1.9x104 4
4 These risk assessments used an AFW reliability number of.001 (in other words, AFW system will fail once in every 1000 demands). Due to our discovery that during specific ATWS events (namely loss of main feedwater events) our AFW pumps will trip shortly after initiation of the transient due to low discharge pressure, this reliability value is suspect. SECY 83-293 Enclosure D (page 35) also states that sensitivity studies on AFW system reliability were not done since an Energy, incorporated study has shown that Paws is insensitive to AFW unavailability.
Our analysis shows that with successful actuation of the Diverse Scram System, the AFW pumps will not trip due to low discharge pressure on any ATWS transient.
I An analysis of the current IPE for the Prairie Island plant was performed to determine the core damage frequency (CDF) contribution from ATWS events. The current IPE evaluates ATWS events only for transients which lead to a Loss of Main Feedwater. These initiating events were isolated to determine the CDF contribution and then were reanalyzed with the assumption of AFW failure. This resulted in an increase in CDF due to AFW failure by a factor of 3.7, however 4
the CDF contribution due to ATWS events even with AFW failure remained less than 4x10.
This is an extremely conservative assumption since no credit is provided for any recovery actions. In addition, the CDF contribution from ATWS events is a small portion of the total CDF j
for the plant.
l l
l
p July 14,1998 NORTHERN STATES POWER COMPANY Page 21 i
Following the installation of the Diverse Scram system, the Prairie Island IPE will be revised to include the ATWS transients which were shown by analysis to require mitigation and to include th'e revised AMSAC and DSS functions. We are confident that this PRA analysis will show a significant decrease in CDF contribution from ATWS events.
i C. edit can be taken for a combined AMSAC / Diverse Scram System in Westinghouse plants since this has already been analyzed by the NRC and shown to reduce the risk due to ATWS events, by a factor of three, below the risk with only the AMSAC functions. Additionally, the plant specific IPE analysis will be revised to include the ATWS transients determined to require mitigation and to include the revised AMSAC / DSS functions. It is expected that this analysis will show a significant reduction in CDF due to ATWS events compared to the current IPE value.
Question 11.4:
Identify any assumptions that are different from the original ATWS analysis performed by Westinghouse for satisfying the ATWS rule and show that changes from the original generic analysis are adequate.
Response
The original generic analyses performed by Westinghouse in support of the ATWS rule utilized a 4 loop, Series 51 steam generator plant as the reference plant. The NSP analysis is specific to the Prairie Island facility - 2 loop, Series 51 steam generator plant.
The original generic analyses performed by Westinghouse in support of the ATWS ruie assumed no automatic reactor scram or control rod insertion; whereas, the NSP analysis assumes successful actuation of the Diverse Scram System. This is an appropriate assumption because NSP is installing a DSS for back-up reactor scram functions for the Reactor Protection System.
The original generic analyses performed by Westinghouse in support of the ATWS rule assumed reactor coolant flow equal to the thermal-hydraulic design flow; whereas, the NSP analysis assumed nominal reactor coolant flow. This assumption is consistent with Regulatory Guide 1.70 with regard to nominal initial conditions.
The original generic analyses performed by Westinghouse in support of the ATWS rule utilized a moderator density coefficient in the neutron kinetics equation which takes into account large enthalpy rises and boiling; whereas, NSP utilized a moderator temperature coefficient consistent with our Reload Safety Evaluation Methods, NSPNAD-8101 & NSPNAD-8102. The moderator temperature coefficient used by NSP does not include a term for the negative reactivity feedback that would result from core voiding', therefore it is more conservative.
I 4 While the RCS flow will remain in a single phase (no bulk bolling) throughout tne analyzed transients, there may be some localized nucloate or sub-cooled boiling within the active fuel region of the core.
D" 7
July 14,1998 NORTHERN STATES POWER COMPANY Page 22 There are differences in the assumed MTC: Westinghouse used an MTC equal to -8 pcm/ F; whereas, NSP used an MTC equal to -2 pcm/ F. The MTC of-2 pcm/*F is more conservative, and more consistent with current operations.
The core peaking factors in the NSP analysis are consistent with Prairie Island Technical Specifications which are greater than what was assumed in the Westinghouse arialysis. The utilization of higher peaking factors is conservative for CHF analyses.
Quostion ll.5:
In accordance with the staff's technical review procedures on the ATWS analysis for existing PWRs, the staff uses the following acceptance criterion to assess the ATWS analysis:
"The ATWS analysis must show that the unfavorable exposure time (UET), given the cycle design (including the MTC), will be less than 5 percent, or equivalently, that the ATWS pressure limit will be met for at least 95 percent of the cycle. The UET is the time during the cycle when reactivity feedback is insufficient to maintain pressure under 3200 psi for a given reactor state".
Provide a discussion of the bases for selection of the MTC used in the ATWS analysis and address its compliance with the acceptance criterion (5% UET) stated above.
Response
Recent cycle MTC5 values have been positive at low power levels during the initial startup following a refueling outage, and the analytical full power MTC values have been approximately
-5 to -6 pcm/ F. While MTC is not measured, the isothermal temperature coefficient (lTC) is measured at hot zero power and compared to analytical predictions of ITC. These measured i
ITC values have been in close agreement with the analytical ITC predictions, which provides high confidence in the predicted analytical full power MTC values.
An evaluation of the last two completed cycles on each unit, which took into account the actual operating condition history, showed that the actual MTC value was more negative than
-2 pcm/ F for greater than 95% of each of these cycles. The -2 pcm/ F value for MTC was utilized in the AMSAC/ DSS supporting analysis.
The -2 pcm/ F MTC bounds 100% of the time when at nominal full power conditions, and bounds greater than 95% of the cycle when assessing actual operating history (startup, shutdowns, and derates). The choice of MTC has an impact upon the successful analysis of l
ATWS related transients with regard to overpressurization. The selection of the -2 pcm/ F MTC for the analysis ensures that the reactivity feedback is sufficient to maintain pressure below 3200 psi for at least 95% of the cycle.
5 Plant Tech Specs require that ITC bo below +5 pen #F whenever the reactor is critical. Additionally, ITC must be negative when the reactor is above 70% power (TS 3.1.F).
l l
July 14,1998 NORTHERN STATES POWER COMPANY Page 23 I
The NSP Nuclear Analysis and Design [NAD) staff will confirm, in addition to the Updated Safety Analysis Report Chapter 14 events, that the inputs and assumptions of the AMSAC/ DSS analysis remain valid and bounding for each reload.
Question 11.6:
Section 2.6 of the submittal dated February 27,1998 summarizes the results of ATWS analyses for six cases. Four cases (loss of normal feedwater, loss of load, loss of ac and loss of condenser vacuum) can be characterized by rapid reductions in heat removal capability of the steam l.
generators (SGs). The loss of heat removal results in a rapid rise in the SG secondary pressure
]
(
and temperature and subsequent increase in the RCS pressure and temperature. The severity of l
these events increases (resulting in a higher maximum RCS pressure) If the primary-to-secondary power mismatch increases. The maximum pressures for the four cases varies by about 100 psi.
j However, no information was provided to explain what causes the differences in the primary-secondary power mismatch that result in different maximum pressures. Provide information (such as valve closure time, AFW actuation time and RCP trip time etc.) that explains the causes for the difference in peak RCS pressures for four cases resulting from a loss of heat removal j
capability of the SGs.
l
Response
The Loss of Normal FW (LONFW) event does not experience as large of a pressurization since l
the turbine remains available for steam removal after the tripping of the reactor by the AMSAC/ DSS. In the other events, the turbine is assumed to be isolated at time zero while the reactor is still at power; thus maximizing the primary-secondary power mismatch. For the LONFW, the continued availability of the turbine for steam relief causes the steam generators to be at a lower pressure and temperature in comparison to the other three aforementioned events; thus, providing a smaller power mismatch between the primary and secondary sides. The primary concern in the LONFW event is the complete loss of heat sink. The time of the turbine trip was conservatively assumed to maximize the availability of the turbine for increased blowdown out of the steam generators. Thus, for the LONFW event, the DSS trip occurs before the turbine trip which caused a smaller pressurization on the primary side in comparison to the other three aforementioned events. The results of the other three aforementioned events indicate that the RCS overpressurization was not a concem; therefore, the LONFW assumptions were chosen to be conservative with respect to steam generator blowdown.
Question 11.7:
l In the ATWS analysis, NSP considered the effects of the SG tube plugging limit of 15% of the total tubes on the calculated maximum RCS pressure and minimum DNBR. Discuss the values of the input parameters (such as initial RCS flow, RCP coastdown flow and SG heat transfer area etc.)
I i
t m_ _ _ _ _ _ _ _ _ _ _ _ _ _ _. _ _ _
p <-
July 14,1998 J NORTHERN STATES POWER COMPANY.
Page 24'-
reflecting the SG tube plugging and justify that the effects of the SG tube plugging are -
l appropriately considered.
Response
To account for Steam Generator tube plugging, the intemal flow area, the heat transfer area, fluid inertia, and loss coefficients are modeled consistent with the magnitude of the SG tube
{
plugging. While these modeling changes would have an impact upon the RCS flow rate and SG pressure, the RCS flow rate and SG pressure have been chosen to be consistent with current nominal plant conditions, as per Regulatory Guide 1.70. Currently the RCS flow rate analytical j
value is smaller than the measured core flow less uncertainty. Because RCS flow rate has a j
significant impact on DNBR', RCS flow rate and secondary side parameters will be monitored and validated on a reload basis.-
Question 11.8:
NSP has stated that the addition of the DSS removes the need to trip the AFW pumps during ATWS conditions. Provide a discussion of the SG response and the AFW pump low-pressure-switch design to show that no trip of the AFW pumps is needed to avoid the AFW pump run-out i
I conditions during an ATWS event. -
i
Response
Minimum main steam system pressure was a key parameter during the analysis of these
' transients to ensure. continued operation of the AFW Pumps. Main steam system pressure was L
. verified to remain above the AFW Pump discharge pressure trip setpoint (800 psig) throughout -
the transients.' This evaluation also assumed no pressure drop from the discharge of the AFW 4
Pumps to the Steam Generators which conservatively ensures that the AFW Pump discharge j
pressure trip s,etpoint will not be reached. This demonstrates that the AFW pumps will start and L
. continte to operate throughout the events.
j Question 11.9:
l l
Section 2.3 of the submittal dated February 27,1998, breaks down the events that are not analyzed into 3 categories. Category 2 events are the events that do not require reactor trip to mitigate the consequences of the event with the less restrictive assumptions applicable to the analysis of
"'non design basis" ATWS event.' Clarify the definition of category 2 events and provide a list for the events that belong to this category.
L e Note that the acceptance criteria for the analyses includes a conservative value of DNBR which provides excess assurance that individual fuel assembly geometry remains intact for long-term cootability of the core.
r 7--,
July 14,1998 NORTHERN STATES POWER COMPANY '
l Att2chment 1 l~
Pago 25
Response
No evaluated events were categorized as " events that do not require reactor trip to mitigate the consequences of the event with the less restrictive assumptions applicable to the analysis of non-design basis ATWS event". This category should not have been included in the February 27,1998 submittal.
l
\\
l 1
l 4
l i
l t
i I
l
July 14,1998 NORTHERN STATES POWER COMPANY 1
Replacement Sections for License Amendment Request dated February 27,1998 ATWS Mitigating System Actuating Circuitry / Diverse Scram System 3.5 System Status Output Signals The AMSAC/ DSS provides outputs for Control Room information and annunciation. A control board status window, AMSAC/ DSS BLOCKED, is illuminated whenever the new control board AMSAC/ DSS control switch is in the BLOCK position. A plant process computer based alarm, AMSAC/ DSS TROUBLE, is triggered upon any one of three conditions, power failure to the electronics rack, microprocessor failure, or input signal failure. A plant process computer based alarm, AMSAC/ DSS BLOCKED, is triggered whenever the main control board AMSAC/ DSS control switch is in the BLOCK position. A plant process computer bases alarm, AMSAC/ DSS OPERATION, is triggered upon successful closure of actuation contacts on both digital control system (DCS) output cards. Also, upon successful closure of actuation contacts on both DCS output cards the plant process computer makes an entry in the Sequence of Events Log.
The requirement to provide continuous indication in the Control Room when the AMSAC/ DSS is bypassed for surveillance testing is retained in the existing control room status panel alarm to indicate that the system is blocked.
The plant process computer alarm CRT is continuously displayed in the Control Room. Since AMSAC/ DSS actuation should not affect operation of the reactor and turbine until there has been a failure of both normal control and protection systems, this level of control room indication provides adequate information to the operator while allowing Prairie Island to conserve the scarce annunciator spare positions for future needs.
3.7 Bypasses AMSAC/ DSS will have a new three-position control switch (Manual Actuate, Auto, and Block) and a new Reset pushbutton on the control room main control board. The AMSAC/ DSS system can be maintained at power with the system in the ' Block' mode, by placing the main control board AMSAC/ DSS control switch in the BLOCK position. With the output blocked, it is possible to test, calibrate, or repair the software logic and analog portions of the system without affecting plant operations.
July 94,1998 NORTHERN STATES POWER COMPANY Page 2 When the system is in the Block mode, the system status annunciator panel in the Control Room will continuously indicate that the AMSAC/ DSS is blocked. In addition, a plant process computer alarm will indicate that the system is blocked.
There is no automatic bypass of the AMSAC/ DSS function during operation. The AMSAC/ DSS function can be blocked only by an administratively controlled manual operating bypass. Once the manual bypass is engaged, the AMSAC/ DSS functionality is disabled. This bypass is controlled using the same Block switch as described for the Maintenance Bypass.
The means for bypassing the AMSAC/ DSS is a new three position control switch on the main control board, under administrative control. Bypass capability is provided without the use of lifted leads, pulled fuses, tripped breakers, or physically olockeo relays.
The new three position control switch for AMSAC/ DSS actuation on the main control board will be diverse from the existing Reactor Trip control switch used in the Control Room. The new three position switch will be of different manufacture from the Westinghouse W2 switch used in the reactor protection system.
3.8 Reset The AMSAC/ DSS design for actuation output interfaces is such that, upon actuation, the completion of mitigating actions is consistent with diverse reactor trip, turbine trip, and auxiliary feedwater circuitry. Once actuated, there is no mechanism to prevent completion of the mitigating action. Return to normal power operation is accomplished in accordance with normal operations manual procedures, which require deliberate operator action. Part of this deliberate action will be to momentarily press the new Reset pushbutton on the control room main control board, which will reset the AMSAC/ DSS logic following a system initiation.
I 1
[.'
v
- July 14,1998 NORTHERN STATES POWER COMPANY Page 3 l
l 1
l
. Signal Failure Rack Power Supply Microprocesscf l-Failure / Loss Failure l
l l
1lr ir+
l l
ir AMSAC/ DSS TROUBLE Block Switch in -
BLOCK Position 1r AMSAC/ DSS BLOCKED Actuation Contacts I
+
+
Sequence of AMSAC/ DSS Events Log OPERATION Plant Process Computer Alarms FIGURE 4
3 July 14 1998 NORTHERN STATES POWER COMPANY s
Page 4
)
Redundant Data Highway from Feedwater Control System i
I l
i I
J I"I*'
lA B
C D l l FI A FI al l F2 A F2 A l Cards
$1 h1 kl bl mSACMSS Cabinet 1r V
1r 1r 1r 3r 1r 1r 1
I SERYlCE BUILDING ll5 VAC POWER (T
(INVERTER BACKED)
F
\\/
(D3/D4 BACKED) 1P Thne (aserts aner Dday 30 seconds)
Servke 1r 1P Building Servke Building i
Power Panel g D D
l Output Outpet l Power i
Card Card l
Panet E
E As Eteam Generator I Wide Range Level **
T-t j'
T-2 m
g"'
B: Steam Generator i Wide Range level' H>
C: Steam Cencrator 2 Wide Range I.evel**
aa im p,ase)
. " * * * ' b D: htcam Generator 2 Wide Range Level' E: Eeactor Coolant Pump i Breaker Open**
P' Trip (T
(.)
Trip F1 Reactor Coolant Pump 2 Breaker Opra**
Note: The Reset is os one control room switch. The i
Operator Trip and Black Contacts are on a second s-88'II ** **
73. Turba s/ DSS Tr:p 1 T4
= 1 ane445 Trip 2
- Prescally in Feedwater Control System APW Aelawt Aas hedwsterTrain A MW B e Start Aus Feeduster Trata $
TL
= tem Laglit TL
= Test Light
- New 1/0 j
& I contact is wired to two separate PLC loput cards I
FIGURE 1 l
l l
July 14,1998 NORTHERN STATES POWER COMPANY Supplemental information for License Amendment Request dated February 27,1998
[
ATWS Mitigating System Actuating Circuitry / Diverse Scram System
)
i.
The following are the analytical time delays assumed in the AMSAC/ DSS modification l
supporting analyses:
1 Event Time Delay Description i
(seconds)
- 1 l
AMSAC/ DSS sensing, signal 5
This is the time period from the last process propagation and logic delay variable in a logical trip combination reaching its setpoint until the AMSAC/ DSS digital i
control system output changes state.
DSS Actuation 3
This is the time period from the AMSAC/ DSS digital control system output changing state until the magnetic field produced by tae control rod gripper coils has decayed sufficiently to release the individual rod l
control cluster assemblies (RCCA).
Rod Drop 2.453 "
This is the time assumed in the analysis for the RCCAs to fall from the fully withdrawn position to the fully inserted position.
Turbine stop valve closure 5
This is the time period from the AMSAC/ DSS delay digital control system output changing state until the main turbine stop valves start to I
stroke closed.
l AFW flow initiation 60 This is the time period from the AMSAC/ DSS digital control system output changing state until AFW flow is at 160 gpm into the steam generators
- These values were chosen to be very conservative relative to the expected actual time delays and associated uncertainties. More realistic values based on measurements of the installed equipment may be applied at a later time to compensate for changes in plant conditions. Any new values used will include appropriately detsrmined uncertainties.
" While Technical Specifications require this to be no greater than 1.8 seconds, these analyses have applied additional conservatism.
l l