ML23180A108

ANO Unit 1 SAR Amendment 31, TRM, TS Bases, 10 CFR 50.59 Report, and Commitment Change Summary Report

ML23180A108
Person / Time
Site:	Arkansas Nuclear
Issue date:	06/20/2023
From:	Sullivan J Entergy Operations
To:	Office of Nuclear Reactor Regulation
References
1CAN062302
Download: ML23180A108 (1)

Text

SECURITY-RELATED INFORMATION SAR SECTIONS 2.11.1, 2.11.2, AND 2.11.3 OF ENCLOSURE 1 TO BE WITHHELD FROM PUBLIC DISCLOSURE IN ACCORDANCE WITH 10 CFR 2.390

}entergy Joseph C. Sullivan Site Vice President Arkansas Nuclear One Tel 479-858-3110 10 CFR 50.4(b)(6) 10 CFR 50.59(d)(2) 10 CFR 50.71(e) 10 CFR 54.37(b) 1CAN062302 June 20, 2023 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

SUBJECT:

ANO Unit 1 SAR Amendment 31, TRM, TS Bases, 10 CFR 50.59 Report, and Commitment Change Summary Report Arkansas Nuclear One, Unit 1 NRC Docket No. 50-313 Renewed Facility Operating License No. DPR-51 In accordance with 10 CFR 50. 71 (e) and 10 CFR 50.4(b)(6), enclosed is an electronic copy of Amendment 31 to the Arkansas Nuclear One, Unit 1 (ANO-1) Safety Analysis Report (SAR).

Included with this update is an electronic copy of the current ANO-1 Technical Requirements Manual (TRM) and the current ANO-1 Technical Specification (TS) Bases. The TS Bases file also includes the Table of Contents which outlines the contents of both the TSs and the TS Bases, since the Table of Contents is revised by the licensee in accordance with 10 CFR 50.59.

Pursuant to 10 CFR 50. 71 (e)(4), these documents are being submitted within six months following the previous ANO-1 refueling outage (1 R30) which ended December 30, 2022.

Summaries of changes to the ANO-1 TRM and TS Bases are included in Attachments 1 and 2 of this letter, respectively. The SAR, TS Bases, and TRM changes enclosed are for the period beginning October 6, 2021 and ending June 21, 2023.

In accordance with NEI 98-03, Appendix A, Section A6, a list and short description of information removed from the SAR should be included with each SAR update submittal. For this reporting period, information was not removed from the SAR meeting the criteria of either

/J !)5

--r

'?

- -----------------------i/V~~

Entergy Operations, Inc. 1448 SR 333, Russellville, AR 72802 SECURITY-RELATED INFORMATION - WITHOLD UNDER 10 CFR 2.390 DOCUME~TS TRAN~MITTED HEREWITH CONTAIN ~ENSITIVE, UN,CLAS~IFIED INFORMATION. WHEN SEPARATED FROM THE SENSITIVE INFORMATION, THIS DOCUMENT IS DECONTROLLED.

SECURITY-RELATED INFORMATION SAR SECTIONS 2.11.1, 2.11.2, AND 2.11.3 OF ENCLOSURE 1 TO BE WITHHELD FROM PUBLIC DISCLOSURE IN ACCORDANCE WITH 10 CFR 2.390 1CAN062302 Page 2 of 3 Appendix A, Sections A4 or AS, of NEI 98-03, that would require reporting in accordance with NEI 98-03, Appendix A, Section A6.

Associated in part with post September 11, 2001, response related to security sensitive information, Entergy has reviewed the ANO-1 SAR and determined that the following items contain information required to be withheld from public disclosure with respect to NRC Regulatory Issue Summary (RIS) 2015-17, "Review and Submission of Updates to Final Safety Analysis Reports, Emergency Preparedness Documents, and Fire Protection Documents."

SAR Section 2.11.1 "Maximum Probable Flood" SAR Section 2.11.2 "Failure of Upstream Dams" SAR Section 2.11.3 "Design Flood Evaluation" The above is consistent with currently redacted information from the ANO-1 SAR (reference ML21288A072). Entergy requests the aforementioned information be withheld from public disclosure in accordance with 10 CFR 2.390. Accordingly, a complete version and a redacted version of the ANO-1 SAR are included on the enclosed compact disc (CD).

In accordance with 10 CFR 54.37(b), after a renewed license is issued, the SAR update required by 10 CFR 50. 71 (e) must include any systems, structures, and components (SSCs) newly identified that would have been subject to an aging management review or evaluation of time-limited aging analyses in.accordance with 10 CFR 54.21. The SAR update must describe how the effects of aging will be managed such that the intended function(s) in 10 CFR 54.4(b) will be effectively maintained during the period of extended operation. No SAR changes were required with respect to 10 CFR 54.37(b) during this reporting period. It should be noted that during this update period, SAR Section 16.1.4.2 "Pressurizer Heater Bundle Penetration Welds Examination" was deleted due to replacement of the ANO-1 Pressurizer Heater Bundles during 1R30.

In accordance with 10 CFR 50.59(d)(2), a report containing a brief description of any changes, tests, and experiments must be submitted at intervals not to exceed 24 months. A summary of ANO-1 10 CFR 50.59 evaluations and those evaluations common between ANO-1 and ANO Unit 2 (ANO-2) associated with changes to Licensing Basis Documents over the reporting period is provided in Attachment 3. Attachment 4 contains a copy of each evaluation.

Attachment 5 contains a summary of changes to regulatory commitments which have occurred over the reporting period.

Attachment 6 includes a list of SAR pages that were updated during the period.

If you have any questions or require additional information, please contact Riley Keele at 479-858-7826.

SECURITY-RELATED INFORMATION - WITHOLD UNDER 10 CFR 2.390 I

• DOCUMENTS :rRANSMITTED HER~\NITH CONTAIN SEN~ITIVE, UNCLASSIFIE;D INFORMATION. WHEN SEPARATED 'FROM THE SENSITIVE INFORMATION, THIS DOCUMENT IS DECONTROLLED.

SECURITY-RELATED INFORMATION SAR SECTIONS 2.11.1, 2.11.2, AND 2.11.3 OF ENCLOSURE 1 TO BE WITHHELD FROM PUBLIC DISCLOSURE IN ACCORDANCE WITH 10 CFR 2.390 1CAN062302 Page 3 of 3 I declare under pen.alty of perjury that the foregoing is true and correct. Executed on June 20, 2023. The changes to these documents reflect information and analyses submitted to the Commission, prepared pursuant to Commission requirements, or made under the provisions of 10 CFR 50.59.

Respectfully, JCS/mar Attachments:

1. Summary of ANO-1 TRM Changes

2. Summary of ANO-1 TS Bases Changes

3. Summary of ANO-1 and ANO-Common 10 CFR 50.59 Evaluations

4. 10 CFR 50.59 Evaluations - October 6, 2021 through June 21, 2023

5. ANO-1 and ANO-2 Commitment Change Summary Report

6. List of Affected SAR Pages Enclosures (compact disc):

1. ANO-1 SAR Amendment 31 - Un-redacted Version (CD Rom)

2. ANO-1 SAR Amendment 31 - Redacted Version (CD Rom)

3. ANO-1 TRM (CD Rom)

4. ANO-1 TS Table of Contents and TS Bases (CD Rom) cc: NRG Region IV Regional Administrator NRG Senior Resident Inspector - Arkansas Nuclear One NRG Project Manager - Arkansas Nuclear One Designated Arkansas State Official SECURITY-RELATED INFORMATION - WITHOLD UNDER 10 CFR 2.390 DOCUMENTS TRANSMITTED HEREWITH CONTAIN SENSITIVE, UNCLASSIFIED INFORMATION. WHEN SEPARATED FROM THE SENSITIVE INFORMATION, THIS DOCUMENT IS DECONTROLLED.

Attachment 1 1CAN062302 Summary of ANO-1 TRM Changes

1CAN062302 Page 1 of 1 Summary of AN0-1 TRM Changes The following changes to the Arkansas Nuclear One, Unit 1 (ANO-1) Technical Requirements Manual (TRM) were implemented in accordance with the provisions of 10 CFR 50.59. Because these changes were implemented without prior NRC approval, a description is provided below:

Revision# TRM Section Description of Change TR 3.7.4.1 (Note 3), Engineering Change EC-88943, "Boronometer and 77 TR 3.7.4.4 Control Room Chart Recorder Abandonment" List of Undefined Acronyms TR Test Requirement

Attachment 2 1CAN062302 Summary of AN0-1 TS Bases Changes

1CAN062302 Page 1 of 1 Summary of AN0-1 TS Bases Changes The following changes to the Arkansas Nuclear One, Unit 1 (ANO-1) Technical Specification (TS) Bases were implemented in accordance with the provisions of 10 CFR 50.59 and the Bases Control Program of ANO-1 TS 5.5.14. Because these changes were implemented without prior NRC approval, a description is provided below:

Revision# TS Bases Section Description of Change B 3.7.8 TS Amendment 274, "One-Time Change to 76 Support Proactive Upgrade of the Emergency Cooling Pond Supply (ECP) Piping" TS Amendment 275, "Adopt TSTF-541 'Add 77 B 3.7.9.3, B 3.7.11.3 Exceptions to SR for Valves and Dampers Locked in the Actuated Position"'

TS Amendment 276, "Adopt TSTF-554 - Revise 78 B 3.4.13 Reactor Coolant Leakage Requirements" License Basis Document Change LBDC 22-019, 79 B 3.4.16 "Correct Editorial Error Associated with SG Tube Leakage (CR-ANO-1-2022-326" TS Amendment 278, "Revision to TS 3.4.12 and B 3A.12, B 3.4.13, 3.4.13 Based on Revised Dose Calculations" 80 B 3.3.5 LBDC 22-046, "Update ANO-1 TS Bases B 3.3.5-1 to reflect NaOH ESAS deletion" List of Undefined Acronyms CR Condition Report ESAS Engineered Safeguards Actuation Signal NaOH Sodium Hydroxide SG Steam Generator TSTF Technical Specification Task Force

Attachment 3 1CAN062302 Summary of ANO-1 and ANO-Common 10 CFR 50.59 Evaluations

1CAN062302 Page 1 of 1 Summary of ANO-1 and ANO-Common* 10 CFR 50.59 Evaluations 50.59 # 50.59 Summary 2022-002 "ANO Unit 1 Turbine Control System DEHC Upgrade Implementation (Parent)"/

Engineering Change EC 89300

• There were no ANO-1 and ANO-2 Common 10 CFR 50.59 Evaluations for this reporting period.

Attachment 4 1CAN062302 10 CFR 50.59 Evaluations - October 6, 2021 through June 21, 2023 15 Pages

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 1 of 15 I. OVERVIEW/ SIGNATURES 1 Facility: Arkansas Nuclear One Unit 1 Evaluation # / Rev. #: FFN-2022-002 Proposed Change/ Document:

"ANO Unit 1 Turbine Control System DEHC Upgrade Implementation (Parent)" / EC 89300 Description of Change:

The existing ANO Unit 1 Westinghouse Main Turbine Generator (MTG) Analog Electrohydraulic (AEH) Control system has obsolescence and single-point vulnerability issues.

EC 89300 is an upgrade of the Turbine Controls System (TCS) changing it from an analog electrohydraulic system to a Digital Instrument & Controls (Dl&C) system. A Dl&C system has inherently different failure characteristics which may produce unique software common cause failures (software CCF).

Replacement/Removal of Mechanical Overspeed:

The TCS upgrade includes the replacement of the existing mechanical-hydraulic overspeed trip with a Woodward (hardware/software) Diverse Overspeed Protection System (OOPS) consisting of three overspeed trip modules with three passive speed probes. This serves as the primary overspeed protection system. When turbine speed reaches 110%, OOPS trips a solenoid actuating the emergency trip system. The existing electronic overspeed system is being replaced with a hardwired backup overspeed trip (independent of the OOPS) consisting of three Speed Detector Modules (SDMs) with three active speed probes. This serves as the backup overspeed protection system. When the turbine speed reaches 110% it trips a solenoid draining the emergency trip header as well.

The Turbine Overspeed system is described in Safety Analysis Report (SAR) Section 14.1.2.9.

Analog to Digital Upgrade:

EC 89300 replaces the current ANO Unit 1 analog EHC system with a new Digital Electro-Hydraulic Control (DEHC) Distributed Control System (DCS) which consists of a Main Turbine Control and Protection System (TCPS). The new DEHC is provided by Westinghouse and is based upon an Ovation (software/hardware) platform supplied by Emerson Process Management (EPM).

Summary of Evaluation:

Process Applicability Determination (PAD)

Note that Licensing Amendment Request (tracked by LAR-2021-153) was pre-identified as required to update Technical Specification (TS) Table 3.3.1-1 and TS Bases B 3.3.1 for "Main Turbine Trip (Oil Pressure)". The LAR is a result of the removal of the Auto Stop oil system, as the "RPS Instrumentation" for Main Turbine Trip that monitors EH trip fluid pressure is changing the RPS input for an anticipatory reactor trip from the Auto Stop oil system pressure to the EH trip header pressure. This specific portion of the modification's scope will require approval by the NRC prior to its implementation. The RPS switch modification impacts are not included within the scope of this 10CFR50.59 Evaluation as these impacts are evaluated as part of the referenced LAR issued in conjunction with EC 89298. This is allowed by EN-Ll-100 Attachment 2,Section VI, Step 1 and EN-Ll-101 Section 5.2, Step 1. This 10CFR50.59 Evaluation EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 2 of 15 focuses on the remaining changes evaluated as adverse by EC 89300's Process Applicability Determination (PAD).

A PAD was performed to assess the ANO Unit 1 TCS upgrade EC 89300. The results of the PAD identified that the following portions of the change require additional evaluation:

• Replacement of Mechanical Overspeed

• Analog to Digital Upgrade NEI 96-07 Appendix D, Rev 1: "Supplemental Guidance for Application of 10 CFR 50.59 to Digital Modifications" May 2020 provides guidance for assessing Dl&C modifications. The NRC issued Revision 2 to RG 1.187 which endorsed NEI 96-07, Appendix D, Rev 1. The NRC issued Revision 3 to RG 1.187 which continued to endorse NEI 96-07, Appendix D, Rev 1, and adds an additional clarification in section C.2.e related to the Human Factors Engineering (HFE). This 50.59 Evaluation follows the guidance provided in NEI 96-07 Appendix D, Rev 1.

This evaluation is based on the following issues:

Replacement of Mechanical Overspeed:

As part of the TCS upgrade, the existing mechanical-hydraulic overspeed trip is being replaced with a Diverse Overspeed Protection System (OOPS) consisting of three overspeed trip modules with three passive speed probes. When turbine speed reaches 110%, OOPS.trips a solenoid actuating the emergency trip system. There is a hardwired backup overspeed trip (independent of the OOPS) consisting of three Speed Detector Modules (SDMs) with three active speed probes. When the turbine speed reaches 110%, the SOM trips a solenoid draining the emergency trip header as well.

One feature of the new DEHC System and upgraded overspeed protection is the use of redundant and diverse sensors, probes, transmitters, power sources (with UPS backup), and trip devices to reduce single point failure vulnerabilities of the turbine overspeed protection. The modified configuration provides two independent, and diverse overspeed trip systems in addition to normal speed control which meets the requirements of SAR Section 14.1.2.9. SAR Section 14.1.2.9.5 states that a turbine missile resulting from turbine-generator overspeed is improbable which is partially based on overspeed protection. The requirements of TRM 3.3.5 ensure that the turbine overspeed protection system is tested regularly, functions properly, and that the assumption of a turbine overspeed system as identified in SAR 14.1.2.9 is met. The description of overspeed in TRM B3.3.5 is consistent with the plant licensing basis described in SAR Section 14.1.2.9. This evaluation shows that the changes to the overspeed protection are acceptable.

This EC replaces the mechanical-hydraulic overspeed trip with a OOPS. Turbine Overspeed Reliability and Fault Tree Analysis (WNA-AR-00799-GEN) and the Failure Modes and Effects Analysis (FMEA)

(WNA-AR-01007-BARK1) conclude that the new OOPS does not adversely impact the probability of failure from turbine overspeed. The replacement of the mechanical-hydraulic overspeed trip has no impact on accident mitigation or the consequences of an accident.

Potential failure modes introduced by the overspeed modification, such as susceptibility to Electromagnetic Interference (EMI), firmware problems, power supply failure, and solenoid trip valve failure, have been shown by the Turbine Overspeed Reliability and Fault Tree Analysis and FMEA to not adversely affect the probability of failure of the main turbine to trip upon an overspeed condition. In fact, due to eliminating the mechanical overspeed trip mechanism and trip block, which were susceptible to failure modes not applicable to the new digital system (such as mechanical linkage binding or failure and sticking dump valves due to hydraulic oil impurities), the redundancy added by the new digital system combined with the ability to test it online with relatively low risk results in similar to higher reliability than the mechanical system it replaced.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 3 of 15 Analog to Digital Upgrade This EC upgrades the reliability of the ANO Unit 1 MT System without changing the functional requirements of the systems as described in the SAR.

The TCS upgrade does not change plant operating parameters that would result in an increased challenge to systems, structures or components (SSCs) important to safety, or the frequency of any accident described in the SAR.

The upgraded TCPS system performs self-tests and on line diagnostics that are capable of identifying and isolating failures of individual 1/0 cards, out of tolerance inputs, buses, power supplies, processors, and network communication issues.

The upgraded TCS assures that no failure of a single active component within the system will result in the loss of continuous validated demand signals to TCS valves or operator displays; nor will failure of individual modules cause the control system to trip the turbine resulting in a plant transient.

A Software Hazards Analysis (SHA) (WNA-AR-01008-BARK1, Rev O - September 2021, TDW120 6760

1) was performed for ANO Unit 1. When used in conjunction with the Susceptibility Analysis (SA) (WNA-AR-01009-BARK1, Rev. 0, dated March 2022) and the FMEA (WNA-AR-01007-BARK1, Rev. 0, dated March 2022), they identify and assess potential failure sources within the ANO Unit 1 TCS. These documents also identify and assess preventive and limiting measures within the TCS that reduce the likelihood of failures and/or reduce the undesired effects of them.

Together these analyses provide a qualitative assessment that the software hazards for the TCS upgrade have been analyzed including software CCF and conclude that the TSC upgrade will not more than minimally increase challenges to the plant licensing basis. These analyses were further supplemented by the Entergy design review processes and independent third-party reviews to provide additional technical and process challenges to the viability and reliability of the new designs.

The following conclusions are supported from the platform and project specific analyses contained in the SHA:

• The implementation processes and plans used for the different stages of the software life cycle process, including software configuration management and software verification and validation (V&V) provide reasonable assurance that this is a mitigation strategy in preventing plant software hazards due to latent defects.

• The Ovation platform history and operating experience provide reasonable assurance that the Ovation platform software is stable and that platform related software errors are tracked and corrected when identified.

• The project-specific Ovation software release has been reviewed and the types of defects have been reviewed along with their categories of significance. The SHA did not identify significant failures that impair functionality.

• The results of the SHA do not include any significant issues that would adversely impact the BARK1 (B&W ANO Unit 1) DCS configuration. The BARK1 DCS platform software has no applicable safety notifications or product advisories against it.

• The project-specific and Ovation platform design and implementation processes strongly support an assessment of the evaluation criteria for a quality software implementation program.

As a result of the in-depth defenses against software errors there is reasonable assurance that the likelihood of software malfunctions and common cause failures is minimized. Software EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 4 of 15 related failures will not result in more than a minimal increase in the likelihood of malfunctions that could contribute to the frequency of accidents described in the Safety Analysis Report.

• The system-level failure analysis identified no malfunctions (software hazards) that affect the transient and accident analysis in Chapter 14 of the SAR. The notable results of the failure analysis have identified no new hazards. The SHA lists malfunctions that can cause operational events that are already possible with existing control system and/or plant equipment. As a result, there is no impact on the analysis of the SAR Chapter 14 events.

• The SHA is used in conjunction with the project SA which provides a systematic assessment of potential failure sources that can contribute to common cause failures. In the SA, the preventive and limiting measures within the l&C are evaluated to provide assurance that there is a low likelihood of common cause failures and/or their undesired effects do not create malfunctions that challenge the transient and accident analyses in Chapter 14 of the SAR.

Based upon this evaluation, the new digital electro-hydraulic control system and the upgraded electronic/digital overspeed protection system can be implemented without license amendment.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 5 of 15 Is the validity of this Evaluation dependent on any other change? [gJ Yes No If "Yes," list the required changes/submittals. The changes covered by this 50.59 Evaluation cannot be implemented without approval of the other identified changes (e.g., license amendment request). Establish an appropriate notification mechanism to ensure this action is completed. LAR-2021-153 issued in conjunction with EC 89298 requires approval by the NRC prior to the implementation of the removal of the Auto Stop oil system.

Based on the results of this 50.59 Evaluation, does the proposed change D Yes [gJ No require prior NRC approval?

Preparer2 : Al Evans/ }f).ZI/OM.A / Kinectrics /Civil-Structural/ 9-27-2022 Name (print) / SiQnature /Company/ Department/ Date Reviewer2 : Zach Lehr/ "°Ee.A~ /Entergy/MFP Eng. /9-27-2022 Name (print) /Signature/ Company/ Department I Date Independent Review3 : N/A Name (print) /Signature/ Company/ Department I Date Responsible Manager 0.9'&1,Y'9',db1J,a,nC g4- ~""""-~ [f;!;;.,:;.a_:;:~~P Concurrence: Vince Bond/ ii:.r.,,,:,.,,,.,. /Entergy/MFP Eng. /9-27-2022 *signed per Telecom Name (print) /Signature/ Company/ Department I Date 50.59 Program , Digitally signed by Michael Hall Coordinator Concurrence:

MICh aeI Ha 11 ON: cn=Michael Hall, c=US, o=Entergy, ou=ANO Regulatory Assurance, ema,l=mhall1 O@entergy.com Date: 2022.09.28 13:38:20 -05'00' OSRC:

Chairman's Name (print) /Signature/ Date [GGNS P-33633, P-34230, & P-34420; W3 P-151)

OSRC-2022-011 OSRC Meeting #

1 The printed name should be included on the form when using electronic means for signature or if the handwritten signature is illegible. Signatures may be obtained via electronic authentication, manual methods (e.g., ink signature), e-mail, or telecommunication. Signing documents with indication to look at another system for signatures is not acceptable such as "See EC" or "See Enterprise Asset Management (EAM) Application."

Electronic signatures from other systems are only allowed if they are included with the documentation being submitted for capture in eB (e.g., if using an e-mail, attach it to this form; if using Enterprise Asset Management (EAM) Application, attach a screenshot of the electronic signature(s); if using Corrective Action Program (CAP)

Application, attach a copy of the completed corrective action).

2 Either the Preparer or Reviewer will be a current Entergy employee.

2 3 If required by Section 5.1 [2). Either the Preparer or Reviewer will be a current Entergy employee.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 6 of 15 II. 50.59 EVALUATION [10 CFR 50.59(c)(2)]

Does the proposed Change being evaluated represent a change to a method of D Yes evaluation ONLY? If "Yes," Questions 1 - 7 are not applicable; answer only Question 8. ~ No If "No," answer all questions below.

Does the proposed Change:

1. Result in more than a minimal increase in the frequency of occurrence of an D Yes accident previously evaluated in the UFSAR? ~ No BASIS:

The ANO Unit 1 SAR Chapter 14 identifies the main turbine trip to occur due to the following initiating events and transients:

SAR Section 14.1.2.8: "Loss of Electric Power" A loss-of-load and complete loss of all unit AC power transient results in a decrease in the heat removal by the secondary system due to the turbine trip following a reactor trip. However, the unit is designed to accommodate a loss-of-load condition without a reactor or turbine trip. The Integrated Control System (ICS) initiates a runback signal to automatically reduce power to 15 percent reactor power due to a loss-of-load. The complete loss of power results in gravity insertion of the control rods to trip the reactor. The turbine trip is a result of the reactor trip and not the initiator of the transient.

SAR Section 14.2.2.1: "Steam Line Failure" A break in a main steam line transient results in a decrease in the heat removal by the secondary system due to the turbine trip following a reactor trip. The Emergency Feedwater Initiation and Control (EFIC) system is credited to close the main steam and feedwater isolation valves. A reactor trip results on low RCS pressure or high neutron flux via the ICS. The Emergency Feedwater (EFW) system is credited to supply feedwater into the affected steam generator. The turbine trip is a result of the reactor trip and not the initiator of the transient.

SAR Section 14.2.2.2: "Steam Generator Tube Failure" A steam generator tube failure transient results in a decrease in the heat removal by the secondary due to the turbine trip following a reactor trip. A reactor trip results on low RCS pressure due to the complete severance of a steam generator tube. The turbine trip is a result of the reactor trip and not the initiator of the transient.

SAR Section 14.2.2.5: "Loss of Coolant Accident" For large break LOCAs, a reactor trip results on low RCS pressure. For small break LOCAs, secondary cooling with feedwater from the EFW system and steam relief from the main steam safety valves is credited. The turbine and main feedwater pumps are assumed to trip coincident with the reactor trip. The turbine trip is a result of the reactor trip and not the initiator of the transient.

SAR Sections 4.1.1.2 "Transient Performance, 4.3.8 "Overpressure Protection", 10.2 "Turbine-Generator" and Table 4-8 "Transient Cycles" These sections describe events where a turbine trip results in a reactor trip.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 7 of 15 Digital Electro-Hydraulic Controls (DEHC) System The software used in this upgrade has been subjected to a detailed validation and verification process that includes factory acceptance testing, on-site acceptance testing, and post-upgrade testing that ensures software integrity. These actions are taken to assure that the likelihood of a software failure is sufficiently low that implementing this DEHC upgrade will not increase the frequency of occurrence of an accident previously evaluated in the SAR.

The SHA, when used in conjunction with the project SA and the FMEA provide a qualitative assessment concluding that the failure likelihood introduced by the modified TCS is sufficiently low. Some of the specific conclusions made in the SHA include the following:

• The Westinghouse/Emerson software development, control, and V&V processes provide reasonable assurance that this is a mitigation strategy to prevent plant software hazards.

Additional factory acceptance testing, on-site acceptance testing, and post modification implementation testing assure that the Ovation software operates as designed.

• The Ovation Platform has a large installed base and operating experience that provides reasonable assurance that the software is stable, performs as required, and errors are tracked and corrected when identified. Additionally, the version for ANO has been reviewed and any identified defects do not result in significant failures and do not impair functionality.

• The combination of the SHA along with the SA evaluations show that there is a low likelihood of common cause failures and that any defects will not create malfunctions that challenge the transient and accident analyses contained in SAR Chapter 14. The SHA further states that the*

likelihood of common cause failure in Ovation resulting in failure of the system to perform its intended functions has been qualitatively determined to not be greater than the current system.

• The SHA concludes that the upgraded control system will not result in a more than a minimal increase in the frequency of an accident previously evaluated in the SAR.

• Ovation provides additional diagnostics and redundancy features to assist the operator in diagnosing faults and addressing failures. This minimizes operator inteNentions or operator burden to support system operation.

• The TCS is designed so that a single system component failure does not impact plant monitoring and controls functions, along with a single failure will not prevent the turbine from tripping when required to trip.

Single Point Vulnerabilities A detailed fault tree analysis was performed as part of this TCS upgrade. The DEHC System upgrade reduces the number of Single Point Vulnerabilities (SPVs) and adds speed signal redundancy while maintaining the existing design function of the system. This will improve the TCS reliability and minimizes the probability of spurious turbine trips.

In conclusion, based on the fault tree analysis and FMEA, there is a sufficiently low likelihood that the new hardware will result in an increase in the frequency of occurrence of an accident previously evaluated in the SAR.

The upgraded TCS assures that a single active component within the system will neither result in a loss of continuous validated demand signals to TCS valves or operator displays, nor will failure of individual modules cause the control system to trip the turbine and cause a plant transient. The control elements in the new system are configured to allow unrestricted operation with a single failure and to facilitate online replacement of the failed component. The existing system is not fault tolerant and does not provide fault detection and failure response capability.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 8 of 15 Main Turbine Overspeed Trip Functions The ANO Unit 1 SAR Section 14.1.2.9 "Turbine Overspeed" describes the redundant overspeed trip devices.

The existing mechanical-hydraulic overspeed trip is being replaced with a Diverse Overspeed Protection System (OOPS) consisting of three overspeed trip modules (with redundant sources of power and UPS backup) with three passive speed probes. When turbine speed reaches 110%, OOPS trips a TOM draining the solenoid the emergency trip header.

There is a hardwired backup overspeed trip (independent of the OOPS) consisting of three Speed Detector Modules (SDMs) with three active speed probes each with redundant sources of power plus UPS backup. When the turbine speed reaches 110%, the SOM trips a solenoid draining the emergency trip header as well.

One feature of the new DEHC System is the use of redundant and diverse sensors, probes, transmitters, and trip devices to reduce single point vulnerabilities of the turbine overspeed protection.

The modified configuration provides two independent, and diverse overspeed trip systems which complies with the requirements of SAR Section 14.1.2.9 "Turbine Overspeed" and is consistent with the description contained in TRM 3.3.5 and B.3.3.5 "Miscellaneous Instrumentation".

Potential failure modes introduced by the overspeed modification, such as susceptibility to Electromagnetic Interference (EMI), firmware problems, power supply failure, and solenoid trip valve failure, have been shown by the Reliability and Fault Tree Analysis and FMEA to not adversely affect the probability of failure of the main turbine to trip upon an overspeed condition. In fact, due to eliminating the mechanical overspeed trip mechanism and trip block, which were susceptible to failure modes not applicable to the new digital system (such as mechanical linkage binding or failure and sticking dump valves due to hydraulic oil impurities), the redundancy added by the new digital system combined with the ability to test it on line with relatively low risk results in similar to higher reliability than the mechanical system it replaced.

Turbine Missiles SAR Section 14.1.2.9.5: "Conclusions" states:

"Because of the redundancy and reliability of the plant turbine control and protection system, the close control of oil purity, the periodic check of steam admission valve freedom, the periodic turbine disc inspections, (1CAN098109), and the high value of the bursting overspeed, any missile resulting from a turbine-generator overspeed incident is hypothetical only and not considered credible."

The TCS upgrades retain redundant and diverse overspeed protection, therefore, turbine missiles remain a hypothetical event.

Turbine Control Valves The EC does not impact the physical design or function of the turbine control valves or their actuators.

The turbine performance requirements are not being changed, so there is no increased probability of the turbine operating outside of its design limitations than with the current TCS configuration.

Conclusion With the failure likelihood introduced by the modified TCS, including the addition of independent and diverse OOPS/SOM overspeed protection systems, being sufficiently low, there is not more than a EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 9 of 15 minimal increase in the frequency of occurrence of an accident previously evaluated in the SAR. As described above in the Section 14 event discussions, the TCS responds to those initiating transients to trip the turbine and does not increase the frequency of occurrences of those accidents and/or transients that have been previously evaluated in the SAR.

This evaluation finds the new design to provide an enhancement to the reliability of the new system with respect to the original EHC control system. By increasing the number of redundant instruments that sense turbine parameters and the use of two out of three logic, the change increases redundancy and reliability, eliminates numerous SPVs and multiple failure modes, and EC 89300 reduces the potential for spurious turbine trips with subsequent reactor trips and equipment failures.

2. Result in more than a minimal increase in the likelihood of occurrence of a D Yes malfunction of a structure, system, or component important to safety previously ~ No evaluated in the UFSAR?

BASIS:

The main turbine trip function is not credited for any ANO Unit 1 Chapter 14 SAR transient or accident analyses. The worst-case malfunction of the upgrade TCS system remains a turbine trip, inadvertent turbine stop/ control valve actuation or turbine overspeed trip.

A detailed fault tree analysis and FMEA was performed as part of this TCS upgrade modification. No new failure modes that could cause a plant transient or a turbine trip were identified. The upgrades have eliminated many of the SPVs and failure modes in the TCS System. This will improve the TCS reliability and minimize spurious trips.

The TCS upgrade provides the same functions with respect to turbine control as the system currently evaluated in the SAR. The upgraded system does not create any new functions or interfaces with important to safety components that are not included in the system as currently configured.

The upgraded TCS system performs self-tests and online diagnostics that are capable of identifying and isolating failures of individual 1/0 cards, out of tolerance inputs, buses, power supplies, processors, and network communication issues.

The upgraded TCS assures that no failure of a single active component within the system will result in the loss of continuous validated demand signals to TCS valves or operator displays; nor will failure of individual modules cause the control system to trip the turbine resulting in a plant transient.

Overspeed Trip The existing mechanical-hydraulic overspeed trip is being replaced with a OOPS consisting of three overspeed trip modules with three passive speed probes. When turbine speed reaches 110%, OOPS trips a TOM actuating the emergency trip system. There is a hardwired backup overspeed trip (independent of the OOPS) consisting of three SOMs with three active speed probes. When the turbine speed reaches 110%, the SOM trips a TOM draining the emergency trip header as well. The modified configuration provides two independent and diverse overspeed trip systems, which is consistent with the existing requirements described in SAR Section 14.1.2.9 "Turbine Overspeed". The revised overspeed trip device, replacing the existing mechanical-hydraulic overspeed trip, does not have any interaction with any SSC important to safety.

Turbine Missiles SAR Section 14.1.2.9.5: "Conclusions" states:

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 10 of 15 "Because of the redundancy and reliability of the plant turbine control and protection system, the close control of oil purity, the periodic check of steam admission valve freedom, the periodic turbine disc inspections, (1CAN098109), and the high value of the bursting overspeed, any missile resulting from a turbine-generator overspeed incident is hypothetical only and not considered credible."

The TCS upgrades retain redundant and diverse overspeed protection; therefore, turbine missiles remain a hypothetical event.

Software The SHA, when used in conjunction with the project SA, and the FMEA provide a qualitative assessment concluding that the failure likelihood introduced by the modified TCS and independenUdiverse overspeed protection systems is sufficiently low. Some of the specific conclusions made in the SHA include the following:

• Software related failures will not result in more than a minimal increase in the likelihood of malfunctions that could contribute to the frequency of accidents as described in the SAR.

• The qualitative software assessment and the evaluation of possible system malfunctions performed in the SHA provide reasonable assurance that the likelihood of software common cause failure is minimized and should not result in more than a minimal increase in the likelihood of malfunctions leading to an increase in the frequency of occurrence of an accident.

Conclusion The failure likelihood introduced by the TCS upgrade is sufficiently low, there is not more than a minimal increase in the likelihood of occurrence of a malfunction of an SSC important to safety previously evaluated in the SAR.

This evaluation finds the new design to provide an enhancement to the reliability of the new system with respect to the original EHC control system. By increasing the number of redundant instruments that sense turbine parameters and the use of two out of three logic, the change increases redundancy and reliability, eliminates numerous SPVs and multiple failure modes. The EC 89300 upgrade reduces the potential for spurious turbine trips with subsequent reactor trips and also provides redundant overspeed

• protection (for likelihood of turbine missiles) without spurious trips.

3. Result in more than a minimal increase in the consequences of an accident D Yes previously evaluated in the UFSAR? [gj No BASIS:

The turbine trip function is not credited for any ANO Unit 1 Chapter 14 SAR transient or accident analyses.

TCS has no function for accident mitigation or limiting the consequences of an accident. Also, the function and performance of the TCS, as described in the SAR, is not being changed, with the exception being the replacement of the existing mechanical-hydraulic overspeed trip with a more reliable design.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 11 of 15 Overspeed Trip The existing mechanical-hydraulic overspeed trip is being replaced with a OOPS consisting of three overspeed trip modules with three passive speed probes. When turbine speed reaches 110% OOPS trips a solenoid actuating the emergency trip system.

There is a hardwired backup overspeed trip (independent of the OOPS) consisting of three SO Ms with three active speed probes. When the turbine speed reaches 110%, the SOM trips a solenoid draining the emergency trip header as well.

The modified configuration provides two independent and diverse overspeed trip systems which is consistent with the existing requirements described in SAR Section 14.1.2.9 "Turbine Overspeed". It is important to note that the TCS (Ovation) control system normally functions to control turbine speed and is the first layer of defense to prevent a turbine overspeed.

The replacement of the mechanical-hydraulic overspeed trip has no impact on accident mitigation or the consequences of an accident.

The TCS upgrade has no impact on the radiological consequences of an accident.

The TCS upgrade does not impact the performance of any control valves in that neither the control valves nor valve actuators are being modified, although control valve movement is now controlled through the TCS via the demand signals to their respective servo valves. Additionally, the turbine valve response times are not credited in any accident analyses described in the SAR.

As described in SAR Sections 14.1.2.8, 14.2.2.1, and 14.2.2.2 a turbine trip is assumed to be a result of the accident. (Refer to Question 1 response for these SAR section discussions.) These accident analyses address the worst-case conditions and are bounding scenarios.

Conclusion The TCS upgrade with an independent and diverse OOPS/SOM overspeed protection system does not result in an increase in the consequences of an accident previously evaluated in the ANO Unit 1 SAR.

4.- Result in more than a minimal increase in the consequences of a malfunction of a D Yes structure, system, or component important to safety previously evaluated in the 1:8] No UFSAR?

BASIS:

The TCS upgrade is a reliability enhancement to the existing system described in the SAR. The TCS upgrades do not change the function or performance requirements for TCS as described in the SAR. The TCS upgrade does not adversely modify any plant operating parameters that would result in increased challenges to components important to safety. The upgraded TCS does not add any new interface requirements with SSCs important to safety that function to limit the consequences of an accident established by this upgrade.

The turbine trip function is not credited for any ANO Unit 1 Chapter 14 SAR transient or accident analyses.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 12 of 15 Conclusion The TCS digital upgrade and addition of redundant/diverse overspeed protection does not result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the SAR. *

5. Create a possibility for an accident of a different type than any previously evaluated D Yes in the UFSAR? C8] No BASIS:

Impact on Existing Accident Analysis The ANO U1 specific TCS upgrade SHA evaluated the TCS upgrade related system-level hazards to ensure that the results would be bounded by the results of malfunctions or accidents previously considered in the SAR. Applicable hazards identified and their related ANO Unit 1 SAR sections included:

• Loss of Electric Power- SAR Section 14.1.2.8

• Turbine Overs peed - SAR Section 14.1.2. 9

• Steam Line Failure - SAR Section 14.2.2.1

• Steam Generator Tube Failure - SAR Section 14.2.2.2 The evaluation determined ttiat the results of potential TCS upgrade failures are enveloped by the current SAR Chapter 14 analyses. (Refer to Question 1 response for these SAR section discussions.)

A SHA review of the ANO U 1 SAR Chapter 14 events was also performed to identify any new system-level hazards regarding the digital TCS upgrade. No new system-level hazards or failure modes were identified as a result of this review.

A SHA evaluation of sub-system level software failures, including software common cause failures and cyber security events/cyber-attacks, to deterrT)ine their impact on the identified system-level hazards, concluded that potential sub-system level software failures would not lead to different types of accidents or impact plant SAR analyses.

No TCS upgrade software interfaces were identified through which the TCS upgrade could adversely impact any.safety-related equipment or functions.

Main Turbine Overspeed Trip Functions The ANO Unit 1 SAR Section 14.1.2.9 "Turbine Overspeed" describes the redundant overspeed trip devices.

The existing mechanical-hydraulic overspeed trip is being replaced with a OOPS consisting of three overspeed trip modules with three passive speed probes. When turbine speed reaches 110% OOPS trips a TOM actuating the emergency trip system. There is a hardwired backup overspeed trip (independent of the OOPS) consisting of three Speed Detector Modules (SDMs) with three active speed probes. When the turbine speed reaches 110%, the SOM trips a TOM draining the emergency trip header.

Although the TCS upgrade replaces the mechanical overspeed trip device with a OOPS, potential failure modes introduced by the modification, such as susceptibility to Electromagnetic Interference (EMI),

firmware problems, power supply failure, and solenoid trip valve failure, have been shown by the Reliability and Fault Tree Analysis and FMEA to not adversely affect the probability of failure of the main EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 13 of 15 turbine to trip upon an overspeed condition. In fact, due to eliminating the mechanical overspeed trip.

mechanism and trip block, which were susceptible to failure modes not applicable to the new digital system (such as mechanical linkage binding or failure and sticking dump valves due to hydraulic oil impurities), the redundancy added by the new digital system combined with the ability to test it online with relatively low risk results in similar to higher reliability than the mechanical system it replaced.

The consequences of a failure of the existing mechanical-hydraulic overspeed trip system or its replacement OOPS and redundant SDMs are the same. There is no new accident type created by the failure of the upgraded overspeed trip system.

The turbine trip function is not credited for any ANO Unit 1 Chapter 14 SAR transient or accident analyses.

Impact on the Probability of a Turbine Missile SAR Section 14.1.2.9,5: "Conclusions" states:

"Because of the redundancy and reliability of the plant turbine control and protection system, the close control of oil purity, the periodic check of steam admission valve freedom, the periodic turbine disc inspections, (1CAN098109), and the high value of the bursting overspeed, any missile resulting from a turbine-generator overspeed incident is hypothetical only and not considered credible."

The TCS upgrades retain redundant and diverse overspeed protection; therefore, turbine missiles remain a hypothetical event.

Impact of Digital Modification The new DEHC System will reduce single point vulnerabilities while maintaining the existing design functions of the system; therefore, provide more reliable operation reducing the probability of these transient events. The TCS provides for turbine speed control and protection with the same function and interface requirements of the current system. The DEHC FMEA did not identify any new failure modes.

Therefore, the turbine trip does not result in any new accident scenarios.

The operation of the TCS is bounded by the current failure modes of the control system, turbine overspeed or inadvertent trip, which are both described in the SAR. Any logic failures or software failures are bounded by these events.

The TCS upgrade does not involve any new operating interfaces or parameter changes that would impact systems associated with initiation of an accident (reactivity control, reactor pressure boundary, or core cooling) other than the currently analyzed turbine trip event.

The SHA did not identify any new system level hazards. The SHA evaluation included sub-system level software failures and software common cause failures.

Conclusion Utilizing the NEI 96-07 Ap*pendix D guidance,*the SHA (Software Hazards Analysis), when used in conjunction with the project SA (Susceptibility Analysis), and the FMEA (Failure Modes and Effects Analysis) provide a qualitative assessment concluding that the TCS upgrade does not introduce any failures that are as likely to happen as those in the SAR that can initiate an accident of a different type.

Therefore, the ANO Unit 1 TCS upgrade does not create a possibility for an accident of a different type than any previously evaluated in the ANO Unit 1 SAR.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 14 of 15

6. Create a possibility for a malfunction of a structure, system, or component D Yes important to safety with a different result than any previously evaluated in the 1:8] No UFSAR?

BASIS:

The TCS upgrade does not change the function or performance requirements of this system as described in the SAR such that the components important to safety are required to function in a different manner than currently analyzed. The worst-case malfunction of the upgrade TCS system remains a turbine trip, inadvertent turbine stop/ control valve actuation or turbine overspeed trip.

There are no new interfaces with SSCs important to safety created by this TCS upgrade. Interfaces with adjacent SSCs important to safety have been identified with the appropriate requirements being included in the design, such as separation and seismic 11/1 qualification analysis. No TCS upgrade software interfaces were identified through w_hich the TCS upgrade which could adversely impact any other equipment or functions.

The TCS upgrade SHA review did not identify any new system level hazards. The SHA evaluation of sub-system level software failures, including software common cause failures, contains malfunctions that can cause operational events that are already possible with the existing control system and plant equipment.

Conclusion The SHA when used in conjunction with the project SA and the FMEA provide a qualitative assessment concluding that the ANO Unit 1 TCS upgrade does not create a possibility for a malfunction of an SSC important to safety with a different result than any previously evaluated in the SAR. *

7. Result in a design basis limit for a fission product barrier as described in the D Yes UFSAR being exceeded or altered? 1:8] No BASIS:

The TCS is not credited with functioning to maintain any fission product barrier. The TCS is not changing plant responses or consequences of, therefore there would not be any changes to fission product barriers. The function of the TCS is unchanged by the upgrade and no new interfaces with systems that form fission product barriers are created. The TCS upgrade does not change the operating or design conditions of any system such that the challenge to a barrier is increased.

SAR Sections 4.2.5.4, 4.3 and Table 4-8A discusses design transients evaluated for fission product barrier (RPV and RCS system) and includes consideration for turbine trips from full load. By increasing the number of instruments that sense turbine parameters, EC 89300 will reduce the potential for spurious turbine trips; however, this does not impact the assumed number of full load turbine trips in this analysis.

Conclusion The TCS upgrade does not result in a design basis limit for a fission product barrier as described in the SAR as being exceeded or altered.

EN-Ll-101 R21

ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 15 of 15

8. Result in a departure from a method of evaluation described in the UFSAR used in D Yes establishing the design bases or in the safety analyses? IZ! No BASIS:

The proposed TCS upgrade involves improving the reliability of the TCS. The new system is based upon the current design and digital control strategy improvements.

The TCS upgrade does not impact the design of the turbine control valves or the performance of the valve operators. The valve response times are not credited in the design basis accidents described in Chapter 14 of the SAR. See response to Question 3 above.

The new TCS changes the method of sensing a turbine overspeed but maintains two independent and diverse overspeed protection methods as described in SAR Section 14.1.2.9 "Turbine Overspeed". The upgrade does not change the value for the maximum turbine overspeed, and this does not increase the possibility of a turbine missile to where this would be considered a design basis event.

Although the TCS upgrade replaces the mechanical overspeed trip device with a OOPS, potential failure modes introduced by the modification, such as susceptibility to Electromagnetic Interference (EMI),

firmware problems, power supply failure, and solenoid trip valve failure, have been shown by the Reliability and Fault Tree Analysis and FMEA to not adversely affect the probability of failure of the main turbine to trip upon an overspeed condition. In fact, due to eliminating the mechanical overspeed trip mechanism and trip block, which were susceptible to failure modes not applicable to the new digital system (such as mechanical linkage binding or failure and sticking dump valves due to hydraulic oil impurities), the redundancy added by the new digital system combined with the ability to test it online with relatively low risk results in similar to higher reliability than the mechanical system it replaced.

Conclusion The ANO Unit 1 TCS upgrade does not affect a method of evaluation described in the SAR and used in the safety analyses or to establish a design basis.

If any of the above questions is checked "Yes," obtain NRC approval prior to implementing the change by initiating a change to the Operating License in accordance with NMM Procedure EN-Ll-103.

EN-Ll-101 R21

Attachment 5 1CAN062302 ANO-1 and ANO-2 Commitment Change Summary Report

1CAN062302 Page 1 of 3 ANO-1 and ANO-2 Commitment Change Summary Report Commitment Changed Number Short Title Original Commitment Justification of Change Date Date Steam Generator (SG) secondary side visual inspections are generally performed in the same outage as primary side eddy current tube inspections, in part to allow for The ANO-2 Steam Generator retrieval of any foreign objects that are detected by eddy Integrity Program manages the current testing. The adoption of TSTF-577 to ANO-2 applicable aging effects for the Technical Specifications (TS) under Amendment 326 anti-vibration bars and tube (0CNA122101, ML21313A008) extended the frequency support plates. The program of primary side inspections to once every 96 effective full requires visual inspection of power months. This commitment revision updates the Maintain Steam the steam generator lower frequency of SG secondary side inspections discussed 17932 10/14/2003 05/03/2022 Generator internals (tube support in the commitment to more closely match the procedural Integrity Program structures and tube bundle). requirements found in SEP-SG-ANO-2-001 "AN0-2 This inspection is completed at Steam Generator Program" as well as the new least once every five years. frequencies for primary side inspections outlined in This inspection checks for station TS. The most recent secondary side inspection, loose parts as well as completed in 2R26, showed satisfactory condition of all corrosion and other damage in secondary side components. The results of this this region. inspection were documented under the ANO-2 SG Secondary Side Integrity Plan (EC #88433). The conclusions of the Integrity Plan support the extended frequency proposed in this commitment revision.

1CAN062302 Page 2 of 3 AN0-1 and AN0-2 Commitment Change Summary Report Commitment Changed Number Short Title Original Commitment Justification of Change Date Date At power DROPS test puts ANO-1 into conditional single-point vulnerability (CSPV) due to loss of one train of Control Rod Drive (CRD) programmer power and one of two contact closures in the turbine trip circuit.

Furthermore, plant operation is burdened with reactivity management (to maneuver plant power to 99.7%) to place the Integrated Control System (JCS) into MANUAL control in support of DROPS testing. Per the Probabilistic Safety Assessment for DROPS, PSA-AN01-01-SY-17, AN0-1 PRA-Appendix 17 - Diverse Reactor Overpressure Prevention System (DRPS),

Testing and Maintenance events and input instrumentation failures account for the principal Complete contributors to at power plant risk. Increasing at power Anticipated DROPS functional test frequency to 18 Months Transient Without minimizes the potential for plant transients and SCRAM, Scram (ATWS) Complete A TWS system as well as cost savings.

System Testing Will testing will be performed every 4243 12/16/1988 6/29/2022 Per DROPS Design Change Package, DCP-85-1042, Be Performed refueling. At power testing will Every Refueling. be performed every 6 months. "the purpose of at power DROPS test is to provide At-Power Testing assurance that the system will have the capability of Will Be Performed executing the required functions. The test verifies Every 6 Months shutdown bypass, the DSS trip function, and the AMSAC trip function. The trip test exercises the logic and the final actuation devices in each of the interface systems."

A consolidated review of the last 10-year test data reveals no significant benefit is provided by continuing to implement DROPS online testing every 6 Months; the review identified no single setpoint drift concerns and/or functional performance concerns with DROPS 1 or 2.

Furthermore, the proposed change maintains current scope of at power testing; therefore, it is not expected to impact the ability of ANO-1 to demonstrate DROPS capability to provide designed safety significant function during normal plant operations.

1CAN062302 Page 3 of 3 AN0-1 and AN0-2 Commitment Change Summary Report Commitment Changed Number Short Title Original Commitment Justification of Change Date Date This is incorrect. A review of the commitment and the regulation demonstrates that it is not tied to design changes of the cask. This commitment is independent Notify NRC of Intent of the dry fuel storage system used. The obligation is to to Utilize Casks Change Every Year Until Such simply inform the NRC of the intent to utilize casks under 3922 4/15/1993 07/12/2022 Under the General Time the Cask Design a General License. This was done in letter License 90 Days Changes 0CAN019404. This commitment needs to be revised Prior to First Use from a reoccurring commitment "R" to one that is Met or SAT.

In addition, the source document reference needs to be revised to "10 CFR 72.212(b)(1)".

The addition of the note is a corrective action from CR-Entergy Will Submit ANO-2-2022-01218 to prevent an NRC Request for Future Relief Submit Future Relief Requests Additional Information (RAI) for relief requests Requests for Every for Components in Which 90% associated with limited examinations. Specifically, any Component Coverage is Not Achieved and RAls concerning the start and end dates of an ISi 10-Examination Calculate the Percentage of year interval or the periods within that interval. For 3882 3/26/1993 08/11/2022 Performed Where Code Coverage Attained No either unit.

an Examination Later Than 12 Months After Coverage the End of the 120-Month In addition, the source reference and the first parent Percentage of 90% Interval. document are being revised to tie the commitment Is Not Achieved. (obligation) to the better reference. The new reference and source document is 10 CFR 50.55a(g)(5)(iii).

Attachment 6 1CAN062302 List of Affected SAR Pages

1CAN062302 Attachment 6 Page 1 of 2 List of Affected SAR Pages The following is a list of Safety Analysis Report (SAR) pages revised in Amendment 31 to support corrections, modifications, implementation of licensing basis changes, etc., as described in the Table of Contents of each SAR chapter (reference Enclosure 1 of this letter).

Information relocated from one page to another in support of the aforementioned revisions is not considered a change; therefore, these pages are not included in the following list. In addition, pages associated with the individual Table of Contents are not listed below as related revisions are administrative only changes.

Cover Page 3A.10-1 Figure 3A-11 6.7-11 1.4-2 . 3A.10-2 Figure 3A-12 Figure 6-10 1.4-12 3A.11-1 Figure 3A-13A 7.1-12 1.7-1 3A.11-2 Figure 3A-13B 9.7-6 1.11-9 3A.11-3 Figure 3A-13C 9.13-5 3A.1-1 3A.11-4 Figure 3A-14A 9.13-15 3A.1-2 3A.11-5 Figure 3A-14B Figure 9-3 3A.2-1 3A.11-6 Figure 3A-14C Figure 9-30 3A.3-1 3A.11-7 Figure 3A-15A 12.1-1 3A.3-2 3A.11-8 Figure 3A-15B Figure 12-1 3A.4-1 3A.11-9 Figure 3A-15C 14.2-9 3A.4-2 3A.11-10 Figure 3A-16A 14.2-10 3A.4-3 3A.11-11 Figure 3A-16B 14.2-11 3A.4-4 3A.11-12 Figure 3A-16C 14.2-22 3A.4-5 3A-11.14 Figure 3A-17 14.2-33 3A.5-1 Figure 3A-1 Figure 3A-18 14.2-34 3A.5-2 Figure 3A-2 4.2-16 14.4-6 3A.6-1 Figure 3A-3 4.2-17 14.4-7 3A.7-1 Figure 3A-4 4.3-21 14.5-9 3A.7-2 Figure 3A-5 4.3-22 14.5-11 3A.7-3 Figure 3A-6 4.3-23 14.5-12 3A.8-1 Figure 3A-7 4.3-25 14.5-16 3A.8-2 Figure 3A-8 4.6-12 14.5-29 3A.9-2 Figure 3A-9 4.6-30 Figure 14-21F 3A.9-3 Figure 3A-10 6.7-9 Figure 14-21G

1CAN062302 Page 2 of 2 Figure 14-21 H Figure 14-211 Figure 14-34 Figure 14-35 Figure 14-36 16.1-2 A.3-1 A.3-2 A.3-3

Enclosure 2 1CAN062302 ANO~1 SAR Amendment 31 Redacted Version (CD Rom) 1CAN062302 ANO-1 TRM

{CD Rom)

Enclosure 4 1CAN062302 ANO-1 TS Table of Contents and TS Bases (CD Rom)

SECURITY-RELATED INFORMATION SAR SECTIONS 2.11:1, 2.11.2, AND 2.11.3 OF ENCLOSURE 1 TO BE WITHHELD FROM PUBLIC DISCLOSURE IN ACCORDANCE WITH 10 CFR 2.390 Enclosure 1 1CAN062302 ANO-1 SAR Amendment 31 Un-redacted Version (CD Rom)

SECURITY-RELATED INFORMATION -WITHOLD UNDER 10 CFR 2.390 DOCUMENTS TRANSMITTED HEREWITH CONTAIN SENSITIVE, UNCLASSIFIED INFORMATION. WHEN SEPARATED FROM THE SENSITIVE INFORMATION, THIS DOCUMENT IS DECONTROLLED.