ML24317A110
| ML24317A110 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 11/11/2024 |
| From: | Pehrson D Entergy Operations |
| To: | Office of Nuclear Reactor Regulation, Document Control Desk |
| Shared Package | |
| ML24317A109 | List: |
| References | |
| 1CAN112401 | |
| Download: ML24317A110 (1) | |
Text
SECURITY RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 This letter is decontrolled when separated from Enclosure 1 Entergy Operations, Inc. 1448 SR 333, Russellville, AR 72802 10 CFR 50.4(b)(6) 10 CFR 50.59(d)(2) 10 CFR 50.71(e) 10 CFR 54.37(b) 1CAN112401 November 11, 2024 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001
SUBJECT:
Arkansas Nuclear One, Unit 1 (ANO-1) Safety Analysis Report (SAR)
Amendment 32, Technical Requirements Manual (TRM), Technical Specifications (TS) Bases, 10 CFR 50.59 Report, and Commitment Change Summary Report Arkansas Nuclear One, Unit 1 NRC Docket No. 50-313 Renewed Facility Operating License No. DPR-51 In accordance with 10 CFR 50.71(e) and 10 CFR 50.4(b)(6), enclosed is an electronic copy of Amendment 32 to the Arkansas Nuclear One, Unit 1 (ANO-1) Safety Analysis Report (SAR).
Included with this update is an electronic copy of the current ANO-1 Technical Requirements Manual (TRM) and the current ANO-1 Technical Specification (TS) Bases. The TS Bases file also includes the Table of Contents which outlines the contents of both the TSs and the TS Bases, since the Table of Contents is revised by the licensee in accordance with 10 CFR 50.59.
Pursuant to 10 CFR 50.71(e)(4), these documents are being submitted within six months following the previous ANO-1 refueling outage (1R31) which ended May 20, 2024. Summaries of changes to the ANO-1 TRM and TS Bases are included in Attachments 1 and 2 of this letter, respectively. The SAR, TS Bases, and TRM changes enclosed are for the period beginning June 21, 2023, and ending November 11, 2024.
In accordance with NEI 98-03, Appendix A, Section A6, a list and short description of information removed from the SAR should be included with each SAR update submittal. For this reporting period, the statement from SAR Section 2.3.2.1.2 that states the meteorological tower is supplied by " a 2.5 kVA liquid propane fueled generator " was modified to state that it was supplied by a " minimum 2.5 kVA liquid propane fueled generator " since a slightly higher capacity generator was installed after the previous generator failed and a like-for-like generator could not be found. This is acceptable since the minimum capacity of the generator as specified has been met and is adequate to power the meteorological instruments.
Associated in part with post September 11, 2001, response related to security sensitive information, Entergy has reviewed the ANO-1 SAR and determined that the following items Douglas E. Pehrson Site Vice President Arkansas Nuclear One Tel 479-858-3110
SECURITY RELATED INFORMATION-WITHHOLD UNDER 10 CFR 2.390 This letter is decontrolled when separated from Enclosure 1 1CAN112401 Page 2 of 3 contain information required to be withheld from public disclosure with respect to NRC Regulatory Issue Summary (RIS) 2015-17, "Review and Submission of Updates to Final Safety Analysis Reports, Emergency Preparedness Documents, and Fire Protection Documents."
SAR Section 2.11.1 "Maximum Probable Flood" SAR Section 2.11.2 "Failure of Upstream Dams" SAR Section 2.11.3 "Design Flood Evaluation" The above is consistent with currently redacted information from the ANO-1 SAR. Entergy requests the aforementioned information be withheld from public disclosure in accordance with 10 CFR 2.390. Accordingly, a complete version and a redacted version of the ANO-1 SAR are enclosed.
In accordance with 10 CFR 54.37(b), after a renewed license is issued, the SAR update required by 10 CFR 50.71(e) must include any systems, structures, and components (SSCs) newly identified that would have been subject to an aging management review or evaluation of time-limited aging analyses in accordance with 10 CFR 54.21. The SAR update must describe how the effects of aging will be managed such that the intended function(s) in 10 CFR 54.4(b) will be effectively maintained during the period of extended operation. No SAR changes were required with respect to 10 CFR 54.37(b) during this reporting period.
In accordance with 10 CFR 50.59(d)(2), a report containing a brief description of any changes, tests, and experiments must be submitted at intervals not to exceed 24 months. A summary of ANO-1 10 CFR 50.59 evaluations and those evaluations common between ANO-1 and ANO Unit 2 (ANO-2) associated with changes to Licensing Basis Documents over the reporting period is provided in Attachment 3. Attachment 4 contains a copy of each evaluation. contains a summary of changes to regulatory commitments which have occurred over the reporting period. includes a list of SAR pages that were updated during the period.
This letter contains no new commitments. If you have any questions or require additional information, please contact the Manager, Regulatory Assurance, Riley Keele at 479-858-7826.
I declare under penalty of perjury that the foregoing is true and correct. Executed on November 11, 2024. The changes to these documents reflect information and analyses submitted to the Commission, prepared pursuant to Commission requirements, or made under the provisions of 10 CFR 50.59.
Respectfully,
- Douglas E. Pehrson ANO Site Vice President DEP/mar
SECURITY RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 This letter is decontrolled when separated from Enclosure 1 1CAN112401 Page 3 of 3
Enclosures:
1.
ANO-1 SAR Amendment 32 - Un-redacted Version 2.
ANO-1 SAR Amendment 32 - Redacted Version 3.
ANO-1 TRM 4.
ANO-1 TS Table of Contents and TS Bases Attachments:
cc:
1.
Summary of ANO-1 TRM Changes 2.
Summary of ANO-1 TS Bases Changes 3.
Summary of ANO-1 and ANO-Common 10 CFR 50.59 Evaluations 4.
10 CFR 50.59 Evaluations - June 8*, 2023, through November 11, 2024 5.
ANO-1 and ANO-2 Commitment Change Summary Report 6.
List of Affected SAR Pages NRC Region IV Regional Administrator NRC Senior Resident Inspector - Arkansas Nuclear One NRC Project Manager - Arkansas Nuclear One Designated Arkansas State Official 1CAN112401 Summary of ANO-1 TRM Changes
1CAN112401 Page 1 of 1 Summary of ANO-1 TRM Changes The following changes to the Arkansas Nuclear One, Unit 1 (ANO-1) Technical Requirements Manual (TRM) were implemented in accordance with the provisions of 10 CFR 50.59. Because these changes were implemented without prior NRC approval, a description is provided below:
Revision #
TRM Section Description of Change 78 B 3.3.2, B 3.7.8, B 3.7.10 CR-ANO-C-2022-01583, "The TRM bases for TRO 3.3.2 Seismic Monitoring Instrumentation has conflicting statements" Licensing Basis Document Change LBDC 23-032, correct title of OP-1000.120, "ANO Fire Impairment Program" Condition Report CR-ANO-C-2023-00422, "Correct reference to Appendix R to refer to NFPA-805" 79 B 3.3.5 Engineering Change EC-89300 "Unit 1 Turbine Control System (TCS) modification. Update to the TRM Bases adds clarification that Testing Requirements apply to the new turbine speed DOPS and SDMs for overspeed protection" List of Undefined Acronyms DOPS Diverse Overspeed Protection System NFPA National Fire Protection Association SDM Speed Detector Module TRO Technical Requirement for Operation 1CAN112401 Summary of ANO-1 TS Bases Changes
1CAN112401 Page 1 of 1 Summary of ANO-1 TS Bases Changes The following changes to the Arkansas Nuclear One, Unit 1 (ANO-1) Technical Specification (TS) Bases were implemented in accordance with the provisions of 10 CFR 50.59 and the Bases Control Program of ANO-1 TS 5.5.14. Because these changes were implemented without prior NRC approval, a description is provided below:
Revision #
TS Bases Section Description of Change 81 B 3.3.1, B 3.4.1 TS Amendment 280, "Removal of Technical Specification Condition Allowing Two Reactor Coolant Pump Operation" 82 B 3.3.1, B 3.3.5, B 3.3.6, B 3.3.8. B 3.3.10, B 3.3.11, B 3.3.12, B 3.3.13, B 3.3.14, B 3.5.2, B 3.6.2, B 3.6.3, B 3.6.5, B 3.7.2, B 3.7.5, B 3.7.7, B 3.8.1, B 3.8.4, B 3.8.7, B 3.8.9 TS Amendment 281, "Revision to Technical Specifications to Adopt TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSF Initiative 4b" License Basis Document Change LBDC 23-031, "Technical Specification Bases for SR 3.3.1.4 requires update to reflect SFCP" License Basis Document Change LBDC 23-035, "Align TS 3.3.5 bases with SFCP" License Basis Document Change LBDC 24-004, "Align Technical Specification Surveillance Requirements bases with SFCP" 83 B 3.3.1, TS Amendment 282, "Turbine Control System Upgrade" 84 B 3.7.9 License Basis Document Change LBDC 24-032, "Unit 1 TS Bases for SR 3.7.9.1 surveillance frequency is being changed in accordance with the SFCP. The words 'on a monthly basis' are being replaced with 'on a regular basis' due to the SR being controlled under the SFCP" List of Undefined Acronyms CR Condition Report RITSF Risk-Informed Technical Specification Task Force SFCP Surveillance Frequency Change Program SR Surveillance Requirement TSTF Technical Specification Task Force 1CAN112401 Summary of ANO-1 and ANO-Common 10 CFR 50.59 Evaluations
1CAN112401 Page 1 of 1 Summary of ANO-1 and ANO-Common 10 CFR 50.59 Evaluations 50.59 #
50.59 Summary 2023-002 "ANO 1 Install Microprocessor Relay & Activate Out of Step Function and Loss of Field with Two Zone Protection" / EC-88911 2023-003 "Evaluation of Extending Main Turbine Valve Testing Intervals [ANO-1 and 2]" /
EC-93373 2024-001
"[Temporary Change] Integrated Control System: Runback on Loss of a Single RCP Disabled" / EC 0054105613 List of Undefined Acronyms ANO Arkansas Nuclear One EC Engineering Change RCP Reactor Coolant Pump 1CAN112401 10 CFR 50.59 Evaluations - June 8*, 2023 through November 11, 2024 31 Pages
- NOTE: FFN-2023-002 was approved prior to the last ANO-1 50.59 report, which was October 6, 2021, through June 21, 2023, but was not included. The modification has not been installed in the plant, nor has it been incorporated into the current Safety Analysis Report.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 1 of 13 EN-LI-101 R21 I.
OVERVIEW / SIGNATURES1 Facility: Arkansas Nuclear One Unit 1 Evaluation # / Rev. #: ___________________
Proposed Change / Document:
ANO 1 Install Microprocessor Relay & Activate Out of Step Function and Loss of Field with Two Zone Protection / EC 88911 Description of Change:
The subject Engineering Change replaces the existing original equipment manufacturer (OEM) electromechanical Loss of Field (LOF) protective relay with two new redundant multi-function microprocessor-based protective relays to perform the protection needed for the main generator.
The new multi-function relays are configured to provide redundancy for individual protection functions, i.e., for Loss of Field and newly added Out of Step (OOS), in a two-out-of-two (2oo2) arrangement.
EC 88911 adds the new OOS generator protection function as an enhancement that provides an added level of protection that wasnt accounted for previously based on Transmission requirements.
The purpose of OOS relaying is to separate two areas of a power system, or two interconnected systems, when synchronism is lost to avoid equipment damage or a system-wide shutdown (i.e.,
blackout).
Summary of Evaluation:
Process Applicability Determination (PAD)
A PAD was performed to assess the ANO Unit 1 LOF upgrade and addition of the OOS protection function for EC 88911. The results of the PAD identify that the following portions of the change requiring additional evaluation:
- Added OOS Protective Function
- Added 2oo2 Logic This evaluation is based on the following issues:
Addition of OOS Protective Function:
The Generator Excitation System provides the equipment and controls necessary to establish and maintain the field of the Main Generator. In addition to the protection provided by the Main Generator Excitation system, protective relays are also installed to reduce the risk of damage to the Main Generator.
An LOF relay is included in the generator protection package to protect the rotor from damage during under-excited operation. The existing non-safety related electromechanical LOF relay is being replaced with two redundant digital microprocessor-based relays enabling a two-zone protection scheme which satisfies IEEE Standard C37.102-2006. Each of the two new relays employs the two-zone protection scheme. The zone 1 setting is more restrictive and trips through a 0.08-sec timer. It provides fast clearing on loss of field, and it is secure against swings. The zone 2 setting is wider and drives a 0.50-sec timer to detect partial loss of field and provide backup to the zone 1 setting. Relay timer setpoint is determined in accordance with the criteria in NERC Standard PRC-026-1. This ensures that a plant trip does not occur during a stable power swing under non-fault conditions. The time delays allow the system FFN-2023-002
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 2 of 13 EN-LI-101 R21 to restore itself to a steady-state condition. This will align ANO Unit 1 with the North American Electric Reliability Corporation (NERC) standard PRC-026-1 Relay Performance During Stable Power Swings.
The LOF relay provides an output to Generator Lockout Relays 286-G1-1, 286-G1-2, and 286-G1-3 to trip the generator and turbine on a LOF event. The relay also provides an output to drive the GEN RELAYS TRIP alarm (Window A7) on Annunciator Panel KC20, which initiates main annunciator K04-A8 GENERATOR L.O. RELAY TRIP.
The replacement digital microprocessor-based relays also include the OOS protection function. OOS is a condition where a generator experiences a large increase in the angular difference of the Electro Motive Force (EMF) with other generators or portions of a system to which it is connected, usually following a major power system disturbance. OOS protection continually measures generator terminal bus voltage to identify changes which may indicate conditions that would likely lead to loss of synchronism, i.e.,
differences between generator output frequency and transmission line frequency due to generator pole slippage. The generator protection OOS function is set to operate to isolate equipment in order to limit the extent of damage when operating conditions exceed equipment capabilities or stability limits (steady and transient). As such, the OOS function is solely to protect the generator. The OOS function employs the one-zone protection scheme with different settings than the LOF relay to ensure that a plant trip does not occur during a stable power swing under non-fault conditions. The newly added OOS function is an enhancement that provides added generator protection. The added OOS function has no impact on accident mitigation or the consequences of an accident.
Based on the guidance of NEI 96-07 Appendix D, the PAD has determined that the relay replacement is considered a simple digital upgrade replacement and is not considered an adverse change. Therefore, the upgrade to a digital relay is not considered to adversely affect the function of the generator protection scheme and is not further evaluated.
Addition of 2oo2 Logic:
The existing OEM electromechanical LOF relay provides a single output to trip the Generator Lockout Relays. The replacement digital microprocessor-based relay performs the same function for both the LOF and the OOS functions utilizing a 2oo2 trip logic scheme, requiring two LOF trip signals or two OOS trip signals in order to trip the Generator Lockout Relays.
The existing contact arrangement is a normally open contact that closes on a loss-of-field condition to energize the lockout relays. This modification adds two digital microprocessor-based relays (i.e., one primary and one backup), similar in function to the existing relay, to duplicate the number of contacts to energize the lockout relays. The replacement LOF/OOS relays retain the same lockout relay trip scheme with redundancy such that both relays output contact closures are required to energize the lockout relays to trip the generator (i.e., 2oo2 arrangement). This arrangement ensures that a functional failure of the relay will not result in a spurious trip, as it is not a fail-safe relay. During normal operating conditions, the existing electromechanical LOF relay output contact remains open, but has a vulnerability of not closing when required to provide LOF protection. CALC-ANOC-SE-15-00001 identifies that the failure mode of interest for the LOF relay is for it to spuriously trip due to setpoint drift, i.e., output contact closes when not intended to. The non-fail-safe trip scheme is mitigated by installing bypass switches in parallel with the trip contacts of each relay. Through the use of new bypass switches installed by this EC on the same panel, either relays trip contacts may be bypassed if that respective relay fails. This ensures that a trip can still occur if a fault condition exists. The bypass switch allows the failed relay to be placed in a tripped condition, while the remaining operable relay continues to provide protection, i.e., in a one-out-of-one (1oo1) condition or half-trip state, while the failed relay is repaired/replaced. This scenario is the same as the existing condition. This ensures that a trip can still occur if a fault condition exists and ensures that a functional failure of one relay does not result in a spurious trip.
Other possible failure modes of the existing electromechanical relay include an open coil and stuck output contacts. Either of these would cause a failure of the relay to operate under an actual LOF/OOS
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 3 of 13 EN-LI-101 R21 condition. Digital microprocessor-based relays do not have the risk of setpoint drift as the setpoint is configured and maintained by internal software, resulting in a high accuracy of 0.1%. Per the vendor information there is a low likelihood of a failure. The vendors OOS relay has extensive applicable operating history and is used throughout the industry. There is reasonable assurance that the relatively simple digital architecture is stable and performs as required. Unlike electromechanical relays, digital microprocessor-based relays do not operate with coils, and as such, there is no possibility of an open/short coil condition. Furthermore, based on vendor information, the relay employs a loss of potential function such that if an input from a CT/PT is lost (or if a blown fuse occurs), it is detected and prevents operation, i.e., it does not initiate a generator trip. Therefore, an internal failure of the relay or loss of external inputs would not cause a trip condition under any circumstance, thus eliminating this as a cause for a spurious trip. The worst case scenario would be a loss of trip function. However, this modification adds bypass switches, which mitigates this unlikely condition. Through the use of new bypass switches installed by this EC on the same panel, either relays trip contacts may be bypassed if that respective relay fails. This ensures that a trip can still occur if a fault condition exists.
The protective relay upgrade does not change plant operating parameters that would result in an increased challenge to systems, structures or components (SSCs) important to safety, or the frequency of any accident described in the SAR.
No new failure modes that could cause a plant transient or a turbine/generator trip were identified for the replacement relay. The protective relay upgrade reduces the number of failure modes and adds redundancy while maintaining the existing design function of generator protection. Failure modes associated with the existing electromechanical relay (such as open coil and stuck output contacts) are eliminated with the new digital microprocessor-based relay.
Based upon this evaluation this modification can be implemented without license amendment.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 4 of 13 EN-LI-101 R21 Is the validity of this Evaluation dependent on any other change?
Yes No If Yes, list the required changes/submittals. The changes covered by this 50.59 Evaluation cannot be implemented without approval of the other identified changes (e.g., license amendment request). Establish an appropriate notification mechanism to ensure this action is completed._________________________________________________________________________
Based on the results of this 50.59 Evaluation, does the proposed change require prior NRC approval?
Yes No Preparer2:
Al Evans /
/ Kinectrics / Civil-Structural / 2-2-2023 Name (print) / Signature / Company / Department / Date Reviewer2:
Name (print) / Signature / Company / Department / Date Independent Review3:
N/A Name (print) / Signature / Company / Department / Date Responsible Manager Concurrence:
Name (print) / Signature / Company / Department / Date 50.59 Program Coordinator Concurrence:
Name (print) / Signature / Company / Department / Date OSRC:
Chairmans Name (print) / Signature / Date [GGNS P-33633, P-34230, & P-34420; W3 P-151]
OSRC Meeting #
1 The printed name should be included on the form when using electronic means for signature or if the handwritten signature is illegible. Signatures may be obtained via electronic authentication, manual methods (e.g., ink signature), e-mail, or telecommunication. Signing documents with indication to look at another system for signatures is not acceptable such as See EC or "See Enterprise Asset Management (EAM) Application."
Electronic signatures from other systems are only allowed if they are included with the documentation being submitted for capture in eB (e.g., if using an e-mail, attach it to this form; if using Enterprise Asset Management (EAM) Application, attach a screenshot of the electronic signature(s); if using Corrective Action Program (CAP)
Application, attach a copy of the completed corrective action).
2 Either the Preparer or Reviewer will be a current Entergy employee.
3 If required by Section 5.1[2].2 Either the Preparer or Reviewer will be a current Entergy employee.
Brad Miller/
/EOI/ DE Elec/ 2-27-23 T.Hatfield/
/EOI/Design Eng./2-27-23 Michael Hall /
/EOI/Regulatory Assurance/
2-27-23 OSRC-2023-016 Digitally signed by Brad Miller DN: cn=Brad Miller, c=US, o=ANO Electrical Design, ou=Entergy Operations Inc.,
email=jmille3@entergy.com Date: 2023.02.27 11:29:59 -06'00' Brad Miller Digitally signed by Thomas A. Hatfield II DN: cn=Thomas A. Hatfield II, c=US, o=Entergy - ANO, ou=Design Engineering, email=thatfie@entergy.com Date: 2023.02.27 16:05:54 -06'00' Thomas A.
Hatfield II Digitally signed by Michael Hall DN: cn=Michael Hall, c=US, o=Entergy Operations Inc., ou=ANO Regulatory Assurance, email=mhall10@entergy.com Date: 2023.02.27 16:12:11 -06'00' Michael Hall Brian Patrick Digitally signed by Brian Patrick Date: 2023.06.08 13:30:45 -05'00'
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 5 of 13 EN-LI-101 R21 II.
50.59 EVALUATION [10 CFR 50.59(c)(2)]
Does the proposed Change being evaluated represent a change to a method of evaluation ONLY? If Yes, Questions 1 - 7 are not applicable; answer only Question 8.
If No, answer all questions below.
Yes No Does the proposed Change:
1.
Result in more than a minimal increase in the frequency of occurrence of an accident previously evaluated in the UFSAR?
Yes No BASIS:
The new OOS generator protection feature has been evaluated to assure that it will not more than minimally increase the frequency of the main generator and turbine trip.
The ANO Unit 1 SAR Chapter 14 identifies the main generator and turbine trip to occur due to the following initiating events and transients:
SAR Section 14.1.2.8: Loss of Electric Power SAR Section 14.2.2.1: Steam Line Failure SAR Section 14.2.2.2: Steam Generator Tube Failure The added OOS function is an enhancement that provides added generator protection. The replacement digital microprocessor-based relays perform the same function for both the LOF and the OOS.
Addition of OOS Protective Function The existing OEM electromechanical relay is classified as a Single Point Vulnerability (SPV) due to the possibility of setpoint drift to a point where an unanticipated trip could occur. Other possible failure modes include an open coil and stuck output contacts. Either of these would cause a failure of the relay to operate under an actual LOF condition. Digital microprocessor-based relays do not have the risk of setpoint drift as the setpoint is configured and maintained by internal software, resulting in a high accuracy of 0.1%. Per the vendor Product Quality Report QDA-8004, the Mean Time Between Failures (MTBF) is 870 years (7,621,200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br />) with an annualized failure rate of 0.11%. Thus, the likelihood of a failure is very unlikely. The vendors OOS relay has extensive applicable operating history and is used throughout the industry. There is reasonable assurance that the relatively simple digital architecture is stable and performs as required. Unlike electromechanical relays, digital microprocessor-based relays do not operate with coils, and as such, there is no possibility of an open/short coil condition. Furthermore, based on vendor information, the relay employs a loss of potential function such that if an input from a CT/PT is lost (or if a blown fuse occurs), it is detected and prevents operation, i.e., it does not initiate a generator trip. Therefore, an internal failure of the relay would not cause a trip condition under any circumstance, thus eliminating this as a cause for a spurious trip. The worst case scenario would be a loss of trip function. However, this modification adds a redundant relay along with bypass switches, which mitigates this unlikely condition. The bypass switch allows the failed relay to be placed in a tripped condition, while the remaining operable relay continues to provide protection, i.e., in a one-out-of-one (1oo1) condition or half-trip state, while the failed relay is repaired/replaced. This scenario is the same as the existing condition. This ensures that a trip can still occur if a fault condition exists and ensures that a functional failure of one relay does not result in a spurious trip.
The existing electromechanical relay was susceptible to failure modes not applicable to the new digital microprocessor-based relay (such as open coil and stuck output contacts). The redundancy added by the new relays. combined with the ability to test them online with relatively low risk, results in similar to higher
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 6 of 13 EN-LI-101 R21 reliability than the electromechanical relay it replaced. The OOS function provides additional generator protection, higher reliability with built-in fault tolerance and does not cause a generator trip upon failure.
The added OOS function provides generator protection by initiating a generator trip (and subsequent turbine trip, at a minimum, with a reactor trip possible depending on other plant conditions such as plant power) if a valid fault were to occur. The frequency of generator trips would be no more of a minimal increase than if it were not installed, as the other protective relays (e.g., Backup Impedance Relay (221))
would have provided the same level of protection and result in a generator trip albeit later in time. The Backup Impedance (Generator Distance Backup Protection) (221) relay is set up to reach the 22KV winding of the Main Transformer, providing back up protection for faults in the leads between the Generator and the transformer. It provides back up protection for the Generator from external faults not cleared by the ANO Switchyard 500 kV primary relaying.
Addition of 2oo2 Logic This modification adds additional trip inputs to the existing Generator Lockout Relays trip scheme. While the apparent potential for a spurious trip from the existing electromechanical relay seems to increase as a result of this EC due to the increase in trip initiators, the existing contact arrangement is a normally open contact that closes on an LOF (or OOS) condition to energize the lockout relays. The replacement LOF/OOS relay retains the same lockout relay trip scheme with redundancy such that both relays output contact closures are required to energize the lockout relays to trip the generator (i.e., 2oo2 arrangement).
This arrangement ensures that a functional failure of the relay will not result in a spurious trip, as it is not a fail-safe relay. This modification is being implemented to reduce the potential of a spurious trip during a stable power swing under a non-fault condition (as described by NERC PRC-026-1) by incorporating a time delay. This allows the system to restore to a steady state condition before a trip would occur. For each protection circuit, the relays are divided between separate output contacts that are wired in series.
The redundant LOF outputs are wired in series with the primary LOF outputs, providing a 2oo2 trip logic.
For the OOS function, two normally opened contacts (one from each relay) are wired in series to also provide a 2oo2 trip logic. A new annunciator window GEN LOF/OOS RELAY LOSS OF POTENTIAL (K04-E8) is added to provide Operations an alarm on either a loss of power to the relay or a loss of voltage input, which is indicative of a faulted relay. Through the use of new bypass switches installed by this EC on the same panel, either relays trip contacts may be bypassed if that respective relay fails. This ensures that a trip can still occur if a fault condition exists. The bypass switch allows the failed relay to be placed in a tripped condition, while the remaining operable relay continues to provide protection, i.e., in a one-out-of-one (1oo1) condition or half-trip state, while the failed relay is repaired/replaced. This scenario is the same as the existing condition. This ensures that a trip can still occur if a fault condition exists and ensures that a functional failure of one relay does not result in a spurious trip.
The new relays use three phase current inputs and three phase voltage inputs, as opposed to the single-phase current input used by the existing relay. This reduces the potential for an unintended trip.
Additionally, the digital relay has an adjustable time delay, which allows the relay to withstand stable power swings during non-fault conditions. The trip output scheme is a normally open contact that closes on a fault condition, and thus a failure of the relay itself will not cause a trip.
The existing relay is wired using three potential transformer (PT) inputs (one per phase) plus a ground, and one current transformer (CT) input plus a ground. The replacement primary LOF/OOS relay is wired using the same PT inputs and ground and utilizes three CT inputs (one per phase) plus ground. The replacement redundant LOF/OOS relay utilizes the same input scheme but is tapped off of separate PTs and CTs, thus eliminating any potential operational failures due to failure of upstream components (i.e.,
PTs/CTs). The redundant LOF/OOS outputs are wired in series (one output contact from each relay) to provide the two-zone protection scheme described above. Power to the primary relay is provided by 120VAC Panel RS2, using the existing Turbine Generator Trip circuit (CKT 18). Power to the redundant relay is provided by 120VAC Panel RS3 using spare circuit 14 (20A breaker). Thus, redundant power sources are used to protect the generator under fault conditions. A separate set of contacts are wired to
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 7 of 13 EN-LI-101 R21 an existing auxiliary relay (for LOF) and a new auxiliary relay (for OOS) that will drive the existing common relay trip alarm and a dedicated computer point.
Conclusion This evaluation finds the new design to provide an enhancement to the reliability with respect to the generator protection system. The protective relay upgrade reduces the number of failure modes and adds redundancy while maintaining the existing design function of generator protection. This improves the generator protection reliability and minimizes the probability of spurious turbine/generator trips.
The added OOS function, along with the redundant 2oo2 arrangement, assures that a single relay will neither result in loss of necessary generator protection, nor will failure of an individual relay cause the generator to trip or cause a plant transient. The existing relay is not fault tolerant and does not provide fault detection and failure response capability.
In conclusion, there is a sufficiently low likelihood that the new relays will result in an increase in the frequency of occurrence of an accident previously evaluated in the SAR.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 8 of 13 EN-LI-101 R21
- 2.
Result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the UFSAR?
Yes No BASIS:
The generator protection function is not credited for any ANO Unit 1 Chapter 14 SAR transient or accident analyses. The worst-case malfunction of the upgraded protective relays remains a main generator and turbine trip.
No new failure modes that could cause a plant transient or a turbine/generator trip were identified for the replacement relay. The protective relay upgrade reduces the number of failure modes and adds redundancy while maintaining the existing design function of generator protection. Failure modes associated with the existing electromechanical relay (such as open coil and stuck output contacts) are eliminated with the new digital microprocessor-based relay. Unlike electromechanical relays, digital microprocessor-based relays do not operate with coils, and as such, there is no possibility of an open/short coil condition. The replacement relay has extensive applicable operating history and is used throughout the industry. There is reasonable assurance that the relatively simple digital architecture is stable and performs as required.
Electromechanical relays, compared to digital microprocessor-based relays, are more susceptible to contact chatter as a result of being subjected to seismic events or vibration. The relay upgrade relies on solid state outputs and does not employ mechanical means to close contact outputs. The replacement relay withstands vibration, electrical surges, fast transients, and extreme temperatures, meeting stringent industry standards. This reduces the likelihood of malfunction.
A concern with electromechanical relay failure is due to the possibility of setpoint drift to a point where an unanticipated trip could occur. Digital microprocessor-based relays do not have the risk of setpoint drift compared to existing electromechanical relays as the setpoint is configured and maintained by internal software, resulting in a high accuracy of 0.1%. Per the vendor Product Quality Report QDA-8004, the Mean Time Between Failures (MTBF) is 870 years (7,621,200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br />) with an annualized failure rate of 0.11%. Thus, the likelihood of a failure is very unlikely and not more than a minimal increase of malfunction due to setpoint drift.
Electromechanical relays are more susceptible to failure because the mechanism that closes the contact (coil) is constantly being applied voltage and the resistance of that coil has the possibility of changing overtime. This is not the case with the replacement relay.
The generator protection scheme for these relays relies on a normally open contact to close to energize the Generator Lockout Relays when fault conditions exist. This arrangement ensures that a functional failure of the relay will not result in a spurious trip, as it is not a fail-safe relay. The addition of a 2oo2 redundant trip scheme provides added reliability to protect the generator during faults without increasing the malfunction of the generator, i.e., initiating a trip. Thus the likelihood of occurrence of a malfunction has not more than minimally increased with the relay upgrade as it functions similarly.
The replacement relay utilizes added three-phase CT inputs compared to only one phase for the existing relay, which improves reliability. Power to the redundant relays is provided by separate redundant sources, also improving reliability to prevent a malfunction if one was unable to provide generator protection when required.
Failure modes are bounded by the existing analysis. The addition of a protective device would not cause more than a minimal increase in the likelihood of a malfunction of the generator.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 9 of 13 EN-LI-101 R21 This modification improves the generator protection reliability and minimizes the probability of spurious turbine/generator trips. The upgrade has eliminated failure modes of the existing relay.
Conclusion With the failure likelihood introduced by the added OOS function and 2oo2 logic being sufficiently low, there is not more than a minimal increase in the likelihood of occurrence of a malfunction of an SSC important to safety previously evaluated in the SAR.
- 3.
Result in more than a minimal increase in the consequences of an accident previously evaluated in the UFSAR?
Yes No BASIS:
The turbine/generator trip function is not credited for any ANO Unit 1 Chapter 14 SAR transient or accident analyses.
The turbine/generator has no function for accident mitigation or limiting the consequences of an accident.
Also, the function and performance of the generator protection, as described in the SAR, is not being changed.
The existing electromechanical LOF relay is being replaced with one of similar functionality with an added OOS protection function. Redundancy is added such that any one of two redundant relays can provide necessary generator protection during fault conditions, while ensuring that a plant trip does not occur during a stable power swing under non-fault conditions.
The modified 2oo2 trip scheme configuration provides two independent relays for generator protection employing diverse power supplies, which also adds reliability.
The relay upgrade and added OOS protection function has no impact on the radiological consequences of an accident.
As described in SAR Section 14.1.2.8, the unit is designed to withstand the effects of loss of electric load or electric power. This section, along with Sections 14.2.2.1 and 14.2.2.2, describe that a turbine trip is assumed to be a result of the accident/transient in the accident analyses. These accident analyses address the worst-case conditions and are bounding scenarios.
Conclusion The protection relay upgrade and addition of an OOS function does not result in more than a minimal increase in the consequences of an accident previously evaluated in the ANO Unit 1 SAR.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 10 of 13 EN-LI-101 R21
- 4.
Result in more than a minimal increase in the consequences of a malfunction of a structure, system, or component important to safety previously evaluated in the UFSAR?
Yes No BASIS:
The relay upgrade is a reliability enhancement to the existing generator protection system described in the SAR. The protection relay upgrade does not change the function or performance requirements for the system as described in the SAR. The generator protection OOS function is set to operate to isolate equipment in order to limit the extent of damage when operating conditions exceed equipment capabilities or stability limits (steady and transient). As such, the OOS function is solely to protect the generator. The relay upgrade does not increase any plant operating parameters that would result in increased challenges to components important to safety. There are no new interface requirements with SSCs important to safety that function to limit the consequences of an accident established by this upgrade.
The turbine/generator trip function is not credited for any ANO Unit 1 Chapter 14 SAR transient or accident analyses. As described in SAR Section 14.1.2.8, the unit is designed to accommodate a loss of electric load without a reactor or turbine trip. This section describes that a turbine trip is assumed to be the result of the accident/transient in the accident analyses. These accident analyses address the worst-case conditions and are bounding scenarios.
Conclusion The protection relay upgrade does not result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the SAR.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 11 of 13 EN-LI-101 R21
- 5.
Create a possibility for an accident of a different type than any previously evaluated in the UFSAR?
Yes No BASIS:
Impact on Existing Accident Analysis Applicable safety analyses identified and their related ANO SAR sections include:
- Loss of Electric Power - SAR Section 14.1.2.8 The current safety analysis states that the unit is designed to withstand the effects of loss of electric load or electric power, and that the unit has been designed to accommodate a loss-of-load condition without a reactor or turbine trip. The turbine trip function is not credited for any ANO Unit 1 Chapter 14 SAR transient or accident analyses except for mitigating missiles due to an overspeed event. The safety analysis describes that a generator trip is possible due to protective relaying schemes without initiating a turbine trip. Under such circumstances, a runback signal causes an automatic power reduction to 15 percent reactor power. Therefore, the turbine trip remains the worst-case initiator of the current bounding Chapter 14 accident analyses related to the main turbine and generator.
The only output interface that the protective relays have to SSCs is to the Generator Lockout Relays 286-G1-1, 286-G1-2, and 286-G1-3 that trip the generator. Power to the redundant relays is provided by existing 120VAC Panels RS2 and RS3. Breakers are provided upstream of the protective relays to limit currents that would protect other RS2/RS3 loads and upstream sources in the event of a short circuit.
The protective relay upgrade does not involve any new operating interfaces or parameter changes that would impact systems associated with initiation of an accident (reactivity control, reactor pressure boundary, or core cooling) other than the currently analyzed turbine trip event. No new system-level hazards or failure modes have been identified that would create a possibility for an accident of a different type or impact plant SAR analyses.
No new failure modes that could cause a plant transient or a turbine/generator trip were identified for the replacement relay. The protective relay upgrade reduces the number of failure modes and adds redundancy while maintaining the existing design function of generator protection. Failure modes associated with the existing electromechanical relay (such as open coil and stuck output contacts) are eliminated with the new digital microprocessor-based relay. Unlike electromechanical relays, digital microprocessor-based relays do not operate with coils, and as such, there is no possibility of an open/short coil condition. Digital microprocessor-based relays do not have the risk of setpoint drift compared to existing electromechanical relay as the setpoint is configured and maintained by internal software, resulting in a high accuracy of 0.1%. The replacement relay has extensive applicable operating history and is used throughout the industry. There is reasonable assurance that the relatively simple digital architecture is stable and performs as required.
The protection relay upgrade, addition of an OOS function and added 2oo2 trip scheme has the limiting consequence of a spurious generator or turbine trip which is an analyzed event. Therefore, this evaluation determines that the results of potential relay upgrade failures are enveloped by the current SAR Chapter 14 analyses.
This evaluation finds the new design to provide an enhancement to the reliability of the new system with respect to the original generator protection system. By increasing the number of redundant relays and adding an OOS protection function, the change increases redundancy and reliability, eliminates multiple failure modes and this modification will reduce the potential for spurious turbine trips and equipment failures.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 12 of 13 EN-LI-101 R21 Conclusion Therefore, the ANO Unit 1 protection relay upgrade does not create a possibility for an accident of a different type than any previously evaluated in the ANO Unit 1 SAR.
- 6.
Create a possibility for a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the UFSAR?
Yes No BASIS:
The protection relay upgrade does not change the function or performance requirements of the generator protection system as described in the SAR such that the components important to safety are required to function in a different manner than currently analyzed. The worst-case malfunction of this upgrade remains a turbine trip.
There are no new interfaces with SSCs important to safety created by the addition of redundant protective relays. New power to the added redundant relay is provided by 120VAC Panel RS3. A breaker is included in the design to provide isolation and to limit the potential for disturbance to all other loads from that panel in case of high fault current. Interfaces with adjacent SSCs important to safety have been identified with the appropriate requirements being included in the design, such as separation and seismic II/I qualification analysis. No other interfaces were identified through which the protection relay upgrade could adversely impact any other equipment or functions.
No new failure modes that could cause a plant transient or a turbine/generator trip were identified for the replacement relay. The protective relay upgrade reduces the number of failure modes and adds redundancy while maintaining the existing design function of generator protection. Failure modes associated with the existing electromechanical relay (such as open coil and stuck output contacts) are eliminated with the new digital microprocessor-based relay.
The turbine trip function is not credited for any ANO Unit 1 Chapter 14 SAR transient or accident analyses.
Conclusion This modification does not create a possibility for a malfunction of an SSC important to safety with a different result than any previously evaluated in the SAR.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 13 of 13 EN-LI-101 R21
- 7.
Result in a design basis limit for a fission product barrier as described in the UFSAR being exceeded or altered?
Yes No BASIS:
The generator is not credited with functioning to maintain any fission product barrier. The generator is not changing plant responses or consequences of, therefore there would not be any changes to fission product barriers. The function of the generator protection system is unchanged by the upgrade and no new interfaces with systems that form fission product barriers are created. The protection relay upgrade does not change the operating or design conditions of any system such that the challenge to a barrier is increased.
SAR Sections 4.2.5.4, 4.3 and Table 4-8A discuss design transients evaluated for fission product barrier (RPV and RCS system) and includes consideration for turbine trips from full load. By increasing the number of redundant relays and adding an OOS protection function, the change increases redundancy and reliability, eliminates multiple failure modes and this modification will reduce the potential for spurious turbine/generator trips and equipment failures.
Conclusion The protection relay upgrade does not result in a design basis limit for a fission product barrier as described in the SAR as being exceeded or altered.
- 8.
Result in a departure from a method of evaluation described in the UFSAR used in establishing the design bases or in the safety analyses?
Yes No BASIS:
The proposed protection relay upgrade provides an enhancement to the reliability with respect to the generator protection system. The protective relay upgrade reduces the number of failure modes and adds redundancy while maintaining the existing design function of generator protection. This improves the generator protection reliability and minimizes the probability of spurious turbine/generator trips. The new system is based upon the current design and digital control strategy improvements.
Conclusion The ANO Unit 1 protection relay upgrade does not affect a method of evaluation described in the SAR and used in the safety analyses or to establish a design basis.
If any of the above questions is checked Yes, obtain NRC approval prior to implementing the change by initiating a change to the Operating License in accordance with NMM Procedure EN-LI-103.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 1 of 3 EN-LI-101 R22 I.
OVERVIEW / SIGNATURES1 Facility: Arkansas Nuclear One, Units 1 & 2 Evaluation # / Rev. #: 1 Proposed Change / Document: EC-93373 Description of Change: EC-93373 performs the engineering evaluation to support the extension of the test intervals associated with the ANO-1&2 turbines, specifically:
x ANO-1 throttle valves (TVs) and governor valves (GVs);
x ANO-2 stop valves (SVs), control valves (CVs), and combined intermediate valves (CIVs).
These valves are key elements of the turbine overspeed protection system (OPS) for their respective units due to their function and use in terminating steam flow to the high pressure (HP) and low pressure (LP) turbines. Prompt and effective termination of steam flow to the main turbine during a load separation event leading to a turbine overspeed conditions limits the potential that turbine missiles can be generated as a result of turbine rotor components failure.
The engineering evaluation is homogenous for both units: that is, to follow the methodology set forth in Regulatory Guide 1.115, Rev. 2, which states that safe and reliable operation is ensured if the probability of missile genesis from each units turbine (P1) is kept below an acceptance criteria of 1E-5 per year. New P1 values have been developed for each units turbine in accordance with previously existing methodology; a sensitivity study is then performed to reduce existing margin between each units P1 value and the acceptance criteria to allow for the extension of test interval.
The basis of this sensitivity study is to elongate the period between test intervals and examine the effect it has on P1 via reliability theory.
For ANO-1, the GVs and TVs are currently tested at a six month interval; this work allows for an extension of these tests up to eighteen months. No attempt is made in this work to alter the current ANO-1 test interval for these valves - but this activity lays the groundwork to pursue this extension at a later date.
For ANO-2, the SVs, CVs, and CIVs are tested at a four month interval; this work allows for an extensions of these tests up to eight months. This work goes on to alter the current ANO-2 test interval for these valves, pursuing the appropriate procedure changes and a change to the current ANO-1 Technical Requirements Manual (ANO-1 TRM).
In accordance with industry best practices, the test interval extensions are expected to be staggered, i.e. while an eight month extension is demonstrated to be acceptable with this work, an increase to six months must be had prior to ensure performance degradation does not occur. The same is valid for ANO-1, when and if that extension is pursued.
This activity will not impact the ANO-1 SAR, which addresses turbine overspeed qualitatively in 14.1.2.9, referencing the original Cycle 1 turbine overspeed analysis, concluding turbine overspeed is not a credible accident sequence. Work in 1R8 and 1R14 added additional 1
The printed name should be included on the form when using electronic means for signature or if the handwritten signature is illegible. Signatures may be obtained via electronic authentication, manual methods (e.g., ink signature), e-mail, or telecommunication. Signing documents with indication to look at another system for signatures is not acceptable such as See EC or "See Enterprise Asset Management (EAM) Application." Electronic signatures from other systems are only allowed if they are included with the documentation being submitted for capture in eB (e.g., if using an e-mail, attach it to this form; if using Enterprise Asset Management (EAM) Application, attach a screenshot of the electronic signature(s); if using Corrective Action Program (CAP) Application, attach a copy of the completed corrective action).
ANO-2 ANO-2 condition limits the potential that EC-93379, "Evaluation of Extending Main Turbine Valve Testing Intervals" FFN-2023-003
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 2 of 3 EN-LI-101 R22 conservatism to this analysis with fully/partially integrated rotor upgrades to the 1 and 2 section LP rotors. This work is revisited each cycle during the ANO-1 reload, via the ANO-1 Reload Technical Document.
This activity does, however, impact the ANO-2 SAR, which addresses turbine overspeed quantitatively in Section 3.5.2.2 & 10.2.3, specifically stating missile probabilities; the test interval is also explicitly defined in the ANO-2 TRM. As a result, an LBDCR is issued for this work.
Revision 1 of this 50.59 Evaluation addresses a concern from ANO Licensing regarding the consequences of valve failure, discussed in Questions 3 & 4specifically, the hypothetical scenario that the unit is operating with Technical Specification limits for primary activity and primary-to-secondary leakage. That position would render the secondary fluid radioactive, and therefore, an unmitigated turbine overspeed event would yield a radiological consequence. Questions 3 & 4 now address that. The conclusion of this evaluation is unchanged.
Summary of Evaluation:
The eight questions in this evaluation were answered in the negative. Therefore, prior NRC approval for this change is not required.
Is the validity of this Evaluation dependent on any other change?
Yes No If Yes, list the required changes/submittals. The changes covered by this 50.59 Evaluation cannot be implemented without approval of the other identified changes (e.g., license amendment request). Establish an appropriate notification mechanism to ensure this action is completed.
N/A Based on the results of this 50.59 Evaluation, does the proposed change require prior NRC approval?
Yes No Preparer2:
Matt Montgomery /
/ EOI / Integrated Risk / See Sign.
Name (print) / Signature / Company / Department / Date Reviewer2:
Lindsey McConnell / / EOI / Major Projects / See Sign.
Name (print) / Signature / Company / Department / Date Independent Review3:
Name (print) / Signature / Company / Department / Date Responsible Manager Concurrence:
Name (print) / Signature / Company / Department / Date 50.59 Program Coordinator Concurrence:
Name (print) / Signature / Company / Department / Date 2
Either the Preparer or Reviewer will be a current Entergy employee.
3 If required by Section 5.1[2].
N/A T. Hatfield/
/EOI/Central Design/9-27-23 Michael Hall/
/EOI/Regulatory Assurance/9-27-23 Digitally signed by Matthew T.
Montgomery DN: cn=Matthew T. Montgomery, c=US, o=Integrated Risk, ou=Entergy, email=mmontg4@entergy.com Date: 2023.09.26 14:54:36 -05'00' cn=Lindsey McConnell, c=US, o=Engineering Supervisor, ou=Entergy ANO, email=lmcconn@entergy.com 2023.09.27 07:30:18 -05'00' Lindsey McConnell Digitally signed by Thomas A. Hatfield II DN: cn=Thomas A. Hatfield II, c=US, o=Entergy - ANO, ou=Design Engineering, email=thatfie@entergy.com Date: 2023.09.27 08:14:07 -05'00' Thomas A.
Hatfield II Digitally signed by Michael Hall DN: cn=Michael Hall, c=US, o=Entergy, ou=ANO Regulatory Assurance, email=mhall10@entergy.com Date: 2023.09.27 09:24:11 -05'00' Michael Hall
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 3 of 3 EN-LI-101 R22 OSRC:
Chairmans Name (print) / Signature / Date [GGNS P-33633, P-34230, & P-34420; W3 P-151]
OSRC Meeting #
II.
50.59 EVALUATION [10 CFR 50.59(c)(2)]
Does the proposed Change being evaluated represent a change to a method of evaluation ONLY? If Yes, Questions 1 - 7 are not applicable; answer only Question 8.
If No, answer all questions below.
Yes No Does the proposed Change:
- 1.
Result in more than a minimal increase in the frequency of occurrence of an accident previously evaluated in the UFSAR?
Yes No BASIS:
Decreasing the frequency of turbine valve tests increases the unreliability of the turbine overspeed protection system; this is applicable to both ANO-1 & 2. High reliability of the overspeed protection system is required to ensure that the risk of turbine missiles remains low. Production of turbine missiles in a turbine overspeed transient is an accident described in ANO-1 SAR Chapter 14, while it is an event described in ANO-2 SAR Chapters 3 & 10.
The analyses that support the proposed change in the test intervals, CALC-ANO1-ME-23-00001 for ANO-1 and CALC-ANO2-ME-22-00007 for ANO-2, do not calculate a new missile probability. These analyses estimate the impact on existing turbine missile probability P1 calculated by the OEM vendors. The results of these analyses indicate that the acceptance criterion of RG 1.115, Rev. 2, of 1E-5 per year will continue to be met with extended test intervals. Section 4.3.1 of NEI 96-07 indicates that a proposed activity would not result in more than a minimal increase in the frequency of an accident previously evaluated in the UFSAR provided that the plant-specific frequency threshold is not exceeded as a result of the change. Given we continue to meet the acceptance criterion of 1E-5 per year with margin, no, this change does not result in more than a minimal increase in the frequency of occurrence of an accident previously evaluated in the UFSAR.
OSRC-2023-023 Brian Patrick Digitally signed by Brian Patrick Date: 2023.09.28 10:12:20 -05'00'
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 4 of 3 EN-LI-101 R22
- 2.
Result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the UFSAR?
Yes No BASIS:
For ANO-1, the GVs and TVs are used to terminate steam flow to the HP turbines, whereas for ANO-2, the SVs, CVs, and CIVs are used to terminate steam flow to both the HP and LP turbines. For both units, these valves serve to assist in reducing the probability of a turbine overspeed event that could ultimately lead to turbine missile generation. The OPS functions to mitigate the effects of an overspeed event by signaling closure of these valves, and periodic testing of these valves demonstrates that they will satisfactorily perform this design function.
NEI 96-07 Section 4.3.2 provides guidance on a more than minimal increase in the likelihood of a malfunction of a structure, system, or component important to safety previously evaluated in the UFSAR by stating that NRC approval would be necessitated in the event that the change in likelihood of occurrence of a malfunction is calculated in support of the evaluation and increases by more than a factor or two, and this factor of two should be applied at the component level.
To ensure this factor of two is not exceeded, the turbine test intervals are to be implemented in a phased approach; that is, for ANO-1, the current six month testing interval for the GVs and TVs are to be extended in three month intervals, i.e. to 9 months, then to 12 months, then 15 months, then 18 months (if desired to align with LP valve testing), while the ANO-2 four month testing interval for the SVs, CVs, and CIVs is to be extended in two month intervals, i.e. to 6 months, then 8 months. This phased implementation has been analyzed in CALC-ANO1-ME-23-00001 and CALC-ANO2-ME 00007 to not increase valve unreliability by more than a factor of two.
Furthermore, this is in alignment with best industry practices for turbine valve test extensions pursued at similar sites as ANO. As defense-in-depth, valve stroke timing and EHC fluid quality are to be trended and monitored for degradation. Therefore, no, this change does not result in more than a minimal increase in the occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the either units UFSAR.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 5 of 3 EN-LI-101 R22
- 3.
Result in more than a minimal increase in the consequences of an accident previously evaluated in the UFSAR?
Yes No BASIS:
A turbine overspeed event is not postulated to yield any radiological consequence to the public or operators in the control room, by extension of the fact that the water-steam mixture in the secondary is not normally radioactive. This is valid for both ANO-1 & 2. In the event either unit is operating at the Tech Spec limit for primary activity and primary-to-secondary leakage such that the secondary has a non-negligible degree of radioactivity, an existing Chapter 14/15 accident analysis bounds the scenario. Therefore, no, this change does not result in a more than minimal increase in the consequences of an accident previously evaluated in either units UFSAR.
- 4.
Result in more than a minimal increase in the consequences of a malfunction of a structure, system, or component important to safety previously evaluated in the UFSAR?
Yes No BASIS:
As stated in the response to Question 3 above, radiological consequence is not postulated to occur as a result of a turbine overspeed transient. A hypothetical failure of the subject valves could potentially lead to a release of secondary steam, but a dose concern is not credible. As stated above, the water-steam mixture in the secondary is not normally radioactive, but if postulated to be, due to either unit operating at TS limits for primary activity and primary-to-secondary leakage, an existing Chapter 14/15 accident analysis would bound the transient. Therefore, no, this change does not result in more than a minimal increase in the consequences of a malfunction of a structure, system, or component important to safety previously evaluated in either units UFSAR.
- 5.
Create a possibility for an accident of a different type than any previously evaluated in the UFSAR?
Yes No BASIS:
No new accident can be introduced as a result of this change; the turbine overspeed accident remains bounding. This is valid for both ANO-1 & 2. Therefore, no, this change does not create a possibility for an accident of a different type than any previously evaluated in either units UFSAR.
- 6.
Create a possibility for a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the UFSAR?
Yes No BASIS:
The turbine valves and other overspeed protection system components must actuate to an overspeed condition to trip the turbine. Less frequent testing of the steam turbine valves does not change the existing failure modes or introduce new failure modes of these components. This is valid for ANO-1 & 2. Therefore, no, this change does not create a possibility for a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the UFSAR.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 6 of 3 EN-LI-101 R22 7.
Result in a design basis limit for a fission product barrier as described in the UFSAR being exceeded or altered?
Yes No BASIS:
This change involves the test intervals associated with turbine valves in the secondary. These valves are not credited fission product barriers in the UFSAR. This is valid for both ANO-1 & 2. Therefore, no, this change does not result in a design basis limit for a fission product barrier as described in the UFSAR being exceeded or altered.
8.
Result in a departure from a method of evaluation described in the UFSAR used in establishing the design bases or in the safety analyses?
Yes No BASIS:
The OEM vendor evaluation for the missile genesis probability, P1, is as-built with this change; Westinghouse/Siemens provided this input for ANO-1, while GE provided this input for ANO-2. The vendor has utilized the same evaluation method described in the UFSAR. A sensitivity study has been performed atop these analyses that manipulate an input to the method - the interval of valve testing - and examine the relative impact of different valve test intervals using reliability theory.
Following the guidance of NEI 96-07, the NRCs approval of our analysis of the turbine overspeed event was not contingent on a fixed, understood value of the interval of valve testing, only that the overall probability of the event remains low. As such, this input can be manipulated, so long as the acceptance criterion of RG 1.115, Rev. 2, continues to be met. This is valid for ANO-1 & 2. Therefore, no, this change does not result in a departure from a method of evaluation described in the UFSAR used in establishing the design bases or in the safety analyses.
If any of the above questions is checked Yes, obtain NRC approval prior to implementing the change by initiating a change to the Operating License in accordance with NMM Procedure EN-LI-103.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 1 of 12 EN-LI-101 R22 I.
OVERVIEW / SIGNATURES1 Facility: Arkansas Nuclear One, Unit 1 Evaluation # / Rev. #: FFN-2024-001 / 0 Proposed Change / Document:
[Temporary Change] Integrated Control System: Runback on Loss of a Single RCP Disabled /
EC 0054105613 Initiating Event:
In January of 2024, Arkansas Nuclear One Unit 1 (ANO-1) experienced a plant runback from a loss of a single Reactor Coolant Pump (RCP) due to a spurious runback signal from the Integrated Control System (ICS) as noted in CR-ANO-1-2024-00084. Troubleshooting revealed that all four RCP pumps remained running in spite of the spurious signal. Further troubleshooting efforts were unable to isolate the cause of the failure beyond that of the control system components within and/or between ICS and the field devices that would signal RPS and/or ICS of an RCP failure. This was in part due to self-restoration of the condition prior to troubleshooting beginning.
Description of Change:
To support continued operation to the next refueling outage while investigating the cause of CR-ANO-1-2024-00084, a temporary modification (T-mod) is being pursued to disable the RCP runback function within ICS from acting due to a single pump failure signal. Given the unresolved condition, a portion of the ICS system is being operated in manual in order to defeat the possibility of a runback due to the potential risk to reactivity control should the condition repeat itself. EC 0054105613 will render a specific control relay within the ICS system non-functional such that the ICS system will not perform a runback when the Unit Load Demand (ULD) exceeds 75% with the loss of a single RCP. The response to such a condition will be approximated by other functions of the ICS, albeit, at a slower rate (10% per minute max) than the system is capable of performing due to the installation of the T-mod. While a faster rate could potentially be performed manually by Operations by placing the system into track (20% per minute) for the remainder of the cycle until the cause of the condition report has been addressed, the manual rate is also slower than the automatic runback rate (50% per minute). Due to the modification affecting functions described in the UFSAR and potentially other license basis documents (act of temporarily disabling an automatic function and using manual operator action in its place), this condition screened into requiring an evaluation as part of the 10CFR50.59 process.
Summary of Evaluation:
The ICS system includes a function to perform a runback when above 75% plant power at a rate of 50% per minute upon the indication of a loss of a single RCP. This function is listed within ANO-1s UFSAR section 7.2.3.2.2. Furthermore, ICS is identified to be involved in a handful of accidents and abnormalities evaluated within Chapter 14, Safety Analysis, of the UFSAR. In some cases, ICS is described as a system that would initially respond to the event while another system, such as the Reactor Protection System (RPS) or Control Rod Drive (CRD) system, would be the designed system credited for mitigating said event. In other cases, ICS is identified as responding to the event to maintain the plant within the normal operating limits, but is not credited in any accident for mitigating an analyzed part of the event or its consequences (it is simply discussed in the section).
See Question 1s response for more details.
The T-mod being implemented under EC 0054105613 is in response to a plant malfunction identified in CR-ANO-1-2024-00084 which resulted in a false actuation of the UFSAR section 7.2.3.2.2 described function of a 50% per min plant runback to 75% plant power (675 Mwe Loss of 1 RCP Runback). To restore the system to automatic control and return to 100% power, the specific runback would require being disabled to prevent a repeat occurrence. Based on the T-mods scope, the ability to reduce plant demand would still exist following the T-mod. The ability for
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 2 of 12 EN-LI-101 R22 the ICS system to respond to changing plant conditions in support of plant operating would also be retained. Operations ability to take the system to manual mode would also be retained. The only thing this T-mod will do is take a single set of contacts that notifies the runback relay of an RCP trip and renders it in a state that the runback will think the RCPs are all running, regardless of actual RCP status. This does not affect the upstream devices which communicate RCP status to FW control, reactor control, turbine control, or other ICS logic which triggers cross limits, re-ratio, or other such functions. Nor does this change affect any other runback within the ICS system. To summarize, all of the systems functions will be maintained, save for the single function listed for the 50% per min runback rate to 75% power upon loss of a single RCP.
Thus, the T-mod disables just the physical relay contacts which actuate to indicate a single RCP pump failure within the runback logic only. This would block the 50% per minute rate of change function, however, the system could still reduce overall demand at either a maximum rate of 10%
per minute with ICS in full automatic, 20% per minute with ICS in tracking mode, or 30% per minute from another triggered runback, depending on the plant operating mode at the time of the event. In any case, these rates are clearly below the 50% per minute that would be used for the loss of a single RCP.
Further analysis of the ICS system response with the T-mod installed identified that manual operator action is not required as an alternative to meet the intent of the design. ICS will still perform a runback, but not at a rate of 50% per minute. The rate of change in reduction will be limited to a maximum of 20% per minute in track. The Operator could support ensuring ICS enters tracking mode by placing it as such. Their role would be in support, but not credited. ICS retains the ability to go to track automatically when the mismatch between the primary and secondary side is detected from the loss of the single RCP pump (example: Feedwater cross-limits). As mentioned prior, it will also receive a status of the RCP pumps loss, as that portion of the logic will retain the RCP pump status signal to support ICSs overall plant demand reduction.
Within ICS, there is no operator interface that exists to place ICS into a 50% per minute runback manually. Operator action to replace that function cannot be credited because no interface exists.
Per the NEI guidance, human factors were evaluated for any potential operator actions, but this review could not conceive of a way for an operator to place the system into a 50% per minute runback without significant system modification. That type of modification would require an outage to install due to the risk. The intent of the site is to use the Temporary modification proposed to support operation until such a time that they can correct the initiating condition during an outage instead of performing a permanent modification. Thus, the proposed changed within this 50.59 is a temporary one to continue online operation until the next outage.
In summary, the ICS system design is to maintain the plant within the normal operating limits and will respond as such during accidents; but ICS is not credited as part of the accident analyses responses.
Thus, it is the conclusion of this evaluation that there will be no more than a minimal increase in the likelihood, frequency, or consequences of a malfunction of a structure, system, or component important to safety nor accident evaluated within the UFSAR. Nor will this change result in a design basis limit for a fission product barrier as described in the UFSAR being exceeded or altered, nor result in a departure from a method of evaluation described in the UFSAR used in establishing the design bases or in the safety analyses, nor create a possibility for an accident of a different type than any previously evaluated in the UFSAR.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 3 of 12 EN-LI-101 R22 Is the validity of this Evaluation dependent on any other change?
Yes No If Yes, list the required changes/submittals. The changes covered by this 50.59 Evaluation cannot be implemented without approval of the other identified changes (e.g., license amendment request). Establish an appropriate notification mechanism to ensure this action is completed._______N/A_______________________________________________________________
Based on the results of this 50.59 Evaluation, does the proposed change require prior NRC approval?
Yes No Preparer2:
Zach Lehr / / Entergy / MFP Engineering / 2-19-24 Name (print) / Signature / Company / Department / Date Reviewer2:
Rich Blagbrough / / Entergy / Engineering / 2-19-24 Name (print) / Signature / Company / Department / Date Independent Review3:
Name (print) / Signature / Company / Department / Date Responsible Manager Concurrence:
Name (print) / Signature / Company / Department / Date 50.59 Program Coordinator Concurrence:
Name (print) / Signature / Company / Department / Date OSRC:
Chairmans Name (print) / Signature / Date
_OSRC-2024-003___________________________
OSRC Meeting #
2 Either the Preparer or Reviewer will be a current Entergy employee.
3 If required by Section 5.1[2].
N/A Digitally signed by Zach Lehr DN: cn=Zach Lehr, c=US, o=Entergy, ou=Major Fleet Projects, email=zlehr@entergy.com Date: 2024.02.19 14:46:58 -06'00' Digitally signed by Zach Lehr DN: cn=Zach Lehr, c=US, o=Entergy, ou=Major Fleet Projects, email=zlehr@entergy.com Date: 2024.02.19 14:47:25 -06'00' Digitally signed by Michael Hall DN: cn=Michael Hall, c=US, o=Entergy, ou=ANO Regulatory Assurance, email=mhall10@entergy.com Date: 2024.02.19 14:50:48 -06'00' Michael Hall Digitally signed by Scott Kerins DN: cn=Scott Kerins, c=US, email=skerins@entergy.com Date: 2024.02.19 15:21:31 -
06'00' Scott Kerins Brian D. Patrick Digitally signed by Brian D. Patrick Date: 2024.02.20 10:16:27 -06'00'
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 4 of 12 EN-LI-101 R22 II.
50.59 EVALUATION [10 CFR 50.59(c)(2)]
Does the proposed Change being evaluated represent a change to a method of evaluation ONLY? If Yes, Questions 1 - 7 are not applicable; answer only Question 8.
If No, answer all questions below.
Yes No Does the proposed Change:
- 1.
Result in more than a minimal increase in the frequency of occurrence of an accident previously evaluated in the UFSAR?
Yes No BASIS:
Within the ANO-1 UFSAR, the accidents and abnormalities previously evaluated that involve the ICS system are as follows:
x 14.1.2.1 Uncompensated Operating Reactivity Changes This abnormality is described in the UFSAR as follows:
The UORC (Uncompensated Operating Reactivity Changes) analysis was suggested for inclusion into the FSAR through AEC Regulatory Staff guidance when ANO-1 was licensed for operation. Subsequent Regulatory Staff guidance dropped this type of "abnormality" from the list of those events which should be analyzed.
The ICS operation during this event is described as follows:
ICS (Integrated Control System) would compensate for any reactivity perturbations due to these normal core operating phenomena. If the ICS failed to operate properly and the operator failed to respond to the reactivity perturbations, the RPS (Reactor Protection System) would prevent the safety limits from being exceeded.
This event does not require further evaluation for disabling of the single RCP ICS Runback, as the accident evaluation already encompasses ICSs failure to operate properly as well as operation in both automatic and manual control. Furthermore, as stated, this type of abnormality is not required to be analyzed.
x 14.1.2.2 Startup Accident This accident describes uncontrolled reactivity additions and the risk to the plant during plant startup. Primarily, the evaluation focuses on the Control Rod control system and limitations in place to minimize the impact. While ICS is not explicitly discussed in the accident analysis, the ICS system sends demand signals from the Reactor Control portion of ICS to the Control Rod Drive (CRD) system. This demand signal affects rod position while both systems are in automatic control, reference 7.2.3.2.5 Reactor Control for more details.
Above 75% plant power, the loss of a single RCP runback would trigger the rate limited Unit Load Demand to rapidly decrease. This would be processed through various portions of ICS, and ultimately result in a lowering demand signal to the control rods. Below 75%
plant power, this function does not actuate.
As part of the UFSAR evaluation within the section, the following statement shows a focus on control rod withdraw as the initiating event:
design provisions (to) minimize the possibility of inadvertent continuous rod withdrawal and limit the potential power excursions
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 5 of 12 EN-LI-101 R22 As noted, the accident evaluation pertains to rod withdraw versus rod insertion.
Furthermore, the control systems for rod control are evaluated to be operational for this accident.
The RCP ICS runback affects control rod insertion via a reduction in demand, albeit only the rate of change of said reduction. While ICS will remain operational after the T-mod is installed, the specific portion of the circuit which would increase the rate of change upon single RCP failure would be removed. This portion of the logic provides additional insurance that rod insertion would occur quickly during startup given the single pump failure, but it would not prevent said insertion or cause a withdraw. Finally, the ICS circuit is not the primary or credited method of control within this accident analysis but provides an initial control function in support.
Furthermore, Section 14.1.2.2.1 states the following:
It is concluded that the reactor is completely protected against any startup accident involving the withdrawal of any or all control rods, since in no case does the thermal power approach the design overpower condition and the peak pressure never exceeds code allowable limits.
In conclusion, the T-mod to temporarily defeat the RCP Runback within ICS is deemed to cause no more than a minimal increase in the frequency of occurrence of a Startup Accident previously analyzed in the UFSAR given it will still result in a rod insertion should an RCP fail, it is not the credited method of protection, and the accident analysis deems any startup accidents to never exceed allowable limits.
x 14.1.2.3 Rod Withdrawal Accident at Rated Power Operation This accident pre-supposes an operator error or equipment failure resulting in accidental withdrawal of a control rod group while the reactor is at rated power. As previously stated, ICS demand is an input into the CRD system. Demand increases (request to withdraw rods) due to an ICS equipment failure or operator error would be an initiator of the accident evaluated.
The current failure within the ICS system results in an undesired demand reduction. The T-mod solution would disable this demand reduction from accidentally occurring at rated power operation while also preventing it during a loss of a single RCP, should it occur.
Neither condition should result in a demand increase, as worst case the demand would remain unchanged given no runback has been initiated. Normally however, demand would still be reduced given the failure due to reactor power changing from the pump trip, but at a much slower rate of reduction since a runback which triggers the higher rate of change (50% per min) would not trigger (10% per min to 20% per minute in normal control).
In conclusion, since the T-mod resolution of defeating the single RCP pump runback is evaluated to not increase the position demand signal sent to the control rods in tandem with an actual RCP failure, this change is evaluated to not cause more than a minimal increase in the frequency of occurrence of a Rod Withdrawal Accident at Rated Power Operation that was previously evaluated in the UFSAR.
x 14.1.2.6 Loss of Coolant Flow This accident involves the reactor coolant flow rate being reduced if one or more of the Reactor Coolant Pumps fail. ICS functions to respond to this scenario by performing a runback of the plant. As discussed within this accident evaluation:
The reactor is protected from the consequences of Reactor Coolant Pump failure(s) by the Reactor Protection System and the ICS. The ICS initiates a power reduction upon
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 6 of 12 EN-LI-101 R22 pump failure to prevent reactor power from exceeding that permissible for the available flow. The reactor is tripped if insufficient reactor coolant flow exists for the power level.
As described, ICS is described in this accident as performing the power reduction upon single pump failure. This T-mod would disable that function for the remaining cycle. As further described however, the reactor would be tripped should we have insufficient coolant flow for that power level as part of the Reactor Protection System. As such, the reactor protection systems automatic plant trip would be the credited protection (i.e.
design function) while ICSs control is to prevent the need for the plant trip (i.e. system function).
In conclusion, the T-mod would disable the system function of the ICS runback contrary to what is described in the UFSAR, but the loss of coolant flow accidents frequency, i.e. how often it occurs, would not be impacted. ICSs non-safety related function is intended to mitigate the plant response to the accident by preventing the plant conditions from reaching an automatic plant trip, but does not affect the accident initiation. Thus, this change is evaluated to not cause more than a minimal increase in the frequency of occurrence of a Loss of Coolant Flow that was previously evaluated in the UFSAR.
x 14.1.2.9 Turbine Overspeed The ICS system interfaces with the turbine control system by sending a demand signal for control of the main turbine valve positions and thus steam flow from the steam generator into the turbine. This T-mod affects the runback circuit of ICS which affects the rate limited Unit Load Demand. This load demand is first processed by the turbine load control portion of ICS, and as such, can affect overall turbine control.
Disabling the runback would prevent the turbine from quickly responding to the load change upon loss of a single RCP pump. The error between reactor power and megawatts processed by ICS would still denote the need for a change to the overall load demand, but the rate of change would be much slower than that of a runback (50% per min vs < 20% per min). The response would still be a reduction in overall steam flow to the turbine, and thus would not be a concern with respect to a turbine overspeed event, which would require an increase in demand and steam flow.
Thus, the T-mod change is evaluated to not cause more than a minimal increase in the frequency of occurrence of a Turbine Overspeed that was previously evaluated in the UFSAR.
x 14.2.2.1 Steam Line Failure This event is described as follows:
The loss of secondary coolant due to a failure of a steam line between the steam generator and the turbine causes a decrease in steam pressure and thus places a demand on the control system for increased feedwater flow. Increased feedwater flow, accompanied by steam flow through the turbine stop valves and the break, lowers the average reactor coolant temperature.
ICS is discussed within this accident as follows:
(Note: Reactor power will also increase due to Integrated Control System (ICS) pulling rods to increase Tave).
The ICS will then cause control rod insertion in an attempt to limit reactor power to 102 percent.
The important thing to note for this failure is that the RCPs are assumed to be in operation:
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 7 of 12 EN-LI-101 R22 Offsite power was assumed to be available in this analysis due to the additional primary to secondary heat removal that will result from the RCPs running.
In this accident scenario, a runback is not credited to perform the ICS demand changes to the control rods nor to limit the plant power. Since the RCPs are analyzed as being in operation, the failure of an RCP to result in a runback would be a different type of accident.
Furthermore, ICS and its runback are not an initiator of the event. The other control portions of the ICS system are instead responding during the event, and these portions will not be modified by the T-mod change proposed.
As such, the T-mod change is evaluated to not cause more than a minimal increase in the frequency of occurrence of a Steam Line Failure that was previously evaluated in the UFSAR.
Human Factors Consideration:
Disabling the automatic runback function and having Operations manually support the runback would increase the time it takes for the ICS system, and overall plant, to respond to the loss of a single RCP.
However, as noted prior, the rate of change in demand after T-mod installation would be slower while in automatic, but it would not be prevented. Thus, manual action would likely speed up the demand change and act to better align the overall response to that of the original design.
While additional manual operator control would naturally introduce some increased complexity that might increase the potential for an operator error, that error would result in an identical situation as already being experienced, by T-mod installation, with the overall plant responding slower to the runback. The worst case situation would result in tripping the plant via automatic or manual means, which would also place the plant in a safe condition. The method of control would remain identical to the existing method of a manual plant runback using the hand/auto stations to use different setpoints and rates of change.
Thus, the human factor analysis from temporarily transferring the automatic to manual control function with respect to the T-mod to disable the single pump RCP runback is evaluated to be no more than a minimal increase to the frequency of occurrence of an accident previously evaluated in the UFSAR.
==
Conclusion:==
Based on each of the above analyses, the T-mod to temporarily disable the ICS runback on loss of a single RCP is evaluated to not cause more than a minimal increase in the frequency of occurrence of an accident that was previously evaluated in the UFSAR.
- 2.
Result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the UFSAR?
Yes No Basis:
The structure, system, or component in question are the ICS system and associated modules that are being altered by this change.
The ICS system falls into the definition per NEI 96-07 which states:
The term "malfunction of an SSC important to safety" refers to the failure of structures, systems, and components (SSCs) to perform their intended design functions-including both non-safety-related and safety-related SSCs.
ICS isa non-safety related SSC performing plant control and is included within this evaluation.
The proposed activity will disable a single module within ICS to prevent the runback from loss of a single RCP. The disabling will place the module in the state of failure. The malfunction in question would be a loss of the runback feature which is described in SAR section 7.2.3.2.2 as an ICS system function:
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 8 of 12 EN-LI-101 R22 Loss of any number of coolant pumps; runback at 50 percent per minute to the power corresponding to the remaining pumping capability.
When reviewing the accident and abnormality analyses, as performed under Question 1, the ICS RCP runback on a single pump failure was not listed as a design function within the analyses but was instead a system function to support operation and prevent a plant trip. As such, the loss of said function would constitute a system functional failure but not a design functional failure with respect to the licensing evaluations as other systems, such as the RPS, are credited for the design functions within the licensing for protection should non-safety systems, such as ICS, fail.
Note that said runback would still occur in the form of a normal power reduction, the rate of change would no longer be 50% per minute but a slower rate of change of 10% to 20% per minute based on ICS system status at the time of the event. Furthermore, as noted in SAR section 14.1.2.6 Loss of Coolant Flow, the RPS system is credited to trip the plant should insufficient coolant flow exist for that power level, as the design function. The RPS function is not impacted by the change proposed within the T-mod. RPS will still be capable of performing a trip due to any power, imbalance, or flow deviations during RCP coast down independent of the ICS automatic RCP runback at full speed.
==
Conclusion:==
The T-mod to temporarily disable the ICS runback on loss of a single RCP is evaluated to not result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component important to safety previously evaluated in the UFSAR.
- 3.
Result in more than a minimal increase in the consequences of an accident previously evaluated in the UFSAR?
Yes No Basis:
As evaluated under Question 1, the following are the accidents and abnormalities which require evaluation for this analysis and their associated evaluations:
x 14.1.2.2 Startup Accident This accident describes uncontrolled reactivity additions and the risk to the plant during plant startup. Section 14.1.2.2.1 states the following:
It is concluded that the reactor is completely protected against any startup accident involving the withdrawal of any or all control rods, since in no case does the thermal power approach the design overpower condition and the peak pressure never exceeds code allowable limits.
In conclusion, the T-mod to temporarily defeat the RCP Runback within ICS is deemed to cause no more than a minimal increase in the consequences of a Startup Accident previously analyzed in the UFSAR given the change will still result in a rod insertion should an RCP fail, it is not the credited method of protection, and the accident analysis deems any startup accidents to never exceed allowable limits.
x 14.1.2.3 Rod Withdrawal Accident at Rated Power Operation This accident pre-supposes an operator error or equipment failure resulting in accidental withdrawal of a control rod group while the reactor is at rated power. As previously stated, ICS demand is an input into the CRD system. Demand increases (request to withdraw rods) due to an ICS equipment failure or operator error would be an initiator of the accident evaluated.
The current failure within the ICS system results in an undesired demand reduction. The T-mod solution would disable this demand reduction from accidentally occurring at rated power operation while also preventing it during a loss of a single RCP, should it occur.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 9 of 12 EN-LI-101 R22 Neither condition should result in a demand increase, as worst case the demand would remain unchanged given no runback has been initiated.
In conclusion, since the T-mod resolution of defeating the single RCP pump runback is evaluated to not increase the position demand signal sent to the control rods in tandem with an actual RCP failure, this change is evaluated to not cause more than a minimal increase in the consequences of a Rod Withdrawal Accident at Rated Power Operation that was previously evaluated in the UFSAR.
x 14.1.2.6 Loss of Coolant Flow This accident involves the reactor coolant flow rate being reduced if one or more of the Reactor Coolant Pumps fail. ICS functions to respond to this scenario by performing a runback of the plant. As discussed within this accident evaluation:
The reactor is protected from the consequences of Reactor Coolant Pump failure(s) by the Reactor Protection System and the ICS. The ICS initiates a power reduction upon pump failure to prevent reactor power from exceeding that permissible for the available flow. The reactor is tripped if insufficient reactor coolant flow exists for the power level.
As described, ICS is described in this accident as performing the power reduction upon single pump failure. This T-mod would disable that function for the remaining cycle. As further described however, the reactor would be tripped should we have insufficient coolant flow for that power level. As such, the reactor protection systems automatic plant trip would be the credited protection (i.e. design function) while ICSs control is to prevent the need for the plant trip (i.e. system function).
In conclusion, the T-mod would disable the system function of the ICS runback contrary to what is described in the UFSAR, but the loss of coolant flow accidents consequences, i.e.
impact to the plant, would remain unchanged. The credited RPS trip function is not impacted by the change proposed within the T-mod. RPS will still be capable of performing a trip due to any power, imbalance, or flow deviations during RCP coast down independent of the ICS automatic RCP runback at full speed. ICSs non-safety related function is intended to mitigate the plant response to the accident by preventing the plant conditions from reaching an automatic trip setpoint within RPS.
Thus, this change is evaluated to not cause more than a minimal increase in the consequences of a Loss of Coolant Flow that was previously evaluated in the UFSAR as the worst consequences that the ICS system change via the T-mod would cause is a plant trip should a single RCP pump fail, which is already analyzed.
x 14.1.2.9 Turbine Overspeed The ICS system demand to the turbine affects the overall turbine control but does not change the consequences of an overspeed condition nor the protective functions designed to prevent an overspeed. Thus, the T-mod change is evaluated to not cause more than a minimal increase in the consequences of a Turbine Overspeed that was previously evaluated in the UFSAR.
x 14.2.2.1 Steam Line Failure As noted in the SAR, ICS will perform a control rod insertion to attempt to limit reactor power to 102 percent.
The important thing to note for this failure is that the RCPs are assumed to be in operation:
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 10 of 12 EN-LI-101 R22 Offsite power was assumed to be available in this analysis due to the additional primary to secondary heat removal that will result from the RCPs running.
In this accident scenario, a failure of a single RCP pump and an associated runback is not analyzed. The ICS demand changes to the control rods and associated limits the plant power will remain unaffected by the T-mod change. Since the RCPs are analyzed as being in operation, the failure of an RCP to result in a runback would be a different type of accident.
As such, the T-mod change is evaluated to not cause more than a minimal increase in the consequences of occurrence of a Steam Line Failure that was previously evaluated in the UFSAR.
==
Conclusion:==
Per NEI 96-07 4.3.3, an increase in consequences must involve an increase in radiological doses to the public or to control room operators. As described prior, this changes impact did not identify any impact to radiation release, as such, the T-mod change is evaluated to not cause more than a minimal increase in the consequences of an accident that was previously evaluated in the UFSAR.
4.
Result in more than a minimal increase in the consequences of a malfunction of a structure, system, or component important to safety previously evaluated in the UFSAR?
Yes No Basis:
The proposed change to the ICS runback upon loss of a single RCP, as stated prior, would result in a slower rate of change in overall plant demands to the turbine, feedwater, and reactor controls. In response to an accident, ICSs function is to perform support by reducing overall plant demand signals to each of the aforementioned systems. This in turn helps ensure rods are inserted, steam flow is reduced, and overall power is reduced to prevent the need for a plant trip from the credited reactor protection system.
This change will not disable the ability of the ICS system to perform a reduction in demand, nor will it adversely impact the credited reactor protection, control rod drive, or other safety systems ability to mitigate the consequences of said accidents. As such, the overall malfunctions evaluated in the UFSAR will not have their radiological consequences affected as a result of the proposed activity.
==
Conclusion:==
The T-mod to disable the runback from the loss of a single RCP is evaluated to not result in more than a minimal increase in the consequences of a malfunction of a structure, system, or component important to safety previously evaluated in the UFSAR.
5.
Create a possibility for an accident of a different type than any previously evaluated in the UFSAR?
Yes No Basis:
The proposed change to the ICS runback upon loss of a single RCP, as stated prior, would result in the system retaining all functionality save the use of the specific rate of change of 50% per minute should an RCP fail. The inability for ICS to reduce overall plant demand at a higher rate would increase the potential for the evaluated plant trip by the RPS system but would not introduce a new type of accident. As such, the existing accident analyses are evaluated to be bounding.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 11 of 12 EN-LI-101 R22
==
Conclusion:==
Thus, the T-mod change is evaluated to not create a possibility for an accident of a different type than any previously evaluated in the UFSAR, as the existing evaluations are deemed bounding.
- 6.
Create a possibility for a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the UFSAR?
Yes No Basis:
The structure, system, or component in question is the ICS system and associated module that is being altered by this change. The proposed activity will disable a single set of contacts on a relay module within ICS to prevent a 50% per minute runback from loss of a single RCP. The disabling action will place the module contacts in the state of failure with respect to RCP pump status for runback initiation (failed to running status vs tripped status). No new failure mechanism is being introduced. The result of the runback rate not being fast enough would still result in the RPS system tripping the plant on an imbalance should it occur. Thus, this would not introduce a malfunction with a different result.
==
Conclusion:==
This T-mod is evaluated to not create a possibility for a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the UFSAR as the result of a plant trip would be bounded by the existing evaluations in the UFSAR.
- 7.
Result in a design basis limit for a fission product barrier as described in the UFSAR being exceeded or altered?
Yes No Basis:
Section 14.1.2.6.4 in the UFSAR states:
ICS initiates a power reduction upon pump failure to prevent reactor power from exceeding the permissible for the available flow. However, the reactor is tripped if insufficient reactor coolant flow exists for the power level.
This trip occurs via the RPS system and not the ICS system. The T-mod will not alter any reactor control setpoints, logic, protective setpoints, or other changes as they pertain to fission product barriers. This change is isolated to an overall plant runback rate given a single RCP pump failure.
As such, the review concludes that no design basis limits are either directly or indirectly affected.
==
Conclusion:==
This change does not result in a design basis limit for a fission product barrier as described in the UFSAR from being exceeded or altered.
- 8.
Result in a departure from a method of evaluation described in the UFSAR used in establishing the design bases or in the safety analyses?
Yes No Basis:
The removal of the 50% rate of change runback for loss of a single RCP pump would result in essentially the same results from the analyses of record within the UFSAR, as the ICS system is not credited to perform any safety related functions.
==
Conclusion:==
As such, this change does not result in a departure from a method of evaluation described in the UFSAR used in establishing the design bases or in the safety analyses.
ATTACHMENT 9.1 50.59 EVALUATION FORM Sheet 12 of 12 EN-LI-101 R22 If any of the above questions is checked Yes, obtain NRC approval prior to implementing the change by initiating a change to the Operating License in accordance with NMM Procedure EN-LI-103.
1CAN112401 ANO-1 and ANO-2 Commitment Change Summary Report
1CAN112401 Page 1 of 16 ANO-1 and ANO-2 Commitment Change Summary Report Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 3318 7/27/1992 12/18/2023 Modify appropriate ANO-2 maintenance procedures to include additional Regulatory Guide 1.97 instrument testing Modify appropriate ANO-2 maintenance procedures to include additional Regulatory Guide 1.97 instrument testing. In alignment with 2CNA041904 and Amendment 315 to Renewed Facility Operating License No. NPF-6 for ANO-2, testing frequency for Technical Specification associated Regulatory Guide 1.97 components is controlled by the process described in EN-DC-355, "Implementation of the Technical Specification Surveillance Frequency Control Program" and its progeny procedures.
Testing frequency for non-TS Regulatory Guide 1.97 SSCs will be controlled by 10 CFR 50.59, "Changes, Tests, and Experiments" and EN-WM-110, "Surveillance Program."
Amendment 315 to Renewed Facility Operating License No. NPF-6 for ANO-2 revised the Technical Specifications by relocating certain surveillance frequencies to a licensee-controlled program. (Surveillance Frequency Control Program). Procedure OP-1001.008, "Surveillance Frequency Control Program" requires a full risk evaluation as part of this application to validate this assumption.
OP-1001.008 also requires acceptable component performance before a surveillance frequency can be extended. EN-DC-355, "Implementation of the Technical Specification Surveillance Frequency Control Program" provides the requirements for allowing testing/calibration extensions. This process specifically requires an evaluation be performed to adjust the frequency of a test/calibration to show acceptability of the new frequency including a PRA based risk assessment, component testing and performance reviews and additional justification to support the change.
This evaluation is then reviewed and approved by an Independent Decision Making Panel. As described in EN-DC-355 section 5.6, continued equipment performance monitoring is also required to be performed for adjustments to the frequency if a prior change has impacted equipment reliability.
Based on the process described in EN-DC-355, this process is sufficient to replace specific Regulatory Guide 1.97 testing/surveillance frequency requirements and instead cite adherence to EN-DC-355 to provide assurance of required equipment reliability for Regulatory Guide 1.97 components.
1CAN112401 Page 2 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 3321 7/24/1992 12/18/2023 Commitment to modify appropriate ANO-1 and maintenance procedures to include additional Regulatory Guide 1.97 instrument testing. And, specifically, 0CAN089207 states "Most Regulatory Guide 1.97 instruments undergo a periodic channel check (generally 1/shift or 1/week) and either a functional test or calibration test (generally each refueling outage or shorter interval as directed by component function or Tech. Specs)".
Commitment to modify appropriate ANO-1 maintenance procedures to include additional Regulatory Guide 1.97 instrument testing. In alignment with 1CNA051901 and Amendment 264 to Renewed Facility Operating License No. DPR-51 for ANO-1, Testing frequency for Technical Specification associated Regulatory Guide 1.97 components is controlled by the process described in EN-DC-355, "Implementation of the Technical Specification Surveillance Frequency Control Program" and its progeny procedures.
Testing frequency for non-TS Regulatory Guide 1.97 SSCs will be controlled by 10 CFR 50.59, "Changes, Tests, and Experiments" and EN-WM-110, "Surveillance Program."
Amendment 315 to Renewed Facility Operating License No. NPF-6 for ANO-2 revised the Technical Specifications by relocating certain surveillance frequencies to a licensee-controlled program. (Surveillance Frequency Control Program). Procedure OP-1001.008, "Surveillance Frequency Control Program" requires a full risk evaluation as part of this application to validate this assumption.
OP-1001.008 also requires acceptable component performance before a surveillance frequency can be extended. EN-DC-355, "Implementation of the Technical Specification Surveillance Frequency Control Program" provides the requirements for allowing testing/calibration extensions. This process specifically requires an evaluation be performed to adjust the frequency of a test/calibration to show acceptability of the new frequency including a PRA based risk assessment, component testing and performance reviews and additional justification to support the change.
This evaluation is then reviewed and approved by an Independent Decision Making Panel (IDP). As described in EN-DC-355 section 5.6, continued equipment performance monitoring is also required to be performed for adjustments to the frequency if a prior change has impacted equipment reliability.
Based on the process described in EN-DC-355, this process is sufficient to replace specific Regulatory Guide 1.97 testing/surveillance frequency requirements and instead cite adherence to EN-DC-355 to provide assurance of required equipment reliability for Regulatory Guide 1.97 components.
1CAN112401 Page 3 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 19823 6/17/2016 8/10/2024 Establish and implement an ANO Integrated Strategic Workforce Plan (ISWP) that provides a strategic long-term perspective of future staffing needs with an explicit focus on ensuring staffing is sufficient to support nuclear safety. The workforce planning process will look into the future at least five-years, be updated annually, and reviewed quarterly by the ANO People Health Committee (APHC).
Establish and implement an ANO Integrated Strategic Workforce Plan (ISWP) that provides a strategic long-term perspective of future staffing needs with an explicit focus on ensuring staffing is sufficient to support nuclear safety. The workforce planning process will look into the future at least five-years, be updated annually, and reviewed periodically, but at least annually by the ANO People Health Committee (APHC).
EN-HR-107, "People Health Committee" is currently in revision to support "Path to Premier" activities. This commitment has been identified as one that, as written, provides little value. The requirement to generate the list annually and review it quarterly puts it out of synchronization with other reviews and requires a quarterly review of a report that typically only requires updates on an annual basis. Experience has shown that with adequate oversight and engagement, changes to organizational planning needs dont occur rapidly enough to necessitate quarterly review.
This change would align the ISWP review with its generation, while not changing the ability to hold pop up or emergent APHC meetings to address staffing issues as they arise.
Workforce planning and organizational health have been satisfactory, and the leadership team closely monitors organizational capacity regarding planned attrition, promotions, and other changes. There is no risk to changing the required frequency of these meetings.
1CAN112401 Page 4 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 15006 12/22/198 2
5/10/2024 Entergy provided its final response to NUREG-0612 in Entergy letter to the NRC, Final Response on NUREG-0612, Control of Heavy Loads at Nuclear Power Plants, dated December 22, 1982.
Specifically, Section 2.3 of the ANO response addresses the overhead handling systems operating inside containment. Entergy provided justification that would exclude L-21 from further considerations for the following reasons:
- 2. This crane is utilized to assist in several maintenance operations prior to the removal of the reactor vessel head.
However, administrative controls are being developed to ensure that prior to the removal of the reactor vessel head, the crane is locked in a position at the east end of the refueling canal so that it is incapable of carrying any load over the open reactor vessel.
- 2. L-21 will be able to move over a defueled open vessel to support the completion of OP-1306.008, "Unit 1 Reactor Vessel Internal Vent Valve Stroke Test" or other loads within the capacity of L-21 during Refueling Outages. Other times that the ANO-1 reactor vessel is open, and fuel is in the vessel, L-21 will be parked against the east stops as currently required by procedures.
L-21 has administratively been derated to a lifting capacity of 2000 pounds. The intended loads are lower than that.
L-21 will be used only once the all the fuel assemblies have been unloaded from the reactor vessel.
1CAN112401 Page 5 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 4243 12/16/198 8
6/5/2024 Complete ATWS system testing will be performed every refueling. At power testing will be performed every 18 months.
ATWS system testing will be performed IAW EN-DC-355, "Implementation of the Technical Specifications Surveillance Frequency Control Program (SFCP)"
due to some of its inputs being TS required. At power testing will be performed every 18 months.
This change will not remove the testing, only change the frequency of activities performance during outage. The intent is to allow for single train outages. Surveillance Test Interval (STI) documents will evaluate the plant risk associated with the frequency change. Calibration of parameters that provide input to the ATWS systems will be performed on a 2R alternating frequency. STI-23-011, "Unit 1 Wide Range Pressure Calibrations" and STI-23-012, "Engineered Safeguards Actuation System (ESAS) Analog Channel Calibration" evaluated the frequency changes for the Technical Specification required components providing input into Diverse Reactor Overpressure Prevention System (DROPS). These STIs have evaluated that plant risk remains acceptable with this change. This commitment change coincides with the evaluated surveillance testing of the applicable parameters. This will allow outages to only take one train of safety related equipment out of service.
19876 6/17/2016 6/12/2024 Revise the procedure "Nuclear Safety Culture Monitoring" to define the role and responsibilities of the ANO Nuclear Safety Culture (NSC) manager.
The roles and responsibilities of the NSC manager will now be under the Regulatory Assurance and Performance Improvement Director (RAPID) due to the removal of the NSC manager position. EN-QV-136 Editorial change as the NSC Manager reported to the RAPID.
1CAN112401 Page 6 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 3317 7/24/1992 6/13/2024 Commitment P-3317, 0CAN079207, (Regulatory Guide 1.97) Commitment to modify appropriate ANO-1 maintenance procedures to include additional Regulatory Guide 1.97 instrument testing.
Specifically, 0CAN079207 states "Most Regulatory Guide 1.97 instruments undergo a periodic channel check (generally 1/shift or 1/week) and either a functional test or calibration test (generally each refueling outage or shorter interval as directed by component function or Tech. Specs.)"
Commitment P-3317, 0CAN079207, (Regulatory Guide 1.97) Commitment to modify appropriate ANO-1 maintenance procedures to include additional Regulatory Guide 1.97 instrument testing. In alignment with 1CNA051901, and Amendment 264 to Renewed Facility Operating License No. DPR-51 for ANO-1, Testing frequency for Technical Specification associated Regulatory Guide 1.97 components is controlled by the process described in EN-DC-355, "Implementation of the Technical Specification Surveillance Frequency Control Program" and its progeny procedures.
Testing frequency for non-TS Regulatory Guide 1.97 Systems, Structures, and Components (SSC)s will be controlled by 10 CFR 50.59, "Changes, Tests, and Experiments" and EN-WM-110, "Surveillance Program."
Reference NRC Correspondence 1CNA051901 for Amendment No. 264 to Renewed Facility Operating License No. DPR-51 for ANO-1, which revises the Technical Specifications by relocating certain surveillance frequencies to a licensee-controlled program (Surveillance Frequency Control Program). Procedure OP-1001.008, "Surveillance Frequency Control Program" requires a full risk evaluation as part of this application to validate this assumption.
OP-1001.008 also requires acceptable component performance before a surveillance frequency can be extended. EN-DC-355, "Implementation of the Technical Specification Surveillance Frequency Control Program" and its progeny procedures provide the requirements for allowing testing/calibration extensions. This process specifically requires an evaluation be performed to adjust the frequency of a test/calibration to show acceptability of the new frequency including a PRA based risk assessment, component testing and performance reviews and additional justification to support the change. This evaluation is then reviewed and approved by an Independent Decision Making Panel. As described in EN-DC-355 section 5.6, continued equipment performance monitoring is also required to be performed for adjustments to the frequency if a prior change has impacted equipment reliability. Based on the process described in EN-DC-355 and its progeny procedures, this process is sufficient to replace specific Regulatory Guide 1.97 testing/surveillance frequency requirements and instead cite adherence to EN-DC-355 to provide assurance of required equipment reliability for Regulatory Guide 1.97 components.
1CAN112401 Page 7 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 11401 1/5/1981 6/13/2024 Reactor Building Water Level Indicators will be calibrated every 18 months.
Reactor Building Water Level Indicators calibration will be controlled by the Surveillance Frequency Control Program.
Procedures OP-1304.198 and OP-1304.199 perform the outside containment portion of the U1 Reactor Building (RB)
Flood Level instrument loop calibrations with the unit online (not during outages). The refueling outage part of the ANO-1 RB Flood Level test/calibration is performed under OP-1304.069. All three procedures; OP-1304.069, OP-1304.198, and OP-1304.199 are required to be performed to satisfy TS Surveillance Requirement (SR) 3.3.15.2 Table 3.3.15-1 Item 6. Per OP-1304.069, the benefit will allow outages to take one train of safety related equipment out of service. Additionally, this should save outage time and money. Benefits per OP-1304.198 and 1304.199 will include saving 10 man/hours per year for the life of the plant, fewer 30-day LCO entries and less wear and tear on equipment. Reference NRC Correspondence 1CNA051901 for Amendment No. 264 to Renewed Facility Operating License No. DPR-51 for ANO-1, which revises the Technical Specifications by relocating certain surveillance frequencies to a licensee-controlled program.
Procedure Op-1001.008, "Surveillance Frequency Control Program" requires a full risk evaluation and review of equipment performance before a surveillance frequency can be extended. EN-DC-355, "Implementation of the Technical Specification Surveillance Frequency Control Program" and its progeny procedures provide the requirements for allowing testing/calibration extensions. This process specifically requires an evaluation be performed to adjust the frequency of a test/calibration to show acceptability of the new frequency including a PRA based risk assessment, component testing and performance reviews and additional justification to support the change. This evaluation is then reviewed and approved by an independent Decision Making Panel. As described in EN-DC-355 Section 5.6, continued equipment performance monitoring is also required to be performed for adjustments to the frequency if a prior change has impacted equipment reliability. Based on the process described in EN-DC-355 and its progeny procedures, this commitment change is acceptable because adherence to EN-DC-355 provides assurance of required equipment reliability, and the process is sufficient to change testing/surveillance requirements.
1CAN112401 Page 8 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 2899 3/11/1992 8/14/2024 At-power test should be performed at 6-month intervals with complete system test being performed every refueling.
Anticipated Transient Without Scram (ATWS) system testing will be performed in accordance with EN-DC-355:
Implementation of the TS SFCP due to some of its inputs being TS required.
See commitment P-4243 for at-power test requirements.
ATWS system testing will be performed in accordance with EN-DC-355: implementation of the TS SFCP due to some of its inputs being TS required. See commitment P-4243 for at-power test requirements.
This change will not remove the testing, only change the frequency of activities performance during refueling outage.
The intent is to allow for single train outages. Surveillance Test Interval (STI) documents will evaluate the plant risk associated with the frequency change. Calibration of parameters that provide input to the ATWS systems will be performed on a 2R alternating frequency. STI-23-011, "Unit 1 Reactor Coolant System (RCS) Pressure Calibration" evaluated the frequency change for the Technical Specification required components providing input into Diverse Reactor Overpressure Prevention System (DROPS). This STI has evaluated that plant risk remains acceptable with this change. This commitment change coincides with the evaluated surveillance testing of the applicable parameters This will allow outages to only take one train of safety related equipment out of service.
8790 9/20/1985 10/22/2024 Post-Accident Sampling System (PASS) shall be verified as OPERABLE monthly, perform within 7 days of criticality if greater than 1 month since previously performed.
The status of these commitments is being revised from "CLOSED" to "HISTORIC". No change to the commitment descriptions required.
The PASS has been abandoned in place and is no longer in service.
15191 8/22/1985 10/22/2024 Surveillance procedure requires notification of NRC Resident if PASS is out of service for more than seven consecutive days.
The status of these commitments is being revised from "CLOSED" to HISTORIC. No change to the commitment descriptions required.
The PASS has been abandoned in place and is no longer in service.
1CAN112401 Page 9 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 19749 6/28/2016 9/5/2024 Establish a Vendor Oversight team to drive continuous improvement in Vendor Oversight.
Continuous improvement in Vendor oversight is established through Performance Review Meeting (PRM) process per EN-LI-121. Vendor oversight and supplemental worker performance are reviewed, discussed, and challenged in order to track/trend, identify low level issues and prevent reoccurrence. PRM review includes Corrective Action Program (CAP),
Observations, and other data inputs to evaluate performance.
Department Performance Review Meetings (DPRM) monitors supplemental worker performance as a part of the Projects application of Performance Improvement process.
Each site department is procedurally required to hold DPRMs. Given the overlap in scope between the Vendor Oversight Committee (VOC) and the DPRM it is prudent to retire VOC. This will maintain the intent of the VO-4&5 without causing a duplication of effort in two different performance monitoring meetings.
19750 6/28/2016 9/5/2024 Develop and implement a process for monitoring of supplemental oversight plan compliance.
Continuous improvement in Vendor oversight is established through Performance Review Meeting (PRM) process per EN-LI-121. Vendor oversight and supplemental worker performance are reviewed, discussed, and challenged in order to track/trend, identify low level issues and prevent reoccurrence. PRM review includes Corrective Action Program (CAP),
Observations, and other data inputs to evaluate performance.
Department Performance Review Meetings (DPRM) monitors supplemental worker performance as a part of the Projects application of Performance Improvement process.
Each site department is procedurally required to hold DPRMs. Given the overlap in scope between the Vendor Oversight Committee (VOC) and the DPRM it is prudent to retire VOC. This will maintain the intent of the VO-4&5 without causing a duplication of effort in two different performance monitoring meetings.
1CAN112401 Page 10 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 19751 6/28/2016 9/5/2024 Establish specific templates and guidance to support consistent development of Supplemental Oversight Plans.
Specific templates and guidance are established in EN-OM-126, "Vendor Oversight." This guidance is applicable to the fleet and is to be implemented as a Graded Approach.
Established by Management Oversight and risk assessment of vendor scope.
The VO-6 commitment will be maintained in the upcoming revision to EN-OM-126. The templates and criteria for the application of Oversight plans will remain in the procedure.
Application will be enforced based on risk ranking of work.
Allowing for efficiency but honoring the integrity of the commitment.
19818 6/28/2016 9/5/2024 VO-11: Revise the Supplemental Personnel Expectations Brief Checklist to include supplemental personnel receiving a site employee handbook and discussion by responsible management on the site employee handbook and expectations for use.
Personnel Expectation Brief will include the indoctrination PowerPoint. The PowerPoint will be stored on company SharePoint and referenced in the procedure.
This will be a living document that will be revisited, reviewed, and updated on an annual frequency.
The requirement for a handbook was designated as sustainable for VO-11/NF-6. We can accomplish the intent of this requirement using the indoctrination power point file.
This power point is a living document that is used to facilitate the communication of expectations between Entergy leadership and on boarding supplemental supervisors. The use of this tool allows for more timely updates to the facilitation tools which increases the quality of the interaction at the indoctrination briefings. Placing the file for the briefing in the SharePoint site also allows accessibility to the staff around the fleet.
19756 6/28/2016 9/5/2024 NF-6: Revise EN-OM-126 "Management and Oversight of Supplemental Personnel" to ensure that supplemental employees receive the ANO Employee Handbook and are provided expectations for its use in a discussion by their manager.
Personnel Expectation Brief will include the indoctrination PowerPoint. The PowerPoint will be stored on company SharePoint and referenced in the procedure.
This will be a living document that will be revisited, reviewed, and updated on an annual frequency.
The requirement for a handbook was designated as sustainable for VO-11/NF-6. We can accomplish the intent of this requirement using the indoctrination power point file.
This power point is a living document that is used to facilitate the communication of expectations between Entergy leadership and on boarding supplemental supervisors. The use of this tool allows for more timely updates to the facilitation tools which increases the quality of the interaction at the indoctrination briefings. Placing the file for the briefing in the SharePoint site also allows accessibility to the staff around the fleet.
1CAN112401 Page 11 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 19759 6/28/2016 9/5/2024 VO-18: Revise Project Management procedures to ensure projects are organized and managed with (1) effective support by subject matter experts and (2) effective vendor and technical oversight.
Vendor oversight will be supported by Entergy Management accountable for the work, providing a line of accountability between work, worker, and oversight.
Vendor oversight will be supported by Entergy Management accountable for the work, providing a line of accountability between work, worker, and oversight.
This change is based on the progression since the Stator Drop Event in the ownership and accountability of the Entergy line management. EN-OM-126 moves from use of Subject Matter Expert (SME) to Entergy Management will help align our accountability to responsible leadership assigned to a given scope of work.
19866 6/28/2016 10/7/2024 Safety Culture: To improve nuclear safety culture values and behaviors to ensure commitment by leaders and individuals to emphasize safety over competing goals, Entergy will implement the following by December 2016:
Corporate/Independent oversight (CO) - CO-4 Revise procedures that govern nuclear oversight performance assessments to include nuclear safety culture trend codes to provide a perspective on nuclear safety culture and include in established nuclear safety culture monitoring processes.
Revise procedures that govern nuclear oversight performance assessments to include nuclear safety culture trend codes. Apply relevant safety culture trend code(s) during the trending process. Roll up codes to provide a perspective on nuclear safety culture and include in established nuclear safety culture monitoring processes.
The intent of the action is maintained, only the method of implementation is changed. Trimester reporting a "safety culture" perspective based on the aggregate review of new problem development sheets will be eliminated. The Nuclear Oversight (NIOS) managers provide their perspective as a required input to the Nuclear Safety Culture Executive Team for review. This process is anchored with reference to this commitment in EN-QV-136 Rev. 27, "Nuclear Safety Culture Monitoring."
1CAN112401 Page 12 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 19885 6/17/2016 10/21/2024 Safety Culture (SC) - SC-14 Establish and implement a Nuclear Safety Culture Observation process including elements of leader behaviors, NSC, and SCWE. The observer monitors leader performance on a daily basis and provides feedback to correct adverse trends in behaviors.
Safety Culture (SC) - SC-14 Establish and implement a Nuclear Safety Culture Observation process including elements of leader behaviors, NSC, and SCWE.
The observer monitors leader performance on a daily basis and provides feedback to correct adverse trends in behaviors. This observer function is to be used at the discretion of the NSCMP and/or RAPID.
Due to this commitment, EN-QV-136, Nuclear Safety Culture Monitoring, section 5.2 requires a Nuclear Safety Culture Observe (NSCO) in certain meetings. ANO performance in the area of Nuclear Safety Culture has continuously been proven healthy in numerous assessments including NRC PI&Rs, SRC visits, INPO Evaluations, and other evaluation methods. Periodic Nuclear Safety Culture Monitoring Panels (NSCMP) and emergency or ad-hoc NSC meetings continue to be performed. Current ANO performance reveals that directed NSC observations should no longer be required, as their intended effect has been integrated into ANO culture.
However, they should still be available to be used as tools to address identified performance gaps, specific goals, or simply at the discretion of the NSCMP and/or RAPID. This intent of this request for commitment revision is not to stop performing observations of leader behaviors, NSC, and SCWE, it is simply to remove NSC Observations as a requirement in key forums, allowing the NSCMP and/or RAPID discretionary application.
19871 6/17/2016 10/21/2024 Safety Culture - LF-9 Establish a NSC Observer function to observe and provide feedback on leader behaviors in key forums and to provide observation data for review by the NSCMP.
Safety Culture - LF-9 Establish an NSC observer function to observe and provide feedback on leader behaviors in key forums and to provide observation data for review by the NSCMP.
This observer function is to be used at the discretion of the NSCMP and/or RAPID.
Due to this commitment, EN-QV-136, Nuclear Safety Culture Monitoring, section 5.2 requires a Nuclear Safety Culture Observer (NSCO) in certain meetings. ANO performance in the area of Nuclear Safety Culture has continuously been proven healthy in numerous assessments including NRC PI&Rs, SRC visits, INPO Evaluations, and other evaluation methods. Periodic Nuclear Safety Culture Monitoring Panels (NSCMP) and emergency or ad-hoc NSC meetings continue to be performed. Current ANO performance reveals that directed NSC observations should no longer be required, as their intended effect has been integrated into ANO culture.
However, they should still be available to be used as tools to address identified performance gaps, specific goals, or simply at the discretion of the NSCMP and/or RAPID.
The intent of this request for commitment revision is not to stop performing NSC observations, it is simply to remove NSC Observations as a requirement in key forums, allowing the NSCMP and/or RAPID discretionary application.
1CAN112401 Page 13 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 19867 6/17/2016 10/21/2024 Corrective Actions (CA)
CA-2 Establish a NSC Observer function and expectations to observe and provide feedback on leader behaviors (NSC and SCWE) in key forums and provide trends for review by the NSCMP for review.
Corrective Actions (CA)
CA-2 Establish an NSC observer function and expectations to observe and provide feedback on leader behaviors in key forums and to provide trends for review by the NSCMP. This observer function is to be used at the discretion of the NSCMP and/or RAPID.
Due to this commitment, EN-QV-136, Nuclear Safety Culture Monitoring, section 5.2 requires a Nuclear Safety Culture Observe (NSCO) in certain meetings. ANO performance in the area of Nuclear Safety Culture has continuously been proven healthy in numerous assessments including NRC PI&Rs, SRC visits, INPO Evaluations, and other evaluation methods. Periodic Nuclear Safety Culture Monitoring Panels (NSCMP) and emergency or ad-hoc NSC meetings continue to be performed. Current ANO performance reveals that directed NSC observations should no longer be required, as their intended effect has been integrated into ANO culture.
However, they should still be available to be used as tools to address identified performance gaps, specific goals, or simply at the discretion of the NSCMP and/or RAPID.
Specific trending of NSC has been implemented effectively in EN-LI-121 (currently Section 5.2 Step 7), and EN-QV-136 directs the review of these applied NSC trend codes.
The intent of this request for commitment revision is not to stop performing NSC observations or applying NSC trend codes, it is simply to remove NSC Observations as a requirement in key forums, allowing the NSCMP and/or RAPID discretionary application. NSC trend code application is handled under EN-FAP-LI-001, EN-LI-102, and EN-LI-121.
1CAN112401 Page 14 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 19780 6/17/2016 10/24/024 Revise the OE actions for selected responses to require a Pre-Job Brief from the OE Specialist. This brief should include examples of missed opportunities from past OE Responses and a review of the procedure requirements for a satisfactory OE Written Response.
Cancel Commitment EN-OE-100, "Operating Experience Program" is being revised as part of the Path-to-Premier initiative, which includes the Operating Experience (OE) administrative processes being streamlined. The necessity of a specific Pre-Job brief for each OE response is no longer present.
CAP Training for General Employees includes lessons learned from not properly addressing Operating Experience.
The PJB (JA-PI-06) is available for use as a self-brief, department brief, or specialized brief. There is no intent to retire the PJB for OE entirely, only to target it at specific people/organizations/etc. as needed.
In the time since that Commitment was made several industry and ANO initiatives have been implemented that focused on the same topics. Notably, INPO IER L2-21-04, "Improving Plant Reliability", has several recommendations that involve the evaluation, application, and elevation of OE to improve equipment reliability. The ANO OE Coordinator maintains periodic contact with the INPO Department Specific Point of Contact (DSPOC) to share and received feedback on OE performance. ANO Performance Improvement also frequently monitors and measures how many OE reports are elevated at the station, and feedback is provided appropriately based on trends. ANO has fully implemented the industry recommendations and has been successfully evaluated by INPO on those recommendations indicating advancing beyond compliance to focus on continuous improvement in the application of OE. Further, ANO performance in the area of evaluating, applying, and elevating OE has improved over the last 4 years and has again been successfully evaluated by both the Entergy Fleet and INPO. ANO staff has consistently demonstrated that we have the standards and monitoring methods in place related to OE.
Additionally, oversight is given to the OE Program via PRG reviewing a set percentage of completed OE Written Responses to ensure quality continues. These PRG reviews are highly critical and in-depth enough to ensure targeted feedback is given for improvement. This review is generally more beneficial for the final Written Review than a PJB.
1CAN112401 Page 15 of 16 Number Original Date Changed Date Original Commitment Revised Commitment Justification of Change 19770 6/17/2016 10/24/2024 Develop and implement initial CAP training and develop continuing CAP training for station employees, ACE/RCE Evaluators, Responsible Managers (Including CARB and CRG), Department Performance Improvement Coordinators, OE Specialists and Points of Contact, and Performance Improvement Personnel.
Develop and implement initial CAP training and develop continuing CAP training for station employees, ACE/RCE Evaluators, Responsible Managers (Including CARB and CRG), Department Performance Improvement Coordinators, OE Specialists, and Performance Improvement Personnel.
The intent of this qualification for OE POC training stemmed from gaps in evaluating OE for applicability primarily during causal evaluations. The OE POC training originated from the extent-of-cause from the Root Cause (RC) and was not a significant contributor to the RC or Contributing Causes (CC). It is important to note the OE contribution to causal evaluations is maintained in the causal evaluation training in guidance and OE POC training is separate.
Since this commitment was made, several industry and ANO initiatives have been implemented that focused on the same topics. Notably, INPO IER L2-21-04, "Improving Plant Reliability" has several recommendations that involve the evaluation, application, and elevation of OE to improve equipment reliability. The ANO OE Coordinator maintains periodic contact with the INPO Department Specific Point of Contact (DSPOC) to share and received feedback on OE performance. ANO Performance Improvement also frequently monitors and measures how many OE reports are elevated at the station and feedback is provided appropriately based on trends.
ANO has fully implemented industry recommendations and has been successfully evaluated by INPO on those recommendations. Further, ANO performance in the area of evaluating, applying, and elevating OE has improved over the last 4 years and has been successfully evaluated by both the Entergy Fleet and INPO. Exposure to, and oversight of OE for all employees is much broader now than it was when this RCE was completed.
Elimination of this requirement does not impact the RC or CC from the associated Condition Report. It is desired to reduce the administrative burden in the area of OE evaluation and application. The OE POC Training discussed above will still be available for review by personnel as needed.
1CAN112401 Page 16 of 16 List of Acronyms ACE Apparent Cause Evaluation ANO Arkansas Nuclear One APHC ANO People Health Committee ATWS Anticipated Transient Without SCRAM CA Corrective Action CAP Corrective Action Program CARB Corrective Action Review Board CC Contributing Cause CO Corporate Oversight CRG Condition Report Review Group DPRM Department Performance Review Meeting DROPS Diverse Reactor Overpressure Prevention System DSPOC INPO Department Specific Point of Contact IDP Independent Decision-Making Panel INPO Institute of Nuclear Power Operations ISWP Integrated Strategic Workforce Plan LCO Limiting Condition for Operation NIOS Nuclear Independent Oversight NSC Nuclear Safety Culture NSCMP Nuclear Safety Culture Monitoring Panel NSCO Nuclear Safety Culture Observer OE Operating Experience PASS Post-Accident Sampling System PI&R Problem Identification and Resolution PJB Pre-Job Brief POC Point of Contact PRA Probabilistic Risk Assessment PRG Performance Improvement Review Group PRM Performance Review Meeting RAPID Regulatory Assurance and Performance Improvement Director RB Reactor Building RC Root Cause RCE Root Cause Evaluation RCS Reactor Coolant System SC Safety Culture SCWE Safety Conscious Work Environment SFCP Surveillance Frequency Control Program SME Subject Matter Expert SR Surveillance Requirement SRC Safety Review Committee SSC Systems, Structures, and Components STI Surveillance Test Interval Evaluation TS Technical Specification VOC Vendor Oversight Committee 1CAN112401 List of Affected SAR Pages
1CAN112401 Page 1 of 1 List of Affected SAR Pages The following is a list of Safety Analysis Report (SAR) pages revised in Amendment 32 to support corrections, modifications, implementation of licensing basis changes, etc., as described in the Table of Contents of each SAR chapter (reference Enclosure 1 of this letter).
Information relocated from one page to another in support of the aforementioned revisions is not considered a change; therefore, these pages are not included in the following list. In addition, pages associated with the individual Table of Contents are not listed below as related revisions are administrative only changes.
Cover Page 3A.9-2 Figure 3A-2 7.1-6 1.4-2 3A.9-3 Figure 3A-3 7.2-19 1.4-3 3A.9-4 Figure 3A-4 7.6-11 1.11-28 3A.10-1 Figure 3A-5 8.3-29 2.3-3 3A.10-2 Figure 3A-6 9.6-3 2.8-2 3A.11-1 Figure 3A-7 9.6-4 Figure 2-32 3A.11-2 Figure 3A-8 9.6-5 3.4-5 3A.11-3 Figure 3A-9 9.6-27 3A.1-1 3A.11-4 Figure 3A-10 9.6-29 3A.2-1 3A.11-5 Figure 3A-11 Figure 9-16 3A.3-1 3A.11-6 Figure 3A-12 10.1-2 3A.3-2 3A.11-7 Figure 3A-13A 14.1-20 3A.4-1 3A.11-8 Figure 3A-13B A.3-2 3A.4-2 3A.11-9 Figure 3A-13C A.3-3 3A.4-3 3A.11-10 Figure 3A-14A 3A.4-4 3A.11-11 Figure 3A-14B 3A.5-1 3A.11-12 Figure 3A-14C 3A.5-2 3A.11-13 Figure 3A-15A 3A.6-1 3A.11-14 Figure 3A-15B 3A.7-1 3A.11-15 Figure 3A-15C 3A.7-2 3A.11-16 Figure 3A-16A 3A.7-3 3A.11-17 Figure 3A-16B 3A.8-1 3A.11-18 Figure 3A-16C 3A.8-2 3A.11-19 Figure 3A-17 3A.9-1 Figure 3A-1 Figure 3A-18
SECURITY RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 This letter is decontrolled when separated from Enclosure 1 1CAN112401 ANO-1 SAR Amendment 32 Un-redacted Version 1CAN112401 ANO-1 SAR Amendment 32 Redacted Version 1CAN112401 ANO-1 TRM 1CAN112401 ANO-1 TS Table of Contents and TS Bases