ND-23-0597, ITAAC Closure Notification on Completion of ITAAC 2.5.02.06a.ii (Index Number 530)

ITAAC Closure Notification on Completion of ITAAC 2.5.02.06a.ii (Index Number 530)

ML23195A106
Person / Time
Site:	Vogtle
Issue date:	07/14/2023
From:	Coleman J Southern Nuclear Operating Co
To:	Office of Nuclear Reactor Regulation, Document Control Desk
References
ND-23-0597, ITAAC 2.5.02.06a.ii
Download: ML23195A106 (1)

Text

Jamie M. Coleman Regulatory Affairs Director Vogtle 3 & 4 7825 River Road Waynesboro, GA 30830 706-848-6926 tel July 14, 2023 Docket No.:

52-026 ND-23-0597 10 CFR 52.99(c)(1)

U.S. Nuclear Regulatory Commission Document Control Desk Washington, DC 20555-0001 Southern Nuclear Operating Company Vogtle Electric Generating Plant Unit 4 ITAAC Closure Notification on Completion of ITAAC 2.5.02.06a.ii [Index Number 530]

Ladies and Gentlemen:

In accordance with 10 CFR 52.99(c)(1), the purpose of this letter is to notify the Nuclear Regulatory Commission (NRC) of the completion of Vogtle Electric Generating Plant (VEGP) Unit 4 Inspections, Tests, Analyses, and Acceptance Criteria (ITAAC) Item 2.5.02.06a.ii [Index Number 530] for verification of the Protection and Safety Monitoring System (PMS) via completion of the specified tests and inspections. The closure process for this ITAAC is based on the guidance described in NEI 08-01, Industry Guideline for the ITAAC Closure Process under 10 CFR Part 52, which was endorsed by the NRC in Regulatory Guide 1.215.

This letter contains no new NRC regulatory commitments. Southern Nuclear Operating Company (SNC) requests NRC staff confirmation of this determination and publication of the required notice in the Federal Register per 10 CFR 52.99.

If there are any questions, please contact Kelli Roberts at 706-848-6991.

Respectfully submitted, Jamie M. Coleman Regulatory Affairs Director Vogtle 3 & 4

Enclosure:

Vogtle Electric Generating Plant (VEGP) Unit 4 Completion of ITAAC 2.5.02.06a.ii [Index Number 530]

JMC/KIK/sfr

U.S. Nuclear Regulatory Commission ND-23-0597 Page 2 of 2 cc:

Regional Administrator, Region ll Director, Office of Nuclear Reactor Regulation (NRR)

Director, Vogtle Project Office NRR Senior Resident Inspector - Vogtle 3 & 4

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 1 of 21 Southern Nuclear Operating Company ND-23-0597 Enclosure Vogtle Electric Generating Plant (VEGP) Unit 4 Completion of ITAAC 2.5.02.06a.ii [Index Number 530]

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 2 of 21 ITAAC Statement Design Commitment 6.a) The PMS initiates an automatic reactor trip, as identified in Table 2.5.2-2, when plant process signals reach specified limits.

6.b) The PMS initiates automatic actuation of engineered safety features, as identified in Table 2.5.2-3, when plant process signals reach specified limits.

6.c) The PMS provides manual initiation of reactor trip and selected engineered safety features as identified in Table 2.5.2-4.

8.a) The PMS provides for the minimum inventory of displays, visual alerts, and fixed position controls, as identified in Table 2.5.2-5. The plant parameters listed with a "Yes" in the "Display" column and visual alerts listed with a "Yes" in the "Alert" column can be retrieved in the MCR.

The fixed position controls listed with a "Yes" in the "Control" column are provided in the MCR.

8.c) Displays of the open/closed status of the reactor trip breakers can be retrieved in the MCR.

9.a) The PMS automatically removes blocks of reactor trip and engineered safety features actuation when the plant approaches conditions for which the associated function is designed to provide protection. These blocks are identified in Table 2.5.2-6.

9.b) The PMS two-out-of-four initiation logic reverts to a two-out-of-three coincidence logic if one of the four channels is bypassed. All bypassed channels are alarmed in the MCR.

9.c) The PMS does not allow simultaneous bypass of two redundant channels.

Inspections/Tests/Analyses An operational test of the as-built PMS will be performed using real or simulated test signals.

An operational test of the as-built PMS will be performed using real or simulated test signals.

An operational test of the as-built PMS will be performed using the PMS manual actuation controls.

i) An inspection will be performed for retrievability of plant parameters in the MCR.

iii) An operational test of the as-built system will be performed using each MCR fixed position control.

Inspection will be performed for retrievability of displays of the open/closed status of the reactor trip breakers in the MCR.

An operational test of the as-built PMS will be performed using real or simulated test signals.

An operational test of the as-built PMS will be performed.

An operational test of the as-built PMS will be performed. With one channel in bypass, an attempt will be made to place a redundant channel in bypass.

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 3 of 21 Acceptance Criteria ii) PMS output signals to the reactor trip switchgear are generated after the test signal reaches the specified limit. This needs to be verified for each automatic reactor trip function.

Appropriate PMS output signals are generated after the test signal reaches the specified limit.

These output signals remain following removal of the test signal. Tests from the actuation signal to the actuated device(s) are performed as part of the system-related inspection, test, analysis, and acceptance criteria.

ii) PMS output signals are generated for reactor trip and selected engineered safety features as identified in Table 2.5.2-4 after the manual initiation controls are actuated.

i) The plant parameters listed in Table 2.5.2-5 with a "Yes" in the "Display" column, can be retrieved in the MCR.

iii) For each test of an as-built fixed position control listed in Table 2.5.2-5 with a "Yes" in the "Control" column, an actuation signal is generated. Tests from the actuation signal to the actuated device(s) are performed as part of the system-related inspection, test, analysis and acceptance criteria.

Displays of the open/closed status of the reactor trip breakers can be retrieved in the MCR.

The PMS blocks are automatically removed when the test signal reaches the specified limit.

The PMS two-out-of-four initiation logic reverts to a two-out-of-three coincidence logic if one of the four channels is bypassed. All bypassed channels are alarmed in the MCR.

The redundant channel cannot be placed in bypass.

ITAAC Determination Basis Multiple ITAAC are performed to verify that:

The Protection and Safety Monitoring System (PMS) initiates an automatic reactor trip, as identified in Table 2.5.2-2, when plant process signals reach specified limits.

The PMS provides manual initiation of reactor trip and selected engineered safety features as identified in Table 2.5.2-4.

The PMS provides for the minimum inventory of displays, visual alerts, and fixed position controls as identified in Table 2.5.2-5, with the plant parameters listed with a "Yes" in the "Display" column and visual alerts listed with a "Yes" in the "Alert" column retrievable in the MCR (Main Control Room), and the fixed position controls listed with a "Yes" in the "Control" column provided in the MCR.

The subject ITAAC requires:

An operational test of the as-built PMS be performed using real or simulated test signals to verify PMS output signals to the reactor trip switchgear are generated after the test signal reaches the specified limit for each automatic reactor trip function.

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 4 of 21 An operational test of the as-built PMS be performed using the PMS manual actuation controls to verify PMS output signals are generated for reactor trip and selected engineered safety features as identified in Table 2.5.2-4 after the manual initiation controls are actuated.

An inspection be performed to verify the plant parameters listed in Table 2.5.2-5 with a "Yes" in the "Display" column, can be retrieved in the MCR.

An operational test of the as-built system be performed using each MCR fixed position control to verify for each test of an as-built fixed position control listed in Table 2.5.2-5 with a "Yes" in the "Control" column, an actuation signal is generated.

This ITAAC also performs:

An operational test of the as-built PMS using real or simulated test signals to verify appropriate PMS output signals are generated after the test signal reaches the specified limit and remain following removal of the test signal to demonstrate the PMS initiates automatic actuation of engineered safety features, as identified in Table 2.5.2-3, when plant process signals reach specified limits.

An inspection for retrievability of displays of the open/closed status of the reactor trip breakers in the MCR to demonstrate displays of the open/closed status of the reactor trip breakers can be retrieved in the MCR.

An operational test of the as-built PMS using real or simulated test signals to demonstrate the PMS automatically removes blocks of reactor trip and engineered safety features actuation identified in Table 2.5.2-6 when the plant approaches conditions for which the associated function is designed to provide protection.

An operational test of the as-built PMS to demonstrate the PMS two-out-of-four initiation logic reverts to a two-out-of-three coincidence logic if one of the four channels is bypassed and bypassed channels are alarmed in the MCR.

An operational test of the as-built PMS in which with one channel in bypass, an attempt will be made to place a redundant channel in bypass to demonstrate the PMS does not allow simultaneous bypass of two redundant channels.

ii) PMS output signals to the reactor trip switchgear are generated after the test signal reaches the specified limit. This needs to be verified for each automatic reactor trip function.

An operational test of the as-built PMS was performed using simulated test signals. The operational test verified that PMS output signals to the reactor trip switchgear were generated after the test signal reached the specified limit for each automatic reactor trip function identified in COL Appendix C Table 2.5.2-2 (Attachment A).

This ITAAC was completed as a combination of:

Factory Acceptance Test - Functional testing of each PMS automatic reactor trip from the test signal input to the PMS output signals to the reactor trip switchgear Site software installation and regression test - Hardware and software integration verification and testing of changes

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 5 of 21 The Factory Acceptance Testing (FAT) followed the guidance of NEI 08-01 (Reference 1)

Section 9.4 for the as-built tests to be performed at other than the final installed location. The FAT was performed in accordance with the Software Program Manual for Common Q Systems WCAP-16096 (Reference 2), AP1000 Protection and Safety Monitoring System Test Plan (Reference 3), and applicable Codes and Standards described in Vogtle 3 and 4 UFSAR Chapter 7 (Reference 4).

The FAT included testing of PMS inputs and outputs, logic, and functionality. During the test, the process parameters were simulated and adjusted to create applicable reactor trip conditions.

PMS signals at reactor trip computer point PMSY-RXTR (Y = A, B, C, or D in accordance with its PMS division) were monitored and it was confirmed that each automatic reactor trip function works as designed from the simulated input to reactor trip computer point PMSY-RXTR. This testing was performed in accordance with FAT Test Procedures SV4-PMS-T1P-007 (Reference

5) and SV4-PMS-T1P-035 (Reference 6). The results of this testing are documented in FAT test reports SV4-PMS-T2R-007 (Reference 7) and SV4-PMS-T2R-035 (Reference 8). During testing in FAT Test Procedure SV4-PMS-T1P-012 (Reference 9), a Steam Generator-2 Level Low-2 was initiated, signals at the computer point PMSY-RXTR were verified, the shunt trip outputs from PMS were verified to turn on, and the under-voltage outputs from PMS were verified to turn off. The results of this testing are documented in the FAT test report SV4-PMS-T2R-012 (Reference 10).

Additional hardware and software installation and associated inspections and testing were performed on-site to verify that the cabinets were intact and functional in accordance with Field Change Notifications (FCNs) AP1000 Vogtle Unit 4 PMS Software Installation - Software Release 9.0.0.1 (Reference 11) and PMS Software Installation - Software Release 9.0.0.4 (Reference 12). These FCNs were implemented by work orders listed in ITAAC Technical Report SV4-PMS-Cabinet Software Loading-001 (Reference 14), and B-GEN-ITPCI-001 (Reference 13). SV4-PMS Cabinet Software Loading-001 (Reference 14) summarizes the software loading. SV4-PMS Cabinet Diagnostic Testing -001 (Reference 15) documents the performance of diagnostic testing, using individual WOs for each cabinet, and verified the diagnostics were satisfactory for each cabinet. References 14 and 15 include steps that confirm and document successful software load and further confirm the physical properties of the as-built PMS. A regression analysis (i.e., change evaluation) was performed for software changes (Reference 16) to determine if additional testing was needed for the as-built system.

The completed Unit 4 FAT test reports, FCNs, B-GEN-ITPCI-001, and regression test results confirm that appropriate PMS output signals were generated after the test signal reaches the specified limit. These output signals remain following removal of the test signal. Tests from the actuation signal to the actuated device(s) are performed as part of the system-related inspection, test, analysis, and acceptance criteria.

Appropriate PMS output signals are generated after the test signal reaches the specified limit.

These output signals remain following removal of the test signal. Tests from the actuation signal to the actuated device(s) are performed as part of the system-related inspection, test, analysis, and acceptance criteria.

An operational test of the as-built PMS was performed using simulated test signals. The operational test verified that appropriate PMS output signals were generated after the test signal reached the specified limit and that these output signals remain following removal of the test signal.

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 6 of 21 This ITAAC was completed as a combination of:

Factory Acceptance Test - Functional testing of PMS automatic engineered safety features from the test signal input to the actuation signal output Site software installation and regression test - Hardware and software integration verification and testing of changes The Factory Acceptance Testing (FAT) followed the guidance of NEI 08-01 (Reference 1)

Section 9.4 for the as-built tests to be performed at other than the final installed location. The FAT was performed in accordance with the Software Program Manual for Common Q Systems WCAP-16096 (Reference 2), AP1000 Protection and Safety Monitoring System Test Plan (Reference 3), and applicable Codes and Standards described in Vogtle 3 and 4 UFSAR Chapter 7 (Reference 4).

The FAT includes testing of PMS inputs and outputs, logic, and functionality. During this test, the initial conditions for the test scenarios were established and confirmed that the setpoints and logics which generated output signals for all the engineered safety features (ESF) identified in COL Table 2.5.2-3 (Attachment B) work as designed. Testing initially input a test signal that verified the bistable and coincidence logic of the PMS. The output from the PMS was then sent to modules that operate the devices in the field with the output signals of these modules documented. Additionally, output signals which are designed to remain following removal of the test signal were verified. This testing was performed in accordance with FAT Test Procedures SV4-PMS-T1P-007 (Reference 5), SV4-PMS-T1P-008 (Reference 17), SV4-PMS-T1P-009 (Reference 18), SV4-PMS-T1P-012 (Reference 9), and SV4-PMS-T1P-035 (Reference 6). The results of the tests are documented in FAT Test Reports SV4-PMS-T2R-007 (Reference 7),

SV4-PMS-T2R-008 (Reference 19), SV4-PMS-T2R-009 (Reference 20), SV4-PMS-T2R-012 (Reference 10), and SV4-PMS-T2R-035 (Reference 8).

The output signals for the Turbine Trip ESF function are designed to not remain following removal of the test signal and is not included in the testing above. In the event of a Turbine Trip, manual operator action is performed to latch the Turbine.

Additional hardware and software installation and associated inspections and testing were performed on-site to verify that the cabinets were intact and functional in accordance with Field Change Notifications (FCNs) AP1000 Vogtle Unit 4 PMS Software Installation - Software Release 9.0.0.1 (Reference 11) and PMS Software Installation - Software Release 9.0.0.4 (Reference 12). These FCNs were implemented by work orders listed in ITAAC Technical Report SV4-PMS-Cabinet Software Loading-001 (Reference 14), and B-GEN-ITPCI-001 (Reference 13). SV4-PMS Cabinet Software Loading-001 (Reference 14) summarizes the software loading. SV4-PMS Cabinet Diagnostic Testing -001 (Reference 15) documents the performance of diagnostic testing, using individual WOs for each cabinet, and verified the diagnostics were satisfactory for each cabinet. References 14 and 15 include steps that confirm and document successful software load and further confirm the physical properties of the as-built PMS. A regression analysis (i.e., change evaluation) was performed for software changes (Reference 16) to determine if additional testing was needed for the as-built system.

The completed Unit 4 FAT test reports, FCNs, B-GEN-ITPCI-001, and regression test results confirm that appropriate PMS output signals are generated after the test signal reaches the specified limit. These output signals remain following removal of the test signal. Tests from the actuation signal to the actuated device(s) are performed as part of the system-related inspection, test, analysis, and acceptance criteria.

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 7 of 21 ii) PMS output signals are generated for reactor trip and selected engineered safety features as identified in Table 2.5.2-4 after the manual initiation controls are actuated.

An operational test of the as-built PMS was performed using PMS manual actuation controls.

The operational test verified that PMS output signals were generated for reactor trip and selected engineered safety features as identified in Table 2.5.2-4 after the manual initiation controls were actuated.

This ITAAC was completed as a combination of:

Factory Acceptance Test - Testing of PMS logic and functions using simulated manual initiation control inputs and verifying generation of the outputs for reactor trip and ESF functions Site software installation and regression test - Hardware and software integration verification and testing of changes Component Test - Testing of the as-built manual initiation controls and verifying the inputs to PMS for ESF functions Preoperational Test - Testing of the as-built manual initiation controls and verifying the inputs to PMS for reactor trip functions The Factory Acceptance Testing (FAT) followed the guidance of NEI 08-01 (Reference 1)

Section 9.4 for the as-built tests to be performed at other than the final installed location. The FAT was performed in accordance with the Software Program Manual for Common Q Systems WCAP-16096 (Reference 2), AP1000 Protection and Safety Monitoring System Test Plan (Reference 3), and applicable Codes and Standards described in Vogtle 3 and 4 UFSAR Chapter 7 (Reference 4).

The FAT included testing of PMS inputs and outputs, logic, and functionality. During this test, the manual initiation control inputs to the PMS were simulated and it was confirmed that the output signals were actuated for reactor trip and selected engineered safety features manual actuations as identified in COL Appendix C Table 2.5.2-4 (Attachment C). This testing was performed in accordance with the PMS FAT procedures SV4-PMS-T1P-007 (Reference 5) and SV4-PMS-T1P-008 (Reference 17). The results of the tests are documented in the FAT test reports SV4-PMS-T2R-007 (Reference 7) and SV4-PMS-T2R-008 (Reference 19).

Additional hardware and software installation and associated inspections and testing were performed on-site to verify that the cabinets were intact and functional in accordance with Field Change Notifications (FCNs) AP1000 Vogtle Unit 4 PMS Software Installation - Software Release 9.0.0.1 (Reference 11) and PMS Software Installation - Software Release 9.0.0.4 (Reference 12). These FCNs were implemented by work orders listed in ITAAC Technical Report SV4-PMS-Cabinet Software Loading-001 (Reference 14), and B-GEN-ITPCI-001 (Reference 13). SV4-PMS Cabinet Software Loading-001 (Reference 14) summarizes the software loading. SV4-PMS Cabinet Diagnostic Testing -001 (Reference 15) documents the performance of diagnostic testing, using individual WOs for each cabinet, and verified the diagnostics were satisfactory for each cabinet. References 14 and 15 include steps that confirm and document successful software load and further confirm the physical properties of the as-built PMS. A regression analysis (i.e., change evaluation) was performed for software changes (Reference 16) to determine if additional testing was needed for the as-built system.

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 8 of 21 Testing of selected ESF manual initiation controls identified in Attachment C was performed in accordance with component test package listed in Reference 21. This component test package tested ESF manual initiation controls. Selected ESF manual initiation controls were actuated and confirmed at the PMS input, by visually inspecting the digital input LED. The completed Unit 4 component test package confirms that select ESF manual controls actuations are received at PMS.

Testing of reactor trip manual controls was performed in accordance with pre-operational test work package listed in Reference 21 to test reactor trip manual initiation controls. Reactor trip manual initiation controls PMS-HS025 and PMS-HS026 were actuated in the Main Control Room (MCR) and Manual Reactor Trip Logic Trip was verified on each divisional safety display.

The completed Unit 4 test procedure confirmed that each Reactor Trip Circuit Breaker (RTCB) trip status was changed after actuation of manual controls.

The completed Unit 4 FAT test reports, FCNs, B-GEN-ITPCI-001, regression test results, and completed component and preoperational test results confirmed that the PMS output signals were generated for reactor trip and selected engineered safety features as identified in Table 2.5.2-4 after the manual initiation controls were actuated.

i) The plant parameters listed in Table 2.5.2-5 with a "Yes" in the "Display" column, can be retrieved in the MCR.

An inspection was performed to verify the retrievability of the VEGP Unit 4 plant parameters in the MCR. The inspection for retrievability confirmed that the plant parameters listed in COL Appendix C Table 2.5.2-5 (Attachment D) with a "Yes" in the "Display" column can be retrieved in the MCR.

The inspection was performed as documented in Reference 22 and visually confirmed that when each of the plant parameters identified in Attachment D with a Yes in the Display column was recalled using the MCR PMS Visual Display Units (VDUs), the expected display appeared on the PMS VDU.

The inspection results are included in Reference 22 and confirm that the plant parameters listed in Table 2.5.2-5 with a "Yes" in the "Display" column can be retrieved in the MCR.

iii) For each test of an as-built fixed position control listed in Table 2.5.2-5 with a "Yes" in the "Control" column, an actuation signal is generated. Tests from the actuation signal to the actuated device(s) are performed as part of the system-related inspection, test, analysis and acceptance criteria.

An operational test of the as-built PMS was performed using each MCR fixed position control to verify that for each test of an as-built fixed position control listed in COL Appendix C Table 2.5.2-5 with a "Yes" in the "Control" column (Attachment D), an actuation signal was generated.

This ITAAC was completed as a combination of:

Factory Acceptance Test - Testing of PMS logic and functions using simulated fixed position control inputs and verifying generation of the actuation signal output Site software installation and regression test - Hardware and software integration verification and testing of changes

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 9 of 21 Component Test - Testing of the as-built fixed position controls and verifying the inputs to PMS for ESF functions Preoperational Test - Testing of the as-built fixed position controls and verifying the inputs to PMS for reactor trip functions The Factory Acceptance Testing (FAT) followed the guidance of NEI 08-01 (Reference 1)

Section 9.4 for the as-built tests to be performed at other than the final installed location. The FAT was performed in accordance with the Software Program Manual for Common Q Systems WCAP-16096 (Reference 2), AP1000 Protection and Safety Monitoring System Test Plan (Reference 3), and applicable Codes and Standards described in Vogtle 3 and 4 UFSAR Chapter 7 (Reference 4).

The FAT included testing of PMS inputs and outputs, logic, and functionality. During this test, the fixed position control inputs to the PMS were simulated and it was confirmed that the actuation signals were generated for reactor trip and selected engineered safety features manual actuations as identified in Attachment D. This testing was performed in accordance with the PMS FAT procedures APP-PMS-T1P-007 (Reference 5) and SV4-PMS-T1P-008 (Reference 18). The results of the tests are documented in the FAT test reports SV4-PMS-T2R-007 (Reference 7) and SV4-PMS-T2R-008 (Reference 19).

Additional hardware and software installation and associated inspections and testing were performed on-site to verify that the cabinets were intact and functional in accordance with Field Change Notifications (FCNs) AP1000 Vogtle Unit 4 PMS Software Installation - Software Release 9.0.0.1 (Reference 11) and PMS Software Installation - Software Release 9.0.0.4 (Reference 12). These FCNs were implemented by work orders listed in ITAAC Technical Report SV4-PMS-Cabinet Software Loading-001 (Reference 14), and B-GEN-ITPCI-001 (Reference 13). SV4-PMS Cabinet Software Loading-001 (Reference 14) summarizes the software loading. SV4-PMS Cabinet Diagnostic Testing -001 (Reference 15) documents the performance of diagnostic testing, using individual WOs for each cabinet, and verified the diagnostics were satisfactory for each cabinet. References 14 and 15 include steps that confirm and document successful software load and further confirm the physical properties of the as-built PMS. A regression analysis (i.e., change evaluation) was performed for software changes (Reference 16) to determine if additional testing was needed for the as-built system.

Testing of selected ESF fixed position controls identified in Attachment D was performed in accordance with component test package listed in Reference 21. This component test package tested ESF fixed position controls. Selected ESF fixed position controls identified in Attachment D were actuated and confirmed at the PMS input, by visually inspecting the digital input LED.

Testing of the Manual ADS and IRWST Injection Unblock was performed in accordance with Unit 4 component test packages listed in Reference 21. The Manual ADS and IRWST Injection Unblock fixed position control switch was taken to unblock in the MCR and the block was verified to be removed at the Component Interface Modules (CIM).

Testing of reactor trip fixed position controls was performed in accordance with pre-operational test work package listed in Reference 21 to test reactor trip fixed position controls. Reactor trip fixed position controls were actuated in the Main Control Room (MCR) and Manual Reactor Trip Logic Trip was verified on each divisional safety display. The test results confirm that each RTCB trip status was changed after actuation of the manual reactor trip fixed position controls.

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 10 of 21 The completed Unit 4 FAT test reports, FCNs, B-GEN-ITPCI-001, regression test results, and component and preoperational test results confirm that for each test of an as-built fixed position control listed in Attachment D with a "Yes" in the "Control" column, an actuation signal is generated. Tests from the actuation signal to the actuated device(s) are performed as part of the system-related inspection, test, analysis and acceptance criteria.

Displays of the open/closed status of the reactor trip breakers can be retrieved in the MCR.

An inspection was performed to verify the displays of the open/closed status of the reactor trip breakers can be retrieved in the MCR.

The inspection was performed as described in Reference 21 and visually confirmed that when each of the displays of the open/closed status of the reactor trip breakers were summoned using the MCR PMS Visual Display Units (VDUs), the expected display appeared on the PMS VDU.

The inspection results are included in Reference 21 and confirm that displays of the open/closed status of the reactor trip breakers can be retrieved in the MCR.

The PMS blocks are automatically removed when the test signal reaches the specified limit.

An operational test of the as-built PMS was performed using simulated test signals to verify that PMS blocks are automatically removed when the test signal reaches the specified limit.

This ITAAC was completed as a combination of:

Factory Acceptance Test - Functional testing of PMS ability to automatically remove blocks Site software installation and regression test - Hardware and software integration verification and testing of changes Component Test - Testing of the PMS auto-block removal for the items not covered in the FAT The Factory Acceptance Testing (FAT) followed the guidance of NEI 08-01 (Reference 1)

Section 9.4 for the as-built tests to be performed at other than the final installed location. The FAT was performed in accordance with the Software Program Manual for Common Q Systems WCAP-16096 (Reference 2), AP1000 Protection and Safety Monitoring System Test Plan (Reference 3), and applicable Codes and Standards described in Vogtle 3 and 4 UFSAR Chapter 7 (Reference 4).

The FAT included testing of PMS inputs and outputs, logic, and functionality. During this test, the initial conditions for the test scenarios were established and confirmed that PMS blocks were automatically removed as appropriate for the reactor trip and engineered safety feature actuation blocks identified in COL Appendix C Table 2.5.2-6 (Attachment E). During the test, the process parameters were simulated and adjusted to create applicable unblock conditions, PMS unblock signals were monitored, and it was confirmed that the automatic unblock functions work as designed. This testing was performed in accordance with FAT Test Procedures SV4-PMS-T1P-007 and SV4-PMS-T1P-008 (Reference 5 and 17). The results of the testing are documented in the FAT test reports SV4-PMS-T2R-007, SV4-PMS-T2R-008 and SV4-PMS-T2R-408 (References 7, 19, and 25).

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 11 of 21 Additional hardware and software installation and associated inspections and testing were performed on-site to verify that the cabinets were intact and functional in accordance with Field Change Notifications (FCNs) AP1000 Vogtle Unit 4 PMS Software Installation - Software Release 9.0.0.1 (Reference 11) and PMS Software Installation - Software Release 9.0.0.4 (Reference 12). These FCNs were implemented by work orders listed in ITAAC Technical Report SV4-PMS-Cabinet Software Loading-001 (Reference 14), and B-GEN-ITPCI-001 (Reference 13). SV4-PMS Cabinet Software Loading-001 (Reference 14) summarizes the software loading. SV4-PMS Cabinet Diagnostic Testing -001 (Reference 15) documents the performance of diagnostic testing, using individual WOs for each cabinet, and verified the diagnostics were satisfactory for each cabinet. References 14 and 15 include steps that confirm and document successful software load and further confirm the physical properties of the as-built PMS. A regression analysis (i.e., change evaluation) was performed for software changes (Reference 16) to determine if additional testing was needed for the as-built system.

Additional testing of the auto-block removal was performed in accordance with component test package listed in Reference 23. During this test, the initial conditions for the test scenarios were established and confirmed that PMS blocks were in place, the process parameters were simulated and adjusted to create applicable unblock conditions, PMS unblock signals were monitored, and it was confirmed that the automatic unblock functions work as designed.

The completed FAT test reports, FCNs, B-GEN-ITPCI-001, regression test results and component testing confirm that the PMS blocks are automatically removed when the test signal reaches the specified limit.

The PMS two-out-of-four initiation logic reverts to a two-out-of-three coincidence logic if one of the four channels is bypassed. All bypassed channels are alarmed in the MCR.

An operational test of the as-built PMS was performed to verify that PMS two-out-of-four initiation logic reverts to a two-out-of-three coincidence logic if one of the four channels is bypassed and that all bypassed channels are alarmed in the MCR.

This ITAAC was completed as a combination of:

Factory Acceptance Test - Functional testing of PMS to ensure two-out-of-four initiation logic reverts to a two-out-of-three coincidence logic if one of the four channels is bypassed and that all bypassed channels are alarmed in the MCR Site software installation and regression test - Hardware and software integration verification and testing of changes Pre-operational Test - Functional testing of PMS to ensure that an alarm is received in the MCR when a channel is bypassed The Factory Acceptance Testing (FAT) followed the guidance of NEI 08-01 (Reference 1)

Section 9.4 for the as-built tests to be performed at other than the final installed location. The FAT was performed in accordance with the Software Program Manual for Common Q Systems WCAP-16096 (Reference 2), AP1000 Protection and Safety Monitoring System Test Plan (Reference 3), and applicable Codes and Standards described in Vogtle 3 and 4 UFSAR Chapter 7 (Reference 4).

The FAT included testing of PMS inputs and outputs, logic, and functionality. During this test, the initial conditions for the test scenarios were established and confirmed that PMS two-out-of-

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 12 of 21 four initiation logic reverts to a two-out-of-three coincidence logic if one of the four channels is bypassed. During the test, one of the four PMS channels was taken to bypass, PMS logic was monitored, and it was confirmed that the change in logic works as designed. This testing was performed in accordance with FAT Test Procedures SV4-PMS-T1P-026 (Reference 26). The results of the testing are documented in the FAT test report SV4-PMS-T2R-026 (Reference 27).

Additional hardware and software installation and associated inspections and testing were performed on-site to verify that the cabinets were intact and functional in accordance with Field Change Notifications (FCNs) AP1000 Vogtle Unit 4 PMS Software Installation - Software Release 9.0.0.1 (Reference 11) and PMS Software Installation - Software Release 9.0.0.4 (Reference 12). These FCNs were implemented by work orders listed in ITAAC Technical Report SV4-PMS-Cabinet Software Loading-001 (Reference 14), and B-GEN-ITPCI-001 (Reference 13). SV4-PMS Cabinet Software Loading-001 (Reference 14) summarizes the software loading. SV4-PMS Cabinet Diagnostic Testing -001 (Reference 15) documents the performance of diagnostic testing, using individual WOs for each cabinet, and verified the diagnostics were satisfactory for each cabinet. References 14 and 15 include steps that confirm and document successful software load and further confirm the physical properties of the as-built PMS. A regression analysis (i.e., change evaluation) was performed for software changes (Reference 16) to determine if additional testing was needed for the as-built system.

Testing of bypass alarms in the MCR was performed in accordance with pre-operational test listed in Reference 24. Each PMS division was individually placed in partial bypass at the Maintenance and Test Panel (MTP) and the bypassed channel alarms were verified in the MCR.

The test results confirm that each RTCB trip status was changed after actuation of the manual reactor trip fixed position controls.

The completed FAT test reports, FCNs, B-GEN-ITPCI-001, regression test results, and completed preoperational test results confirm that the PMS two-out-of-four initiation logic reverts to a two-out-of-three coincidence logic if one of the four channels is bypassed and that all bypassed channels are alarmed in the MCR.

The redundant channel cannot be placed in bypass.

An operational test of the as-built PMS was performed by attempting to place a redundant channel in bypass with one channel in bypass to verify the redundant channel cannot be placed in bypass.

This ITAAC is completed as a combination of:

Factory Acceptance Test - Functional testing of PMS to ensure redundant channels cannot be placed in bypass with one channel in bypass Site software installation and regression test - Hardware and software integration verification and testing of post system delivery changes The Factory Acceptance Testing (FAT) followed the guidance of NEI 08-01 (Reference 1)

Section 9.4 for the as-built tests to be performed at other than the final installed location. The FAT was performed in accordance with the Software Program Manual for Common Q Systems WCAP-16096 (Reference 2), AP1000 Protection and Safety Monitoring System Test Plan (Reference 3), and applicable Codes and Standards described in Vogtle 3 and 4 UFSAR Chapter 7 (Reference 4).

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 13 of 21 The FAT included testing of PMS inputs and outputs, logic, and functionality. During this test, the initial conditions for the test scenarios were established and confirmed that with one channel of PMS in bypass, the redundant channel cannot be placed in bypass. During the test, one of the four PMS channels was taken to bypass, an attempt to place a redundant channel in bypass was made, and it was confirmed that the redundant channel cannot be placed in bypass. This testing was performed in accordance with FAT Test Procedure SV4-PMS-T1P-026 (Reference 26). The results of the testing are documented in the FAT test report SV4-PMS-T2R-026 (Reference 27).

Additional hardware and software installation and associated inspections and testing were performed on-site to verify that the cabinets were intact and functional in accordance with Field Change Notifications (FCNs) AP1000 Vogtle Unit 4 PMS Software Installation - Software Release 9.0.0.1 (Reference 11) and PMS Software Installation - Software Release 9.0.0.4 (Reference 12). These FCNs were implemented by work orders listed in ITAAC Technical Report SV4-PMS-Cabinet Software Loading-001 (Reference 14), and B-GEN-ITPCI-001 (Reference 13). SV4-PMS Cabinet Software Loading-001 (Reference 14) summarizes the software loading. SV4-PMS Cabinet Diagnostic Testing -001 (Reference 15) documents the performance of diagnostic testing, using individual WOs for each cabinet, and verified the diagnostics were satisfactory for each cabinet. References 14 and 15 include steps that confirm and document successful software load and further confirm the physical properties of the as-built PMS. A regression analysis (i.e., change evaluation) was performed for software changes (Reference 16) to determine if additional testing was needed for the as-built system.

The completed Unit 4 FAT test report, FCNs, B-GEN-ITPCI-001, and regression test results confirm that with one PMS channel in bypass, the redundant channel cannot be placed in bypass.

References 1 through 27 are available for NRC inspection as part of the Unit 4 ITAAC 2.5.02.06a.ii Completion Package (Reference 28).

ITAAC Finding Review In accordance with plant procedures for ITAAC completion, Southern Nuclear Operating Company (SNC) performed a review of all findings pertaining to the subject ITAAC and associated corrective actions. This review found there are no relevant ITAAC findings associated with this ITAAC. The ITAAC completion review is documented in the Unit 4 ITAAC Completion Package for ITAAC 2.5.02.06a.ii (Reference 28) and is available for NRC review.

ITAAC Completion Statement Based on the above information, SNC hereby notifies the NRC that ITAAC 2.5.02.06a.ii was performed for VEGP Unit 4 and that the prescribed acceptance criteria are met.

Systems, structures, and components verified as part of this ITAAC are being maintained in their as-designed, ITAAC compliant condition in accordance with approved plant programs and procedures.

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 14 of 21 References (available for NRC inspection)

1. NEI 08-01, Rev 5 - Corrected 6-30-2014, Industry Guideline for the ITAAC Closure Process Under 10 CFR Part 52

2. WCAP-16096, Rev. 4A, Software Program Manual for Common Q Systems

3. APP-PMS-T5-001, Rev. 5, AP1000 Protection and Safety Monitoring System Test Plan

4. Vogtle Electric Generating Plant (VEGP) Units 3 & 4 Updated Final Safety Analysis Report (UFSAR), Rev 12.0

5. SV4-PMS-T1P-007, Rev. 0, AP1000 Protection and Safety Monitoring System Reactor Trip Channel Integration Test Procedure

6. SV4-PMS-T1P-035, Rev. 0, AP1000 Protection and Safety Monitoring System Display Calibration Data Test Procedure

7. SV4-PMS-T2R-007, Rev. 0, Vogtle Unit 4 AP1000 Protection and Safety Monitoring System System-Level Reactor Trip Channel Integration Test Report

8. SV4-PMS-T2R-035, Rev. 1, Vogtle Unit 4 AP1000 Protection and Safety Monitoring System Display Calibration Data Test Report

9. SV4-PMS-T1P-012, Rev. 0, AP1000 Protection and Safety Monitoring System System Integration Test for Time Response Test Procedure

10. SV4-PMS-T2R-012, Rev. 0, Vogtle Unit 4 AP1000 Protection and Safety Monitoring System System Interfaces and Response Time - System Integration Test Report

11. SV4-GW-GCW-740, Rev. 0, Field Change Notice AP1000 Vogtle 4 PMS Software Installation - Software Release 9.0.0.1

12. SV4-GW-GCW-848, Rev. 0, AP1000 Vogtle 4 PMS Software Installation - Software Release 9.0.0.4

13. B-GEN-ITPCI-001, Rev. 4, PMS CABINETS

14. SV4-PMS Cabinet Software Loading-001, Rev. 0, Unit 4 Software Loading for PMS Cabinets for Multiple ITAACs: ITAAC 2.1.02.11a.ii [NRC Index No. 47], ITAAC 2.5.02.06a.ii

[NRC Index No. 530], ITAAC 2.5.02.08a.ii [NRC Index No. 540], ITAAC 2.5.02.08b.ii [NRC Index No. 543], ITAAC 2.5.04.02.i [NRC Index No. 557]

15. SV4-PMS Cabinet Diagnostic Testing -001, Unit 4 PMS Cabinet Diagnostic Testing for Multiple ITAACs: ITAAC 2.5.02.06a.ii [NRC Index No. 530], ITAAC 2.5.02.08a.ii [NRC Index No. 540], ITAAC 2.5.02.08b.ii [NRC Index No. 543], ITAAC 2.5.04.02.i [NRC Index No. 557]

16. SV4-PMS-T2R-050, Rev. 1, Vogtle AP1000 Protection and Safety Monitoring System Fuel Load Regression Test Report

17. SV4-PMS-T1P-008, Rev. 0, AP1000 Protection and Safety Monitoring System System-Level Engineered Safety Features Channel Integration Test Procedure

18. SV4-PMS-T1P-009, Rev. 0, AP1000 Protection and Safety Monitoring System Integrated Logic Processor Component Logic Channel Integration Test Procedure

19. SV4-PMS-T2R-008, Rev. 0, Vogtle Unit 4 AP1000 Protection and Safety Monitoring System System-Level Engineered Safety Features Channel Integration Test Report

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 15 of 21

20. SV4-PMS-T2R-009, Rev. 2, AP1000 Protection and Safety Monitoring System Integrated Logic Processor Component Logic Channel Integration Test Report

21. SV4-PMS-ITR-800530, Rev. 0, Unit 4 Protection and Safety Monitoring System (PMS)

Manual Initiation Controls, Fixed Position Controls and Reactor Trip Breaker Displays:

ITAAC 2.5.02.06a.ii Items 6.c)ii, 8.a)iii and 8.c)

22. SV4-PMS-ITR-801530, Rev. 0, Unit 4 Protection and Safety Monitoring System (PMS)

Main Control Room Displays: ITAAC 2.5.02.06a.ii Item 8.a)i

23. SV4-PMS-ITR-802530, Rev. 0, Unit 4 Recorded Results of Protection and Safety Monitoring System (PMS) auto block removal test: ITAAC 2.5.02.06a.ii Item 9.a

24. SV4-PMS-ITR-803530, Rev. 0, Unit 4 Protection and Safety Monitoring System (PMS)

Channel Bypass Alarm Test: ITAAC 2.5.02.06a.ii Item 9.b

25. SV4-PMS-T2R-408, Rev. 0, Vogtle AP1000 Protection and Safety Monitoring System System-Level Engineered Safety Features Channel Integration Test Report

26. SV4-PMS-T1P-026, Rev. 0, AP1000 Protection and Safety Monitoring System Display Partial Actuate / Partial Bypass Test Procedure

27. SV4-PMS-T2R-026, Rev. 0, Vogtle Unit 4 AP1000 Protection and Safety Monitoring System Display Partial Actuate / Partial Bypass Test Report

28. 2.5.02.06a.ii -U4-CP-Rev 0 U4 ITAAC 2.5.02.06a.ii Completion Package

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 16 of 21 Attachment A

• Excerpt from COL Appendix C Table 2.5.2-2

• PMS Automatic Reactor Trips Source Range High Neutron Flux Reactor Trip Intermediate Range High Neutron Flux Reactor Trip Power Range High Neutron Flux (Low Setpoint) Trip Power Range High Neutron Flux (High Setpoint) Trip Power Range High Positive Flux Rate Trip Reactor Coolant Pump High-2 Bearing Water Temperature Trip Overtemperature Delta-T Trip Overpower Delta-T Trip Pressurizer Low-2 Pressure Trip Pressurizer High-2 Pressure Trip Pressurizer High-3 Water Level Trip Low-2 Reactor Coolant Flow Trip Low-2 Reactor Coolant Pump Speed Trip Low-2 Steam Generator Narrow Range Water Level Trip High-3 Steam Generator Water Level Trip Automatic or Manual Safeguards Actuation Trip Automatic or Manual Depressurization System Actuation Trip Automatic or Manual Core Makeup Tank (CMT) Injection Trip Passive Residual Heat Removal (PRHR) Actuation Reactor Trip

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 17 of 21 Attachment B

• Excerpt from COL Appendix C Table 2.5.2-3

• PMS Automatically Actuated Engineered Safety Features Safeguards Actuation Containment Isolation Automatic Depressurization System (ADS) Actuation Main Feedwater Isolation Reactor Coolant Pump Trip CMT Injection Turbine Trip (Isolated signal to nonsafety equipment)

Steam Line Isolation Steam Generator Relief Isolation Steam Generator Blowdown Isolation Passive Containment Cooling Actuation Startup Feedwater Isolation Passive Residual Heat Removal (PRHR) Heat Exchanger Alignment Block of Boron Dilution Chemical and Volume Control System (CVS) Makeup Line Isolation Steam Dump Block (Isolated signal to nonsafety equipment)

Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization Auxiliary Spray and Purification Line and Zinc/Hydrogen Addition Isolation Containment Air Filtration System Isolation Normal Residual Heat Removal Isolation Refueling Cavity and Spent Fuel Pool Cooling System (SFS) Isolation In-Containment Refueling Water Storage Tank (IRWST) Injection IRWST Containment Recirculation CVS Letdown Isolation Pressurizer Heater Block (Isolated signal to nonsafety equipment)

Containment Vacuum Relief Component Cooling System Containment Isolation Valve Closure

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 18 of 21 Attachment C

• Excerpt from COL Appendix C Table 2.5.2-4

• PMS Manually Actuated ESF Functions Reactor Trip Safeguards Actuation Containment Isolation Depressurization System Stages 1, 2, and 3 Actuation Depressurization System Stage 4 Actuation Feedwater Isolation Core Makeup Tank Injection Actuation Steam Line Isolation Passive Containment Cooling Actuation Passive Residual Heat Removal Heat Exchanger Alignment IRWST Injection Containment Recirculation Actuation Main Control Room Isolation, Air Supply Initiation, and Electrical Load De-energization Steam Generator Relief Isolation Chemical and Volume Control System Isolation Normal Residual Heat Removal System Isolation Containment Vacuum Relief

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 19 of 21 Attachment D

• Excerpt from COL Appendix C Table 2.5.2-5

• Description

• Control *Display Neutron Flux Yes Neutron Flux Doubling No Startup Rate Yes Reactor Coolant System (RCS) Pressure Yes Wide-range Hot Leg Temperature Yes Wide-range Cold Leg Temperature Yes RCS Cooldown Rate Compared to the Limit Based on RCS Pressure Yes Wide-range Cold Leg Temperature Compared to the Limit Based on RCS Pressure Yes Change of RCS Temperature by more than 5°F in the last 10 minutes No Containment Water Level Yes Containment Pressure Yes Pressurizer Water Level Yes Pressurizer Water Level Trend Yes Pressurizer Reference Leg Temperature Yes Reactor Vessel-Hot Leg Water Level Yes Pressurizer Pressure Yes Core Exit Temperature Yes RCS Subcooling Yes RCS Cold Overpressure Limit Yes IRWST Water Level Yes PRHR Flow Yes PRHR HX Outlet Temperature Yes PRHR HX Inlet Isolation and Control Valve Status Yes Passive Containment Cooling System (PCS) Storage Tank Water Level Yes PCS Cooling Flow Yes IRWST to Normal Residual Heat Removal System (RNS) Suction Valve Status Yes Remotely Operated Containment Isolation Valve Status Yes Containment Area High-range Radiation Level Yes Containment Pressure (Extended Range)

Yes CMT Level Yes Manual Reactor Trip (also initiates turbine trip)

Yes Manual Safeguards Actuation Yes Manual CMT Actuation Yes Manual MCR Emergency Habitability System Actuation Yes Manual ADS Stages 1, 2, and 3 Actuation Yes

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 20 of 21

• Description

• Control *Display Manual ADS Stage 4 Actuation Yes Manual PRHR Actuation Yes Manual Containment Cooling Actuation Yes Manual IRWST Injection Actuation Yes Manual Containment Recirculation Actuation Yes Manual Containment Isolation Yes Manual Main Steam Line Isolation Yes Manual Feedwater Isolation Yes Manual Containment Vacuum Relief Yes Manual ADS and IRWST Injection Unblock Yes Note: Dash (-) indicates not applicable.

U.S. Nuclear Regulatory Commission ND-23-0597 Enclosure Page 21 of 21 Attachment E

• Excerpt from COL Appendix C Table 2.5.2-6

• PMS Blocks Reactor Trip Functions:

Source Range High Neutron Flux Reactor Trip Intermediate Range High Neutron Flux Reactor Trip Power Range High Neutron Flux (Low Setpoint) Trip Pressurizer Low-2 Pressure Trip Pressurizer High-3 Water Level Trip Low-2 Reactor Coolant Flow Trip Low-2 Reactor Coolant Pump Speed Trip High-3 Steam Generator Water Level Trip Low-2 Steam Generator Narrow Range Water Level Trip Engineered Safety Features:

ADS and IRWST Injection Actuation Automatic Safeguards Containment Isolation Main Feedwater Isolation Reactor Coolant Pump Trip Core Makeup Tank Injection Steam Line Isolation Startup Feedwater Isolation Block of Boron Dilution Chemical and Volume Control System Isolation Chemical and Volume Control System Letdown Isolation Refueling Cavity and Spent Fuel Pool Cooling System (SFS) Isolation Steam Dump Block Auxiliary Spray and Letdown Purification Line Isolation Passive Residual Heat Removal Heat Exchanger Alignment Normal Residual Heat Removal System Isolation