PLA-6168, Submittal of Proposed License Amendments Re Arts/Mellla Implementation - Supplement

Submittal of Proposed License Amendments Re Arts/Mellla Implementation - Supplement

ML070860232
Person / Time
Site:	Susquehanna
Issue date:	03/12/2007
From:	Mckinney B Susquehanna
To:	Document Control Desk, NRC/NRR/ADRO
References
PLA-6168
Download: ML070860232 (12)

Text

N.

/-

Brltt T. McKinney PPL Susquehanna, LLC Sr. Vice President & Chief Nuclear Officer 769 Salem Boulevard Berwick, PA 18603 Tel. 570.542.3149 Fax 570.542.1504 btmckinney@pplweb.com PPI ppml s.

5.-

• H1AR1 19OPX U. S. Nuclear Regulatory Commission Attn: Document Control Desk Mail Stop OP1-17 Washington, DC 20555-0001 SUSQUEHANNA STEAM ELECTRIC STATION PROPOSED LICENSE AMENDMENT NO. 279 FOR UNIT 1 OPERATING LICENSE NO. NPF-14 AND NO. 248 FOR UNIT 2 OPERATING LICENSE NO. NPF-22 ARTS/MELLLA IMPLEMENTATION - SUPPLEMENT D ocket Nos. 50-387 PLA-6168 and 50-388

Reference:

1) PLA-5931, B. T McKinney (PPL)to Document ControlDesk (USNRC),

"SusquehannaSteam Electric Station ProposedLicense Amendment No. 2 79for Unit 1 OperatingLicense No. NPF-14 and248for Unit 2 OperatingLicense No. NPF-22 ARTS/MELLLA Implementation,"dated November 18, 2005.

In accordance with 10 CFR 50.90, PPL Susquehanna, LLC (PPL) submitted a request for a license amendment to the Susquehanna Steam Electric Station (SSES) Unit 1 and Unit 2 Technical Specifications to implement an expanded operating domain resulting from the implementation of Average Power Range Monitor/Rod Block Monitor/

Technical Specifications/Maximum Extended Load Line Limit Analysis (ARTS/

MELLLA) (Reference 1).

The purpose of this letter is to provide a supplement based on teleconferences held on March 6, 8, and 9, 2007 with the NRC staff.

PPL respectfully requests that NRC expeditiously complete the review and approval of the proposed ARTS/MELLLA License Amendment Request proposed in Reference 1.

PPL continues to install ARTS/MELLLA in Unit 2 and request approval prior to startup from the Spring 2007 Outage.

Document Control Desk PLA-6168 If you have any questions or require additional information, please contact Mr. Michael Crowthers at (610) 774-7766.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on: 3 /Z-/07 B. T. cKinney

Enclosure:

PPL ARTS/MELLLA Supplement cc: NRC Region I Mr. A. J. Blarney, NRC Sr. Resident Inspector Mr. R. V. Guzman, NRC Project Manager Mr. R. R. Janati, DEP/BRP

ENCLOSURE TO PLA-6168 PPL ARTS/MELLLA SUPPLEMENT

Enclosure to PLA-6168 Page 1 of 9 NRC requested PPL provide supplemental information in the three areas provided below:

1. Describe the reliability of the RBM system and the quality standards to which the RBM has been designed, procured, tested and will be maintained. Describe the seismic design basis. Describe the power supply design and quality, and what would occur if the RBM lost power.

Response

RBM Function The Power Range Neutron Monitoring System (PRNMS) RBM system is comprised of two RBM channels each comprised of a RBM chassis and one RBM Interface Module.

The two RBM channels are intended to be redundant to each other but were not designed for any specific safety function. To meet this redundancy objective, there is no direct connection between RBM channels. The RBM channels are mounted in the same panel bay with physical space between them. Per Section 5.2.2.2 of NEDC 32410P-A, the RBM receives LPRM signals and a Simulated Thermal Power (STP) signal from an assigned "master" APRM and receives the identity of the selected control rod from the reactor manual control system. Each RBM selects half of the LPRM detectors surrounding the selected control rod, generates an average signal of the selected LPRM using detector levels B, C, and D signals and applies a gain adjustment to this localized average value to make it equal to 100%. The gain adjustment is applied only if the localized average value is less than 100%. The STP is used to select one of three predefined setpoints.

A rod block signal is generated when the average of the selected LRPM signals reaches or exceeds the setpoint. The RBM is automatically disabled from generating rod blocks if a peripheral control rod is selected or if the STP value from the master APRM is less than approximately 28% of rated core thermal power.

An RBM Interface Module is provided to act as an electrical connector adapter between the cables and compact chassis connectors. The module also provides a mounting location for solid state relays which interface between the RBM and the equipment outside the PRNMS panel, implements and maintains the trip and rod block bypass states independent of the associated RBM chassis, and provides the multiplexing function to convert the relay contact rod select signal input to multiplexed form for the RBM chassis.

RBM Quality and Seismic Design Base As stated in General Electric Licensing Topical Report NEDC-3241OP-A Safety Evaluation Report, Section 3.3, page 10, "The RBM chassis (where applicable), RBM Interface Panels (where applicable), remote I/O Interface Panels (where applicable), and operator interface equipment mounted in the main control board are not required to

Enclosure to PLA-6168 Page 2 of 9 operate to accomplish a system safety function. However, these components must maintain physical integrity under all conditions such that a failure or fault cannot disable power to the components required to perform safety functions, or cause a loss of the RPS AC power busses coming into the PRNMS panels." The RBM and APRM/OPRM are mounted in separate bays in the panel with metal barriers so a major fault is contained within an enclosure and will not propagate from an RBM to any single or multiple APRM channels. All communication from the APRM/OPRM to the non-safety related plant computer is via the RBM and a second fiber-optic link to computer interfacing equipment.

All interfaces between the safety-related equipment and that performing system safety functions are via fiber optics. Per NEDC 324 1OP-A, Section 3.6.1, page 18, the PRNMS system is isolated in accordance to IEEE Std. 279-1971 which "requires that the transmission of signals from protection system equipment for control system use shall be through isolation devices which shall be classified as part of the protection system. In the PRNMS design, all interface connections between control and protections systems are made through fiber optic-based isolation devices of the same classification as the protection system. Additionally, all control wiring is separated from protection system wiring via the use of conduits and physical separation."

The quality standards to which the PRNMS RBM has been designed, manufactured, and qualified is as outlined in PLA-5880 (Adams Ascension Number ML051870394) Section 7, Plant-Specific Evaluation Required by NUMAC PRNM Retrofit Plus Option III Stability Trip Function Topical Report (NEDC-3241OP-A).

The ARTS Performance Specification, Safety Classification section, specifies that "The RBM Instrument is designed, manufactured, and qualified to the same standards as Class 1E equipment, but the RBM instrument provides no safety function."

The procurement and factory acceptance testing of the PRNMS from General Electric was in accordance with the procurement technical requirements outlined in PPL Nuclear Engineering Specification for Procurement of a Power Range Neutron Monitoring System (PRNMS). This specification document is a safety related document outlining both the safety-related and non-safety related functions.

The RBM parts were supplied by General Electric with system safety classification as listed in the following Table:

Enclosure to PLA-6168 Page 3 of 9 Table PRNMS System Safety Classification of Main Components Name Safety Classification Average Power Range Monitor Q Rod Block Monitor S Quad Low Voltage Power Supply Chassis Q 2/4 Logic Module Q RBM Interface Module S Fiber Optic Cables Q Power Range Monitor Cabinet Q Cables Q RBM Cal & Monitoring Panel S APRM Cal & Monitoring Panel Q LPRM Connector Panel Q Multi Vendor Data Acquisition System N N = Non-Safety Related Q = Safety Related S = Special Requirements The Special Requirements classification "S"that is applicable to the RBM is applied to those components that do not perform a safety function but are designed, produced, and documented with considerations similar to safety related. This classification is used in applications where the component itself performs no safety function; however, it is located near safety related components and thus, it is desirable to ensure a failure of the non-safety component will not degrade in a way that it will affect any safety function.

RBM materials were purchased by General Electric as "Q," safety related. Since the higher level system classification must take into account non-safety portions of the RBM operation, the General Electric system classification is "S."

Maintenance of the RBM system is performed during required surveillance testing and on an as needed basis. Should corrective maintenance be required, a plant component work order (PCWO) would be initiated and planned per the requirements of a non-safety related system. Physical work on the PRNM system including RBM is performed by INPO accredited station qualified technicians. If parts replacement is required, the parts are purchased from General Electric in accordance with the original material identifica-tion and requisition drawing and requirements. Upon return to service of the RBM system, the appropriate surveillance testing would be performed to ensure operability in accordance with the Technical Specifications.

Enclosure to PLA-6168 Page 4 of 9 PLA-5880, Section 7, Table Section 4.4.2.3.4 discusses the Seismic Design Consideration for PRNMS. Specifically stated therein is, "The seismic qualification results will be documented in a plant-specific "Qualification Summary." This Qualification Report, supplied to the NRC via PLA-5880, summarizes the qualification and testing of the PRNMS RBM components. Table 1.1 of this report shows the RBM chassis, the RBM Interface Module, and RBM Interface Panel as all being included. This equipment was included to require Seismic and Electromagnetic Compatibility (EMC) emissions qualification in order to prevent them from becoming a missile or interfering with other equipment in the PRNMS panel. Additionally, equipment qualification was performed on both a testing and analysis level. Section 3.3 outlines the results for both the instrument and panel testing.

The qualification standards and guidelines outlined in the Qualification Summary Report are as stated in Section 2.3, "Qualification Standards," and include:

IEEE Std. 323-1974 IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations IEEE Std. 344-1975 IEEE Recommended Practice for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations MIL-STD-461D Requirements for the Control of Electromagnetic Interference Emissions and Susceptibility MIL-STD-462D Measurement of Electromagnetic Interference Characteristics IEC 801-2 Electromagnetic compatibility for industrial-process measurement and control equipment; Part 2: Electrostatic discharge requirements IEC 801-4 Electromagnetic compatibility for industrial-process measurement and control equipment; Part 4: Electrical fast transient/burst requirements IEC 801-5 Electromagnetic compatibility for industrial-process measurement and control equipment; Part 5: Surge immunity requirements EPRI TR- 102323 Guidelines for Electromagnetic Interference Testing in Power Plants, September 1994

Enclosure to PLA-6168 Page 5 of 9 Since the equipment is physically mounted in "Q," safety-related panels, PPL seismic qualification binder calculations have been prepared to support the installation of all PRNMS equipment. The PRNMS equipment is to be located in plant panels 1(2)C608 located in the Control Structure, Lower Relay Room.

RBM Power Supply The RBM chassis is powered from the Quad Low Voltage Power Supply Chassis.

This chassis receives two AC power inputs, one from each RPS channel bus. The RBM chassis receives low voltage power, +5 VDC and +15 VDC, from two redundant Low Voltage Power Supplies contained in a Quad Low Voltage Power Supply (LVPS) chassis, each of which operate from a different RPS AC power bus. The outputs of the redundant power supplies are auctioned and monitored by the respective RBM chassis, both locally and at the Quad LVPS chassis.

At the Quad LVPS, the loss of a single supply's output, either due to hardware failure or input AC power failure, causes a self test alarm at control panel 1(2)C608. The loss of redundant outputs causes an INOP condition and a trip for the affected RBM channel.

Per NEDC 32410P-A, Section 5.3.8, upon loss of input power, the affected RBM chassis trip and alarm outputs default to the safe condition and remain in that condition until power is reapplied and one self-test cycle has completed without detection of a critical failure, at which point the INOP trip will clear. For the RBM, this safe condition initiates a rod block. Loss of all input power to an RBM causes the fail-safe RBM Inop outlet relay to de-energize and the associated normally open contact will open, resulting in a rod block.

Power to the RBM Interface Module is supplied by one of the 120 VAC RPS buses (one bus for each RBM). The AC power goes to an internal LVPS that supplies DC power to the interface circuitry.

==

Conclusion:==

Based on the above, the RBM system is a highly reliable and high quality system that is designed to criteria and standards identical in many ways to the safety related portions of the PRNMS. The system does include redundancy features, fail-safe features and self-monitoring features. This high quality design is consistent with the original Susquehanna RBM System design as described and evaluated in NUREG 0776 "Safety Evaluation Report Related to the Operation of Susquehanna Steam Electric Station Units 1 and 2."

Enclosure to PLA-6168 Page 6 of 9

2. Describe what would occur as a worst case for an RWE event.

The response provided below is a qualitative discussion. No risk calculations or fuel damage calculations have been performed.

Response

The Susquehanna FSAR Section 15.4.2 describes the Rod Withdrawal Error as "... the reactor operator makes a procedural error and withdraws the maximum worth control rod until the Rod Block Monitor (RBM) System inhibits further withdrawal or the control rod is fully withdrawn." The RWE analysis is performed in a conservative manner.

Station administrative and operations control procedures provide assurance against an operator error. Station procedures require that all control rod manipulations be performed by an active licensed operator and verified by a second licensed operator or other qualified member of the technical staff. Both the operator and verifier monitor the plant to ensure the response is as expected. In addition, the on-shift SRO routinely provides added oversight during reactivity manipulations to ensure error-free performance. These requirements are reinforced during periodic operator re-qualification training sessions.

In the unlikely event that both RBM channels become inoperable after the operator error and all administrative controls required by station procedures are not effective while a control rod is being withdrawn, the event could result in exceeding the MCPR Safety Limit.

The increase in overall core power from this scenario is not expected to be large enough to actuate the Reactor Protection System (RPS). The highly reliable RBM design as described in the response to the first question provides the basis for concluding that the probability that both RBM channels could fail while the control rod is being withdrawn in such a way that RBM blocks would not occur is extremely unlikely. The reliability of the PRNMS RBM module is enhanced through its internal self-test function. The RBM module automatically and continuously tests itself to ensure operability during normal operation.

The loss of an essential function (termed a critical self-test fault) results in an inoperable system trip (i.e., a rod block and a self-test alarm condition). Examples of critical self-test faults include failure of an RBM communication card, RBM supply voltage not in range, failure of EPROM memory integrity, and loss of input signal from the Reactor Manual Control System.

The Susquehanna Technical Specifications require that both RBM channels be operable to ensure that no single instrument failure can preclude initiation of a rod block. Per station procedures, it is the intent that the RBM remain operable as required by Technical Specifications and not be bypassed for convenience.

With one RBM channel bypassed, the remaining RBM channel is adequate to perform the rod block function; however, a single failure in the remaining channel can result in loss of

Enclosure to PLA-6168 Page 7 of 9 control rod block capability. The RBM channel TS completion times are based on the low probability of the Rod Withdrawal Error (RWE) event coincident with a failure of the remaining RBM channel. If the inoperable channel is not restored within the specified completion time, one RBM channel must be placed in a trip (block) condition.

==

Conclusion:==

Multiple human errors and equipment failures that collectively are beyond the Susquehanna Licensing basis have to occur for an RWE event to possibly result in exceeding the MCPR Safety Limit. Consistent with GDC 25, the licensing basis requirements for the RWE are to assume a malfunction of the reactivity control system (i.e., the operator error). Subsequent failure of the RBM is not required to be assumed.

Enclosure to PLA-6168 Page 8 of 9

3. Do the GDC 25 requirements apply to the RBM and the RWE event?

GDC 25 states:

"The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods."

The FSAR Design Conformance to GDC 25 (FSAR Section 3.1.2.3.6) states:

"Design Conformance The reactor protection system provides protection against the onset and consequences of conditions that threaten the integrity of the fuel barrier and the RCPB. Any monitored variable which exceeds the scram set point will initiate an automatic scram and not impair the remaining variables from being monitored, and if one channel fails, the remaining portions of the reactor protection system shall function.

The reactor manual control system is designed so that no single failure can negate the effectiveness of a reactor scram. The circuitry for this system is independent of the circuitry controlling the scram valves. This separation of the scram and normal rod control functions prevents failures in the reactor manual control circuitry from affecting the scram circuitry. Because each control rod is controlled as an individual unit, a failure that results in energizing any of the insert or withdraw solenoid valves can affect only one control rod. The effectiveness of a reactor scram is not impaired by the malfunctioning of any one control rod.

The design of the protection system ensures that specified acceptable fuel limits are not exceeded for any single malfunction of the reactivity control systems as specified in Criterion 25.

For further discussion, see the following sections:

1) Principal Design Criteria 1.2.1

2) Reactivity Control System 4.1

3) Nuclear Design 4.3

4) Thermal and Hydraulic Design 4.4

5) Reactor Protection System 7.2

6) Reactor Manual Control System 7.7

7) Accident Analysis 15.0"

Enclosure to PLA-6168 Page 9 of 9

==

Conclusion:==

The GDC describes design requirements for the "protection system." The GDC 25 "protection system" for SSES is the "reactor protection system". FSAR Section 1.2.2.4.1 describes that the reactor protection system "initiates a rapid, automatic shutdown (scram) of the reactor. This action is taken in time to prevent excessive fuel cladding temperatures and any nuclear system process barrier damage following abnormal operational transients. The Reactor Protection System overrides all operator actions and process controls."

The RBM is not part of the reactor protection system. The RBM does not initiate "a rapid, automatic shutdown (scram) of the reactor." Failure of the RBM cannot prevent RPS from affecting a scram. Its function is to apply a rod block. As a result, the requirements of GDC 25 do not apply to the RBM.