RS-08-110, Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System
| ML082480173 | |
| Person / Time | |
|---|---|
| Site: | LaSalle  |
| Issue date: | 09/02/2008 |
| From: | Simpson P Exelon Generation Co, Exelon Nuclear |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| RS-08-110, TAC MD7900, TAC MD7901 | |
| Download: ML082480173 (17) | |
Text
Exelon Generation wwwexeloncorp.corn 4300 Winfield Road warrenville, IL 60555 RS-08-110 September 2, 2008 U. S. Nuclear Regulatory Commission ATTN : Document Control Desk Washington, DC 20555-0001 LaSalle County Station, Units 1 and 2 Facility Operating License Nos. NPF-11 and NPF-18 NRC Docket Nos. 50-373 and 50-374 Exel6n Nuclear 10 C FR 50.90
Subject:
Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System References :
1. Letter from D. M. Benyak (Exelon Generation Company, LLC) to U. S. NRC, "Request for License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System," dated August 14, 2007
- 2.
Letter from P. R. Simpson (Exelon Generation Company, LLC) to U. S. NRC, "Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System," dated May 13, 2008
- 3.
Letter from S. P. Sands (U. S. NRC) to C. G. Pardee, (Exelon Generation Company, LLC), "LaSalle County Station, Units 1 and 2 - Request for Additional Information Related to Request for License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System (TAC Nos. MD7900 and MD7901)," dated August 1, 2008 In Reference 1, Exelon Generation Company, LLC (EGC) requested an amendment to Facility Operating License Nos. NPF-11 and NPF-18 for LaSalle County Station (LSCS), Units 1 and 2.
The proposed change revises the LSCS licensing basis to allow ganged rod drive capability of the Rod Control Management System (RCMS). EGC provided supplemental information concerning this license amendment request in Reference 2.
September 2, 2008 U. S. Nuclear Regulatory Commission Page 2 This letter provides supplemental information to the NRC in response to requests for additional information (RAls) that were provided to EGC in Reference 3, and clarified during teleconferences between EGC and the NRC on June 19, June 26, July 10, and July 21, 2008.
The supplemental information is provided in the attachment to this letter.
In that the attachment to this letter provides a partial response to the Reference 3 RAls, EGC will provide a response to the remaining RAls by September 11, 2008. EGC has discussed this response schedule with the NRC (i.e., Mr. Stephen P. Sands, the NRR Project Manager for LSCS).
There are no regulatory commitments contained in this letter.
If you have any questions concerning this letter, please contact Mr. John L. Schrage at (630) 657-2821.
I declare under penalty of perjury that the foregoing is true and correct. Executed on the 2"d day of September 2008.
Respectfully, U Patrick R. Simpson Manager - Licensing Attachment :
Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System
Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System
Background
In a letter dated August 1, 2008 (i.e., Reference 1), the NRC transmitted Requests for Additional Information (RAls) to Exelon Generation Company, LLC (EGC) concerning a license amendment request (LAR) for LaSalle County Station (i.e., Reference 2). These RAls were discussed, and the questions were clarified during teleconferences between EGC and the NRC on June 19, June 26, July 10, and July 21, 2008. The information below provides a partial response to the Reference 1 RAls. EGC will provide a response to the remaining RAls by September 11, 2008, as noted below for the applicable RAIs. EGC has discussed this response schedule with the NRC (i.e., Mr. Stephen P. Sands, the NRR Project Manager for LSCS).
NRC Request EICB-1 Section 1.2, 1St Paragraph: "EGC is replacing the original Rod Worth Minimizer (RWM) and the Reactor Manual Control System (RMCS), which is comprised of the Rod Drive Control System (RDCS) and the Rod Position Indication System (RPIS) with a new Rod Control Management System (RCMS). The current RMCS uses discrete digital electronics and dynamic logic to control rod motion. The replacement RCMS system will be a digital microprocessor-based system. The new system will also incorporate the RWM within the system, eliminating the need for a separate RWM computer. "
The original design feature included separate computer for the RWM function, however, the proposed design incorporates the RWM and all the subsystems of the RMCS in a single microprocessor based system. Please summarize the failure modes that have been evaluated for the new system, and describe the consequences that result from these failures. This description should include the elements that will be employed to demonstrate that the potential vulnerabilities associated with common-mode software failures have been adequately addressed and justification that these consequences will not put the plant into a new and unanalyzed state.
EGC Response EGC will provide a response to this RAI by September 11, 2008.
NRC Request EICB-2 Sections 1.3 - 2nd Paragraph, Section 3.1.2 - 1S t Paragraph, and Section 3.1.3 : The software can be subject to common mode failure, and therefore, credit cannot be taken for soft interlocks due to software failure. In addition, system indications of rod position could be lost.
Please respond to the following items that could result from a common mode failure :
A. Rod block logic is part of the RCMS and is subject to common cause failure due to software errors. Ganged-rod withdrawal at power is possible due to malfunctioning of RBM. Describe the diverse, non-RCMS equipment, systems, and controls that will be used to recognize and respond to a ganged-rod withdrawal-at-power event due to a common-cause software failure. This description should also indicate if the resultant excess reactivity addition is bounded by current accident analyses.
Page 1 of 15
Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System B. The RDCS, RPIS, and the RWM are all controlled and all the indications are displayed by the same computer system. Failure of software may lead to loss of RPIS. Please describe the backup indication system available to the plant operating personnel under such an event.
If no such backup system is available, please explain what actions the operators would take in the event of such a software failure.
EGC Response A. The following indicators and alarms are on or are immediately adjacent to the H13-P603, Reactor Panel. These indicators and alarms are diverse, non-RCMS equipment in the main control room that will be used by control room operators to recognize a hypothetical ganged-rod withdrawal-at-power event due to a common-mode software failure. Control room operators routinely monitor the indicators with a minimum frequency of three minutes.
i)
Control rod drift annunciator, which would actuate in the case where ganged-rod withdrawal was not seen as commanded by operator.
ii)
Plant Process Computer (PPC) control rod data fault alarm, which would actuate in the case where ganged-rod withdrawal was not seen as commanded by operator.
iii)
A large LED digital display (i.e., two inch tall characters) with a continuous indication (i.e., one second updates) of generator gross megawatt electric (Mwe).
iv)
Four separate 5.5 inch LCD screen recorders together displaying and trending all 6 Average Power Range Monitor (APRM) reactor power signals in percent of rated thermal power (% RTP) and both Rod Block Monitor (RBM) channels (i.e.,
safety related sensors which are not RCMS components) also indicating reactor power level and trend.
v)
Multiple reactor pressure indicators and recorders, which would indicate an increase during a hypothetical ganged-rod withdrawal-at-power event.
vi)
Multiple main steam line flow indicators and recorders which would indicate an increase during a hypothetical ganged-rod withdrawal-at-power event.
vii)
Multiple feedwater pump and feedwater line flow indicators and recorders, which would indicate an increase during a hypothetical ganged-rod withdrawal-at-power event.
viii)
A PPC display screen displaying instantaneous and multiple averaged core thermal power values with audible alarm on exceeding rated power by more than 1%.
ix)
A PPC display screen displaying reactor operating position on a power-to-flow map layout with associated visual alarm on either exceeding rated power or on an increasing control rod flow control rod line.
x)
Reactor recirculation (RR) and core flow indicators and recorders, which would indicate an decrease due to increasing control rod line during a hypothetical ganged-rod withdrawal-at-power event.
xi)
Control Rod Drive (CRD) system drive water flow indicator, which would indicate unexpected flow.
xii)
LPRM high power annunciator alarms which could result from a hypothetical ganged-rod withdrawal-at-power event.
Page 2 of 15
,-,<<achment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System xiii)
APRM high power alarms which could result from a hypothetical ganged-rod withdrawal-at-power event.
xiv)
RBM high power alarms which would result from a hypothetical ganged-rod withdrawal-at-power event.
xv)
APRM high power alarm indicating lights on control room panel H13-P603.
xvi)
RBM high power alarm indicating lights on control room panel H13-P603.
xvii)
LPRM power level indicators (16 total), which would indicate rising power level around the selected control rods.
The following controls are on or are immediately adjacent to the H13-P603, Reactor Panel. These controls are diverse, non-RCMS equipment that can be used by control room operators to respond to a hypothetical ganged-rod withdrawal-at-power event due to a common-mode software failure :
i)
The Reactor Protection System (RPS) manual scram push buttons, which would be used to initiate a reactor scram.
ii)
The RR system flow control valve controllers, which could be used to reduce RR flow and hence power, in accordance with procedural requirements within thermal hydraulic instability region constraints.
iii)
The CRD system drive water differential pressure control valve control switch, which can be opened to stop system withdrawal capability, in accordance with procedural requirements.
iv)
The CRD system flow controller, which can be closed to assist in stopping system withdrawal capability, in accordance with procedural requirements.
v)
The CRD system pump control switch, which can be turned off to stop system withdrawal capability, in accordance with procedural requirements.
In order to provide adequate assurance that any reactivity and power distribution anomalies (i.e., due to a hypothetical ganged-rod withdrawal event caused by common-mode software failures) would not leave the plant in an unacceptable condition at high/full power, EGC conducted an at-power ganged-rod CRWE evaluation. This evaluation is described in the response to NRC request SRXB-5, question 1. The results of this evaluation indicate that even if a common-mode software failure resulted in the spontaneous withdrawal of a rod gang at power (i.e., at power levels above 30%)
the potential consequences are within the consequences of a previously evaluated accident (i.e., the analytical consequences of a Control Rod Drop Accident, (CRDA)
LSCS Updated Final Safety Analysis Report (UFSAR) section 15.4.9.3 and UFSAR Table 15.4-6).
B. Operator and equipment response for the following two scenarios involving a complete loss of the Rod Position Indication System (RPIS) are described below: i) Loss of control rod position indication, and ii) Combined loss of control rod position indication and loss of rod drive capability.
i)
Loss of control rod position indication Upon loss of control rod position indication for one or more control rods, as identified on the 40-inch full-core display screen, other RCMS status screens, and the PPC, licensed operators would enter LaSalle Abnormal Operating Page 3 of 15
Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System Procedure LOA-RM-101(201), "Unit 1 (2) RCMS Abnormal Situations" (i.e., a revised version of the current procedure that addresses Reactor Manual Control system abnormalities), and declare the applicable control rods inoperable.
If fewer than nine control rods are inoperable, Technical Specification (TS)
Limiting Condition for Operation (LCO) 3.1.3, "Control Rod OPERABILITY,"
Condition C, "One or more control rods inoperable for reasons other than Condition A or B," requires operators to insert the inoperable control rods within three hours and disarm the associated control rod drive within four hours. LOA-RM-101(201) also requires confirmation of full-in status of the inserted control rods by the Instrument and Controls (I&C) department.
The new RCMS system will simplify the confirmation of full-in status in that there will be test jacks and pin connector terminals for each individual rod in the Auxiliary Electric Equipment Room (AEER) RPIS cabinet. Utilizing the current system and equipment, I&C technicians are required to remove large, 44-pin amphenol connectors from a back panel in the AEER, and then insert meter probes into the female connector pin holes for the applicable control rods to determine full-in reed switch closure state.
If the inoperable control rods cannot be inserted within three hours, including confirmation of Full-In status, or if nine or more control rods are inoperable, TS 3.1.3, Condition E requires that the reactor be placed in MODE 3 (i.e., Hot Shutdown) within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
ii)
Combined loss of control rod position indication and loss of control rod drive capability The postulated loss of both control rod position indication for nine or more control rods and manual control rod drive capability, if not resolved within three hours, would require the unit to be placed in MODE 3 (i.e., HOT SHUTDOWN) within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, in accordance with TS 3.1.3, Condition E. Due to the postulated loss of control rod drive capability, a manual reactor scram would be needed to reach MODE 3. In this scenario (i.e., a reactor scram without control rod position indication), control room operators would enter Emergency Operating Procedure LGA-010, "Failure to Scram," associated with the Anticipated Transient Without Scram (ATWS) event. This procedure would provide guidance and requirements to control room operators until such time that the RPIS is restored or all rod positions can be confirmed as full-in by I&C technicians using LOA-RM-101(201).
Page 4 of 15
Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System NRC Request EICB-3 EGC Response NRC RecLuest EICB-4 EGC Response Despite a postulated loss of RPIS and manual control rod drive capability, the fully independent and safety-related Reactor Protection System (RPS) would successfully insert all rods, as designed. Similarly, the fully independent neutron monitoring system (i.e., Source Range Monitors (SRMs), Intermediate Range Monitors (IRMs), and Averaging Power Range Monitors (APRMs)) would provide indication of reactor shutdown state or power level to support ATWS procedure compliance and response.
Section 3.2.2 - Comparison of New RCMS to Existing RMCS : The last paragraph on page 10 of 49 states that, "The use of the flat-panel touch screen displays instead of the discrete indicators creates a fundamental change to the human system interface." The last paragraph of this section states, "As is the case with the existing RMCS and RWM, the components for the replacement RCMS are not safety-related or seismic, but are seismically installed in the cabinets and panels to satisfy seismic 11// concerns, where required." The touch-screen VDU is not seismically qualified and is, therefore, subject to multiple spurious actuations in case of a seismic event. Please explain why such an event could not place the plant in a new unanalyzed condition.
EGC will provide a response to this RAI by September 11, 2008.
Section 3.2.5 - External Communication Interfaces : Has a Cyber Security Assessment been performed or is planned to be implemented at LaSalle County Station, Units 1 and 2. If not, how do you plan on insuring Cyber Security for this system?
EGC recently completed a Cyber Security risk assessment at LSCS in accordance with NEI 04-04, "Cyber Security Program for Power Reactors," dated November 18, 2005 and NUREG/CR 6847, "Cyber Security Self-Assessment Method of U. S. Nuclear Power Plants," dated September 2003, for all site critical digital assets, including the proposed design for RCMS.
The proposed RCMS design was ranked as "Very Well Protected," with a susceptibility level of 2, a risk category of B-4, and was deemed an "Acceptable Risk" with no design-related mitigation required. As a result of the company-wide NEI 04-04 Cyber Security reviews, EGC determined that intrusion detection software should be added to all company firewalls as a general mitigating action. This software will add an additional level of security to existing firewalls by providing an early warning of potential external attacks. The schedule for this additional enhancement has not been finalized; however, implementation is currently scheduled to occur in 2008.
Page 5 of 15
Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System NRC Request EICB-5 Section 3.3.4 : The second paragraph states, "From a software perspective, the NUMAC process that was used for development and validation of the RCMS software, as described in Section 3.2.7 above, yields software that has a low probability of failure. However, any software-based system can generate random faults. Based on the development and validation process, there is a very low probability of a common mode failure in those areas that are tested in the V& V testing process. Because of this low probability of a common mode failure, random errors are assumed in only one program of one component "
Given the NRC concern that software design errors are a credible source of common-mode failures (i.e., as discussed in Branch Technical Position HICB-19, "Guidance for Evaluation of Defense-in-Depth and Diversity in Digital Computer-Based Instrumentation and Control Systems"), please justify or revise the statement regarding the low probability of failure, consistent with the guidance in HICB-19. In addition, identify the key defense-in-depth and diversity elements that will be employed to demonstrate that the potential vulnerabilities associated with common-mode software failures have been adequately addressed.
EGC Response EGC will provide a response to this RAI by September 11, 2008.
NRC Request EICB-6 The licensee has stated that the new RCMS pushbuttons are slightly smaller than the current pushbuttons, providing a smaller target for a seismic event. Please provide justification for the conclusion that these smaller switches have similar or better seismic withstand capability as compared with the existing switches. Compare mechanical rigidity and spring strength and any other pertinent design characteristics to back up the justification.
The licensee has stated that 'In the event of a seismic event, these displays are adequately mounted to the H13-P603 panel and are not sensitive to falling objects or debris from other systems." Please confirm that all the equipment in the vicinity and above the VDU touch-screen is mounted seismically to protect the VDUs from falling debris and causing spurious selection of rods for movement.
EGC Response EGC will provide a response to this RAI by September 11, 2008.
Page 6 of 15
Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System NRC Request EICB-7 Following two-way messages provide communication between Level 4 and Level 3 equipment:
" Messages sent to RCMS Controller by the PPC Over the Data Connection
" Messages sent to RCMS Controller by the PPC Over the Status Connection
" Messages sent to RCMS Controller by the RWM Sequence Computer Please confirm that all the communication data is predefined and any data which is not predefined will be ignored by the receiving system. How is unrecognized data handled within the receiving system? Does every message have the same message field structure and sequence, including message identification, status information, data bits etc. in the same location in every message. Every datum should be included in every transmit cycle, whether it has changed since the previous transmission or not, to ensure deterministic system behavior.
Appendix B, Section 5, Monitoring of boundary interfaces provides guidance on setting up the boundary interfaces with security components such as firewalls, network intrusion detection system, host intrusion detector systems etc. Please describe your boundary interfaces and their compliance with NEI 04-04.
Appendix B, Section 7, Variations on the model provides further guidance for deviations from the 4 layer model. Since LaSalle is deviating from this model, please describe how LaSalle meets the guidance of this section of NEI 04-04 [Nuclear Energy Institute].
EGC Response EGC will provide a response to this RAI by September 11, 2008.
NRC Request SRXB-1 The AREVA licensing methodology seems to imply that the Control Rod Withdrawal Error
[CRWE] is analyzed using CASM04/MICROBURN-B2, which is NRC-approved, and capable of analyzing slow transients.
Please explain why the low-power CRWE evaluation was performed using RAMONA 5-FA.
Additionally, justify the use of RAMONA5-FA to analyze this transient in terms of the code's qualification. Demonstrate that the code is capable of modeling this transient and predicting conservative results. Alternatively, provide similar analytic results using your NRC-approved accident/design basis accident analysis methodology.
EGC Response The RAMONA5-FA code was selected for use in the evaluation to provide predicted Intermediate Range Monitor (IRM) responses and fuel enthalpy values during the postulated transient (i.e., a CRWE of a rod gang with reactor power levels at or below 5%). This computational tool was used for the evaluation due to limitations of critical power ratio (CPR) correlation and the need to generate IRM responses. The approved CPR correlation was outside of NRC Safety Evaluation bounds-restrictions at the given low-power conditions.
Page 7 of 15
Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System The RAMONA-5FA is primarily used in a comparative manner for this evaluation. The MICROBURN-B2 code was used to evaluate the Delta CPR (DCPR) at 30% power and demonstrate that the ganged withdrawal consequences were acceptable at that power level.
The RAMONA 5-FA was then used to determine a predicted fuel enthalpy at 30% power conditions, which were shown to have acceptable consequence with the DCPR calculations.
For lower power levels, the RAMONA 5-FA predicted peak enthalpy (highest pin of an assembly) was conservatively compared to the average enthalpy (average of the pins in an assembly) of the 30% power case. Based on the conservative comparison manner in which the RAMONA-5FA code is used, this is an appropriate mechanism for the evaluation of the low power CRWE. The IRM evaluation was also comparative in that the response for multiple control rod withdrawal is compared to the response for a single control rod withdrawal.
NRC Request SRXB-2 In the text of the Low Power CRWE Evaluation, it is discussed that the single rod Gang G-09A had the largest decrease MCPR, and that the same trend is demonstrated for the BOC-B sequence withdrawals in that fewer rods in a gang results in a larger change in the MCPR.
Please identify the relevant nuclear and thermal-hydraulic phenomena and/or initial condition assumptions that cause this trend.
EGC Response The governing phenomena are the worth of individual control rods, the fuel reactivity near the error cell(s) (i.e., the fuel cells near an erroneously withdrawn rod), and the proximity between the control rods in a gang. The approximate worth per control rod is provided in the following figures for beginning-of-cycle (BOC), peak hot excess reactivity (PHE), end-of-cycle (EOC) for the A-sequence, and BOC for the B-sequence. The ratio of DCPR to initial MCPR (MMCPR) is plotted against the worth per control rod in a gang (i.e., total gang worth in terms of mk divided by the number of rods in the gang). In this example loading, the exposed assemblies around the central cell were more reactive at BOC. As the cycle continues, the U-235 is depleted and the reactivity of the center cells decreases. Therefore, the higher worth for multiple control rods is spread out over the core and the resulting power increase in response to the reactivity insertion is spread out over the core.
Page 8 of 15
0.45 0.40 0.35 0.30 U 0.25 a
0.20 Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System 0.15 0.10 0.05 0.00 0.45 0.40 0.35 0.30 U 0.25 a
0.20 0.15 0.10 0.05 0.00 DMCPRAMCPR versus Gang Worth BOC A-sequence (10-30% power) 0 0.5 1
1.5 2
2.5 3
3.5 4
Gang Worth mWnumber of rods in gang DMCPR/IMCPR versus Gang Worth PHE A-sequence (10-30% power) 0 0.5 1
1.5 2
2.5 3
Gang Worth mk/Number of rods In gang Page 9 of 15
- 4 Rod Gangs
" Single Rod Gang O 4 Rod gang Single Rod Gang I
e a
o 0
0 0
O O o
no 0
0 0
em 8 0 ° 0 0
t9 t9 0
0 0
0
Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System 0.45 0.40 0.35 0.30 U 0.25 a
0.20 0.15 0.10 0.05 0.00 DMCPRAMCPR versus Gang Worth EOC A-sequence (10-30% power) 0 0.5 1
1.5 2
2.5 Gang Worth mId number of rods In gang DMCPRAMCPR versus Gang Worth BOC B-sequence (10-30% power) 0.5 1
1.5 2
2.5 Gang Worth mktNumber of rods In gang Page 10 of 15 0
4 rod gang A Single rod Gang
- 4 Rod Gangs
.2 Rod Gangs IASingle Rod Gang D
w ".
0 o
s a
T.
06
~
0
~
K
--~----
0 0
. i s o 13
.0 0
0 0
1 0
O 0 0 0
0 0
IR- -6
Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System NRC Request SRXB-3 While the report states that single rod Gang G-09A had the largest decrease in MCPR, the first three figures of Section 3 [i.e., Attachment 2 of Reference 3, Framatome ANP, Inc., "Low Power CRWE Evaluation for LaSalle," October 31, 2005] do not seem to identify rod gangs by size, as does Figure 3.4. Please provide information clarifying the issue.
EGC Response With the exception of Gang G09A, all other gangs shown in Figures 3.1, 3.2 and 3.3 (i.e., of Reference 3) contain four rods. Gang G09A is uniquely identified in the figures.
The purpose of this analysis was to evaluate the impact of ganged rod pulls. Therefore, several single rod gangs are not included in the evaluation.
NRC Request SRXB-4 The fractional LHGR [Linear Heat Generation Rate] comparisons provided in Section 4 present results from only a selected set of rod gangs. Please explain why remaining gangs were omitted, particularly with respect to some of the remaining gangs toward the center of the core.
EGC Response The evaluation assumes that the banked position withdrawal sequence (BPWS) is followed, up to the point that the CRWE occurs. In the A sequence, the evaluation assumed that the rod groups lower than group 7 would be withdrawn to be critical at 5% power. Likewise group 7 must be withdrawn at 25% power. Therefore only those gangs in groups 7 and higher are included in the evaluation of the impact on linear heat generation rate (LHGR). Also, single rod gangs, such as gangs G07A, G07B, G07C and G07D, were not evaluated.
The specific rods which would be candidates for CRWE in a B sequence rod pattern are different from those for an A sequence rod pattern. However, based on the rod worths, the results of the CPR evaluation, and the significant margin to challenging LHGR limits, it is concluded that evaluation of the B sequence would result in the same conclusion with respect to the impact upon LHGR.
NRC Request SRXB-5 Because you are implementing a new reactivity control system, the hardware-specific conclusions that allow licensees to treat uncontrolled control rod withdrawal errors as an infrequent event may no longer be acceptable, because the staff may not be reasonably assured that the new RCMS is robust enough that only the presented and evaluated single failures could occur, and that occurrence of these single failures would not result in an uncontrolled control rod withdrawal. This conclusion may be applicable to both single and ganged rod withdrawals, both at low-power and/or startup conditions, and at full power (at full power, because the RBM system appears to interact with the RCMS to achieve a rod block). In consideration of this, you are requested to provide the following additional information :
Page 1 1 of 15
Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System 1.
Propose an alternative means to provide adequate assurance that the aforementioned reactivity and power distribution anomalies would not leave the plant in an unacceptable condition. Your present basis implies acceptability based on a low frequency of occurrences, with little regard to possible consequences. Additional consideration of consequences is suggested.
- 2.
Explain how the NRC is reasonably assured of the following :
2a)
Only low-worth gangs of multiple rods will be designed. What defines "low-worth," and how is the NRC assured that your core design will consistently contain low-worth gangs?
2b)
Rod gangs will not be designed for at-power operation. How is the NRC assured that gangs of multiple rods will not be available for withdrawal above the RBM automatic bypass setpoint?
EGC Response
- 1)
In order to provide adequate assurance that any reactivity and power distribution anomalies (i.e., hypothetical single or gang CRWE anomalies caused by common-mode software failures) would not leave the plant in an unacceptable condition at high/full power, the following at-power RWE evaluation was conducted. The results of this evaluation indicate that even if a common-mode software failure were to occur at power (i.e., at power levels above 30%) the potential consequences are within the consequences of a previously evaluated accident (i.e., the analytical consequences of a CRDA, LSCS Updated Final Safety Analysis Report (UFSAR) section 15.4.9.3 and UFSAR Table 15.4-6).
At-Power CRWE Evaluation The following process was used to evaluate the possible consequences of a system failure that would allow a gang of rods to be continuously withdrawn at power during four LSCS core design cycles, based on the design step-throughs (i.e., the expected core performance given target rod patterns, which are based upon target eigenvalues).
- a.
Individually withdraw all rods that are not fully withdrawn in the step-through, as well as in the respective gang assignments.
- b.
Tabulate the maximum Delta CPR for all single rod withdrawals in the cycle
- c.
Tabulate the Delta CPR for all multiple rod withdrawals
- d.
For multiple rod withdrawal cases, identify the number of assemblies with MCPR less than the initial MCPR minus the maximum Delta CPR for the single rod withdrawal.
- e.
Tabulate the number of failed fuel pins by assuming all of the fuel pins in the bundles identified in step d. have failed.
- f.
If the number of failed fuel pins is greater than 850 (i.e., the analytical consequences of a CRDA as described in LSCS UFSAR section 15.4.9.3 and UFSAR Table 15.4-6), evaluate the gang assignments to determine if the Page 12 of 15
59 55 51 47 43 39 35 31 27 23 19 15 11 7
3 Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System This process was implemented and resulted in a redefinition of rod gangs from those originally described in Attachment 2 of Reference 3:
This redefinition of these gangs resulted in the following gang assignment for the A-sequence rods :
G06B G03G G05D G04F G05C G03G G06C G05A G01F G09E G02E G10G G02D G09F G01F G05B GO6A G03E G08C G04D G07F G03C G07G G04D G08D G03E G06A G05B G01E G09D G02C G10E G01C G09K G01D G10F G02C G09D G01E G05A assignments can be changed to reduce the postulated number of failed fuel pins (i.e., repeat steps a. through e. with the reassigned gangs).
Gang G08A was subdivided into G08A and G08J (i.e., two rods in each gang)
Gang G08B was subdivided into G08B and G08k (i.e., two rods in each gang)
Gang G09B was subdivided into G09B and G09J (i.e., two rods in each gang)
Gang G10E was subdivided into G10E and G10J (i.e., two rods in each gang)
Gang G10F was subdivided into G10F and G10K (i.e., two rods in each gang)
Gang G09C was subdivided into G09C and G09K (i.e., two rods in each gang)
G01 E G09D G02C G10F G01C G09K G01D G10E G02C1 G 09D G06A(G03ErG08D 04EIG07G GO3DLGO7F IG04EIG08CFG03EIG06A G05A G01EI G05B~
G05B GO1F G09F G02E G1OG G02D G09E G01F G05A TG06CrG03G (G05CIG04FIG05D I G03GI G06BT 2
6 10 14 18 22 26 30 34 38 42 46 50 54 58 The resulting evaluation of the revised gang assignments, at all exposure points for both single and gang withdrawals, for four core design cycles, resulted in consequences less than the consequences of a CRDA, as described in the LSCS UFSAR (i.e., 850 failed fuel pins). These results provide a reasonable assurance that acceptable core conditions would result even with the unlikely occurrence of uncontrolled ganged rod withdrawals.
- 2) The following information provides reasonable assurance that a) only low-worth rod gangs will be designed; and b) rod gangs will not be designed for at-power operation, thus ensuring that gangs of multiple rods will not be available for withdrawal above the RBM automatic bypass setpoint.
2a)
The EGC process for the design, review, and approval of rod withdrawal sequences, including the design of rod gangs, is procedurally controlled. This Page 1 3 of 15 G06C G08F G08D G04C G07E G03B G08A G04A G08B G03B G07E G04C G08C G03F G06B G01G G09F G02D G10K G01B G09B G02A G10B G02B G09J GOIA G10J G02E G09E G01G G05C G04E G07G G03D G08K G04B G07A G03A G07B G04B G08J G03D G07F G04E G05D G02F G10G G01D G09C G02B G10A G01A G09A G01B G10C G02A G09C G01C G10G G02F G05D G04D G07F G03C G08J G04A G07D G03B G07C G04A G08K G03C G07G G04D G05C G0 1G G09E G02D G10J G01B G09J G02A G10D G02B G09B G01A G10K G02E G09F G01G G06B G03F G08C G04C G07E G03A G08B G04B G08A G03A G07E G04C G08DrG03F G06CI
Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System procedural control ensures that only sequences with satisfactory low-worth gangs will be designed, approved, and transferred to any RCMS sequence register.
The rod withdrawal sequences that are developed using this procedure are derived from the formal Banked Position Withdrawal Sequences (BPWS) with both appropriate core power distribution and rod pull ramp rates (i.e., rod worth)
The minimum allowed calculated reactor period and associated maximum single notch worth are identified as design input parameters. The design input parameters are procedurally controlled using NF-AB-105, "Cycle Design Inputs and Requirements" and transmitted to the fuel vendor. These inputs are used to form the basis and boundaries of the reload design and operating cycle management.
Sequences are developed using the EGC and fuel vendor-approved cycle specific startup report. This report determines rod pull and notch position order by evaluating and ensuring that no individual rod notch has a control rod worth of more than 0.80 mk, which ensures a reactor period greater than or equal to 50 seconds.
This same criteria and evaluation are applied to the specification of gangs and actual rod pull sequences, which will are then developed in accordance with approved station procedures under the control of Qualified Nuclear Engineers.
When withdrawing control rods below 10% RTP, the analyzed sequence constraints (i.e., CRDA, BPWS-based) inherently limit the total worth of any resulting ganged step withdrawal. Near the point of criticality, low worth is procedurally maintained by a controlled approach to criticality. In this region of the startup (i.e., in general, between notch 00 and notch 36), single notch withdrawal is required by procedure. This single notch withdrawal requirement serves to significantly limit total worth that would be added by a gang withdrawal, since a rod gang would only be withdrawn six inches at a time, while reactor period was closely monitored and limited. Furthermore, as described above, gang use will be restricted, as warranted, to preclude high-worth gang withdrawal steps from being executed.
After criticality and continuing up to the 30% RTP limit of gang use, there are no rod worth limitations. In this power region, ramp rates are limited only by balance-of-plant startup constraints.
2b)
The safety-related LSCS RBM system is designed to protect against the High Power Rod Withdrawal Error (RWE) event by monitoring the four Local Power Range Monitor (LPRM) strings (i.e., 16 LPRMs total) around the selected rod.
This system is required to be operable above 30% RTP.
The RBM system is only capable of monitoring core neutronics during withdrawal of a single selected control rod. Due to this RBM system limitation and the >30%
RTP operability requirement for the RBM, gang rod withdrawal above 30% RTP cannot be allowed. Consequently, there is no need or value in designing rod gangs for power control withdrawal above 30% RTP. For these reasons, RCMS Page 14 of 15
Attachment Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System References has been designed and interlocked to only allow multiple (gang) withdrawal, for power control, at <_ 30% RTP.
To provide additional protection against erroneous gang withdrawal above the 30% RTP RBM automatic bypass setpoint, rod gangs will not be designed for at-power, withdrawal operation. All sequences that are developed for transfer to any RCMS sequence register for startup use, in accordance with EGC procedures, will ensure that gangs of multiple rods will not be available for withdrawal above the RBM automatic bypass setpoint. This administrative control will be accomplished by limiting the use of gangs within startup sequences to only the steps required to reach less than 30% RTP.
The combination of the RBM system limitations and administrative sequence development controls will ensure that gangs of multiple rods will not be available for withdrawal above the RBM automatic bypass setpoint.
1.
Letter from S. P. Sands (U.S. NRC) to C. G. Pardee, (Exelon Generation Company, LLC), "LaSalle County Station, Units 1 and 2 - Request for Additional Information Related to Request for License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System (TAC Nos. MD7900 and MD7901)," dated August 1, 2008
- 2. Letter from D. M. Benyak (Exelon Generation Company, LLC) to U.S. NRC, "Request for License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System," dated August 14, 2007
- 3.
Letter from P. R. Simpson (Exelon Generation Company, LLC) to U. S. NRC, "Supplemental Information Concerning License Amendment to Allow Ganged Rod Drive Capability of the Rod Control Management System," dated May 13, 2008 Page 1 5 of 15