Latest revision as of 01:12, 20 March 2020

Text

Redacted - Issuance of Amendment No. 226, Technical Specification Changes to Support Installation of GE Hitachi Power Range Neutron Monitoring System; Implementation of Arts/Mellla
	ML13317B623
Person / Time
Site:	Columbia
Issue date:	01/31/2014
From:	Lyon C; Plant Licensing Branch IV
To:	Reddeman M; Energy Northwest
	Lyon C
References
	TAC ME7905
	Download: ML13317B623 (177)
	v • d • e

OFFICIAL USE ONLY- PROPRIETARY INFORMATION UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 January 31, 2014 Mr. Mark E. Reddemann Chief Executive Officer Energy Northwest P.O. Box 968 (Mail Drop 1023)

Richland, WA 99352-0968

SUBJECT:

COLUMBIA GENERATING STATION -ISSUANCE OF AMENDMENT RE:

IMPLEMENTATION OF POWER RANGE NEUTRON MONITORING/AVERAGE POWER RANGE MONITOR/ROD BLOCK MONITOR/TECHNICAL SPECIFICATIONS/MAXIMUM EXTENDED LOAD LINE LIMIT ANALYSIS (PRNM/ARTS/MELLLA) (TAC NO. ME7905)

Dear Mr. Reddemann:

The U.S. Nuclear Regulatory Commission (Commission) has issued the enclosed Amendment No. 226 to Energy Northwest (licensee) for the Renewed Facility Operating License No. NPF-21 for the Columbia Generating Station. The amendment consists of changes to the Technical Specifications (TSs) in response to your application dated January 31, 2012, as supplemented by letters dated July 31, August 22, October 5, and November 12,2012, and January 7, April 11, May 9, and August 6, 2013.

The amendment allows for expansion of the operating domain by the implementation of Power Range Neutron Monitoring/Average Power Range Monitor/Rod Block Monitor/Technical Specifications/Maximum Extended Load Line Limit Analysis (PRNM/ARTS/MELLLA). The Neutron Monitoring System would be modified by replacing the analog Average Power Range Monitor subsystem with the General Electric-Hitachi Nuclear Measurement Analysis and Control (NUMAC) PRNM System. The licensee would expand the operating domain to MELLLA and make changes to certain allowable values and limits and to the TSs. The changes to the TSs include the adoption of Technical Specifications Task Force (TSTF) change traveler TSTF-493, Revision 4, Option A surveillance notes and addition of a licensing basis to support Anticipated Transient without Scram accident mitigation with one Standby Liquid Control pump instead of two. to this letter contains Proprietary Information. When separated from Enclosure 2, this document is DECONTROLLED.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION M. Reddemann Additional information on the amendment changes and the NRC staffs evaluations are documented in Enclosure 2 (proprietary version) and Enclosure 3 (non-proprietary version).

The Notice of Issuance will be included in the Commission's next biweekly Federal Register notice.

Sincerely, CF~

Carl F. Lyon, Project Manager Plant Licensing Branch IV-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-397

Enclosures:

1. Amendment No. 226 to NPF-21

2. Safety Evaluation (proprietary)

3. Safety Evaluation (non-proprietary) cc w/encls: Distribution via Listserv OFFICIAL USE ONLY- PROPRIETARY INFORMATION

ENCLOSURE1 AMENDMENT NO. 226 ENERGY NORTHWEST COLUMBIA GENERATING STATION DOCKET NO. 50-397

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ENERGY NORTHWEST DOCKET NO. 50-397 COLUMBIA GENERATING STATION AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 226 License No. NPF-21

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by Energy Northwest (licensee), dated January 31, 2012, as supplemented by letters dated July 31, August 22, October 5, and November 12, 2012, and January 7, April 11, May 9, and August 6, 2013, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and Paragraph 2.C.(2) of Renewed Facility Operating License No. NPF-21 is hereby amended to read as follows:

(2) Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 226 and the Environmental Protection Plan contained in Appendix B, are hereby incorporated in the license. The licensee shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

3. The license amendment is effective as of its date of issuance and shall be implemented before plant startup following refueling outage 22, scheduled to begin in May 2015.

FOR THE NUCLEAR REGULATORY COMMISSION

~<~

Michael T. Markley, Chief Plant Licensing Branch IV-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Renewed Facility Operating License No. NPF-21 and Technical Specifications Date of Issuance: January 31, 2014

ATTACHMENT TO LICENSE AMENDMENT NO. 226 RENEWED FACILITY OPERATING LICENSE NO. NPF-21 DOCKET NO. 50-397 Replace the following pages of the Renewed Facility Operating License No. NPF-21 and Appendix A, Technical Specifications with the attached revised pages. The revised pages are identified by amendment number and contain vertical lines indicating the areas of change.

Facility Operating License REMOVE INSERT Technical Specifications REMOVE INSERT 3.2.4-1 3.2.4-1 3.2.4-2 3.2.4-2 3.3.1.1-1 through 3.3.1.1-8 3.3.1.1-1 through 3.3.1.1-18 3.3.1.3-1 3.3.1.3-1 3.3.1.3-2 3.3.1.3-2 3.3.2.1-1 through 3.3.2.1-5 3.3.2.1-1 through 3.3.2.1-12 3.4.1-1 3.4.1-1 3.4.1-2 3.4.1-2 3.4.1-3 3.4.1-4 3.10.8-1 through 3.10.8-3 3.10.8-1 through 3.10.8-7 5.6-1 through 5.6-4 5.6-1 through 5.6-4

(2) Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 226 and the Environmental Protection Plan contained in Appendix B, are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

a. For Surveillance Requirements (SRs) not previously performed by existing SRs or other plant tests, the requirement will be considered met on the implementation date and the next required test will be at the interval specified in the Technical Specifications as revised in Amendment No. 149.

(3) Deleted.

(4) Deleted.

(5) Deleted.

(6) Deleted.

(7) Deleted.

(8) Deleted.

(9) Deleted.

(1 0) Deleted.

(11) Shield Wall Deferral (Section 12.3.2, SSER #4. License Amendment #7)

The licensee shall complete construction of the deferred shield walls and window as identified in Attachment 3, as amended by this license amendment.

(12) Deleted.

(13) Deleted.

The parenthetical notation following the title of many license conditions denotes the section of the Safety Evaluation Report and/or its supplements wherein the license condition is discussed.

Renewed License No. NPF-21 Amendment No. 226

APRM Gain and Setpoint (Prior to Implementation of PRNM Upgrade) 3.2.4 3.2 POWER DISTRIBUTION LIMITS 3.2.4 Average Power Range Monitor (APRM) Gain and Setpoint LCO 3.2.4 a. MFLPD shall be less than or equal to Fraction of RTP (FRTP); or

b. Each required APRM Flow Biased Simulated Thermal Power - High Function Allowable Value shall be modified by greater than or equal to the ratio of FRTP and the MFLPD; or

c. Each required APRM gain shall be adjusted such that the APRM readings are~ 100% times MFLPD.

APPLICABILITY: THERMAL POWER ~ 25% RTP prior to implementation of Power Range Neutron Monitor (PRNM) upgrade.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Requirements of the A.1 Satisfy the requirements of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months LCO not met. the LCO.

B. Required Action and B.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months associated Completion POWER to< 25% RTP.

Time not met.

Columbia Generating Station 3.2.4-1 Amendment No. +e9 ~ 226

APRM Gain and Setpoint (Prior to Implementation of PRNM Upgrade) 3.2.4 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.2.4.1 -------------------------------NC>TE------------------------------

Not required to be met if SR 3.2.4.2 is satisfied for LCC> 3.2.4.b or LCC> 3.2.4.c requirements.

Verify MFLPD is within limits. ()nee within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after

25% RTP 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter SR 3.2.4.2 -------------------------------NC>TE------------------------------

Not required to be met if SR 3.2.4.1 is satisfied for LCC> 3.2.4.a requirements.

Verify each required: 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

a. APRM Flow Biased Simulated Thermal Power -

High Function Allowable Value is modified by greater than or equal to the ratio of FRTP and the MFLPD; or

b. APRM gain is adjusted such that the APRM reading is ;;:: 100% times MFLPD.

Columbia Generating Station 3.2.4-2 Amendment No. 4-eS ~ 226

RPS Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.1.1 3.3 INSTRUMENTATION 3.3.1.1 Reactor Protection System (RPS) Instrumentation LCO 3.3.1.1 The RPS instrumentation for each Function in Table 3.3.1.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.1.1-1 prior to implementation of Power Range Neutron Monitor (PRNM) upgrade.

ACTIONS

NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months channels inoperable.

OR A.2 Place associated trip 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months system in trip.

B. One or more Functions B.1 Place channel in one trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months with one or more system in trip.

required channels inoperable in both trip OR systems.

B.2 Place one trip system in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months trip.

C. One or more Functions C.1 Restore RPS trip capability. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months with RPS trip capability not maintained.

D. Required Action and D.1 Enter the Condition Immediately associated Completion referenced in Time of Condition A, B, Table 3.3.1.1-1 for the or C not met. channel.

Columbia Generating Station 3.3.1.1-1 Amendment No. ~~ 226

RPS Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.1.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME E. As required by Required E.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Action D.1 and POWER to< 30% RTP.

referenced in Table 3.3.1.1-1.

F. As required by Required F.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action D .1 and referenced in Table 3.3.1.1-1.

G. As required by Required G.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Action D .1 and referenced in Table 3.3.1.1-1.

H. As required by Required H.1 Initiate action to fully insert Immediately Action D.1 and all insertable control rods in referenced in core cells containing one or Table 3.3.1.1-1. more fuel assemblies.

SURVEILLANCE REQUIREMENTS

NOTES----------------------------------------------------------

1. Refer to Table 3.3.1.1-1 to determine which SRs apply for each RPS Function.

2. When a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains RPS trip capability.

SURVEILLANCE FREQUENCY SR 3.3.1.1.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Columbia Generating Station 3.3.1.1-2 Amendment No. 99 ~ 226

RPS Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.1.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.1.1.2 -------------------------------NC>TE------------------------------

Not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL PC>WER 2 25% RTP.

Verify the absolute difference between the average 7 days power range monitor (APRM) channels and the calculated power :s; 2% RTP plus any gain adjustment required by LC() 3.2.4, "Average Power Range Monitor (APRM) Gain and Setpoint," while operating at 2 25% RTP.

SR 3.3.1.1.3 -------------------------------NC>TE------------------------------

Not required to be performed when entering MC>DE 2 from MC>DE 1 until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering MC>DE 2.

Perform CHANNEL FUNCTIC>NAL TEST. 7 days SR 3.3.1.1.4 Perform CHANNEL FUNCTIC>NAL TEST. 7 days SR 3.3.1.1.5 Verify the source range monitor (SRM) and Prior to intermediate range monitor (IRM) channels overlap. withdrawing SRMs from the fully inserted position SR 3.3.1.1.6 -------------------------------NC>TE------------------------------

()nly required to be met during entry into MC>DE 2 from MC>DE 1.

Verify the IRM and APRM channels overlap. 7 days SR 3.3.1.1.7 Calibrate the local power range monitors. 1130 MWD/T average core exposure Columbia Generating Station 3.3.1.1-3 Amendment No. 4-eS ~ 226

RPS Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.1.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.1.1.8 Perform CHANNEL FUNCTIONAL TEST. 92 days SR 3.3.1.1.9 ------------------------------NOTES-----------------------------

1. Neutron detectors are excluded.

2. For Function 2.a, not required to be performed when entering MODE 2 from MODE 1 until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering MODE 2.

Perform CHANNEL CALIBRATION. 184 days SR 3.3.1.1.10 ------------------------------NOTES-----------------------------

1. Neutron detectors are excluded.

2. For Function 1, not required to be performed when entering MODE 2 from MODE 1 until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering MODE 2.

Perform CHANNEL CALIBRATION. 18 months for Functions 1 through 4, 6, 7, and 9 through 11 AND 24 months for Functions 5 and 8 SR 3.3.1.1.11 Verify the APRM Flow Biased Simulated Thermal 18 months Power - High Function time constant is ::;; 7 seconds.

SR 3.3.1.1.12 Verify Turbine Throttle Valve- Closure, and Turbine 18 months Governor Valve Fast Closure Trip Oil Pressure-Low Functions are not bypassed when THERMAL POWER is~ 30% RTP.

SR 3.3.1.1.13 Perform CHANNEL FUNCTIONAL TEST. 24 months Columbia Generating Station 3.3.1.1-4 Amendment No . .:t-79 ~ 226

RPS Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.1.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.1.1.14 Perform LOGIC SYSTEM FUNCTIONAL TEST. 24 months SR 3.3.1.1.15 ------------------------------NOTES-----------------------------

1 Neutron detectors are excluded.

2. Channel sensors for Functions 3 and 4 are excluded.

3. For Function 5, "n" equals 4 channels for the purpose of determining the STAGGERED TEST BASIS Frequency.

Verify the RPS RESPONSE TIME is within limits. 24 months on a STAGGERED TEST BASIS Columbia Generating Station 3.3.1.1-5 Amendment No. 4-69 ~ 226

RPS Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.1.1 Table 3.3.1.1-1 (page 1 of3)

Reactor Protection System Instrumentation APPLICABLE CONDITIONS MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPECIFIED PER TRIP REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS SYSTEM ACTION D.1 REQUIREMENTS VALUE

1. Intermediate Range Monitors

a. Neutron Flux- High 2 3 G SR 3.3.1.1.1 <; 122/125 SR 3.3.1.1.3 divisions of full SR 3.3.1.1.5 scale SR 3.3.1.1.6 SR 3.3.1.1.10 SR 3.3.1.1.14 5(a) 3 H SR 33.1.11 <; 122/125 SR 3.3.1.1.4 divisions of full SR 3.3.1.1.10 scale SR 3.3.1.1.14

b. lnop 2 3 G SR 3.3.1.1.3 NA SR 3.3.1.1.14 5(a) 3 H SR 3.3.1.1.4 NA SR 3.3.1.1.14

2. Average Power Range Monitors

a. Neutron Flux- High, 2 2 G SR 3.3.1.1.1 .,; 20% RTP Setdown SR 3.3.1.1.3 SR 3.3.1.1.6 SR 3.3.1.1.7 SR 3.3.1.1.9 SR 3.3.1.1.14

b. Flow Biased Simulated 2 F SR 3.3.1.1.1 <; 0.58 W + 62% RTP Thermal Power- High SR 3.3.1.1.2 and.,; 114.9% RTP SR 3.3.1.1.7 SR 3.3.1.1.8 SR 3.3.1.1.9 SR 3.3.1.1.11 SR 3.3.11.14

c. Fixed Neutron Flux - 2 F SR 3.3.1.1.1 .,; 120% RTP High SR 3.3.1.1.2 SR 3.3.1.1.7 SR 3.3.1.1.8 SR 3.3.1.1.9 SR 3.3.1.1.14 SR 3.3.1.1.15

d. lnop 1,2 2 G SR 3.3.1.1.7 NA SR 3.3.1.1.8 SR 3.3.1.1.14 (a) With any control rod withdrawn from a core cell containing one or more fuel assemblies.

Columbia Generating Station 3.3.1.1-6 Amendment No. +e9 ~ 226

RPS Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.1.1 Table 3.3.1.1-1 (page 2 of 3)

Reactor Protection System Instrumentation APPLICABLE CONDITIONS .

MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPECIFIED PER TRIP REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS SYSTEM ACTION D.1 REQUIREMENTS VALUE

3. Reactor Vessel Steam 1,2 2 G SR 3.3.1.1.8 ~ 1079 psig Dome Pressure - High SR 3.3.1.1.10 SR 3.3.1.1.14 SR 3.3.1.1.15

4. Reactor Vessel Water Level 1,2 2 G SR 3.3.1.1.1 ::> 9.5 inches

- Low, Level 3 SR 3.3.1. 1.8 SR 3.3.1.1.10 SR 3.3.1.1.14 SR 3.3.1.1.15

5. Main Steam Isolation Valve 8 F SR 33.1.1.8 ~ 12.5% closed

-Closure SR 3.31.1.10 SR 3.3.1.1.14 SR 3.3.1.1.15

6. Primary Containment 1,2 2 G SR 3.31.1.8 ~ 1.88 psig Pressure - High SR 3.3.1.1.10 SR 3.3.1.1.14

7. Scram Discharge Volume Water Level - High

a. Transmitter/Trip Unit 1,2 2 G SR 3.3.1.1.8 ~ 529 ft 9 inches SR 3.3.1.1.10 elevation SR 3.3.1.1.14 5(a) 2 H SR 3.3.1.1.8 ~ 529ft 9 inches SR 3.31.1.10 elevation SR 3.3.1.1.14

b. Float Switch 1,2 2 G SR 3.31.1.8 ~ 529 ft 9 inches SR 3.3.1.1.10 elevation SR 3.3.1.1.14 s<*> 2 H SR 3.3.1.1.8 ~ 529 ft 9 inches SR 3.3.1.1.10 elevation SR 3.3.1.1.14

8. Turbine Throttle Valve - ::> 30% RTP 4 E SR 3.3.1.1.8 ~ 7% closed Closure SR 3.3.1.1.10 SR 33.1.1.12 SR 3.3.1.1.14 SR 3.3.1.1.15 (a) With any control rod withdrawn from a core cell containing one or more fuel assemblies.

Columbia Generating Station 3.3.1.1-7 Amendment No. 4-eS ~ 226

RPS Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.1.1 Table 3.3.1.1-1 (page 3 of 3)

Reactor Protection System Instrumentation APPLICABLE CONDITIONS MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPECIFIED PER TRIP REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS SYSTEM ACTION D.1 REQUIREMENTS VALUE

9. Turbine Governor Valve ~ 30% RTP 2 E SR 3 3.1 1.8 ~ 1000 psig Fast Closure, Trip Oil SR 3.3.1.1.10 Pressure- Low SR 3.3.1.1.12 SR 3.3.1.1.14 SR 3.3.1.1.15

10. Reactor Mode Switch - 1,2 2 G SR 3.3.1.1.13 NA Shutdown Position SR 3.3.1.1.14 5(a) 2 H SR 3.3.1.1.13 SR 3.3.1.1.14 NA

11. Manual Scram 1,2 2 G SR 3.3.1.1.4 NA SR 3.3.1.1.14 5(a) 2 H SR 3.3.1.1.4 NA SR 3.3.1.1.14 (a) With any control rod withdrawn from a core cell containing one or more fuel assemblies.

Columbia Generating Station 3.3.1.1-8 Amendment No. 4-69 ~ 226

RPS Instrumentation (After Implementation of PRNM Upgrade) 3.3.1.1 3.3 INSTRUMENTATION 3.3.1.1 Reactor Protection System (RPS) Instrumentation LCO 3.3.1.1 The RPS instrumentation for each Function in Table 3.3.1.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.1.1-1 after implementation of Power Range Neutron Monitor (PRNM) upgrade.

ACTIONS

NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months channels inoperable.

OR

NOTE---------------

Not applicable for Functions 2.a, 2.b, 2.c, 2.d, or 2.f.

A.2 Place associated trip 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months system in trip.

NOTE-------------- B.1 Place channel in one trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Not applicable for system in trip.

Functions 2.a, 2.b, 2.c, 2.d, or 2.f. OR B.2 Place one trip system in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B. One or more Functions trip.

with one or more required channels inoperable in both trip systems.

Columbia Generating Station 3.3.1.1-9 Amendment No. +eQ. 225 226

RPS Instrumentation (After Implementation of PRNM Upgrade) 3.3.1.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. One or more Functions C.1 Restore RPS trip capability. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months with RPS trip capability not maintained.

D. Required Action and D. 1 Enter the Condition Immediately associated Completion referenced in Time of Condition A, B, Table 3.3.1.1-1 for the or C not met. channel.

E. As required by Required E.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Action D .1 and POWER to< 30% RTP.

referenced in Table 3.3.1.1-1.

F. As required by Required F.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action D.1 and referenced in Table 3.3.1.1-1.

G. As required by Required G. 1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Action D.1 and referenced in Table 3.3.1.1-1.

H. As required by Required H.1 Initiate action to fully insert Immediately Action D.1 and all insertable control rods in referenced in core cells containing one or Table 3.3.1.1-1. more fuel assemblies.

Columbia Generating Station 3.3.1.1-10 Amendment No. +6-9~ 226

RPS Instrumentation (After Implementation of PRNM Upgrade) 3.3.1.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME I. As required by Required 1.1 Initiate alternate method to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Action D.1 and detect and suppress referenced in thermal hydraulic instability Table 3.3.1.1-1. oscillations.

AND

NOTE-------------

LCO 3.0.4 is not applicable.

1.2 Restore required channels 120 days to OPERABLE J. Required Action and J.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months associated Completion POWER to less than the Time of Condition I not value specified in the met. COLR.

SURVEILLANCE REQUIREMENTS

NOTES----------------------------------------------------------

1. Refer to Table 3.3.1.1-1 to determine which SRs apply for each RPS Function.

2. When a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains RPS trip capability.

SURVEILLANCE FREQUENCY SR 3.3.1.1.1 Perform CHANNEL CHECK. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Columbia Generating Station 3.3.1.1-11 Amendment No. +e9 ~ 226

RPS Instrumentation (After Implementation of PRNM Upgrade) 3.3.1.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.1.1.2 -------------------------------NC>TE------------------------------

Not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL PC>WER ~ 25% RTP.

Verify the absolute difference between the average 7 days power range monitor (APRM) channels and the calculated power ~ 2% RTP while operating at

~ 25% RTP.

SR 3.3.1.1.3 -------------------------------NC>TE------------------------------

Not required to be performed when entering MC>DE 2 from MC>DE 1 until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering MC>DE 2.

Perform CHANNEL FUNCTIC>NAL TEST. 7 days SR 3.3.1.1.4 Perform CHANNEL FUNCTIC>NAL TEST. 7 days SR 3.3.1.1.5 Verify the source range monitor (SRM) and Prior to intermediate range monitor (IRM) channels overlap. withdrawing SRMs from the fully inserted position SR 3.3.1.1.6 -------------------------------NC>TE------------------------------

()nly required to be met during entry into MC>DE 2 from MC>DE 1.

Verify the IRM and APRM channels overlap. 7 days SR 3.3.1.1.7 Calibrate the local power range monitors. 1130 MWD/T average core exposure Columbia Generating Station 3.3.1.1-12 Amendment No. 4-e-9 ~ 226

RPS Instrumentation (After Implementation of PRNM Upgrade) 3.3.1.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.1.1.8 Perform CHANNEL FUNCTIONAL TEST. 92 days SR 3.3.1.1.9 Deleted.

SR 3.3.1.1.10 ------------------------------NOTES-----------------------------

1. Neutron detectors are excluded.

2. For Function 1, not required to be performed when entering MODE 2 from MODE 1 until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering MODE 2.

3. For Functions 2.b and 2.f, the recirculation flow transmitters that feed the APRMs are included.

Perform CHANNEL CALIBRATION. 18 months for Functions 1, 3, 4, 6, 7, and 9 through 11 AND 24 months for Functions 2, 5, and 8 SR 3.3.1.1.11 Deleted.

SR 3.3.1.1.12 Verify Turbine Throttle Valve - Closure, and Turbine 18 months Governor Valve Fast Closure Trip Oil Pressure-Low Functions are not bypassed when THERMAL POWER is~ 30% RTP.

SR 3.3.1.1.13 Perform CHANNEL FUNCTIONAL TEST. 24 months Columbia Generating Station 3.3.1.1-13 Amendment No. 4-79 ~ 226

RPS Instrumentation (After Implementation of PRNM Upgrade) 3.3.1.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.1.1.14 Perform LOGIC SYSTEM FUNCTIONAL TEST. 24 months SR 3.3.1.1.15 ------------------------------NOTES-----------------------------

1. Neutron detectors are excluded.

2. Channel sensors for Functions 3 and 4 are excluded.

3. For Function 5, "n" equals 4 channels for the purpose of determining the STAGGERED TEST BASIS Frequency.

4. For Function 2.e, "n" equals 8 channels for the purpose of determining the STAGGERED TEST BASIS Frequency. Testing of APRM and oscillation power range monitor (OPRM) outputs shall alternate.

Verify the RPS RESPONSE TIME is within limits. 24 months on a STAGGERED TEST BASIS SR 3.3.1.1.16 ------------------------------NOTES-----------------------------

1. For Function 2.a, not required to be performed when entering MODE 2 from MODE 1 until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering MODE 2.

2. For Functions 2.b and 2.f, the CHANNEL FUNCTIONAL TEST includes the recirculation flow input processing, excluding the flow transmitters.

Perform CHANNEL FUNCTIONAL TEST. 184 days SR 3.3.1.1.17 Verify the OPRM is not bypassed when APRM 24 months Simulated Thermal Power is greater than or equal to the value specified in the COLR and recirculation drive flow is less than the value specified in the COLR.

Columbia Generating Station 3.3.1.1-14 Amendment No. eS ~ 226

RPS Instrumentation (After Implementation of PRNM Upgrade) 3.3.1.1 Table 3.3.1.1-1 (page 1 of4)

Reactor Protection System Instrumentation APPLICABLE CONDITIONS MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPECIFIED PER TRIP REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS SYSTEM ACTION D.1 REQUIREMENTS VALUE

1. Intermediate Range Monitors

a. Neutron Flux- High 2 3 G SR 3.3.1.1.1 ~ 122/125 SR 3.3.1.1.3 divisions of full SR 3.3.1.1.5 scale SR 3.3.1.1.6 SR 3.3.1.1.10 SR 3.3.1.114 5(a) 3 H SR 3.3.1.11 ~ 122/125 SR 3.3.1.1.4 divisions of full SR 3.3.1.1.10 scale SR 3.3.1.1.14

b. lnop 2 3 G SR 3.3.1.1.3 NA SR 3.3.1.1.14 5(a) 3 H SR 3.3.1.1.4 NA SR 3.3.1.1.14

2. Average Power Range Monitors

a. Neutron Flux - High 2 3(b) G SR 3.3.1.1.1 ~ 20% RTP (Setdown) SR 3.3.1.1.6 SR 3.3.1.1.7 SR 3.3.1.1.1 o<d).(e)

SR 3.3.1.1.16

b. Simulated Thermal 3(b) F SR 3.3.1.1.1 ~ 0.63W + 64.0% RTP Power- High SR 3.3.1.12 and~ 114.9% RTP(c)

SR 3.3.1.1.7 SR 3.3.1.1. 1o<d),(e)

SR 3.3.1.1.16 (a) With any control rod withdrawn from a core cell containing one or more fuel assemblies.

(b) Each APRM/OPRM channel provides inputs to both trip systems.

(c) s 0.63W + 60.8% RTP and s 114.9% RTP when reset for single loop operation per LCO 3.4.1, "Recirculation Loops Operating."

(d) If the as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

(e) The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the Limiting Trip Setpoint (L TSP) at the completion of the surveillance; otherwise, the channel shall be declared inoperable.

Setpoints more conservative than the LTSP are acceptable provided that the as-found and as-left tolerances apply to the actual setpoint implemented in the surveillance procedures (Nominal Trip Setpoint) to confirm channel performance. The LTSP and the methodologies used to determine the as-found and as-left tolerances are specified in the Licensee Controlled Specifications.

Columbia Generating Station 3.3.1.1-15 Amendment No. 4-eQ. ~ 226

RPS Instrumentation (After Implementation of PRNM Upgrade) 3.3.1.1 Table3.3.1.1-1 (page2of4)

Reactor Protection System Instrumentation APPLICABLE CONDITIONS MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPECIFIED PER TRIP REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS SYSTEM ACTION D.1 REQUIREMENTS VALUE

2. Average Power Range Monitors

c. Neutron Flux - High F SR 3.3.1.1.1 :-:; 120% RTP SR 3.3.1.1.2 SR 3.3.1.1.7 SR 3.3.1.1.1 o<dl.<*>

SR 3.3.1.1.16

d. lnop 1,2 G SR 3.3.1.1.16 NA

e. 2-0ut-of-4 Voter 1,2 2 G SR 3.3.1.1.1 NA SR 3.3.1.114 SR 3.3.1.1.15 SR 3.3.1.116

f. OPRM Upscale (f) SR 3.3.1.11 NA<9 >

SR 3.3.1.1.7 SR 3.3.1.1.1 o<d>.<*>

SR 3.3.1.1.16 SR 3.3.1.117 (b) Each APRM/OPRM channel provides inputs to both trip systems.

(d) If the as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

(e) The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the Limiting Trip Setpoint (LTSP) at the completion of the surveillance; otherwise, the channel shall be declared inoperable.

Setpoints more conservative than the LTSP are acceptable provided that the as-found and as-left tolerances apply to the actual setpoint implemented in the surveillance procedures (Nominal Trip Setpoint) to confirm channel performance. The LTSP and the methodologies used to determine the as-found and as-left tolerances are specified in the Licensee Controlled Specifications.

(f) THERMAL POWER greater than or equal to the value specified in the COLR.

(g) The OPRM Upscale does not have an Allowable Value. The Period Based Detection Algorithm (PBDA) trip setpoints are specified in the COLR.

Columbia Generating Station 3.3.1.1-16 Amendment No. 69 ~ 226

RPS Instrumentation (After Implementation of PRNM Upgrade) 3.3.1.1 Table 3.3.1.1-1 (page 3 of4)

Reactor Protection System Instrumentation APPLICABLE CONDITIONS MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPECIFIED PER TRIP REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS SYSTEM ACTION D.1 REQUIREMENTS VALUE

3. Reactor Vessel Steam 1,2 2 G SR 3.3.1.1.8 $ 1079 psig Dome Pressure - High SR 3.3.1.1.10 SR 3.3.1.1.14 SR 3.3.1.1.15

4. Reactor Vessel Water 1,2 2 G SR 3.3.1.1.1 ~ 9.5 inches Level - Low, Level 3 SR 3.3.1.1.8 SR 3.3.1.1.10 SR 3.3.1.1.14 SR 3.31.1.15

5. Main Steam Isolation Valve 8 F SR 3.3.1.1.8 $ 12.5% closed

-Closure SR 3.3.1.1.10 SR 3.3.1.1.14 SR 33.1.1.15

6. Primary Containment 1,2 2 G SR 3.3.1.1.8 $ 1.88 psig Pressure - High SR 3.3.1.1.10 SR 3.3.1.1.14

7. Scram Discharge Volume Water Level - High

a. Transmitterrrrip Unit 1,2 2 G SR 3.3.1.1.8 $ 529 ft 9 inches SR 3.3.1.1.10 elevation SR 3.3.1.1.14 5(a) 2 H SR 3.3.1.1.8 $ 529 ft 9 inches SR 3.3.1.1.10 elevation SR 3.3.1.1.14

b. Float Switch 1,2 2 G SR 3.3.1.1.8 $ 529 ft 9 inches SR 3.3.1.1.10 elevation SR 3.3.1.1.14 5(a) 2 H SR 3.3.1.1.8 $ 529ft 9 inches SR 3.3.1.1.10 elevation SR 3.3.1.1.14

8. Turbine Throttle Valve - ~ 30% RTP 4 E SR 3.3.1.1.8 $7% closed Closure SR 3.3.1.110 SR 3.3.1.1.12 SR 3.3.1.1.14 SR 3.3.1.1.15 (a) With any control rod withdrawn from a core cell containing one or more fuel assemblies.

Columbia Generating Station 3.3.1.1-17 Amendment No. ~~ 226

RPS Instrumentation (After Implementation of PRNM Upgrade) 3.3.1.1 Table 3.3.1.1-1 (page 4 of 4)

Reactor Protection System Instrumentation APPLICABLE CONDITIONS MODES OR REQUIRED REFERENCED OTHER CHANNELS FROM SPECIFIED PER TRIP REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS SYSTEM ACTION D.1 REQUIREMENTS VALUE

9. Turbine Governor Valve ~ 30% RTP 2 E SR 3.3.1.1.8 ~ 1000 psig Fast Closure, Trip Oil SR 3.3.1.1.10 Pressure - Low SR 3.3.1.1.12 SR 3.3.1.1.14 SR 3.3.1.1.15

10. Reactor Mode Switch - 1,2 2 G SR 3.3.1.1.13 NA Shutdown Position SR 3.3.1.1.14 5(a) 2 H SR 3.3.1.1.13 SR 3.3.1.1.14 NA

11. Manual Scram 1,2 2 G SR 3.3.1.1.4 NA SR 3.3.1.1.14 5(a) 2 H SR 3.3.1.1.4 NA SR 3.3.1.1.14 (a) With any control rod withdrawn from a core cell containing one or more fuel assemblies.

Columbia Generating Station 3.3.1.1-18 Amendment No. 226

OPRM Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.1.3 3.3 INSTRUMENTATION 3.3.1.3 Oscillation Power Range Monitor (OPRM) Instrumentation LCO 3.3.1.3 Four channels of the OPRM instrumentation shall be OPERABLE within the limits as specified in the COLR.

APPLICABILITY: THERMAL POWER ;::.; 25% RTP prior to implementation of Power Range Neutron Monitor (PRNM) upgrade.

ACTIONS

NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Place channel in trip. 30 days channels inoperable.

OR A.2 Place associated RPS trip 30 days system in trip.

OR A.3 Initiate alternate method to 30 days detect and suppress thermal hydraulic instability oscillations.

B. OPRM trip capability not B.1 Initiate alternate method to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months maintained. detect and suppress thermal hydraulic instability oscillations.

C. Required Action and C.1 Reduce THERMAL 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months associated Completion POWER< 25% RTP.

Time not met.

Columbia Generating Station 3.3.1.3-1 Amendment No. 4-7 ~ 226

OPRM Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.1.3 SURVEILLANCE REQUIREMENTS

NOTE-----------------------------------------------------------

When a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the OPRM System maintains trip capability.

SURVEILLANCE FREQUENCY SR 3.3.1.3.1 Perform CHANNEL FUNCTIONAL TEST. 184 days SR 3.3.1.3.2 Calibrate the local power range monitors. 1130 MWD/T average core exposure SR 3.3.1.3.3 -------------------------------NOTE------------------------------

Neutron detectors are excluded.

Perform CHANNEL CALIBRATION. 24 months SR 3.3.1.3.4 Perform LOGIC SYSTEM FUNCTIONAL TEST. 24 months SR 3.3.1.3.5 Verify OPRM is not bypassed when THERMAL 24 months POWER is ::::: 30% RTP and core flow ~ 60% rated core flow.

SR 3.3.1.3.6 -----------------------------NOTE--------------------------------

Neutron detectors are excluded.

Verify the RPS RESPONSE TIME is within limits. 24 months on a STAGGERED TEST BASIS Columbia Generating Station 3.3.1.3-2 Amendment No . .:t-86 ~ 226

Control Rod Block Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.2.1 3.3 INSTRUMENTATION 3.3.2.1 Control Rod Block Instrumentation LCO 3.3.2.1 The control rod block instrumentation for each Function in Table 3.3.2.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.2.1-1 prior to implementation of Power Range Neutron Monitor (PRNM) upgrade.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One rod block monitor A.1 Restore RBM channel to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (RBM) channel OPERABLE status.

inoperable.

B. Required Action and B.1 Place one RBM channel in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months associated Completion trip.

Time of Condition A not met.

OR Two RBM channels inoperable.

C. Rod worth minimizer C.1 Suspend control rod Immediately (RWM) inoperable movement except by during reactor startup. scram.

OR C.2.1.1 Verify~ 12 rods withdrawn. Immediately OR Columbia Generating Station 3.3.2.1-1 Amendment No. ~~226

Control Rod Block Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.2.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. (continued) C.2.1.2 Verify by administrative Immediately methods that startup with RWM inoperable has not been performed in the last calendar year.

AND C.2.2 Verify movement of control During control rod rods is in compliance with movement banked position withdrawal sequence (BPWS) by a second licensed operator or other qualified member of the technical staff.

D. RWM inoperable during D.1 Verify movement of control During control rod reactor shutdown. rods is in compliance with movement BPWS by a second licensed operator or other qualified member of the technical staff.

E. One or more Reactor E.1 Suspend control rod Immediately Mode Switch - Shutdown withdrawal.

Position channels inoperable. AND E.2 Initiate action to fully insert Immediately all insertable control rods in core cells containing one or more fuel assemblies.

Columbia Generating Station 3.3.2.1-2 Amendment No. 4-e9 ~ 226

Control Rod Block Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.2.1 SURVEILLANCE REQUIREMENTS

N()TES----------------------------------------------------------

1. Refer to Table 3.3.2.1-1 to determine which SRs apply for each Control Rod Block Function.

2. When an RBM channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains control rod block capability.

SURVEILLANCE FREQUENCY SR 3.3.2.1.1 Perform CHANNEL FUNCTI()NAL TEST. 92 days SR 3.3.2.1.2 -------------------------------N()TE------------------------------

Not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after any control rod is withdrawn at ::;; 10% RTP in M()DE 2.

Perform CHANNEL FUNCTI()NAL TEST. 92 days SR 3.3.2.1.3 -------------------------------N()TE------------------------------

Not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after THERMAL P()WER is::;; 10% RTP in M()DE 1.

Perform CHANNEL FUNCTI()NAL TEST. 92 days SR 3.3.2.1.4 -------------------------------N()TE------------------------------

Neutron detectors are excluded.

Verify the RBM is not bypassed: 92 days

a. When THERMAL P()WER is~ 30% RTP; and

b. When a peripheral control rod is not selected.

Columbia Generating Station 3.3.2.1-3 Amendment No. +e9 ~ 226

Control Rod Block Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.2.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.2.1.5 -------------------------------N()TE------------------------------

Neutron detectors are excluded.

Perform CHANNEL CALIBRATI()N. 92 days SR 3.3.2.1.6 Verify the RWM is not bypassed when THERMAL 24 months P()WER is::;; 10% RTP.

SR 3.3.2.1.7 -------------------------------N()TE------------------------------

Not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after reactor mode switch is in the shutdown position.

Perform CHANNEL FUNCTI()NAL TEST. 24 months SR 3.3.2.1.8 Verify control rod sequences input to the RWM are Prior to declaring in conformance with BPWS. RWM ()PERABLE following loading of sequence into RWM Columbia Generating Station 3.3.2.1-4 Amendment No. -'1-79 ~ 226

Control Rod Block Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.2.1 Table 3.3.2.1-1 (page 1 of 1)

Control Rod Block Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS REQUIREMENTS VALUE

1. Rod Block Monitor

a. Upscale (a) 2 SR 3.3.2.1.1 :o; 0.58W +51%

SR 3.3.2.1.4 RTP SR 3.3.2.1.5

b. lnop (a) 2 SR 3.3.2.1.1 NA SR 3.3.2.1.4

c. Downscale (a) 2 SR 3.3.2.1.1 ~ 3% RTP SR 3.3.2.1.4 SR 3.3.2.1.5

2. Rod Worth Minimizer SR 3.3.2.1.2 NA SR 3.3.2.1.3 SR 3.3.2.1.6 SR 3.3.2.1.8

3. Reactor Mode Switch - Shutdown (c) 2 SR 3.3.2.1. 7 NA Position (a) THERMAL POWER ~ 30% RTP and no peripheral control rod selected.

(b) With THERMAL POWER :o; 10% RTP.

(c) Reactor mode switch in the shutdown position.

Columbia Generating Station 3.3.2.1-5 Amendment No. 4-eS ~ 226

Control Rod Block Instrumentation (Prior to Implementation of PRNM Upgrade) 3.3.2.1 (This page intentionally blank)

Columbia Generating Station 3.3.2.1-6 Amendment No. 226

Control Rod Block Instrumentation {After Implementation of PRNM Upgrade) 3.3.2.1 3.3 INSTRUMENTATION 3.3.2.1 Control Rod Block Instrumentation LCO 3.3.2.1 The control rod block instrumentation for each Function in Table 3.3.2.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.2.1-1 after implementation of Power Range Neutron Monitor (PRNM) upgrade.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One rod block monitor A.1 Restore RBM channel to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (RBM) channel OPERABLE status.

inoperable.

B. Required Action and B.1 Place one RBM channel in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months associated Completion trip.

Time of Condition A not met.

OR Two RBM channels inoperable.

c. Rod worth minimizer C.1 Suspend control rod Immediately (RWM) inoperable movement except by during reactor startup. scram.

OR C.2.1.1 Verify~ 12 rods withdrawn. Immediately OR Columbia Generating Station 3.3.2.1-7 Amendment No. +.w. 22e 226

Control Rod Block Instrumentation (After Implementation of PRNM Upgrade) 3.3.2.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. (continued) C.2.1.2 Verify by administrative Immediately methods that startup with RWM inoperable has not been performed in the last calendar year.

AND C.2.2 Verify movement of control During control rod rods is in compliance with movement banked position withdrawal sequence (BPWS) by a second licensed operator or other qualified member of the technical staff.

D. RWM inoperable during D.1 Verify movement of control During control rod reactor shutdown. rods is in compliance with movement BPWS by a second licensed operator or other qualified member of the technical staff.

E. One or more Reactor E.1 Suspend control rod Immediately Mode Switch - Shutdown withdrawal.

Position channels inoperable. AND E.2 Initiate action to fully insert Immediately all insertable control rods in core cells containing one or more fuel assemblies.

Columbia Generating Station 3.3.2.1-8 Amendment No. +W- ~ 226

Control Rod Block Instrumentation (After Implementation of PRNM Upgrade) 3.3.2.1 SURVEILLANCE REQUIREMENTS

NOTES----------------------------------------------------------

1. Refer to Table 3.3.2.1-1 to determine which SRs apply for each Control Rod Block Function.

2. When an RBM channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains control rod block capability.

SURVEILLANCE FREQUENCY SR 3.3.2.1.1 Perform CHANNEL FUNCTIONAL TEST. 184 days SR 3.3.2.1.2 -------------------------------NOTE------------------------------

Not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after any control rod is withdrawn at~ 10% RTP in MODE 2.

Perform CHANNEL FUNCTIONAL TEST. 92 days SR 3.3.2.1.3 -------------------------------NOTE------------------------------

Not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after THERMAL POWER is ~ 10% RTP in MODE 1.

Perform CHANNEL FUNCTIONAL TEST. 92 days Columbia Generating Station 3.3.2.1-9 Amendment No. +69 2-ae 226

Control Rod Block Instrumentation (After Implementation of PRNM Upgrade) 3.3.2.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.2.1.4 -------------------------------NOTE------------------------------

Neutron detectors are excluded.

Verify the RBM is not bypassed: 24 months

a. Low Power Range - Upscale Function is not bypassed when APRM Simulated Thermal Power is ~ 28% and < 63% RTP and peripheral control rod is not selected.

b. Intermediate Power Range- Upscale Function is not bypassed when APRM Simulated Thermal Power is ~ 63% and < 83% RTP and peripheral control rod is not selected.

c. High Power Range - Upscale Function is not bypassed when APRM Simulated Thermal Power is ~ 83% and peripheral control rod is not selected.

SR 3.3.2.1.5 -------------------------------N()TE------------------------------

Neutron detectors are excluded.

Perform CHANNEL CALIBRATION. 24 months SR 3.3.2.1 .6 Verify the RWM is not bypassed when THERMAL 24 months POWER is ~ 10% RTP.

SR 3.3.2.1.7 -------------------------------NOTE------------------------------

Not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after reactor mode switch is in the shutdown position.

Perform CHANNEL FUNCTI()NAL TEST. 24 months SR 3.3.2.1.8 Verify control rod sequences input to the RWM are Prior to declaring in conformance with BPWS. RWM ()PERABLE following loading of sequence into RWM Columbia Generating Station 3.3.2.1-1 0 Amendment No. -+79 22-e 226

Control Rod Block Instrumentation (After Implementation of PRNM Upgrade) 3.3.2.1 Table 3.3.2.1-1 (page 1 of 2)

Control Rod Block Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS REQUIREMENTS VALUE

1. Rod Block Monitor

a. Low Power Range - Upscale (a) 2 SR 3.3.2.1.1 (f)

SR 3.3.2.1.4 SR 3.3.2.1.5(d),(e)

b. Intermediate Power Range- (b) 2 SR 3.3.2.1.1 (f)

Upscale SR 3.3.2.1.4 SR 3.3.2.1.5(d),(e)

c. High Power Range - Upscale (c) 2 SR 3.3.2.1.1 (f)

SR 3.3.2.1.4 SR 3.3.2.1.5(d),(e)

d. lnop (a),(b),(c) 2 SR 3.3.2.1.1 NA (a) APRM Simulated Thermal Power is;:: 28% and< 63% RTP and MCPR is less than the limit specified in the COLR and no peripheral control rod selected.

(b) APRM Simulated Thermal Power is;:: 63% and< 83% RTP and MCPR is less than the limit specified in the COLR and no peripheral control rod selected.

(c) APRM Simulated Thermal Power is;:: 83% and MCPR is less than the limit specified in the COLR and no peripheral control rod selected.

(d) If the as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

(e) The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the Limiting Trip Setpoint (LTSP) at the completion of the surveillance; otherwise, the channel shall be declared inoperable.

Setpoints more conservative than the LTSP are acceptable provided that the as-found and as-left tolerances apply to the actual setpoint implemented in the surveillance procedures (Nominal Trip Setpoint) to confirm channel performance. The LTSP and the methodologies used to determine the as-found and as-left tolerances are specified in the Licensee Controlled Specifications.

(f) Allowable Value Specified in the COLR.

Columbia Generating Station 3.3.2.1-11 Amendment No. 226

Control Rod Block Instrumentation (After Implementation of PRNM Upgrade) 3.3.2.1 Table 3.3.2.1-1 (page 2 of 2)

Control Rod Block Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS CHANNELS REQUIREMENTS VALUE

2. Rod Worth Minimizer SR 3.3.2.1.2 NA SR 3.3.2.1.3 SR 3.3.2.1.6 SR 3.3.2.1.8

3. Reactor Mode Switch - Shutdown (h) 2 SR 3.3.2.1.7 NA Position (g) With THERMAL POWER $10% RTP.

(h) Reactor mode switch in the shutdown position.

Columbia Generating Station 3.3.2.1-12 Amendment No. 226

Recirculation Loops Operating (Prior to Implementation of PRNM Upgrade) 3.4.1 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.1 Recirculation Loops Operating LCO 3.4.1 Two recirculation loops with matched flows shall be in operation.

One recirculation loop shall be in operation provided that the following limits are applied when the associated LCO is applicable:

a. LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," single loop operation limits specified in the COLR; and

b. LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)," single loop operation limits specified in the COLR.

APPLICABILITY: MODES 1 and 2 prior to implementation of Power Range Neutron Monitor (PRNM) upgrade.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Recirculation loop flow A.1 Declare the recirculation 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months mismatch not within loop with lower flow to be limits. "not in operation."

B. Requirements of the B.1 Satisfy the requirements of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months LCO not met for reasons the LCO.

other than Condition A.

C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A or B not met.

OR No recirculation loops in operation.

Columbia Generating Station 3.4.1-1 Amendment No. ~~ 226

Recirculation Loops Operating (Prior to Implementation of PRNM Upgrade) 3.4.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.1.1 -------------------------------N()TE------------------------------

Not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after both recirculation loops are in operation.

Verify recirculation loop drive flow mismatch with 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months both recirculation loops in operation is:

a. :-: ; 10% of rated recirculation loop drive flow when operating at < 70% of rated core flow; and

b. :-: ; 5% of rated recirculation loop drive flow when operating at~ 70% of rated core flow.

Columbia Generating Station 3.4.1-2 Amendment No. 4-7+ ~ 226

Recirculation Loops Operating (After Implementation of PRNM Upgrade) 3.4.1 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.1 Recirculation Loops Operating LCO 3.4.1 Two recirculation loops with matched flows shall be in operation.

One recirculation loop shall be in operation provided that the following limits are applied when the associated LCO is applicable:

a. LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," single loop operation limits specified in the COLR;

b. LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)," single loop operation limits specified in the COLR; and

c. LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation,"

Function 2.b (Average Power Range Monitors, Simulated Thermal Power- High), Allowable Value of Table 3.3.1.1-1 is reset for single loop operation.

APPLICABILITY: MODES 1 and 2 after implementation of Power Range Neutron Monitor (PRNM) upgrade.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Recirculation loop flow A.1 Declare the recirculation 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months mismatch not within loop with lower flow to be limits. "not in operation."

B. Requirements of the 8.1 Satisfy the requirements of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months LCO not met for reasons the LCO.

other than Condition A.

Columbia Generating Station 3.4.1-3 Amendment No. ~ 22a 226

Recirculation Loops Operating (After Implementation of PRNM Upgrade) 3.4.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A or B not met.

No recirculation loops in operation.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.1.1 -------------------------------NOTE------------------------------

Not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after both recirculation loops are in operation.

Verify recirculation loop drive flow mismatch with 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months both recirculation loops in operation is:

a. s 10% of rated recirculation loop drive flow when operating at < 70% of rated core flow; and

b. s 5% of rated recirculation loop drive flow when operating at ::?: 70% of rated core flow.

Columbia Generating Station 3.4.1-4 Amendment No. ~~ 226

SDM Test- Refueling (Prior to Implementation of PRNM Upgrade) 3.10.8 3.10 SPECIAL OPERATIONS 3.10.8 SHUTDOWN MARGIN (SDM) Test- Refueling LCO 3.10.8 The reactor mode switch position specified in Table 1.1-1 for MODE 5 may be changed to include the startup/hot standby position, and operation considered not to be in MODE 2, to allow SDM testing, provided the following requirements are met:

a. LCO 3.3.1.1, "Reactor Protection System Instrumentation," MODE 2 requirements for Functions 2.a and 2.d of Table 3.3.1.1-1;

b. 1. LCO 3.3.2.1, "Control Rod Block Instrumentation," MODE 2 requirements for Function 2 of Table 3.3.2.1-1, with banked position withdrawal sequence requirements of SR 3.3.2.1.8 changed to require the control rod sequence to conform to the SDM test sequence,

2. Conformance to the approved control rod sequence for the SDM test is verified by a second licensed operator or other qualified member of the technical staff;

c. Each withdrawn control rod shall be coupled to the associated control rod drive (CRD);

d. All control rod withdrawals during out of sequence control rod moves shall be made in notch out mode;

e. No other CORE ALTERATIONS are in progress; and

f. CRD charging water header pressure~ 940 psig.

APPLICABILITY: MODE 5 with the reactor mode switch in startup/hot standby position prior to implementation of Power Range Neutron Monitor (PRNM) upgrade.

Columbia Generating Station 3.10.8-1 Amendment No. 4-69 ~ 226

SDM Test- Refueling (Prior to Implementation of PRNM Upgrade) 3.10.8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. ------------NOTE------------ --------------------NOTE-------------------

Separate Condition entry Rod worth minimizer may be is allowed for each bypassed as allowed by control rod. LCO 3.3.2.1, "Control Rod Block

Instrumentation," if required, to allow insertion of inoperable control One or more control rod and continued operation.

rods not coupled to its ------------------------------------------------

associated CRD.

A.1 Fully insert inoperable 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months control rod.

AND A.2 Disarm the associated 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months CRD.

B. One or more of the B.1 Place the reactor mode Immediately above requirements not switch in the shutdown or met for reasons other refuel position.

than Condition A.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.10.8.1 Perform the MODE 2 applicable SRs for According to the LCO 3.3.1.1, Functions 2.a and 2.d of applicable SRs Table 3.3.1.1-1.

SR 3.10.8.2 -------------------------------NOTE------------------------------

Not required to be met if SR 3.1 0.8.3 satisfied.

Perform the MODE 2 applicable SRs for According to the LCO 3.3.2.1, Function 2 of Table 3.3.2.1-1. applicable SRs Columbia Generating Station 3.10.8-2 Amendment No. 4e9 ~ 226

SDM Test- Refueling (Prior to Implementation of PRNM Upgrade) 3.10.8 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.10.8.3 -------------------------------N()TE------------------------------

Not required to be met if SR 3.1 0.8.2 satisfied.

Verify movement of control rods is in compliance During control rod with the approved control rod sequence for the SDM movement test by a second licensed operator or other qualified member of the technical staff.

SR 3.10.8.4 Verify no other C()RE AL TERATI()NS are in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months progress.

SR 3.10.8.5 Verify each withdrawn control rod does not go to the Each time the withdrawn overtravel position. control rod is withdrawn to "full out" position Prior to satisfying LC() 3.1 0.8.c requirement after work on control rod or CRD System that could affect coupling SR 3.10.8.6 Verify CRD charging water header pressure 7 days

~ 940 psig.

Columbia Generating Station 3.10.8-3 Amendment No. +69 ~ 226

SDM Test- Refueling (Prior to Implementation of PRNM Upgrade) 3.10.8 (This page intentionally blank)

Columbia Generating Station 3.10.8-4 Amendment No. 226

SDM Test- Refueling (After Implementation of PRNM Upgrade) 3.10.8 3.10 SPECIAL OPERATIONS 3.10.8 SHUTDOWN MARGIN (SDM) Test- Refueling LCO 3.10.8 The reactor mode switch position specified in Table 1.1-1 for MODE 5 may be changed to include the startup/hot standby position, and operation considered not to be in MODE 2, to allow SDM testing, provided the following requirements are met:

a. LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation,"

MODE 2 requirements for Functions 2.a, 2.d, and 2.e of Table 3.3.1.1-1;

b. 1. LCO 3.3.2.1, "Control Rod Block Instrumentation," MODE 2 requirements for Function 2 of Table 3.3.2.1-1, with banked position withdrawal sequence requirements of SR 3.3.2.1.8 changed to require the control rod sequence to conform to the SDM test sequence,

2. Conformance to the approved control rod sequence for the SDM test is verified by a second licensed operator or other qualified member of the technical staff;

c. Each withdrawn control rod shall be coupled to the associated control rod drive (CRD);

d. All control rod withdrawals during out of sequence control rod moves shall be made in notch out mode;

e. No other CORE ALTERATIONS are in progress; and

f. CRD charging water header pressure ~ 940 psig.

APPLICABILITY: MODE 5 with the reactor mode switch in startup/hot standby position after implementation of Power Range Neutron Monitor (PRNM) upgrade.

Columbia Generating Station 3.10.8-5 Amendment No. 226

SDM Test- Refueling (After Implementation of PRNM Upgrade) 3.10.8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. ------------NOTE------------ --------------------N0 TE -------------------

Separate Condition entry Rod worth minimizer may be is allowed for each bypassed as allowed by control rod. LCO 3.3.2.1, "Control Rod Block

Instrumentation," if required, to allow insertion of inoperable control One or more control rod and continued operation.

rods not coupled to its ------------------------------------------------

associated CRD.

A.1 Fully insert inoperable 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months control rod.

AND A.2 Disarm the associated 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months CRD.

B. One or more of the B.1 Place the reactor mode Immediately above requirements not switch in the shutdown or met for reasons other refuel position.

than Condition A.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.10.8.1 Perform the MODE 2 applicable SRs for According to the LCO 3.3.1.1, Functions 2.a, 2.d, and 2.e of applicable SRs Table 3.3.1.1-1.

SR 3.10.8.2 -------------------------------N0 TE ------------------- -----------

Not required to be met if SR 3.1 0.8.3 satisfied.

Perform the MODE 2 applicable SRs for According to the LCO 3.3.2.1, Function 2 of Table 3.3.2.1-1. applicable SRs Columbia Generating Station 3.10.8-6 Amendment No . .:tB9 22e 226

SDM Test - Refueling (After Implementation of PRNM Upgrade) 3.10.8 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.10.8.3 -------------------------------NOTE------------------------------

Not required to be met if SR 3.1 0.8.2 satisfied.

Verify movement of control rods is in compliance During control rod with the approved control rod sequence for the SDM movement test by a second licensed operator or other qualified member of the technical staff.

SR 3.10.8.4 Verify no other CORE ALTERATIONS are in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months progress.

SR 3.10.8.5 Verify each withdrawn control rod does not go to the Each time the withdrawn overtravel position. control rod is withdrawn to "full out" position Prior to satisfying LCO 3.1 o.8.c requirement after work on control rod or CRD System that could affect coupling SR 3.10.8.6 Verify CRD charging water header pressure 7 days

~ 940 psig.

Columbia Generating Station 3.10.8-7 Amendment No. :t-e9 22e 226

Reporting Requirements 5.6 5.0 ADMINISTRATIVE CONTROLS 5.6 Reporting Requirements The following reports shall be submitted in accordance with 10 CFR 50.4.

5.6.1 Annual Radiological Environmental Operating Report The Annual Radiological Environmental Operating Report covering the operation of the unit during the previous calendar year shall be submitted by May 15 of each year. The report shall include summaries, interpretations, and analyses of trends of the results of the Radiological Environmental Monitoring Program for the reporting period. The material provided shall be consistent with the objectives outlined in the Offsite Dose Calculation Manual (ODCM), and in 10 CFR 50, Appendix I, Sections IV.B.2, IV.B.3, and IV.C.

The Annual Radiological Environmental Operating Report shall include the results of analyses of all radiological environmental samples and of all environmental radiation measurements taken during the period pursuant to the locations specified in the table and figures in the ODCM, as well as summarized and tabulated results of these analyses and measurements in the format of the table in the Radiological Assessment Branch Technical Position, Revision 1, November 1979. In the event that some individual results are not available for inclusion with the report, the report shall be submitted noting and explaining the reasons for the missing results. The missing data shall be submitted in a supplementary report as soon as possible.

5.6.2 Radioactive Effluent Release Report The Radioactive Effluent Release Report covering the operation of the unit shall be submitted in accordance with 10 CFR 50.36a. The report shall include a summary of the quantities of radioactive liquid and gaseous effluents and solid waste released from the unit. The material provided shall be consistent with the objectives outlined in the ODCM and the Process Control Program and in conformance with 10 CFR 50.36a and 10 CFR 50, Appendix I, Section IV.B.1.

Columbia Generating Station 5.6-1 Amendment No.~~ 226 I

Reporting Requirements 5.6 5.6 Reporting Requirements 5.6.3 CORE OPERATING LIMITS REPORT (COLR)

a. Core operating limits shall be established prior to each reload cycle, or prior to any remaining portion of a reload cycle, and shall be documented in the COLR for the following:

1. The APLHGR for Specification 3.2.1;

2. The MCPR for Specification 3.2.2;

3. The LHGR for Specification 3.2.3;

4. LCO 3.3.1.3, "Oscillation Power Range Monitor (OPRM)

Instrumentation" prior to implementation of Power Range Neutron Monitor (PRNM) upgrade;

5. The Oscillation Power Range Monitor (OPRM) Instrumentation for Specification 3.3.1.1 after implementation of PRNM upgrade; and

6. The Rod Block Monitor Instrumentation for Specification 3.3.2.1 after implementation of PRNM upgrade.

b. The analytical methods used to determine the core operating limits shall be those previously reviewed and approved by the NRC, specifically those described in the following documents:

1. XN-NF-81-58(P)(A), "RODEX2 Fuel Rod Thermal-Mechanical Response Evaluation Model," Exxon Nuclear Company

2. XN-NF-85-67(P)(A), "Generic Mechanical Design for Exxon Nuclear Jet Pump BWR Reload Fuel," Exxon Nuclear Company

3. EMF-85-74(P) Supplement 1(P)(A) and Supplement 2(P)(A),

"RODEX2A (BWR) Fuel Rod Thermal-Mechanical Evaluation Model,"

Siemens Power Corporation

4. ANF-89-98(P)(A), "Generic Mechanical Design Criteria for BWR Fuel Designs," Advanced Nuclear Fuels Corporation

5. XN-NF-80-19(P)(A) Volume 1, "Exxon Nuclear Methodology for Boiling Water Reactors - Neutronic Methods for Design and Analysis,"

Exxon Nuclear Company

6. XN-NF-80-19(P)(A) Volume 4, "Exxon Nuclear Methodology for Boiling Water Reactors: Application of the ENC Methodology to BWR Reloads," Exxon Nuclear Company Columbia Generating Station 5.6-2 Amendment No. +QG~ 226

Reporting Requirements 5.6 5.6 Reporting Requirements 5.6.3 CORE OPERATING LIMITS REPORT (COLR) (continued)

7. EMF-2158(P)(A), "Siemens Power Corporation Methodology for Boiling Water Reactors: Evaluation and Validation of CASM0-4/MICROBURN-B2," Siemens Power Corporation

8. XN-NF-80-19(P)(A) Volume 3, "Exxon Nuclear Methodology for Boiling Water Reactors, THERMEX: Thermal Limits Methodology Summary Description," Exxon Nuclear Company

9. XN-NF-84-1 05(P)(A) Volume 1, "XCOBRA-T: A Computer Code for BWR Transient Thermal-Hydraulic Core Analysis," Exxon Nuclear Company

10. ANF-524(P)(A), "ANF Critical Power Methodology for Boiling Water Reactors," Advanced Nuclear Fuels Corporation

11. ANF-913(P)(A) Volume 1, "COTRANSA2: A Computer Program for Boiling Water Reactor Transient Analysis," Advanced Nuclear Fuels Corporation

12. ANF-1358(P)(A) "The Loss of Feedwater Heating Transient in Boiling Water Reactors," Advanced Nuclear Fuels Corporation

13. EMF-2209(P)(A), "SPCB Critical Power Correlation," Siemens Power Corporation

14. EMF-2245(P)(A), "Application of Siemens Power Corporation's Critical Power Correlations to Co-Resident Fuel," Siemens Power Corporation

15. EMF-2361 (P)(A), "EXEM BWR-2000 ECCS Evaluation Model,"

Framatome ANP Richland

16. EMF-2292(P)(A), "ATRIUM' -1 0: Appendix K Spray Heat Transfer Coefficients," Siemens Power Corporation

17. EMF-CC-074(P)(A) Volume 4, "BWR Stability Analysis-Assessment of STAIF with Input from MICROBURN-B2," Siemens Power Corporation

18. CENPD-300-P-A, "Reference Safety Report for Boiling Water Reactor Reload Fuel," ABB Combustion Engineering Nuclear Operations

19. NED0-32465-A, "BWR Owners' Group Reactor Stability Detect and Suppress Solutions Licensing Basis Methodology and Reload Applications"

20. NEDC-33419P, "GEXL97 Correlation Applicable to ATRIUM-10 Fuel,"

Global Nuclear Fuel Columbia Generating Station 5.6-3 Amendment No. +9G- 22-e 226

Reporting Requirements 5.6 5.6 Reporting Requirements 5.6.3 CORE OPERATING LIMITS REPORT (COLR) (continued)

21. NEDE-24011-P-A and NEDE-24011-P-A-US, "General Electric Standard Application for Reactor Fuel (GESTAR II) and Supplement for United States," Global Nuclear Fuel

c. The core operating limits shall be determined such that all applicable limits (e.g., fuel thermal mechanical limits, core thermal hydraulic limits, Emergency Core Cooling Systems (ECCS) limits, nuclear limits such as SDM, transient analysis limits, and accident analysis limits) of the safety analysis are met.

d. The COLR, including any midcycle revisions or supplements, shall be provided upon issuance for each reload cycle to the NRC.

5.6.4 Post Accident Monitoring (PAM) Instrumentation Report When a report is required by Condition 8 or F of LCO 3.3.3.1, "Post Accident Monitoring (PAM) Instrumentation," a report shall be submitted within the following 14 days. The report shall outline the preplanned alternate method of monitoring, the cause of the inoperability, and the plans and schedule for restoring the instrumentation channels of the Function to OPERABLE status.

Columbia Generating Station 5.6-4 Amendment No . .:t-90 ~ 226

ENCLOSURE 3 (NON-PROPRIETARY)

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 226 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-21 ENERGY NORTHWEST COLUMBIA GENERATING STATION DOCKET NO. 50-397

OFFICIAL USE ONLY- PROPRIETARY INFORMATION TABLE OF CONTENTS

1.0 INTRODUCTION

........................................................................................................ 1.1 Background ................................................................................................................ 1.2 Limiting Trip Setpoints ................................................................................................ 1.3 Addition of Surveillance Notes to TS Functions .......................................................... 2.0 TECHNICAL SPECIFICATION EVALUATION ......................................................... 2.1 Introduction .............................................................................................................. 2.2 Regulatory Evaluation .............................................................................................. 2.3 Evaluation of Exclusion Criteria ................................................................................ 2.4 Evaluation ................................................................................................................ 2.4.1 Addition of Surveillance Notes toTS Functions ........................................................ 2.4.2 Evaluation of Surveillance Notes toTS Functions .................................................... 3.0 REACTOR SYSTEMS EVALUATION ....................................................................... 3.1 Introduction .............................................................................................................. 3.2 Regulatory Evaluation .............................................................................................. 3.3 Background .............................................................................................................. 3.4 Method of Analysis ................................................................................................... 3.5 Fuel Thermal Limits .................................................................................................. 3.6 RWE Analysis .......................................................................................................... 3.7 Vessel Overpressure ................................................................................................ 3.8 Thermal-Hydraulic Stability ....................................................................................... 3.9 LOCA Analysis ......................................................................................................... 3.10 Anticipated Transient without Scram ........................................................................ 3.11 Technical Specification Changes for ARTS/MELLLA ................................................ 3.12 References ............................................................................................................... 4.0 INSTRUMENTATION AND CONTROLS TECHNICAL EVALUATION ..................... 4.1 Introduction .............................................................................................................. 4.2 Regulatory Evaluation .............................................................................................. 4.3 Technical Evaluation ................................................................................................ 4.3.1 System Description and Configuration ...................................................................... 4.3.2 Proposed Technical Specification Changes .............................................................. 4.3.2.1 TS 1.1, Definitions, and TS 3.2.4, Average Power Range Monitor (APRM) Gain and Setpoint .................................................................................. OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION ii 4.3.2.2 TS 3.3.1.1, Reactor Protection System (RPS) Instrumentation ............................ 4.3.2.2.1 Changes toTS APRM Functions ........................................................................ 4.3.2.2.2 Changes to LCO 3.3.1.1 Actions ........................................................................ 4.3.2.2.3 Changes to Surveillance Requirements (SRs) .................................................... 4.3.2.2.3.1 Channel Check Surveillance Requirements ................................................... 4.3.2.2.3.2 Channel Functional Test Surveillance Requirements ..................................... 4.3.2.2.3.3 Channel Calibration Surveillance Requirements ............................................ 4.3.2.2.3.4 Logic System Functional Test (LSFT) Surveillance Requirements ................. 4.3.2.2.3.5 Response Time Testing Surveillance Requirements ...................................... 4.3.2.2.4 Changes Involving Table 3.3.1.1-1, Reactor Protection System Instrumentation ................................................................................................... 4.3.2.2.4.1 Minimum Number of Operable APRM/OPRM Channels ................................ 4.3.2.2.4.2 Applicable Modes of Operation, Setpoints, and Allowable Values .................. 4.3.2.2.4.3 Table 3.3.1.1-1 Notes .................................................................................... 4.3.2.3 TS 3.3.1.3, Oscillation Power Range Monitor (OPRM) Instrumentation ............... 4.3.2.3.1 OPRM LCO 3.3.1.3 Conditions and Required Actions ........................................ 4.3.2.3.2 OPRM Surveillance Requirements ..................................................................... 4.3.2.4 TS 3.3.2.1, Control Rod Block Instrumentation .................................................... 4.3.2.4.1 Surveillance Changes to RBM ............................................................................ 4.3.2.4.2 Changes Related to Implementation of ARTS/MELLLA ...................................... 4.3.2.4.2.1 Preventing Bypass of RBM Power Range- Upscale Functions ..................... 4.3.2.4.2.2 Control Rod Block Instrumentation Changes ................................................. 4.3.3 PRNMS Interfaces Including Digital Instrumentation Communications ..................... 4.3.3.1 lntrachannel Communications Between Safety Components ............................... 4.3.3.2 Interchannel Communications Between PRNMS Safety Components ................. 4.3.3.3 Interfaces with the Operator Bench Board ........................................................... 4.3.3.4 Interchannel Communications between PRNMS Safety Components and PRNMS Nonsafety Components ................................................................... 4.3.3.5 Nonsafety PRNM Interfaces Between RBM Channels and PPC and RMCS (Reactor Manual Control System) ............................................................ 4.3.4 MELLLA Implementation .......................................................................................... 4.3.5 Diversity and Defense-in-Depth ................................................................................ 4.3.6 Setpoint Methodology and Calculations .................................................................... 4.3.7 Response Time Performance ................................................................................... OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION iii 4.3.8 System and Software Development for the CGS PRNMS ........................................ 4.3.8.1 Applicability of Current Regulatory Evaluation Criteria to Changes ...................... 4.3.8.2 System and Software Requirements Development Approach .............................. 4.3.8.3 Software Configuration Control. ........................................................................... 4.3.8.4 Software Safety Plan ........................................................................................... 4.3.8.5 Hazard Analysis ................................................................................................... 4.3.8.6 Verification and Validation (V&V) Testing ............................................................ 4.3.8. 7 Secure Software Development and Operations ................................................... 4.3.9 Equipment Qualification ............................................................................................ 4.3.9.1 Environmental Qualification ................................................................................. 4.3.9.2 Seismic Qualification ........................................................................................... 4.3.9.3 Electromagnetic Compatibility Qualification ......................................................... 4.3.1 0 Deviations from the Prior LTRs ................................................................................. 4.3.11 Confirmation of Plant-Specific Actions ...................................................................... 4.4 Instrumentation and Controls Conclusion ............................................................... - 101 -

4.5 References ............................................................................................................. - 101 -

5.0 HUMAN PERFORMANCE EVALUATION .............................................................. - 106 -

5.1 Introduction ............................................................................................................ - 106-5.2 Regulatory Evaluation ............................................................................................ - 107-5.3 Technical Evaluation .............................................................................................. - 108-5.3.1 Description of Operator Action(s) Added/Changed/Deleted .................................... - 108-5.3.2 Operating Experience Review ................................................................................ - 108 -

5.3.3 Functional Requirements Analysis and Function Allocation .................................... - 108 -

5.3.4 Task Analysis ......................................................................................................... - 109 -

5.3.5 Staffing ................................................................................................................... - 109 -

5.3.6 Probabilistic Risk and Human Reliability Analyses ................................................. - 109 -

5.3.7 Human-System Interface Design ............................................................................ - 109-5.3.8 Procedure Design ................................................................................................... - 110-5.3.9 Training Program Design ........................................................................................ - 111 -

5.3.1 0 Human Factors Verification and Validation (V&V) ................................................... - 111 -

5.3.11 Human Performance Monitoring Strategy ............................................................... - 111 -

5.4 Conclusion ............................................................................................................. - 111 -

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION iv

6.0 STATE CONSULTATION

.......................................................................................-112-

7.0 ENVIRONMENTAL CONSIDERATION

.................................................................. -112-

8.0 CONCLUSION

........................................................................................................- 112 -

ATTACHMENT A- List of Acronyms and Abbreviations .................................................... A1 OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 226 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-21 ENERGY NORTHWEST COLUMBIA GENERATING STATION DOCKET NO. 50-397

1.0 INTRODUCTION

By application dated January 31, 2012 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML120400144), as supplemented by letters dated July 31, August 22, October 5, and November 12, 2012, and January 7, April 11, May 9, and August 6, 2013 (ADAMS Accession Nos. ML12219A255, ML12248A136, ML122920735, ML123280090, ML130150329, ML13116A013, ML13141A581 and ML13233A287, respectively), Energy Northwest (the licensee) requested changes to the Technical Specifications (TSs) (Appendix A to Renewed Facility Operating License No. NPF-21) for the Columbia Generating Station (CGS). The requested change would revise the licensee's TSs and Operating License to reflect the installation of the digital General Electric Hitachi (GEH) Nuclear Measurement Analysis and Control (NUMAC) Power Range Neutron Monitoring (PRNM) system. The licensee's letters dated January 31, July 31, August 22, October 5, and November 12, 2012, and January 7, April 11, May 9, and August 6, 2013, contain proprietary information that has been redacted from the publicly available versions of the documents.

The supplemental letters provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the U.S. Nuclear Regulatory Commission (NRC) staff's original proposed no significant hazards consideration determination as published in the Federal Register on September 11, 2012 (77 FR 55867).

The proposed amendment would modify TSs for Power Distribution Limits, Reactor Protection System Instrumentation, Control Rod Block Instrumentation, Oscillation Power Range Monitor (OPRM) Instrumentation, Recirculation Loops Operating, Shutdown Margin Test- Refueling, and the Core Operating Limits Report (COLR).

The proposed changes are needed to allow modifications to the Neutron Monitoring System (NMS) by installation of the GEH NUMAC PRNM system. The existing OPRM system hardware would be replaced. The OPRM trip function would be integrated into the NUMAC PRNM system. The modification of the PRNM system replaces analog technology with a more reliable digital upgrade and simplifies the management and maintenance of the system.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION The proposed amendment would also provide an expanded operating domain resulting from the implementation of Average Power Range Monitor/Rod Block Monitor/Technical Specifications I Maximum Extended Load Line Limit Analysis (ARTS/MELLLA). The Average Power Range Monitor (APRM) flow-biased simulated thermal power scram Allowable Value would be revised to permit operation in the MELLLA region. The current flow biased Rod Block Monitor (RBM) would also be replaced by a power-dependent RBM which also would require new Allowable Values. In addition, the flow-biased APRM simulated thermal power setdown requirements would be replaced by more direct power- and flow-dependent thermal limits to reduce the need for manual APRM gain adjustments and to provide more direct thermal limits administration during operation at other than rated conditions. Operation in the MELLLA region will provide improved power ascension capability by extending plant operation at rated power with less than rated flow. Operation in the MELLLA region can result in the need for fewer control rod manipulations to maintain rated power during the fuel cycle. Replacement of the flow-biased APRM simulated thermal power setdown requirement with power and flow-based limits on Minimum Critical Power Ratio (MCPR) and Linear Heat Generation Rate (LHGR) will provide more direct protection of thermal limits.

Energy Northwest is also requesting NRC approval to incorporate a change to the CGS licensing basis analysis to reflect Anticipated Transient without Scram (ATWS) mitigation with one Standby Liquid Control (SLC) system pump, instead of two. The change improves system reliability by increasing redundancy while maintaining margin to the SLC system relief valve setpoint under ARTS/MELLLA conditions. No changes to the TSs are required to implement this change. The licensing basis change is a result of Amendment No. 221 to the CGS TSs, which increased Boron 10 enrichment in the SLC system.

Implementation of ARTS/MELLLA involves changing the APRM flow-biased Simulated Thermal Power (STP) Allowable Value (AV) to permit operation in the MELLLA operating domain.

Implementation of the PRNM hardware in conjunction with the ARTS improvements allows the current flow-biased Rod Block Monitor (RBM) to be replaced by a power-dependent RBM which would require new AVs. The flow-biased APRM total peaking setdown requirement would be replaced by more direct power- and flow-dependent thermal limits administration. The changes to the TSs include the adoption of Technical Specifications Task Force (TSTF) change traveler TSTF 493, Revision 4, Option A surveillance notes.

Energy Northwest plans to replace the analog APRM and RBM subsystems of the existing NMS and the OPRM System at CGS with the more reliable digital NUMAC PRNM System during the spring 2015 refueling outage (R22). Implementation of the expanded operating domain using ARTS/MELLLA would occur in the subsequent operating cycle.

The licensee proposed to change TS sections 1.1, 3.2.4, 3.3.1.1, 3.3.1.3, 3.3.2.1, 3.4.1, 3.1 0.8, 5.6.3, and their associated TS Bases, allowing modification of the APRM and RBM subsystems of the NMS, and the OPRM System by installation of a digital PRNM system. The TS changes above also reflect the proposed expansion of the operating domain via application of the ARTS/MELLLA improvements. The proposed changes support CGS's replacement of the existing analog APRM and RBM subsystems, and the OPRM System, excluding the associated Local Power Range Monitor (LPRM) detectors and cables, with the NUMAC microprocessor-based PRNM System. The NUMAC PRNM system will perform the same functions as the currently installed APRM, RBM, and OPRM systems.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION The planned modification involves replacing the existing six APRM instrument channel modules of power range monitor electronics with four channels of NUMAC PRNM System hardware.

The modification provides redundancy to the LPRM detector power supply hardware and also upgrades electronics. The replacement PRNM system will provide additional margin to existing setpoints via improved accuracy and drift characteristics over the current NMS.

The specific changes proposed by the licensee to the TSs are listed in Section 2 of Enclosure 1 of the submittal dated January 31, 2012, as revised by the licensee in Enclosure 4 of the supplement dated May 9, 2013.

1.1 Background Energy Northwest is planning a modification to upgrade the existing APRM, RBM, LPRM, OPRM, and recirculation flow processing equipment, all part of the existing NMS and OPRM systems for CGS. With the modification, the existing APRM subsystem and OPRM system hardware will be replaced with GEH's NUMAC PRNM System, which will perform the same functions as the currently installed systems, including the OPRM Stability Option Ill functions.

The NUMAC PRNM system also incorporates the functions of the RBM and LPRM systems.

The digital PRNM modification replaces analog technology with a more reliable digital upgrade and simplifies management and maintenance of the system. The modification excludes the LPRM detectors and signal cables, which will be retained with the NUMAC PRNM replacement.

The NUMAC PRNM License Topical Report (LTR; NRC-approved NEDC-3241 OP-A, Volumes 1 and 2, and NEDC-32410P-A, Supplement 1) describes in detail the generic NUMAC PRNM design including the OPRM functions (Stability Option Ill) and several plant specific variations and plant specific actions.

The current OPRM system implements the "Reactor Stability Long Term Solution Option Ill" as described in NED0-31960-A, "BWR Owners' Group Long-Term Stability Solutions Licensing Methodology," dated November 1995. The current OPRM System has some separate hardware, but functions logically with the APRM System and receives inputs from the NMS.

With the replacement NUMAC PRNM system, the existing OPRM hardware is removed and the function is digitally integrated within the PRNM equipment. The NUMAC PRNM LTR discusses implementation of the OPRM functions within the PRNM equipment.

CGS Final Safety Analysis Report (FSAR) Section 7, "Instrumentation and Control Systems,"

contains a description of the current NMS and OPRM systems in the following Sections:

7.1, "Introduction"

7.2, "Reactor Protection (Trip) System"

7.6, "All Other Instrumentation Systems Required for Safety"

7.7, "Control Systems Not Required for Safety" OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION The licensee described the functions of the NMS and OPRM in Enclosure 2 of its submittal dated January 31, 2012, as excerpted below.

Neutron Monitoring System Functions:

All NMS functions are retained, including LPRM detector signal processing, LPRM averaging, and APRM trips. In some cases, the existing functions will be improved with additional filtering or modified processing. These include LPRM filtering and, for some functions, APRM filtering. The LPRM signal input filtering is improved using advanced digital processing methods. The digital filtering provides improved noise rejection for AC power related noise and some non--

nuclear type transients without affecting the system response to real neutron flux signals. For the APRM, a filtered APRM flux signal called "simulated thermal power (STP)" is generated using a six second (nominal value) first order filter.

The APRM flow biased scram trip (and the associated clamp) will continue to operate from STP to provide the same response characteristics as the current system. STP will continue to be used for APRM calibration against core thermal power to provide a better indication of actual average flux. The PRNM system will use STP for the APRM upscale rod block trips which is different from the current system which used unfiltered flux. The current RBM system normalizes the LPRM signals to APRM STP. The proposed PRNM system RBM functions normalize the LPRM signals to a fixed reference signal. With the PRNM system, if STP is indicating less than the low power range setpoint, the RBM is automatically bypassed. The APRM neutron flux- high scram trip will continue to operate from unfiltered APRM flux to meet the trip response time assumptions in the safety analyses. Both filtered APRM flux (STP) and unfiltered APRM flux are displayed for the operator. The filtered APRM flux provides the best indication of true average power while the unfiltered flux provides a real-time indication of APRM flux changes.

The current six APRM channel configuration is replaced with four APRM channels, each using one quarter of the total LPRM detectors. The outputs from all four APRM channels go to four independent 2-out-of-4 Voter channels. Two of the four Voter channels are assigned to Reactor Protection System (RPS) trip system A and two to RPS trip system B. The APRM Neutron Flux- High trip function will be retained, but four 2-out-of-4 Voter channels are added between the APRM channels and the input to the RPS. The trip outputs from all four APRM channels are sent to each 2-out-of-4 Voter channel, so that each of the inputs to the RPS is a voted result of all four APRM channels.

Recirculation flow signal processing, previously accomplished using separate hardware within the existing NMS control panels is integrated into the APRM chassis in the new PRNM system. The existing four channel recirculation flow processing system (four flow transmitters on each recirculation loop) is retained.

In the current system, two flow channels provide inputs to the three APRM channels in one RPS trip system while the other two flow channels provide inputs to the APRM channels in the other RPS trip system. In the replacement PRNM system, each flow channel provides inputs to one of the four APRM channels.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Therefore, each APRM channel also provides the signal processing for one flow channel in the replacement PRNM. The APRM hardware also performs the recirculation upscale flow alarm function.

The NUMAC PRNM LTR describes various plant specific configurations for the RBM system that the PRNM system can support, including setpoints that are based on either "non-ARTS" or "ARTS" values. ARTS is an acronym for Average Power Range Monitor I Rod Block Monitor I Technical Specifications. CGS currently is a "non-ARTS" plant, but is planning to implement "ARTS" in conjunction with the PRNM installation.

The basic RBM function will remain the same as in the current system (with the new ARTS setpoints applied). The LPRM signals and recirculation flow signals will be provided digitally from the APRM channels. The NUMAC RBM chassis provides some additional surveillance capability that allows testing of functions in all plant conditions. The same hardware, which performs the RBM logic (the RBM chassis), will also perform the recirculation flow comparison alarm function in the replacement system. In the replacement system, this function compares the recirculation flow values from each of the four flow channels.

Low voltage power supply (LVPS) functions are retained except that the post modification configuration provides additional redundancy against loss of RPS Alternating Current (AC) power. In the current NMS, each APRM and RBM channel is powered by a single channel of RPS AC power busses, either channel A or channel B. In the replacement PRNM system, each APRM channel and each RBM channel is powered from independent (from the other channels},

redundant LVPS units, operating from each of the RPS AC busses. Therefore, if one RPS AC power input is lost, full APRM and RBM signal processing and indication continues to be available. Further, if an individual LVPS power supply fails, the associated channel continues to operate normally on the second LVPS.

The final trip outputs from the APRM and RBM to the RPS and Reactor Manual Control System (RMCS), however, still operate from one RPS AC input, so loss of one RPS AC input will still result in RPS half scram and rod block inputs the same as the current NMS.

The existing level of electrical separation, between components and redundant channels, is maintained or improved through extensive use of fiber-optic cables for inter-channel communications and optically coupled relay devices for interface connections to other systems.

Interface functions between the PRNM system and other systems are unchanged from the current design, except for data to the plant process and core monitoring system computers and data to the plant operator's panel. The plant operator's panel will use the digital display outputs for most information displays.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION OPRM Function:

The OPRM Option Ill Stability Trip Function is digitally incorporated into the PRNM system. The OPRM function continues to satisfy the same regulatory requirements as the currently installed OPRM equipment. Changes from the existing OPRM are the assignment of LPRM inputs to new OPRM cell assignments and trip logic from the 2-out-of-4 Voter module. The current OPRM cell assignments are selected for compatibility with the current NMS's six APRM, two LPRM channel configuration. The replacement system's OPRM cell assignments are selected for compatibility with the four APRM/OPRM configuration of the NUMAC PRNM. Both configurations are included in the NRC reviewed and approved Licensing Topical Reports, applicable to the OPRM Stability Option Ill [NED0-31960-A, including Supplement 1, and NED0-32465-A]. The existing OPRM trip logic is the 1-out-of-2 taken twice which is being revised to input to the 2-out-of-4 Voter logic. This logic is in accordance with and discussed in the NUMAC PRNM LTR.

FSAR Section 7. 7 .1.8, "Neutron Monitoring System - Rod Block Monitor," describes the RBM system. The purpose of the RBM is to limit control rod withdrawal if localized neutron flux exceeds a predetermined setpoint during operator control rod manipulations. The RBM has two channels. Each channel uses input signals from a number of LPRM channels. A trip signal from either RBM channel initiates a rod block signal to the RMCS to inhibit control rod withdrawal.

The trip is initiated when RBM output exceeds the rod block setpoint. The RBM is a system that is not essential for the safety of the plant and does not include any of the circuitry or devices used to automatically or manually scram the reactor.

The FSAR includes information that describes the facility, presents the design bases and the limits on its operation, and presents a safety analysis of the structures, systems, and components and of the facility as a whole. The regulations at 10 CFR 50.36 require, in part, that the TSs include items in the following categories: safety limits, limiting safety systems settings, limiting conditions for operation, and surveillance requirements. Safety limits (SL) for nuclear reactors are limits upon important process variables that are found to be necessary to reasonably protect the integrity of certain of the physical barriers that guard against the uncontrolled release of radioactivity. If any safety limit is exceeded, the reactor must be shut down. Limiting safety systems settings (LSSSs) for nuclear reactors are settings for automatic protective devices related to those variables having significant safety functions. Where an LSSS is specified for a variable on which a SL has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded.

The automatic protective action can be accomplished by the plant protective systems, which are designed to initiate reactor trips (scrams) or other protective actions before selected unit parameters exceed analytical limits (Als) assumed in the safety analysis presented in the FSAR. This prevents violation of the reactor core Sls and reactor coolant system (RCS) pressure SL from postulated anticipated operational occurrences (AOOs) and to assist the engineered safety features (ESF) systems in mitigating accidents. The reactor core Sls and RCS pressure SL ensure that the reactor core and RCS maintain structural integrity.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Limiting Conditions for Operation (LCOs) are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When an LCO is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the TSs until the condition can be met. Surveillance requirements (SRs) are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within Sls, and that the LCOs will be met.

1 .2 Limiting Trip Setpoints The licensee added the term "Limiting Trip Setpoint" as terminology for the setpoint value calculated by means of the plant-specific setpoint methodology documented in the Licensee Controlled Specifications. Limiting Trip Setpoints (L TSPs) are used in the tests and calibrations of instrumentation required by the TSs. The LTSPs are selected in part to assure that facility operation will be within Sls, and that the LCOs will be met.

The licensee stated that the LTSP is more conservative than the AV and is the least conservative value to which the instrument channel is adjusted following surveillance testing.

The LTSP is the limiting setting for the channel trip setpoint considering all credible instrument errors associated with the instrument channel. The LTSP is the least conservative value (with an As-Left Tolerance (ALT)) to which the channel must be reset at the conclusion of periodic testing to ensure that the AL will not be exceeded during an AOO or accident before the next periodic surveillance or calibration. During in-field surveillance testing, the instrument and control technician typically sets an instrument to the band or "calibration tolerance" around the LTSP. Therefore, the LTSP adjustment is considered successful if the as-left instrument setting is within the setting tolerance (i.e., a range of values around the LTSP). The field setting is within the AL T (i.e., a range of values around the LTSP). The trip setpoint is the LTSP with margin added. The trip setpoint is equal to or more conservative than the LTSP.

The AVs are the only value included in the TSs to indicate the least conservative value that the as-found trip point may have during testing for the channel to be operable. In this case, the LTSP values in the Licensee Controlled Specifications and the title of this document are identified in surveillance Note 2 in order to satisfy the 10 CFR 50.36 requirements that the LSSS be in the TSs. Additionally, to ensure proper use of the AV, trip setpoint, and LTSP, the methodology for calculating the as-left and as-found tolerances must also be included in a document incorporated by reference in the FSAR and listed in surveillance Note 2 as discussed in SE Section 3.1 .2.

1.3 Addition of Surveillance Notes to TS Functions In its application, the licensee proposed to add surveillance notes to certain TSs in accordance with Option A of TSTF 493, Revision 4, to address instrumentation limiting condition for operation issues that could occur during periodic testing and calibration of instrumentation.

Energy Northwest submitted a license amendment request on October 2, 2013 (ADAMS Accession No. ML13284A063), to implement Technical Specification Task Force (TSTF)

Traveler TSTF-493-A, Revision 4, "Clarify Application of Setpoint Methodology for LSSS Functions," Option A. The NRC staff's evaluation of the licensee's application to fully implement TSTF-493 will be provided by separate correspondence. The licensee's proposed changes in this safety evaluation are consistent with the proposed inclusion of TSTF-493 in the CGS TSs.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Setpoint calculations for an LTSP are based on the AL of the safety analysis to ensure that trips or protective actions will occur prior to exceeding the process parameter value assumed by the safety analysis calculations. These setpoint calculations may also provide an allowable limit of the change to be expected (i.e., the As-Found Tolerance (AFT)) between performance of the surveillance tests for assessing the value of the setpoint setting. The least conservative as-found instrument setting value that a channel can have during calibration without requiring performance of a TS remedial action is the setpoint AV. Discovering an instrument setting to be less conservative than the setting AV indicates that there may not be sufficient margin between the LTSP setting and the AL. Technical Specifications channel calibrations are performed to verify channels are operating within the assumptions of the setpoint methodology used to calculate the LTSP and that channel settings have not exceeded the TS AVs. When the measured as-found setpoint is non-conservative with respect to the AV, the channel is inoperable and the actions identified in the TSs must be taken.

Surveillance Note 1 Surveillance Note 1 states:

If the as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

The Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its AFT but conservative with respect to the AV.

Evaluation of channel performance will verify that the channel will continue to function in accordance with safety analysis assumptions and the channel performance assumptions in the CGS setpoint methodology and establishes a high confidence of acceptable channel performance in the future. Because the AFT allows for both conservative and non-conservative deviation from the LTSP, changes in channel performance that are conservative with respect to the LTSP will also be detected and evaluated for possible effects on expected performance.

The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service, the licensee will evaluate the channels under the CGS Corrective Action Program (CAP). Entry into the CAP will ensure required review and documentation of the condition to establish a reasonable expectation for continued operability.

Verifying that a trip setting is conservative with respect to the AV when a surveillance is performed does not by itself verify the instrument channel will operate properly in the future because of setpoint drift. Although the channel was operable during the previous surveillance interval, if it is discovered that channel performance is outside the performance predicted by the plant setpoint calculations for the test interval, then the design basis for the channel may not be met, and proper operation of the channel for a future demand cannot be assured. Surveillance Note 1 formalizes the establishment of the appropriate AFT for each channel. This AFT is applied about the LTSP or about any other more conservative trip setpoint. The as-found setting tolerance ensures that channel operation is consistent with the assumptions or design inputs used in the setpoint calculations and establishes a high confidence of acceptable channel performance in the future. Because the setting tolerance allows for both conservative and non-OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION conservative deviation from the LTSP, changes in channel performance that are conservative with respect to the LTSP will also be detected and evaluated for possible effects on expected performance.

Implementation of surveillance Note 1 requires the licensee to calculate an AFT. The licensee calculated the AFT using the CGS setpoint methodology procedure EES-4 based on Instrument Society of America setpoint calculation method 2.

Surveillance Note 2 Surveillance Note 2 states:

The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the Limiting Trip Setpoint (LTSP) at the completion of the surveillance; otherwise, the channel shall be declared inoperable. Setpoints more conservative than the LTSP are acceptable provided that the as-found and as-left tolerances apply to the actual setpoint implemented in the surveillance procedures (Nominal Trip Setpoint) to confirm channel performance. The LTSP and the methodologies used to determine the as-found and the as-left tolerances are specified in the Licensee Controlled Specifications.

The second surveillance Note requires that the as-left setting for the channel be returned to within the AL T of the LTSP. Where a setpoint more conservative than the LTSP is used in the plant surveillance procedures, the AL T and AFT, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the SL and AL is maintained. If the as-left channel setting cannot be returned to a setting within the ALT of the LTSP, then the channel would be declared inoperable. The second surveillance Note also requires that the LTSP and the methodologies for calculating the AL T and the AFT be included in the Licensee Controlled Specifications.

To implement surveillance Note 2, the AL T for some instrumentation Function channels is established to ensure that realistic values are used that do not mask instrument performance.

The licensee stated that setpoint calculations assume that the instrument setpoint is left at the LTSP within a specific AL T (e.g., 25 pounds per square inch gauge (psig) + 2 psig). A tolerance is necessary because it is not possible to read and adjust a setting to an absolute value due to the readability and/or accuracy of the test instruments or the ability to adjust potentiometers.

The licensee stated that the ALT is normally as small as possible considering the tools and the objective to meet an as low as reasonably achievable calibration setting of the instruments. The AL T is considered in the setpoint calculation. Failure to set the actual plant trip setpoint to the LTSP and within the AL T would invalidate the assumptions in the setpoint calculation because any subsequent instrument drift would not start from the expected as-left setpoint.

The regulatory requirements and guidance documents the NRC staff considered in its review of the licensee's application are addressed in each specific area of review below.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION 2.0 TECHNICAL SPECIFICATION EVALUATION 2.1 Introduction Energy Northwest submitted a license amendment request on October 2, 2013 (ADAMS Accession No. ML13284A063), to implement Technical Specification Task Force (TSTF)

Traveler TSTF-493-A, Revision 4, "Clarify Application of Setpoint Methodology for LSSS Functions," Option A. The request is under NRC staff review. The proposed amendment would revise the TSs by adding requirements to assess channel performance during testing that verifies instrument channel setting values established by the plant-specific setpoint methodologies. The availability of this TS improvement was announced in the Federal Register on May 11, 2010 (75 FR 26294), as part of the consolidated line item improvement process.

The NRC staffs evaluation of the licensee's application to implement TSTF-493 will be provided by separate correspondence.

The licensee's proposed changes in this safety evaluation are consistent with the proposed inclusion of TSTF-493 in the CGS TSs. The NRC approved Revision 4 of TSTF-493 via issuance of a model application for adoption on April 30, 2010 (ADAMS Accession No. ML100710442). Using the guidance of Appendix A of TSTF-493, Energy Northwest has applied the actions identified to this LAR; the results being that the two notes specified in the TSTF are applied to channel calibration SR 3.3.1.1.1 0 for the following APRM functions listed in TS Table 3.3.1.1-1 as follows:

APRM Neutron Flux - High (Setdown) (2.a)

APRM Simulated Thermal Power- High (2.b)

APRM Neutron Flux - High (2.c)

OPRM Upscale (2.f)

In order to implement this change, Energy Northwest will revise the Licensee Controlled Specifications (LCS) to include the Limiting Trip Setpoint values and the methodologies used for determining these setpoints prior to the startup from the refueling outage that this modification is installed.

This section of the safety evaluation (SE) addresses the licensee's proposed addition of surveillance notes in accordance with Option A of TSTF-493, Revision 4, to address instrumentation limiting condition for operation issues that could occur during periodic testing and calibration of instrumentation.

The proposed change will resolve potential questions that may arise during operability determinations associated with potentially non-conservative TSs Allowable Values (AVs)< 1l calculated using some methods in the Instrument Society of America (ISA) standard ISA-S67.04-1994, Part 2, "Methodologies for the Determination of Setpoints for Nuclear Safety-1

<l The instrument setting "Allowable Value" is a limiting value of an instrument's as-found trip setting used during surveillances. The AVis more conservative than the Analytical Limit (AL) to account for applicable instrument measurement errors consistent with the plant-specific setpoint methodology. If during testing, the actual instrumentation setting is less conservative than the AV, the channel is declared inoperable and actions must be taken consistent with the TS requirements.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Related Instrumentation." The concern is that when these values are used to assess instrument channel performance during testing, non-conservative decisions about the equipment operability may result. In addition, the proposed change will resolve potential questions that may arise during operability determinations related to relying on AVs associated with TS limiting safety system setpoints (LSSSs) to ensure that TSs requirements, not plant procedures, will be used for assessing instrument channel operability.

The proposed change would revise the CGS TSs to be consistent with the NRC-approved TSTF-493, Revision 4, Option A. Paragraph 50.36(c)(1 )(ii)(A) of 10 CFR states that "[LSSSs]

for nuclear reactors are settings for automatic protective devices related to those variables having significant safety functions." TSTF-493 Attachment A contains Functions related to those variables. Under Option A, two surveillance notes would be added to SRs in the Surveillance Requirement Column of TSs Instrumentation Function Tables. Specifically, surveillance notes would be added to SRs that require verifying trip setpoint setting values (i.e.,

Channel Calibration). The list of affected instrument functions is in Enclosure 2 to the license amendment request (LAR) dated January 31, 2012. This list includes instrument functions in the LCOs for the Reactor Protection System Instrumentation, TS 3.3.1.1, and the Control Rod Block Instrumentation, TS 3.3.2.1-1.

2.2 Regulatory Evaluation The regulatory requirements that the NRC staff considered in its review of the proposed changes applicable to the TSs include the following:

1. The regulation at 10 CFR Part 50, Appendix A, General Design Criterion (GDC) 13, "Instrumentation and control," states, in part, that Instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems.

Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges.

2. The regulation at 10 CFR Part 50, Appendix A, GDC 20, "Protection system functions,"

states:

The protection system shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety.

CGS's FSAR Section 3.1, "Conformance with NRC General Design Criteria [GDC]," states, in part, that "Based on the content herein, Energy Northwest concludes that CGS is in compliance OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION with the GDC." CGS FSAR Section 3.1.2.2.4, "Criterion 13 - Instrumentation and Control,"

states, in part, that As noted above, adequate instrumentation is provided to monitor system variables in the reactor core, RCPB [reactor coolant pressure boundary], and reactor containment. Appropriate controls are provided to maintain the variables in the operating range and to initiate the necessary corrective action in the event of abnormal operational occurrence or accident. These instrumentation and controls meet the requirements of Criterion 13.

In addition, CGS FSAR Section 3.1.2.3.1, "Criterion 20 - Protection System Functions," states, in part, that "The design of the protection system satisfies the functional requirements as specified in Criterion 20."

The Commission's regulatory requirements related to the content of the TSs are contained in 10 CFR 50.36. The regulation at 10 CFR 50.36 requires applicants for nuclear power plant operating licenses to include proposed TSs as part of the application. The regulation requires, in part, that the TSs include items in the following categories: (1) safety limits, limiting safety systems settings, and limiting control settings; (2) limiting conditions for operation; (3) surveillance requirements; (4) design features; and (5) administrative controls. However, the regulation does not specify the particular requirements to be included in TSs.

Paragraph 10 CFR 50.36(c)(1)(i)(A) states, in part, that Safety limits for nuclear reactors are limits upon important process variables that are found to be necessary to reasonably protect the integrity of certain of the physical barriers that guard against the uncontrolled release of radioactivity.

Paragraph 10 CFR 50.36(c)(1 )(ii)(A) states, in part, that Limiting safety system settings for nuclear reactors are settings for automatic protective devices related to those variables having significant safety functions.

Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded. If, during operation, it is determined that the automatic safety system does not function as required, the licensee shall take appropriate a-ction, which may include shutting down the reactor.

Paragraph 10 CFR 50.36(c)(2)(i) states, in part, that Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Paragraph 10 CFR 50.36(c)(3) states, in part, that Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met.

Paragraph 10 CFR 50.36(c)(5), states in part, that Administrative controls are the provisions relating to organization and management, procedures, recordkeeping, review and audit, and reporting necessary to assure the operation of the facility in a safe manner.

In addition to the regulatory requirements stated above, the NRC staff considered the previously approved guidance in NUREG-1433, Revision 3, "Standard Technical Specifications, General Electric Plants, BWR/4," dated March 2004 (ADAMS Accession No. ML041910194). This guidance applies to CGS TS 3.3.2.1, control rod block instrumentation. For CGS, a BWR/5, the control rod block instrumentation is more similar to a BWR/4 (NUREG-1433) than a BWR/6 (NUREG-1434). The NRC approved NUREG-1434, "Standard Technical Specifications, General Electric Plants, BWR/6," were approved for CGS in Amendment No. 149, dated March 4, 1997; however, the staff based the conversion to the Standard TS forTS 3.3.2.1 on the BWR/4 specification. The staff used Revision 3 of NUREG-1433 during its review, since Revision 4 was issued in April2012, after the licensee's application. There were no changes in Revision 4 that affected the staff's review of the application. All other TSs affected by the submittal (TS 3.2.4, 3.3.1.1, 3.4.1, 3.1 0.8) were based on NUREG-1434. The OPRM TS 3.3.1.3 is new and not in either NUREG.

The staff also considered the guidance in Regulatory Guide (RG) 1.1 05, Revision 3, "Setpoints for Safety-Related Instrumentation," December 1999 (ADAMS Accession No. ML993560062),

for determining the acceptability of revising instrumentation TS requirements. RG 1.1 05, Revision 3, describes a method acceptable to the NRC staff for complying with the NRC's regulations for ensuring that setpoints for safety-related instrumentation are initially and remain within the TS limits. The RG endorses Part 1 of ISA-S67.04-1994, "Setpoints for Nuclear Safety-Related Instrumentation," subject to NRC staff clarifications. The ISA standard provides a basis for establishing setpoints for nuclear instrumentation for safety systems and addresses known contributing errors in the channel. Part 1 establishes a framework for ensuring that setpoints for nuclear safety-related instrumentation are established and maintained within specified limits.

2.3 Evaluation of Exclusion Criteria Exclusion criteria are provided in TSTF-493 that are used to determine which Functions do not need to receive the additional surveillance test requirements of the added surveillance Notes.

Instruments are excluded from the additional requirements when their functional purpose can be described as (1) a manual actuation circuit, (2) an automatic actuation logic circuit, or (3) an instrument function that derives input from contacts, which have no associated sensor or adjustable device. Many permissives or interlocks are excluded if they derive input from a sensor or adjustable device that is tested as part of another TS function. The list of affected OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Functions in Enclosure 2 of the LAR was developed by the licensee on the principle that all the APRM functions in TS 3.3.1.1 and all the rod block monitor functions in TS 3.3.2.1 are included unless one or more of the exclusions that follow apply. In general, the licensee excluded the following functions from additional surveillance testing requirements applied as surveillance Notes:

1. The two surveillance Notes are not applied to Functions which utilize manual actuation circuits, automatic actuation logic circuits, or to instrument functions that derive input from contacts which have no associated sensor or adjustable device (i.e., limit switches, breaker position switches, manual actuation switches, float switches, proximity detectors, etc.). In addition, the two surveillance Notes do not apply to those permissives and interlocks that derive input from a sensor or adjustable device that is tested as part of another TS function.

The two surveillance Notes are not applied to Functions which utilize mechanical components to sense the trip setpoint, or to manual initiation circuits (the latter are not explicitly modeled in the accident analysis) because current functional SRs, which have no setpoint verifications, adequately demonstrate the operability of these Functions.

Surveillance Note 1 requires a comparison of the periodic SR results to provide an indication of channel (or individual device) performance. This comparison is not valid for most mechanical components. While it is possible to verify that a limit switch perform its function at a point of travel, a change in the surveillance result is likely caused by the mechanical properties of the limit switch, for example, not that the input/output relationship has changed. Therefore, a comparison of SR results would not provide an indication of the channel or component performance.

2. The two surveillance Notes are not applied to TSs associated with mechanically operated safety relief valves. The performance of these components is already controlled (i.e., trended with as-left and as-found tolerances) under the American Society of Mechanical Engineers (ASME) Code for Operation and Maintenance of Nuclear Power Plants testing program.

3. The two surveillance Notes are not normally applied to Functions and SRs, which test only digital components. Digital components, such as actuation logic circuits, relays, and input/output modules are not expected to exhibit drift characteristics; therefore, a change in result between surveillances or any test result other than the identified TS surveillance acceptance criteria would cause the digital component to be declared inoperable. However, where separate as-left and as-found tolerances are established for digital component SRs, the Note requirements would apply.

The licensee has applied exclusion criteria to the following functions in the following TS Tables:

TS Table 3.3.1.1-1, "Reactor Protection System Instrumentation," functions:

2. Average Power Range Monitors

d. lnop (interlock)

e. 2-0ut-of-4 Voter (automatic actuation logic circuit)

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

TS Table 3.3.2.1-1, "Control Rod Block Instrumentation," functions:

1. Rod Block Monitor

d. lnop (interlock)

The NRC staff reviewed the list of excluded TS functions and concludes that the list is acceptable because the functions meet the proposed exclusion criteria.

2.4 Evaluation 2.4.1 Addition of Surveillance Notes to TS Functions The licensee has added surveillance Notes to TS 3.3.1.1, "Reactor Protection System (RPS)

Instrumentation" and TS 3.3.2.1, "Control Rod Block Instrumentation." The licensee stated that the determination to include surveillance Notes for specific Functions in these TS Tables is based on whether or not it is a setting for an automatic protective device related to those variables having significant safety functions (i.e. a LSSS pursuant to 10 CFR 50.36(c)(1 )(ii)(A)).

Furthermore, the licensee stated that if during calibration testing the setpoint is found to be conservative with respect to the AV but outside its predefined AFT band, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service.

The calibration tolerances are specified in the Licensee Controlled Specifications (LCS) for CGS. The LCS is the name used by EN for the licensee-controlled manual developed by many utilities that contains many of the former TSs. This manual is typically incorporated by reference into the FSAR. This manual is typically called a Technical Requirements Manual (TRM),

Operations Requirements Manual, or Licensee Controlled Specifications, and is formatted similar to the improved Standard TS (ITS). All changes made to the former technical specifications placed in the LCS must be evaluated under 10 CFR 50.59. As requirements are moved from the TSs to the LCS, shutdown requirements, special report submittals, and other unnecessary restrictions may be evaluated under 10 CFR 50.59 and eliminated. Changes to former TSs relocated to the LCS must be documented and evaluated under the requirements of 10 CFR 50.59.

The licensee has applied surveillance Notes to the following functions in Table 3.3.1.1-1:

2. Average Power Range Monitors

a. Neutron Flux- High (Setdown)

b. Simulated Thermal Power- High

c. Neutron Flux- High

f. OPRM [Oscillation Power Range Monitor] Upscale The licensee has applied surveillance Notes to the following functions in Table 3.3.2.1-1:

1. Rod Block Monitor

a. Low Power Range - Upscale

b. Intermediate Power Range- Upscale

c. High Power Range- Upscale OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION The proposed surveillance notes will add the requirement to address operability of the subject functions in the TS as discussed in TSTF-493, Revision 4, Option A. The NRC staff reviewed the list of affected TS functions and concluded that it was acceptable because it complies with the NRC-approved guidance of TSTF-493, Revision 4, Option A for functions being automatic protective devices related to variables having significant safety functions.

2.4.2 Evaluation of Surveillance Notes toTS Functions The proposed surveillance notes will ensure instrument operability will be maintained and that uncertainties will be included in the AFT calculations in an acceptable manner. By establishing the TS requirements in the surveillance notes, the licensee will ensure that there will be a reasonable expectation that these instruments will perform their safety function, if required.

Therefore, the NRC staff concludes that the addition of the notes is acceptable. The NRC staff further concludes that the proposed TS changes are acceptable since they meet the requirements of 10 CFR 50.36(c)(3) in that the TS include SRs which assure that the necessary quality of systems are maintained, that the facility operation will be within SLs, and the LCOs will be met.

3.0 REACTOR SYSTEMS EVALUATION 3.1 Introduction The proposed amendment would allow additional startup and operating flexibility and an expanded operating domain resulting from the proposed concurrent implementation of the Average Power Range Monitor, Rod Block Monitor, and Iechnical Specifications (ARTS) with the Maximum Extended Load Line Limit Analysis (MELLLA) operating power/flow (P/F) map.

To support this proposed change, the licensee's submittal provided a CGS plant-specific ARTS/MELLLA safety analysis report (A/MSAR), NEDC-33570P, Revision 1, "Columbia Generating Station APRM/RBM/Technical Specifications/ Maximum Extended Load Line Limit Analysis (ARTS/MELLLA)," January 2012 (proprietary) (Reference 3.3), prepared by the Nuclear Steam Supply System (NSSS) vendor, GE Hitachi Nuclear Energy (GEH). The fuel dependent portions of the safety analyses are based on the Cycle 20 core design using GE14 and ATRIUM-10 fuel. For the fuel dependent portions of the safety analyses, the licensee performed plant and fuel specific analyses to justify operation in the ARTS/MELLLA condition using NRC-approved methodologies. In general, the transient and accident analyses for the plant are fuel dependent. The nonfuel dependent evaluations, such as containment response, are based on the current plant design and configuration.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION The CGS is a boiling-water reactor (BWR), GE-5 series with a Mark 2 containment, and the current licensed thermal power (CL TP) is 3486 megawatts-thermal (MWt). The operational flexibility of a BWR during power ascension from the low-power, low-flow core condition to the rated high-power, high-flow core condition is restricted by several factors. Also, once rated power is achieved, periodic adjustments to core flow and control rod positions must be made to compensate for the reactivity changes due to Xenon buildup and decay, with fuel and burnable poison burn up. Factors currently restricting plant flexibility at CGS in efficiently achieving and maintaining rated power include:

The current operating P/F map,

The APRM flow-biased flux scram and flow-biased rod block setdown requirements, and

The Rod Block Monitor (RBM) fl()w-referenced rod block trip.

CGS has proposed TS changes to address the above restrictions, which are similar to the changes requested and approved by the NRC staff at other BWR plants.

3.2 Regulatory Evaluation The licensee provided a regulatory analysis section in the LAR dated January 31, 2012 (Reference 3.1 ). The NRC staff determined that the information supplied in the licensee's submittal and the supporting supplements identified the applicable regulatory requirements.

The regulatory requirements that the NRC staff considered in its review of the proposed changes applicable to the reactor systems include the following:

10 CFR 50.36, "Technical specifications."

10 CFR 50, Appendix A, General Design Criterion (GDC) 10, "Reactor design,"

requires that The reactor core and associated coolant, control, and protection systems be designed with appropriate margin to assure that specified acceptable fuel design limits are not exceeded during any condition of normal operation, including the effects of anticipated operational occurrences.

10 CFR 50, Appendix A, GDC 12, "Suppression of reactor power oscillations,"

requires that The reactor core and associated coolant, control, and protection systems shall be designed to assure that power oscillations which can result in conditions exceeding specified acceptable fuel design limits are not possible or can be reliably and readily detected and suppressed.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

10 CFR 50.46, "Acceptance criteria for reactor coolant system venting systems,"

sets forth acceptance criteria for the performance of the emergency core cooling system (ECCS) following postulated loss-of-coolant accidents (LOCAs).

10 CFR 50, Appendix K, "ECCS Evaluation Models," describes required and acceptable features of the evaluation models used to calculate ECCS performance.

10 CFR 50.62, "Requirements for reduction of risk from anticipated transients without scram (ATWS) events for light-water-cooled nuclear power plants," in part, specifies the equivalent flow rate, level of boron concentration and Boron-1 0 isotope enrichment required for BWR standby liquid control systems.

The proposed TS changes would revise SRs and the LCO actions and completion times for each applicable operating condition, and are consistent with the requirements of NUREG-1433, "Standard Technical Specifications- General Electric Plants, BWR/4," Revision 3. The NRC has previously approved similar amendments for plants, such as Nine Mile Point Nuclear Station, Unit 2, Edwin I. Hatch Nuclear Plant Units 1 and 2, Duane Arnold Energy Center (no increased core flow (ICF)), Cooper Nuclear Station, Pilgrim Nuclear Power Station, Unit No. 1, Fermi, Unit 2, Monticello Nuclear Generating Plant, Brunswick Steam Electric Plant, Units 1 and 2, Peach Bottom Atomic Power Station, Units 2 and 3, Limerick Generating Station, Units 1 and 2, and Browns Ferry Nuclear Plant, Units 1, 2, and 3.

3.3 Background The function of the licensed allowable P/F operating map is to define the normal operating condition of the reactor core used in determining the operating safety limits. The licensee proposes to modify the current Extended Load Line Limit Analysis (ELLLA) P/F upper boundary to include the operating region bounded by the rod line which passes through the 100 percent of CLTP I 80.7 percent of rated core flow (RCF) point, the rated thermal power (RTP) line, and the rated load line. The P/F region above the current ELLLA boundary is referred to as the MELLLA region. The MELLLA expansion of the P/F map provides improved operational flexibility by allowing operation at RTP with less than RCF, consistent with NRC-approved operating domain improvements for other BWRs, and are to be performed as part of the standard cycle-specific reload analysis. A further expansion of the operating domain (MELLLA) and implementation of ARTS would allow for more efficient and reliable power ascensions and would allow rated power to be maintained over a wider core flow range, thereby reducing the frequency of control rod manipulations that require power maneuvers to implement.

The function of the RBM is to prevent fuel damage in the event of erroneous rod withdrawal from locations of high power density during high-power level operation. It does this by blocking control rod movement which could result in violating a thermal limit (the Safety Limit Minimum Critical Power Ratio (SLMCPR) or the 1 percent cladding plastic strain limit) in the event of a Rod Withdrawal Error (RWE) event.

The functions of the APRM system include:

1. Generation of a trip signal to scram the reactor during core-wide neutron flux transients before exceeding the safety analysis design basis; OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

2. Blocking control rod withdrawal whenever operation exceeds set limits in the operating map, prior to approaching the scram level; and

3. Providing an indication of the core average power level in the power range.

The flow-biased rod block setdown, and APRM flow-biased flux scram trip and alarm functions, are provided to achieve these requirements.

ARTS changes the form of the RBM from a flow-biased to a power-biased function. The evaluation of the RWE event was performed taking credit for the mitigating effect of the power-dependent RBM. The power-dependent RBM Allowable Limits and Allowable Values (AVs) were provided.

The proposed implementation of the ARTS/MELLLA improvement program will increase the plant operating efficiency by updating the thermal limits requirements to be consistent with current GE methodology and from improvements in plant instrumentation accuracy. The ARTS improvement program includes changes to the current APRM system, which requires the TS changes, as described in Section 3.11 of this SE. The functions of the APRM are integrated within the Nuclear Measurement Analysis and Control (NUMAC) Power Range Neutron Monitoring System (PRNMS).

The NUMAC PRNMS APRM calculates an average local power range monitor (LPRM) chamber signal such that the APRM signal is proportional to the core average neutron flux and can be calibrated as a means of measuring core thermal power. The APRM signals are used to calculate the Simulated Thermal Power (STP) that closely approximates reactor thermal power during a transient. The STP signals are compared to a recirculation drive flow-referenced scram and a recirculation drive flow-referenced control rod withdrawal block.

CGS currently operates such that the Maximum Fraction of Limiting Power Density (MFLPD) is less than or equal to the Fraction of Rated Thermal Power (FRTP), which limits the local power peaking at lower core power and flows. If the ratio of the MFLPD to the FRTP is greater than 1.

the flow-referenced APRM trips must be lowered (setdown) or the APRM gain must be increased (CGS current TS 3.2.4) to limit the maximum power that the plant can achieve. The basis for this "APRM trip setdown" requirement originated under the original BWR design Hench-Levy minimum critical heat flux ratio (MCHFR) thermal limit criterion and provides conservative restrictions with respect to current fuel thermal limits (Reference 3.4).

The CGS ARTS/MELLLA application utilizes the results of the AOO analyses to define initial condition operating thermal limits, which conservatively ensure that all licensing criteria are satisfied without the peaking factor requirement and associated setdown of the flow-referenced APRM scram and rod block trips.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Two licensing areas that can be affected by the elimination of the APRM trip setdown and peaking factor requirement are fuel thermal-mechanical integrity, and LOCA analysis. The following criteria ensure satisfaction of the applicable licensing requirements for the elimination of the APRM trip setdown requirement:

The SLMCPR shall not be violated as a result of any AOO.

All fuel thermal-mechanical design bases shall remain within the licensing limits.

Peak cladding temperature (PCT) and maximum cladding oxidation fraction following a LOCA shall remain within the limits defined in 10 CFR 50.46.

As required by TS 5.6.3.a, Core Operating Limits Report (COLR), core operating limits shall be established prior to each reload cycle, or prior to any remaining portion of a reload cycle, and shall be documented in the COLR for:

1. The APLHGR for Specification 3.2.1;

2. The MCPR for Specification 3.2.2;

3. The LHGR for Specification 3.2.3; and

4. LCO 3.3.1.3, "Oscillation Power Range Monitor (OPRM) Instrumentation."

The analytical methods used to determine the core operating limits shall be those previously reviewed and approved by the NRC, and listed in TS 5.6.3.b. These analytical methods used to evaluate the Operating Limit MCPR (OLMCPR) ensure that the SLMCPR and the fuel thermal-mechanical design bases are satisfied. The analyses documented in the COLR also establish the power-dependent and flow-dependent MCPR and LHGR curves for CGS.

3.4 Method of Analysis The analyses which were used to justify operation with the ARTS improvement and the MELLLA power/flow operating map for a core design using GE14 and ATRIUM-10 fuels are based on the NSSS vendor (GEH) computer codes, methodologies, and applicable industry standards, which are discussed in the AIMSAR, associated references, and in its August 22, 2012, response (Reference 3.2) to the NRC staffs request for additional information (RAI) dated July 23, 2012 (Reference 3.16). Table 1-1 of the CGS AIMSAR (Reference 3.3) lists NRC-approved GEH computer codes used in the safety analyses (nonproprietary version designated as NED0-33507, Revision 1, available at ADAMS Accession No. ML12040A080).

The analyses performed are based on the current plant operating parameters. For the transient and stability analyses, the CGS Cycle 20 core design was utilized. These analyses will be revalidated as part of the subsequent cycle-specific reload licensing analyses in accordance with GESTAR II (Reference 3.5, which is also referenced in the CGS TS Bases B 3.2.1, APLHGR, and B 3.2.2, MCPR). The NRC staff concludes that the licensee's method of analysis for the CGS MELLLA operation is acceptable.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION 3.5 Fuel Thermal Limits The potentially limiting AOOs and accident analyses were evaluated to support CGS operation in the MELLLA region with ARTS off-rated limits. The P/F state points chosen for the review of AOOs include the MELLLA region and the current licensed operating domain for CGS. The AOO evaluations are discussed below.

The core-wide AOOs included in the current Cycle 20 reload licensing analyses (Reference 3.6) and the CGS Final Safety Analysis Report (FSAR) were examined for operation in the ARTS/MELLLA region (including off-rated power and flow conditions). The following events were considered potentially limiting in the ARTS/MELLLA region and were reviewed as part of the ARTS program development:

1. Generator Load Rejection with No Bypass (LRNBP) event;

2. Turbine Trip with No Bypass (TINBP) event;

3. Feedwater Controller Failure (FWCF) maximum demand event;

4. Loss of Feedwater Heating (LFWH) event;

5. Inadvertent High Pressure Core Spray (HPCS) Startup event;

6. Idle Recirculation Loop Start-up (IRLS) event; and

7. Recirculation Flow Increase (RFI) event.

The LRNBP, TTNBP, FWCF, LFWH, and HPCS events were generally the source of the power-dependent thermal limits, while the IRLS and RFI events were generally the source of the flow-dependent thermal limits. The initial ARTS/MELLLA assessment of these events for all BWR type plants concluded that for plant-specific applications, only the TINBP, LRNBP, and FWCF events need to be evaluated at both rated and off-rated power and flow conditions.

The generic assessments were performed to determine the most limiting transients and characteristics for the BWR fleet. This was done by using the plant characteristics from the fleet of BWR/3 through BWR/5 plants that resulted in the most limiting transients. The plants were chosen to cover a wide range of conditions and characteristics including steam line volume, plants with and without the recirculation pump trip (RPT) feature, high and low feedwater runout capacity, and low bypass capacity. None of the BWR/5 plants, such as CGS, had plant characteristics that were limiting for the fleet.

The key plant characteristics considered for off-rated limits calculations include:

Steam Line Characteristics

Feedwater (FW) Runout Capacity

HPCS Flow Capacity

RPT

Steam Bypass Capacity

Relief Capacity

Design Conditions (Power Density, FW temperature, etc.)

To confirm the applicability of the generic assessment to CGS, plant-specific power-dependent calculations were performed which included all of the key plant characteristics described above that applied to CGS. These analyses were performed with NRC-approved methods and the OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION most recent core designs. These analyses confirmed the applicability of the generic assessments for the limiting AOOs to CGS. Consistent with the initial ARTS/MELLLA assessment of events for all BWR type plants, and based on plant-specific reasons, the LFWH, HPCS, IRLS, and RFI events were not specifically evaluated for CGS. The RWE event is discussed separately in the following section.

Extensive transient analyses at a variety of power and flow conditions were performed during the original development of the ARTS improvement program. These evaluations are applicable for operation in the MELLLA region. The analyses were utilized to study the trend of transient severity without the APRM trip setdown. A database was established by analyzing limiting transients over a range of power and flow conditions. The database includes evaluations representative of a variety of plant configurations and parameters such that the conclusions are applicable to all BWRs. The database was utilized to develop a method of specifying plant operating limits (MCPR and LHGR) such that margins to fuel safety limits are equal to or larger than those currently applied.

The generic evaluations determined that the power-dependent severity trends must be examined in two power ranges. The first power range is between rated power and the power level (Psypass) where reactor scram on turbine stop valve closure or turbine control valve fast closure is bypassed. The analytical value of Psypass for CGS is 30 percent of RTP. The second power range is between Psypass and 25 percent of RTP. No thermal monitoring is required below 25 percent of RTP according to CGS TS 3.2.

The power-dependent MCPR multiplier, K(P), was originally developed for application to all plants in the high power range (between rated power and Psypass). The values for K(P) increased at lower power levels based on the FWCF transient severity trends. As power is reduced from the rated condition in this power range, the LRNBP and TTNBP become less severe because the reduced steam flow rate at lower power results in milder reactor pressurization. However, for the FWCF, the power decrease results in greater mismatch between runout and initial feedwater flow, resulting in an increase in reactor subcooling and more severe changes in thermal limits during the event.

Between Psypass and 25 percent power, CGS specific evaluations were performed to establish the plant-unique MCPR and LHGR limits in the low power range (below Psypass). These plant-specific limits include sufficient conservatism to remain valid for future CGS core configurations containing ATRIUM-10 and/or GNF fuel.

Generic flow-dependent MCPR and LHGR limits are applied to CGS. These generic limits include sufficient conservatism to remain valid for future CGS reloads of GNF and/or ATRIUM-10 fuel, utilizing the GEXL-PLUS correlation and the GEMINI analysis methods as defined in GESTAR II (Reference 3.5), provided the core flow corresponding to the maximum two recirculation pump runout is less than 108.5 percent of RCF.

The rated OLMCPRs and LHGRs are determined by the cycle-specific reload analyses in accordance with GESTAR II (Reference 3.5). At any P/F state (P,F), all applicable off-rated limits are determined: MCPR(P), MCPR(F), LHGR(P), and LHGR(F). The most limiting MCPR (maximum of MCPR(P) and MCPR(F)) and the most limiting LHGR (minimum of LHGR(P) and LHGR(F)) will be the governing limits.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION In response to the NRC staff's RAI (Reference 3.2), the licensee confirmed that for the mixed core of Cycle 20 using ATRIUM-10 and GE14 fuels and with the implementation of ARTS/MELLLA, GE14 fuel was bounding with respect to the SAFDLs (MCPR, LHGR, cladding strain) during a transient.

The licensee is required by TS 5.6.3 to perform cycle-specific reload fuel analyses to determine the limits for rated and applicable off-rated conditions, and application of the methodology is demonstrated by the analyses performed for the current operating cycle.

3.6 RWE Analysis The improved RBM system for CGS with power-dependent setpoints requires that new RWE analyses be performed to determine the MCPR requirements and corresponding setpoints. A generic statistical analysis for application to all BWRs including CGS was performed and the application of these results is validated for GNF and/or ATRIUM-10 fuel and core design for each reload analysis consistent with the GESTAR II (Reference 3.5) critical power ratio (CPR) correlation.

The RWE transient is hypothesized as an inadvertent reactor operator initiated withdrawal of a single control rod from the core. Withdrawal of a single control rod has the effect of increasing local power and core thermal power which lowers the MCPR and increases the LHGR in the core limiting fuel rods. The RWE transient is terminated by control rod blocks which are initiated by the RBM system.

The function of the RBM is to prevent fuel damage in the event of erroneous rod withdrawal from locations of high power density during high-power level operation. It does this by blocking control rod movement that could result in violating a thermal limit (1 percent plastic strain criterion, or the SLMCPR) in the event of a RWE.

The evaluation of the RWE event was performed taking credit for the mitigating effect of the power-dependent RBM. The RBM setpoints are determined based on a statistical analysis. The RBM has three power biased trip levels. The trip levels are determined based on analyses that compare severity of the RWE with different setpoints. The setpoints that are adopted are based on a 95/95 confidence interval assessment that the RWE consequences do not breach the safety limit MCPR. The analyses were performed assuming conservative LPRM failure assumptions and using NRC-approved methods. Specific evaluations were performed for the reference CGS core to confirm that the maximum LHGR (MLHGR) limits are met based on the RBM setpoints. On a core-specific basis, it is confirmed that the RBM monitor setpoints adequately ensure cladding integrity protection by comparison to thermal limits.

The NRC staff concludes that the statistical evaluation is sufficiently conservative and the analytical results indicate that the implementation of ARTS/MELLLA with the proposed setpoints provides reasonable assurance that an RWE in the MELLLA operating domain will not result in fuel bundles exceeding their SAFDLs.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Based on the analyses provided by the licensee, and given that approved methodologies were used, the NRC staff concludes that the CGS RWE analysis with the proposed NUMAC PRNMS and ARTS/MELLLA implementation at CLTP conditions are acceptable.

3. 7 Vessel Overpressure The Main Steam Isolation Valve Closure with a Flux Scram (MSIVF) event is used to determine compliance to the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code. This event was previously analyzed at the 102 percent P /106 percent F state point for the CGS Cycle 20 reload licensing transient analysis. This is a cycle-specific calculation performed consistent with GESTAR II (Reference 3.5) at 102 percent of RTP and the maximum licensed core flow (maximum flow is limiting for this transient for CGS). Because the implementation of ARTS/MELLLA does not change the maximum core flow, ARTS/MELLLA does not affect the vessel overpressure protection analysis.

The MSIVF is the limiting event for the ASME overpressure analysis. For the ASME overpressure analysis, the MSIVF includes an additional failure in the RPS system and is therefore not an AOO where MCPR is calculated. It was demonstrated that the increased core flow condition (1 06 percent core flow) produces the more limiting peak vessel pressure for CGS.

The higher initial core flow has a higher core pressure drop and a higher initial pressure in the lower plenum and results in higher peak vessel pressures. Therefore, MELLLA initial condition does not adversely affect the peak vessel pressure.

3.8 Thermal-Hydraulic Stability The stability compliance of GNF fuel designs with the regulatory requirements is documented in GESTAR II (Reference 3.5). The NRC staff approval of the stability performance of GE fuel designs also includes operation in the MELLLA region of the P/F map. The NRC staff acceptance of thermal-hydraulic stability includes the condition that the plant has systems and procedures in place, supported by TS, as appropriate, which provide adequate instability protection.

Protection against exceeding SAFDLs as a result of instability events is provided by the Option Ill detection and suppress (DSS) long-term stability solution (LTS). CGS has an approved TS 3.3.1.3 for the Option Ill hardware (Amendment No. 171, dated April 5, 2001 ).

The Option Ill hardware was installed and connected to the Reactor Protection System (RPS).

When the MELLLA upper boundary domain is implemented, cycle-specific setpoints will be determined consistent with GESTAR II (Reference 3.5) and will be documented in the Supplemental Reload Licensing Report (SRLR). In the event that the Oscillation Power Range Monitor (OPRM) system becomes inoperable, CGS will operate under alternate methods.

The Option Ill solution combines closely spaced LPRM detectors into "cells" to effectively detect either core-wide or regional (local) modes of reactor instability. These cells are termed OPRM cells and are configured to provide local area coverage with multiple channels. Plants implementing Option Ill have hardware to combine the LPRM signals and to evaluate the cell signals with instability detection algorithms. The Period Based Detection Algorithm (PBDA) is the only algorithm credited in the Option Ill licensing basis. Two defense-in-depth algorithms, referred to as the Amplitude Based Algorithm (ABA) and the Growth Rate Algorithm (GRA),

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION provide assurance that fuel failure will not occur as a consequence of stability related oscillations.

The Option Ill Trip Enabled Region has been generically defined as the region (less than or equal to 60 percent RCF and greater than or equal to 30 percent rated power) where the OPRM system is fully armed. The Backup Stability Protection (BSP) evaluation showed that the generic Option Ill Trip Enabled Region should be expanded for operation in the MELLLA region.

The BSP analysis recommends extending the power boundary of the generic Option Ill OPRM Trip-Enabled Region to greater than or equal to 25 percent rated CLTP and keeping the flow boundary at less than or equal to 60 percent RCF.

The minimum power at which the OPRM should be confirmed operable is 20 percent rated CLTP. A 5 percent absolute power separation between the OPRM Trip-Enabled Region power boundary and the power at which the OPRM system should be confirmed operable is considered adequate for the Option Ill solution.

Stability Option Ill provides SLMCPR protection by generating a reactor scram if a reactor instability, which exceeds the specified trip setpoint, is detected. The demonstration setpoint for the Cycle 20 core design at the increased MELLLA P/F map upper boundary is determined in accordance with the NRC-approved methodology (Reference 3.7). The Option Ill stability reload licensing basis calculates the limiting OLMCPR required to protect the SLMCPR for both steady-state and transient stability events as specified in the Option Ill methodology. These OLMCPRs are calculated for a range of OPRM setpoints for MELLLA operation. Selection of an appropriate instrument setpoint is then based upon the OLMCPR required to provide adequate SLMCPR protection. This determination relies on the DIVOM curve (Delta CPR Over Initial MCPR Versus Oscillation Magnitude) to determine an OPRM setpoint that protects the SLMCPR during an anticipated instability event. The DIVOM slope was developed based on a TRACG evaluation consistent with the BWR Owner's Group (BWROG) Regional DIVOM Guideline (Reference 3.8). CGS implements the associated BSP regions (Reference 3.9) as the stability licensing basis if the Option Ill OPRM system is declared inoperable.

Based on the analyses provided by the licensee, and the fact that NRC-approved methodologies were used, the NRC staff concludes that the thermal hydraulic stability characteristics of CGS with the proposed ARTS/MELLLA implementation at the CLTP conditions are acceptable.

3.9 LOCA Analysis The ECCS is designed to provide protection against postulated LOCAs caused by ruptures in the primary system piping. The ECCS performance under all LOCA conditions and the analysis models must satisfy the requirements of 10 CFR 50.46 and 10 CFR Part 50, Appendix K. The Maximum Average Planar Linear Heat Generation Rate (MAPLHGR) operating limit is based on the most limiting LOCA and ensures compliance with the ECCS acceptance criteria in 10 CFR 50.46.

In general, two major competing phenomena that affect the fuel PCT in large-break LOCA analysis, which are sensitive to the higher load line in the operating P/F map, are the time of boiling transition (BT) at the high power node of the limiting fuel assembly and the core recovery OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION time. Initiation of the postulated LOCA at lower core flow can result in earlier BT at the high power node, compared to the 100 percent of RCF results, causing a higher calculated PCT. On the other hand, initiation of the postulated LOCA at lower core flow (higher power-to-flow ratio, hence higher core inlet subcooling) affects break flow rate which can result in faster core recovery, compared to the 100 percent RCF, and can lower the PCT. The net effect on the calculated PCT is acceptable as long as the results remain less than the Licensing Basis PCT limits. The nominal and Appendix K PCT response following a large recirculation line break for most plants show that the PCT effect due to MELLLA is small. For small-break LOCAs, the fuel remains in nucleate boiling until the fuel is uncovered and MELLLA is expected to have no adverse effect on the small-break LOCA response.

The current licensing basis SAFER/GESTR-LOCA analysis for CGS (References 3.10 and 3.11) was reviewed to determine the effect on the ECCS performance resulting from CGS operation in the MELLLA domain. The LOCA analysis for CGS operation in the MELLLA domain is in conformance with 10 CFR 50.46 requirements. Calculations at the ((

)).

The CGS current licensing basis PCT for Gel1 fuel is 1710 F for the recirculation suction line break (RSLB) with a top-peaked axial power distribution (Reference 3.11). Calculations assuming the MELLLA extended operation domain were performed to quantify the effect on PCT to the allowed operation envelope, and it remained unaffected by ARTS/MELLLA.

MELLLA has a negligible effect on compliance with the other acceptance criteria of 10 CFR 50.46.

The CGS MELLLA evaluation is based on plant-specific calculations with a representative full core of GE14 fuel using SAFER/GESTR methodology. In response to the NRC staff's RAI (Reference 3.2), the licensee confirmed that for the mixed core of Cycle 20 using ATRIUM-1 0 and GE14 fuels and with the implementation of ARTS/MELLLA, ((

))

The calculations for CGS show that the MELLLA option will meet the PCT acceptance criteria for a representative core with GE14 fuel and has no effect on any other LOCA criteria.

Therefore, no additional restrictions on fuel power to account for LOCA criteria compliance are required. Calculations at the CLTP/RCF condition result in the highest PCT for both the small-and large-break LOCA and set the licensing basis PCT for CGS. Calculations performed at the CLTP/MELLLA core flow condition result in lower PCT than the CLTP/RCF condition.

The NRC staff's review confirmed that the small-break LOCA spectrum adequately covers an acceptable range in size, single failures, and location to determine the limiting small-break LOCA event for CGS and is, therefore, acceptable.

3.10 Anticipated Transient without Scram The basis for the current anticipated transient without scram (ATWS) requirements is 10 CFR 50.62. This regulation includes requirements for an ATWS-RPT, an Alternate Rod Insertion (ARI) system, and an adequate Standby Liquid Control System (SLCS) injection rate.

The purpose of the A TWS analysis is to demonstrate that these systems are adequate for operation in the MELLLA region. This is accomplished by performing a plant-specific analysis in OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION accordance with the NRC-approved licensing methodology (Reference 3.12) to demonstrate that ATWS acceptance criteria are met for operation in the MELLLA region.

The ATWS analysis takes credit for ATWS-RPT and SLCS, but assumes that ARI fails. If reactor vessel and fuel integrity are maintained, then the ATWS-RPT setpoint is adequate. If containment integrity is maintained, then the SLCS injection rate is adequate.

Three ATWS events for CGS were re-evaluated at the MELLLA point (100 percent of CLTP and 80.7 percent of RCF) with ARI assumed to fail, thus requiring the operator to initiate SLCS injection for shutdown. These events were: (1) Closure of all MSIVs (MSIVC), (2) Pressure Regulator Failure Open (PRFO) to Maximum Steam Demand Flow, and (3) Loss of Offsite Power (LOOP). The MSIVC and PRFO events result in reactor isolation and a large power increase without scram. These events are the most limiting for fuel integrity and reactor pressure vessel integrity.

The LOOP event does not result in reduction in the number of residual heat removal cooling loops, this event is not potentially limiting for suppression pool or containment integrity.

The Inadvertent Opening of a Relief Valve (IORV) event was also considered, but found to be non-limiting. As a result of the sequence of events for the IORV event, it is non-limiting with respect to the ATWS acceptance criteria. Peak suppression pool temperature and containment pressure are limited because the main condenser remains available for most of the event.

Reactor pressure vessel and fuel integrities are not challenged because the vessel is shutdown (via boron injection) by the time the MSIVs isolate.

The subject of ATWS with instability was covered generically for the BWR fleet in References 3.13 and 3.14. For ATWS with instability, the fuel integrity criterion is that fuel damage be limited so as not to significantly distort the core, impede core cooling, or prevent safe shutdown. The emergency operating procedures require operator action to reduce water level to below the feedwater sparger. This reduces the core subcooling, oscillation magnitude and mitigates the effect on fuel cladding heat up to meet the acceptance criteria. The licensee has also verified that the potential to damage fuel as a result of instabilities during an ATWS is effectively addressed and mitigated by plant emergency operating procedures. The NRC staff concludes that the licensee has adequately addressed the issue of A TWS instability in accordance with NRC-approved Reference 3.12 and, therefore, finds this acceptable.

The results for the MSIVC and PRFO events show that the peak vessel bottom pressure for this event is 1364 psig, which is below the ATWS vessel overpressure protection criterion of 1500 psig. The highest calculated peak suppression pool temperature is 180 °F, which is below the ATWS limit of 204.5 degrees Fahrenheit (°F). The highest calculated peak containment pressure is less than 10.0 psig, which is below the ATWS limit of 45 psig.

Analyses were also performed for one pump operation with 44 percent Boron-1 0 enrichment.

The one pump operation increases the SLCS transport delay due to the reduced volumetric flow in the system. As a result, the peak pool temperature was determined to be 187 °F, which is well below the temperature limit of 204.5 °F. The peak containment pressure was determined to be less than 12 psig, well below the 45 psig limit. Other acceptance criteria are not affected by one SLCS pump operation as the peak values occur before SLCS initiation.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Coolable core geometry is ensured by meeting the 2200 oF PCT limit, and the 17 percent local cladding oxidation acceptance criteria of 10 CFR 50.46. The limiting PCT was determined to be 1572 °F, which is significantly less than the 2200 F limit. The fuel cladding oxidation is insignificant and less than the 17 percent local limit.

The maximum SLCS pump discharge pressure depends primarily on the safety relief valve (SRV) setpoints. The maximum SLCS pump discharge pressure during the limiting ATWS event using one SLCS pump is 1209.5 psig. This value is based on a peak reactor vessel upper plenum pressure of 1155 psig that occurs during the limiting ATWS event after SLCS initiation. The relief valves used for the SLCS at CGS have a setpoint of 1400 psig and a drift tolerance of approximately 28 psig, resulting in a lower setpoint tolerance of 1372 psig. There is 162.5 pounds per square inch differential (psid) margin between the maximum SLCS discharge pressure of 1209.5 psig and the lower setpoint of 1372 psig. A margin of 30-psid from the relief valve lower setpoint is needed to adequately accommodate the SLCS pump pressure pulsation.

Therefore, the margin from the lower setpoint is adequate to prevent the SLCS relief valve from lifting during SLCS operation to meet the guidelines published in NRC Information Notice 2001-13 (Reference 3.15). The NRC staff therefore concludes that the proposed operation with the ARTS improvement and the MELLLA power/flow operating map at CGS is in compliance with the applicable code and is, therefore, acceptable.

The results of the ATWS analysis performed for CGS to support operation in the MELLLA region show that the maximum values of the key performance parameters (reactor vessel pressure, suppression pool temperature, and containment pressure) remain within the applicable limits. The NRC staff, therefore, concludes that the licensee has demonstrated reasonable assurance that operations at CGS with the ARTS improvement and the MELLLA power/flow operating map will continue to be conducted in compliance with the requirements of 10 CFR 50.62.

3.11 Technical Specification Changes for ARTS/MELLLA The regulations in 10 CFR 50.36, "Technical specifications," provides the regulatory requirements for the content in a licensee's TSs. The regulations require that the TSs will include surveillance requirements (SRs) to assure that the limiting conditions for operation (LCO) will be met.

The NRC staff reviewed the proposed changes to the CGS TSs that are identified in the licensee's January 31 2012, submittal (Reference 3.1 ). The changes include deletion of the current setdown requirement, and new power and flow-dependent MCPR and maximum linear heat generation rate (MLHGR) limits, and are evaluated in this SE.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION TS 1.1, Definitions, and TS 3.2.4, Average Power Range Monitor (APRM) Gain and Setpoint As part of the ARTS/MELLLA implementation, the licensee originally proposed to delete this TS section, which includes requirements for flow-biased APRM STP setdown. The proposed changes were subsequently revised to retain TS 3.2.4 by the licensee in Enclosure 4 of its letter dated May 9, 2013, based upon the licensee's proposed implementation schedule in Refueling Outage 22 for the amendment.

TS 3.4.1, Reactor Coolant System (RCS)

With the introduction of ARTS/MELLLA, the licensee proposed to add a new statement to LCO 3.4.1, which would state:

c. LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation,"

Function 2.b (Average Power Range Monitors, Simulated Thermal Power- High), Allowable Value of Table 3.3.1.1-1 is reset for single loop operation.

TS 5.6.3. Core Operating Limits Report (COLR)

In support of the proposed removal of current LCO 3.3.1.3 for the PRNM System incorporation of the OPRM System, the licensee originally revised TS 5.6.3.a.4 to reflect that the COLR will document OPRM limits and setpoints to support LCO 3.3.1.1.

The licensee proposed changes for the ARTS/MELLLA improvement including the addition of TS 5.6.3.a.5 and a.6 to reflect that the COLR will specify the Allowable Values and MCPR conditions for the RBM Upscale Functions to support LCO 3.3.2.1.

The proposed changes were subsequently revised by the licensee in Enclosure 4 of its letter dated May 9, 2013, based upon the licensee's proposed implementation schedule in Refueling Outage 22 for the amendment, to retain LCO 3.3.1.3 and to specify the applicability of the revisions to "before" and "after the implementation of the PRNM upgrade.

The proposed changes to the TSs are discussed in further detail in SE Section 4.3.2 below.

The changes to the TSs proposed by the licensee are consistent with the implementation of the planned PRNM/ARTS/MELLLA modifications and, therefore, are acceptable to the NRC staff.

3.12 References 3.1 Sawatzke, B. J., Energy Northwest, letter to U.S. Nuclear Regulatory Commission, "Columbia Generating Station, License Amendment Request to Change Technical Specifications in Support of PRNM I ARTS/MELLLA Implementation," dated January 31, 2012 (ADAMS Accession No. ML120400144).

3.2 Sawatzke, B. J., Energy Northwest, letter to U.S. Nuclear Regulatory Commission, "Columbia Generating Station, Response To Request For Additional Information Regarding License Amendment Request To Implement PRNM/ARTS/MELLLA," dated August 22, 2012 (ADAMS Accession No. ML12248A136).

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION 3.3 NEDC-33570P, Revision 1, "Columbia Generating Station APRM/RBM/Technical Specifications/ Maximum Extended Load Line Limit Analysis (ARTS/MELLLA),"

January 2012 (proprietary).

3.4 J. M. Healzer, J. E. Hench, E. Janssen, and S. Levy, "Design Basis for Critical Heat Flux Condition in Boiling Water Reactors," APED-5186, Class II, 1966.

3.5 GE Nuclear Energy, NEDE-24011-P-A-16, "GESTAR II General Electric Standard Application for Reactor Fuel," October 2007 (proprietary); non-proprietary version designated as NED0-24011-NP-A-16 (ADAMS Accession No. ML091340077).

3.6 Global Nuclear Fuel, "Supplemental Reload Licensing Report for CGS Reload 19, Cycle 20," 0000-0098-0322-SRLR, Revision 0, March 2009.

3.7 GE Nuclear Energy, "Reactor Stability Detect and Suppress Solutions Licensing Basis Methodology for Reload Applications," NED0-32465-A, Revision 0, August 1996.

3.8 GE Nuclear Energy, "Plant-Specific Regional Mode DIVOM Procedure Guideline," GE-NE-0000-0028-9714-R1, June 2005.

3.9 GE Nuclear Energy, letter to BWR Owners' Group Detect and Suppress II Committee, "Backup Stability Protection (BSP) for Inoperable Option Ill Solution," OG 02-0119-260, dated July 17, 2002.

3.10 GE Nuclear Energy, "WNP-2 SAFER/GESTR-LOCA Loss-of-Coolant Accident Analysis,"

NEDC-32115P, Revision 2, March 2004.

3.11 GE Nuclear Energy, "Columbia Generating Station GE14 ECCS-LOCA Evaluation,"

0000-0090-6853-RO, February 2009.

3.12 GE Nuclear Energy, "Qualification of the One Dimensional Core Transient Model (ODYN) for Boiling Water Reactors (Supplement 1 -Volume 4)," NEDC-24154P-A, February 2000 (proprietary).

3.13 GE Nuclear Energy, "ATWS Rule Issues Relative to BWR Core Thermal-Hydraulic Stability," NED0-32047-A, June 1995.

3.14 GE Nuclear Energy, "Mitigation of BWR Core Thermal Hydraulic Instabilities in ATWS,"

NED0-32164, December 1992.

3.15 U.S. Nuclear Regulatory Commission, Information Notice 2001-13, "Inadequate Standby Liquid Control System Relief Valve Margin," dated August 10, 2001 (ADAMS Accession No. ML012210146).

3.16 Gibson, L. K., U.S. Nuclear Regulatory Commission, letter to Mark Reddemann, Energy Northwest, "Columbia Generating Station -Request for Additional Information Regarding OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION License Amendment Request to Implement PRNM/ARTS/MELLLA (TAC No. ME7905),"

dated July 23, 2012 (ADAMS Accession No. ML12201B050).

4.0 INSTRUMENTATION AND CONTROLS TECHNICAL EVALUATION 4.1 Introduction The proposed amendment provides an expanded operating domain resulting from the implementation of 8verage Power Range Monitor/ Rod Block Monitorfiechnical §pecifications, Maximum Extended Load Line Limit Analysis (ARTS/MELLLA). The allowable value (AV) of the APRM flow-biased simulated thermal power scram would be revised to permit operation in the MELLLA region. The existing flow-biased Rod Block Monitor (RBM) would also be replaced by a power-dependent RBM requiring new AV. Additionally, the flow-biased APRM simulated thermal power (STP) setdown requirements would be replaced by more direct power- and flow-dependent thermal limits to minimize manual APRM gain adjustments and provide more direct administration of thermal limits during operation at other than rated conditions.

The changes are based on licensing topical reports (LTRs) that were reviewed and approved by the NRC staff in 1995 and 1997 (see References 4.2 and 4.3). The overall change is further supported by prior operating experience that has been gained from changes to install similar General Electric- Hitachi (GEH) Nuclear Measurement Analysis and Control (NUMAC)-based equipment in U.S. nuclear power plants. The LTRs and their corresponding safety evaluations (SEs) (also contained in References 4.2 and 4.3) establish utility-specific licensee actions that each referencing license amendment request (LAR) must perform, as applicable. The LTRs provide a series of block diagrams to show a variety of GEH NUMAC Power Range Neutron Monitoring System (PRNMS) equipment configurations that could be applied to different General Electric (GE) Boiling-Water Reactor (BWR) designs using GEH NUMAC hardware and software.

CGS is a GE BWR/5 plant. The existing design incorporates six APRM channels. Each APRM channel uses input signals from a number of local power range monitors (LPRMs). The six APRM channels are combined in two groups of three channels each to form two trip channels.

The PRNMS modification will replace the six-channel APRM with a four-channel APRM configuration whereby each channel uses one-fourth of the total LPRM detectors. The APRM functions in each channel are the same; however four 2-0ut-of-4 Voter logic channels are added. Each four-channel APRM provides inputs to all four of the 2-0ut-of-4 Voter logic channels. Outputs from two voter logic channels supply inputs to each of two Reactor Protection System (RPS) trip system divisions.

The GEH NUMAC PRNMS development approach includes reliance upon pre-developed hardware and software components. A high-level description of these pre-developed components is contained in the LTRs (References 4.2 and 4.3). The set of pre-developed software supports interfaces with NUMAC boards and instrument-specific application functions, which are configured to construct plant-specific instrumentation such as the CGS PRNMS.

Most of this pre-developed software was produced to satisfy the applicable regulatory evaluation criteria that the NRC staff used to evaluate the base LTR in 1995. However, since that time, the applicable regulatory evaluation criteria used by the NRC staff to evaluate software-based safety functions within digital safety-related equipment have changed. The OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION NRC staff has used the current regulatory criteria for the changes along with the applicable operating experience and additional compensatory actions taken by the licensee for this evaluation.

This review evaluates proposed TS changes, the plant-specific configuration of the CGS PRNMS, and the safety functions that it performs against current and applicable regulatory criteria. Also included in this review is an evaluation of the CGS PRNMS against the plant-specific action items defined in the LTRs and their SEs (see References 4.2 and 4.3). This review evaluates the CGS PRNMS development including its software, which in part is justified by applicable operational experience. The software review is limited to changes that have occurred to the pre-developed safety software since the LTR approvals. Otherwise, this review does not re-evaluate earlier NRC staff conclusions that are documented in theSEs for the approved LTRs.

The applicable regulatory bases and corresponding guidance and regulatory acceptance criteria that have been used to evaluate the proposed changes are identified in Section 4.2 of this SE.

The technical evaluation of the proposed change is documented in Section 4.3 of this SE.

Section 4.4 provides the NRC staff's conclusion and Section 4.5 provides a list of references.

4.2 Regulatory Evaluation The following regulations and guidance are applicable to the licensee's proposed change to install the GEH NUMAC PRNMS equipment at CGS:

10 CFR 50.36, "Technical specifications."

Paragraph 10 CFR 50.55a(a)(1 ), states that Structures, systems, and components must be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety function to be performed.

Paragraph 10 CFR 50.55a(h), "Protection and safety systems," approves the 1991 version of Institute for Electrical and Electronics Engineers (IEEE)

Standard 603, "IEEE Standard Criteria for Safety Systems for Nuclear Power Generating Stations," for incorporation by reference including the correction sheet dated January 30, 1995.

The following General Design Criteria (GDC) in Appendix A to 10 CFR Part 50:

GDC 1, "Quality standards and records" GDC 2, "Design bases for protection against natural phenomena" GDC 4, "Environmental and dynamic effects design bases" GDC 10, "Reactor design" OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION GDC 12, "Suppression of reactor power oscillations" GDC 13, "Instrumentation and control" GDC 15, "Reactor coolant system design" GDC 20, "Protection system functions" GDC 21, "Protection system reliability and testability" GDC 22, "Protective system independence" GDC 23, "Protection system failure modes" GDC 24, "Separation of protection and control systems" GDC 25, "Protection system requirements for reactivity control malfunctions" GDC 29, "Protection against anticipated operational occurrences" The NRC staff evaluated the licensee's proposal using applicable portions of the following guidance:

Regulatory Guide 1. 75, Revision 3, "Criteria for Independence of Electrical Safety Systems," February 2005 (ADAMS Accession No. ML043630448), describes a method acceptable to the NRC staff for satisfying physical independence of the circuits and electrical equipment that comprise or are associated with safety systems.

Regulatory Guide 1.1 00, Revision 3, "Seismic Qualification of Electrical and Active Mechanical Equipment and Functional Qualification of Active Mechanical Equipment for Nuclear Power Plants," September 2009 (ADAMS Accession No. ML091320468), describes a method acceptable to the NRC staff for satisfying the seismic qualification.

Regulatory Guide 1.1 05, Revision 3, "Setpoints for Safety Related Instrumentations," December 1999 (ADAMS Accession No. ML993560062),

describes a method acceptable to the NRC staff for complying with the NRC's regulations for ensuring that instrumentation setpoints are initially within and remain within the TS limits. The regulatory guide endorses Part I of Instrument Society of America (ISA)-S67.04-1994, "Setpoints for Nuclear Safety Instrumentation," subject to the NRC staff clarifications.

Regulatory Guide 1.152, Revision 3, "Criteria for Use of Computers in Safety Systems of Nuclear Power Plants," July 2011 (ADAMS Accession No. ML102870022}, describes a method acceptable to the NRC staff for complying with the NRC's regulations as they apply to high functional reliability and design requirements for computers used in safety systems of nuclear power plants.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

Regulatory Guide 1.168, Revision 1, "Verification, Validation, Reviews, and Audits for Digital Computer Software Used in Safety Systems of Nuclear Power Plants," February 2004 (ADAMS Accession No. ML040410189), describes a method acceptable to the NRC staff for complying with the NRC's regulations as they apply to the verification and validation of safety system software.

Regulatory Guide 1.169, "Configuration Management Plans for Digital Computer Software Used in Safety Systems of Nuclear Power Plants," September 1997 (ADAMS Accession No. ML003740102}, describes a method acceptable to the NRC staff for complying with the NRC's regulations as they apply to the configuration management of safety system software.

Regulatory Guide 1.170, "Software Test Documentation for Digital Computer Software Used in Safety Systems of Nuclear Power Plants," September 1997 (ADAMS Accession No. ML003740105), describes a method acceptable to the NRC staff for complying with the NRC's regulations as they apply to test documentation of safety system software.

Regulatory Guide 1.171, "Software Unit Testing for Digital Computer Software Used in Safety Systems of Nuclear Power Plants," September 1997 (ADAMS Accession No. ML003740108}, describes a method acceptable to the NRC staff for complying with the NRC's regulations as they apply to the unit testing of safety system software.

Regulatory Guide 1.172, "Software Requirements Specifications for Digital Computer Software Used in Safety Systems of Nuclear Power Plants,"

September 1997 (ADAMS Accession No. ML003740094}, describes a method acceptable to the NRC staff for complying with the NRC's regulations as they apply to preparation of software requirement specifications for safety system software.

Regulatory Guide 1.173, "Developing Software Life Cycle Processes for Digital Computer Software Used in Safety Systems of Nuclear Power Plants,"

September 1997 (ADAMS Accession No. ML003740101), describes a method acceptable to the NRC staff for complying with the NRC's regulations as they apply to the development processes for safety system software.

Regulatory Guide 1.180, Revision 1, "Guidelines for Evaluating Electromagnetic and Radio-Frequency Interference in Safety Related Instrumentation and Control Systems," October 2003 (ADAMS Accession No. ML032740277), describes a method acceptable to the NRC staff for the design, installation, and testing practices to address the effects of electromagnetic and radio-frequency interference (EMI/RFI) and power surges on safety-related instrumentation and control (I&C) systems.

Regulatory Guide 1.209, "Guidelines for Environmental Qualification of Safety Related Computer-Based Instrumentation and Control Systems in Nuclear Power Plants," March 2007 (ADAMS Accession No. ML070190294}, describes a method acceptable to the NRC staff for satisfying the environmental qualification OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION of safety-related computer-based I&C systems for service in mild environments at nuclear power plants.

DI&C-ISG-02, Revision 2, "Task Working Group #2: Diversity and Defense-in-Depth Issues, Interim Staff Guidance," dated June 5, 2009 (ADAMS Accession No. ML091590268), describes methods acceptable to the NRC staff for implementing diversity and defense-in-depth (D3) in digital instrumentation and control (DI&C) system designs.

DI&C-ISG-04, Revision 1, "Task Working Group #4: Highly-Integrated Control Rooms-Communications Issues (HICRc)," March 2007 (ADAMS Accession No. ML083310185), describes methods acceptable to the NRC staff to prevent adverse interactions among safety divisions and between safety-related equipment and equipment that is not safety-related.

The NRC staff also considered applicable portions of the branch technical positions in accordance with the review guidance established within NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition" (SRP),

Chapter 7, "Instrumentation and Controls," as follows:

Branch Technical Position 7-11, "Guidance on Application and Qualification of Isolation Devices"

Branch Technical Position 7-12, "Guidance on Establishing and Maintaining Instrument Setpoints"

Branch Technical Position 7-14, "Guidance on Software Reviews for Digital Computer-Based Instrumentation and Control Systems"

Branch Technical Position 7-19, "Guidance for Evaluation of Diversity and Defense-In-Depth in Digital Computer-Based Instrumentation and Control Systems"

Branch Technical Position 7-21, "Guidance on Digital Computer Real-Time Performance" 4.3 Technical Evaluation The following subsections identify and describe the safety-related CGS PRNMS I&C components of the proposed change and evaluate these components against the current and applicable regulatory evaluation criteria that are identified in SE Section 4.2. Section 4.3.1 provides a summary of the proposed change and the remaining subsections address specific technical evaluation areas that apply to the proposed instrumentation. The evaluation of the proposed TS changes is addressed in Section 4.3.2 of the technical evaluation. The NRC staff also considered in its review more current evaluation criteria than that included in older NRC-approved LTRs (i.e., References 4.2 and 4.3). SE Sections 4.3.3 through 4.3.9 address these areas. Section 4.3.1 0 addresses licensee deviations from the NRC-approved LTRs.

Section 4.3.11 addresses plant-specific actions required in the NRC-approved LTRs.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION 4.3.1 System Description and Configuration Summary Description The licensee is replacing the existing analog power range monitor subsystem of the existing NMS with the digital NUMAC PRNMS at CGS. The NUMAC PRNMS retrofit is based on the LTR (References 4.2 and 4.3), which were approved by the NRC. The PRNMS design retrofit includes an automatic instability trip function, OPRM, which is defined by the Boiling Water Reactor Owners' Group (BWROG) as OPRM Option Ill detect-and-suppress function. CGS will be transitioning from the ASEA Brown Boveri (ABB) Option Ill stability solution to the GEH Option Ill stability solution with the confirmation density algorithm.

As proposed, all the existing power range monitor functions are retained, including LPRM detector signal processing, LPRM averaging, APRM trips, and RBM logic and interlocks. In some cases, the existing functions will be improved with additional filtering or modified processing. These include LPRM signal filtering, APRM filtering, and RBM filtering of the digitized analog signals. The existing analog LPRM signal processing electronics, LPRM averaging and APRM trip electronics, LPRM detector power supply hardware and recirculation flow signal processing electronics are being replaced by integrated digital NUMAC chassis based APRM electronics. The existing six APRM channels will be replaced with four channels of NUMAC APRM, each channel utilizing one-fourth ("~th) of the total available LPRM detectors.

Four 2-0ut-of-4 Voter channels are being added between the APRM channels and the existing RPS logic, with each receiving input from all four APRM channels and providing two inputs to each reactor protection system (RPS) trip logic. This ensures that each input to RPS is a voted result of all four APRMs. The interface with RPS or the trip logic does not change. Relay outputs are provided to the RPS trip system. All interfaces with external systems are maintained electrically equivalent using interface sub-assemblies with exception of the interface to the plant computer and plant operator's panel. Interface to the plant computer system is accomplished by the NUMAC Interface Computer (NIC) system and the Operator Display Assemblies (ODAs), which replace the existing meter displays. The NUMAC PRNM subsystems consist of APRM, RBM, OPRM, and Bypass Switch (see Reference 4.1.h, Section 1.1 ).

The PRNMS design retrofit includes an automatic instability trip function, OPRM, which is defined by the BWROG as OPRM Option Ill detect-and-suppress function (see Reference 4.19).

The Option Ill stability solution combines closely spaced LPRM detectors into "cells" to effectively detect either core-wide or regional modes of reactor instability. These cells are termed OPRM cells and are configured to provide local area coverage with multiple channels.

The OPRM cell signals are analyzed by the Option Ill detection algorithm to determine when a reactor trip is required. CGS will be transitioning from the ABB Option Ill stability solution to the GEH Option Ill stability solution.

The proposed amendment also includes an expanded operating domain resulting from the implementation of ARTS/MELLLA. The APRM flow-biased simulated thermal power scram AV would be revised to permit operation in the MELLLA region. The existing flow-biased RBM would also be replaced by a power-dependent RBM that also requires new AVs. Additionally, the flow-biased APRM STP setdown requirements would be replaced by more direct power- and OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION flow-dependent thermal limits to reduce the need for manual APRM gain adjustments and to provide more direct thermal limits administration during operation at other than rated conditions.

The APRM channels have a Master APRM module and a Slave APRM module, which is also called the LPRM module. Both the Master and the Slave modules receive inputs from the associated LPRM detectors. The input data is filtered to reject high frequency noise and to reduce aliasing effects on sampled data (see Reference 4.4.h, Section 3.1 ). Flow transmitters in each of the recirculation loops provide the loop flow input to the associated APRM channels.

The APRM channel consists of LPRM, APRM, and 2-0ut-of-4 Voters which are all safety-related. Communication with RBM, which is not safety-related, is conducted through Fiber Direct Data Interface (FOOl) (see Reference 4.4.h, Section 4.2.2). The FOOl Module provides electrical and communication isolation of the signals while permitting the data to be transmitted without any appreciable transmission delays. The safety functions performed by each PRNM channel involve the processing of sensor inputs to produce a set of trip votes that must then satisfy 2-0ut-of-4 coincidence voting logic to cause the PRNM relay outputs to the RPS trip system to change state.

The APRM/LPRM subsystem has three main interfaces which are: (i) LPRM detector signal inputs, (ii) recirculation flow system inputs, and (iii) PRNM trip state output. They are described below:

Each LPRM module provides interfaces to a set of LPRM detectors, processes the signal using the embedded software, and exchanges the data with its channel's APRM and both channels of the RBM though two separate FDDI modules (see Reference 4.4.h, Section 5.2.4).

Each APRM module provides interfaces to the LPRM detectors, provides interfaces to each recirculation loop (Loops A and B) flow transmitters, embeds vendor-developed software to process detector signals, performs algorithms to produce a set of trip votes, interfaces with all four 2-0ut-of-4 Voters to provide its trip votes, receives bypass and self-test status information from its channel's 2-0ut-of-4 Voter, and exchanges data with its channel's LPRM and both channels of RBM through two separate FOOl modules. The FOOl module in the APRM communicates with its own RBM channel whereas a separate FOOl module in the LPRM communicates with the other RBM channel (see Reference 4.4.h, Figure 6). Each RBM, RBM A and RBM B, receives input from either the APRM or the RBM module of each channel.

The 2-0ut-of-4 Voters associated with APRM channels 1, 2, 3, and 4 are sometimes referred to as A1, A2, B1, and B2, respectively (see Reference 4.2, Figure E.2.1 ). Each 2-0ut-of-4 Voter receives the operating panel bypass switch status and forwards this status to the other three 2-0ut-of-4 Voters, receives the bypass status from the other three 2-0ut-of-4 Voters, provides bypass and operational status to its channel's APRM, receives trip votes from all four channels of APRM, embeds vendor-developed programmable logic to implement a voting scheme where only one channel may be in bypass, and controls the state of redundant relay outputs to its corresponding subdivision of the RPS trip system based on the voter logic. The two subdivisions of the RPS trip system are typically referred to as trip system A (A 1 and A2) and trip system B (B1 and B2) respectively (see Reference 4.11, Figure 7.2-3).

The "CGS PRNMS Architecture & Theory of Operation Report" shows the interfaces between safety-related and nonsafety-related portions of the PRNMS (see Reference 4.4.h, Figure 6).

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Primary interface communication is between the four safety-related APRM/LPRM modules and the two RBM channels. ((

)) The RBM subsystem, in turn, communicates with the NUMAC Interface Computer (NIC) which is also a nonsafety-related component.

The NIC further provides communication with the cyber security interface computer which is not a part of the PRNM system. The Primary Plant Computer (PPC) is connected to the cyber security interface computer through a data diode which allows one-way communication from cyber security interface computer to the PPC. The PPC provides the gain adjustment data to the cyber security interface computer (through an operator interface) which in turn communicates with NIC. All communication interfaces between the RBM, the NIC, the cyber security interface computer, and the PPC are non-safety related communications. In Section 1. 3 of Enclosure 2 of its application dated January 31, 2012, the licensee stated:

Utilizing guidance from NEI 08-09, Revision 3 ("Cyber Security Plan for Nuclear Power Reactors," dated September 2009) and Regulatory Guide 5.71 ("Cyber Security Programs for Nuclear Facilities," dated January 201 0), pathways and configurations for data transmission will be in compliance with requirements to protect digital communication systems and networks per 10 CFR 73.54.

Modifications to the data transmission pathways will be performed through the new system to be in compliance with regulatory requirements. External calculation processes will also be modified to be in alignment with 10 CFR 73.54 protection requirements. Any systems located on cyber security defensive architecture level 3 or 4 will be protected as recommended by the regulatory guidance discussed above.

Evaluation of the cyber security interface computer is addressed as part of the NRC evaluation and approval of the EN Cyber Security Plan (Amendment No. 222).

A single fiber optic bypass switch assembly will be installed on panel H13-P603 in the "Operator-at-the-Controls zone" within the main control room to select a PRNMS channel for bypass (see Reference 4.1.h, Section 1.4.6). The bypass switch has mutually exclusive positions, thus assuring that only one APRM/OPRM channel is bypassed at a time. ([

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

)) This approach is consistent with the proposed TS operability requirements for three out of four APRM channels; thereby ensuring that no single failure will preclude a scram on a valid signal.

The power supply to the RPS trip system provides a continuous, dependable source of power for the RPS logic. The system supplies power from two independent motor generator (MG) set sources, each capable of sustaining output voltage and frequency on momentary loss of input power (e.g., due to switching). The system is classified as nonessential (Division A and B) since loss of output power due to open, short, or ground causes the reactor to trip. The power system supplying power to the RPS MG set is backed by a diesel generator backed critical power supply motor control center (MCC). The output of the MG sets is connected to redundant RPS power panels. This alternate power supply is available should one of the MG sets fail.

This power source is interlocked such that it can connect with only one of the two RPS power supply panels. The RPS power panels supply power to the RPS trip logic channels.

The CGS PRNMS provides APRM scram functions for the following: 1) Neutron Flux- High, (Setdown) (existing), 2) Fixed Neutron Flux- High (existing), lnop (existing), 3) Simulated Thermal Power- High (changed from Flow-Biased Simulated Thermal Power), 4) 2-out-of-4 Voter (new), and 5) OPRM Upscale (new). The licensee proposed changes to the TS to address the operability and availability of these safety functions based on the proposed PRNM configuration. In general, these changes are consistent with the previously approved LTRs, including the example mark-ups of the TS that are contained in the LTR (see References 4.2 and 4.3, including Appendix H). Section 4.3.2 of this SE identifies the licensee's proposed TS changes and provides the NRC staff's evaluation for the CGS PRNM changes using the previously approved LTRs, and their example TS mark-ups, as applicable to a GE Non-BWR/6 large core plant. Any deviations are explained with justifications.

4.3.2 Proposed Technical Specification Changes The licensee proposed TS changes to reflect the installation of NUMAC PRNMS and to reflect the expanded operating domain resulting from implementation of ARTS and MELLLA (see References 4.1.a, 4.1.b, 4.1.c, 4.1.d, and 4.1.f). The proposed changes for installation of the PRNMS are consistent with NRC-approved NEDC-32410P-A (References 4.2 and 4.3).

Implementation of ARTS/MELLLA involves changing the APRM flow-biased simulated thermal power (STP) AV to permit operation in the MELLLA operating range. In addition, the flow-biased APRM total peaking setdown requirement would be replaced by more direct power-dependent and flow-biased thermal limits administration (see Reference 4.1.a). With the implementation of the PRNM hardware in conjunction with the ARTS improvements, the existing flow-biased rod blocks would be changed to power-dependent rod blocks requiring new AVs.

The new RBM is also based on STP. The licensee does not plan to operate the plant in the MELLLA range when operating in the single-loop operating (SLO) mode, so existing licensed thermal power limits will be used in the SLO mode.

The NRC staff reviewed and evaluated the proposed changes to modify the TSs, LCOs, and SRs for existing PRNMS functions and to add LCOs and SRs for new PRNMS functions based on the proposed PRNMS configuration. Most of the changes would reduce existing surveillance frequencies in accordance with previously approved LTRs (References 4.2 and 4.3).

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION In the LAR, the TS changes were contained in Enclosure 1 and its attachments. The licensee later decided to retain the TSs as is with a note that they are valid prior to implementation and the proposed changes are noted as changes after the implementation. The resulting changes after the implementation (see Reference 4.1 0) are same as they were in the LAR. The licensee described its proposed changes to its TSs as follows (see Reference 4.1 0, Enclosure 4):

1. Specifications 3.2.4 and 3.3.1.3 were initially proposed to be deleted.

Instead of deleting these Specifications, the Applicability of each will be changed to" ... prior to implementation of Power Range Neutron Monitor (PRNM) upgrade." The header of each specification will be updated to include "(Prior to Implementation of PRNM Upgrade)."

2. Since the above two Specifications will not be deleted, the Table of Contents will not be changed.

3. The Definition of Maximum Fraction of Limiting Power Density (MFLPD) was initially proposed to be deleted. Because TS 3.2.4 is not being deleted, this Definition will not be deleted.

4. Specifications 3.3.1.1, 3.3.2.1, 3.4.1, and 3.1 0.8 were initially proposed to be changed to reflect the new analyses and hardware associated with the PRNM and ARTS/MELLLA modification. Instead, two versions of each Specification will be created with different Applicability Statements.

Each existing Specification will be retained with the revised Applicability of" ... prior to implementation of PRNM upgrade."

The header of each specification will be updated to include "(Prior to Implementation of PRNM Upgrade)."

Each revised version of the Specification will include a change to the Applicability to include "after implementation of Power Range Neutron Monitor (PRNM) upgrade." The header of each specification will be updated to include "(After Implementation of PRNM Upgrade)."

4.3.2.1 TS 1.1, Definitions, and TS 3.2.4, Average Power Range Monitor (APRM) Gain and Setpoint TS 1.1, Definitions, and TS 3.2.4, Average Power Range Monitor (APRM) Gain and Setpoint Items 1, 2, and 3, as previously discussed, apply to the changes in TS 3.2.4. Therefore, the existing TS 3.2.4 will be updated to include "(Prior to Implementation of PRNM Upgrade)." After the implementation of ARTS/MELLLA, TS section 3.2.4, which includes requirements for flow-biased APRM simulated thermal power (STP) setdown, would be deleted. The following additional changes would be made to reflect the deletion of TS 3.2.4:

The TS Table of Contents would be revised.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

The definition for Maximum Fraction of Limiting Power Density (MFLPD) would be deleted from TS Section 1.1.

CGS currently operates such that the Maximum Fraction of Limiting Power Density (MFLPD) is less than or equal to the Fraction of Rated Thermal Power (FRTP), which limits the local power peaking at lower core power and flows. If the ratio of the MFLPD to the FRTP is greater than 1, the flow-referenced APRM trips must be lowered (setdown) or the APRM gain must be increased (CGS current TS 3.2.4) to limit the maximum power that the plant can achieve. The basis for this "APRM trip setdown" requirement originated under the original BWR design Hench-Levy minimum critical heat flux ratio (MCHFR) thermal limit criterion and provides conservative restrictions with respect to current fuel thermal limits.

4.3.2.2 TS 3.3.1.1, Reactor Protection System (RPS) Instrumentation The explanation under item 4 of SE Section 4.3.2 applies to the changes in TS 3.3.1.1, and these changes propose two versions of TSs, the current version and the proposed version after the implementation of changes. Therefore, the header of the existing version of TS 3.3.1.1 will be updated to include "(Prior to Implementation of PRNM Upgrade)" and after the implementation of changes, the header of the revised version of TS 3.3.1.1 will be updated to include "(After Implementation of PRNM Upgrade)."

To support implementation of the digital PRNMS, the following TS changes are proposed:

4.3.2.2.1 Changes toTS APRM Functions The existing APRM subsystem uses four safety-related functions, which provide input to the RPS. These functions are identified in TS Table 3.3.1.1-1, "Reactor Protection System Instrumentation," and are listed in the following table.

TS APRM Function Name TS APRM Function Designation Neutron Flux- High, Setdown 2.a Flow Biased Simulated Thermal Power- High 2.b Fixed Neutron Flux- High 2.c lnop 2.d Proposed changes to these functions are consistent with the NUMAC PRNM LTR and include the following:

Function 2.a, "Neutron Flux- High, Setdown" scram is retained but the name is changed to "Neutron Flux- High (Setdown)." This is a format change only.

Function 2.b, "Flow Biased Simulated Thermal Power- High" scram is retained but the name is changed to "Simulated Thermal Power- High." This change has been reviewed and approved as part of Section 3.2.5 of the LTR (Reference 4.2).

Function 2.c, "Fixed Neutron Flux- High" scram is retained but the name is changed to "Neutron Flux- High." This is a format change only.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

Function 2.d, "lnop" trip is retained but is changed to reflect the new NUMAC PRNMS equipment and to delete the minimum number of LPRM detector count from this trip. The minimum number of LPRM detector count will be retained in the APRM "Trouble" alarm function. This change has been reviewed and approved as part of Section 3.2.1 0 of the LTR (Reference 4.2).

A new Function 2.e is proposed, and is entitled "2-0ut-of-4 Voter." This new function is added to the TS to facilitate minimum operable channel definition and associated actions. This function has been added because all 4 voter channels are required to be operable for this new addition to the logic. Each of the four APRM channels provides signals to the 2-0ut-of-4 logic cards for APRM and OPRM trips. This change has been reviewed and approved as part of Section 5.3.3.17 of the LTR (Reference 4.2).

A new Function 2.f is proposed, and is titled as "OPRM Upscale." This OPRM trip function is added to the TS under APRM Functions. This function is relocated from LCO 3.3.1.3 to this section of the TS (LCO 3.3.1.1 ). This change is classified as "OPRM related RPS Trip Functions" per Section 8.4 of Supplement 1 to the LTR (see Reference 4.3). This change has been reviewed and approved as part of Section 8.4.2.2 of Supplement 1 to the LTR (see Reference 4.3).

4.3.2.2.2 Changes to LCO 3.3.1.1 Actions

In the Actions for LCO 3.3.1.1, CGS proposes to add a note before Required Action A.2 and Condition B. This note indicates that neither Required Action A.2 nor Condition B apply to new and existing APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f. This change is consistent with the NUMAC PRNM LTR (see References 4.2 and 4.3, Section H.1.1).

New Conditions "I" and "J" are added to support the incorporation of new APRM Function 2.f, "OPRM Upscale." This change is consistent with the NUMAC PRNM LTR. There are some differences in the licensing approach for the proposed incorporation of the OPRM function into the PRNMS from the existing OPRM LCO. The licensee provided justification for these differences (see Reference 4.1.g, Sections 1.5.3 and 1.5.4). These changes are described in the following paragraphs.

Proposed Required Action 1.1 is consistent with the approved LTR (see Reference 4.3, Section H.1.1 ). However, proposed Required Action 1.2 of LCO 3.3.1.1, requires restoration of required OPRM channels to OPERABLE status with a Completion Time of 120 days, is modified by a note that states "LCO 3.0.4 is not applicable." An exception to LCO 3.0.4 was not included within the NUMAC PRNM LTR, but has been approved in the NRC'S SEdated March 21, 2005, for activating the OPRM Upscale function at Peach Bottom Atomic Power Station, Units 2 and 3 (Reference 4.30).

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION The licensee for Peach Bottom Atomic Power Station, Units 2 and 3, requested similar changes including the exception (see Reference 4.30, Section 4.2.1 ). For this change, the NRC's March 21, 2005, SE notes, in part, that The exception allows the licensee to restart the plant in the event of a shutdown during the 120-day completion time for REQUIRED ACTION 1.2, consistent with the original intent of NEDC-32410P-A, which was to allow normal plant operations to continue during the recovery time from a hypothesized design problem with the Option Ill algorithms.

The same rationale applies to CGS; therefore, this change is acceptable to the NRC staff.

Without this clarification, CGS will not be able to enter back in Mode 1 or 2 after a trip per LCO 3.0.4. This clarification allows CGS to continue plant operation while OPRM operability is being resolved within the 120-day window.

The note for Required Action J.1 is changed from ":::;[25)% RTP" to "less than the value specified in the COLR." This change from LTR Supplement 1 (see Reference 4.3, Section H.1.1) is acceptable, because the 25 percent value is a nominal value whereas the value in the COLR is a plant cycle-specific value. A sample of COLR pages was provided for information (see Reference 4.1.e). (Note RTP stands for rated thermal power.)

4.3.2.2.3 Changes to Surveillance Requirements (SRs)

The following changes proposed to the SRs in LCO 3.3.1.1 are consistent with the LTR, with any differences noted:

4.3.2.2.3.1 Channel Check Surveillance Requirements

The new APRM Function 2.e, "2-0ut-of-4 Voter," will have a Channel Check frequency of every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

A Channel Check requirement for APRM Function 2.f, "OPRM Upscale," at a frequency of every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months will be included. The existing OPRM System has no Channel Check requirement.

The proposed Channel Check frequency of every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is consistent with the approved LTR (see References 4.2 and 4.3, Section H.1.1 ). Therefore, the preceding SRs are acceptable.

4.3.2.2.3.2 Channel Functional Test Surveillance Requirements

APRM Function 2.a, "Neutron Flux- High (Setdown)"

The requirement will be changed from a frequency of every 7 days to every 184 days (6 months). This change is functionally implemented by applying new SR 3.3.1.1.16 versus the old SR 3.3.1.1.3.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

APRM Function 2.b, "Simulated Thermal Power- High" The requirement will be changed from a frequency of every 92 days to every 184 days (6 months). The Channel Functional Test includes the recirculation flow input processing, excluding the flow transmitters. This change is functionally implemented by applying new SR 3.3.1.1.16 versus the old SR 3.3.1.1.8.

APRM Function 2.c, "Neutron Flux- High" The requirement will be changed from a frequency of every 92 days to every 184 days (6 months). This change is functionally implemented by applying new SR 3.3.1.1.16 versus the old SR 3.3.1.1.8.

APRM Function 2.d, "lnop" The requirement will be changed from a frequency of every 92 days to every 184 days (6 months). This change is functionally implemented by applying new SR 3.3.1.1.16 versus the old SR 3.3.1.1.8.

Proposed APRM Function 2.e, "2-0ut-of-4 Voter

The requirement for a frequency of every 184 days (6 months) is included, which is the same frequency as used for the APRM and OPRM functions supported by the Voter. This change is functionally implemented by applying new SR 3.3.1.1.16.

Proposed APRM Function 2.f, "OPRM Upscale" The OPRM Upscale will have a Channel Functional Test requirement with a frequency of every 184 days (6 months), which is the same frequency as used for the existing OPRM System. The Channel Functional Test for the OPRM Upscale includes the recirculation flow input processing function, excluding the flow transmitters. This change is functionally implemented by applying new SR 3.3.1.1.16.

The proposed Channel Test frequency of every 184 days is consistent with the frequency in the approved LTR (see Reference 4.2, Section 8.3.4.2.2, and Reference 4.3, Page H-10 for OPRM only). Therefore, a frequency of 184 days is acceptable. In addition, for the APRM Simulated Thermal Power-High (Setdown) channel functional test, the flow input is included but the flow transmitters are excluded (see Reference 4.2, Section 8.3.4.2.2). Testing of the flow transmitters is, however, included in the proposed "OPRM Upscale" in the channel calibration surveillance requirements (see Reference 4.1.b, Section 2.2.3.3). The above changes meet the guidance of the LTR and are acceptable.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION 4.3.2.2.3.3 Channel Calibration Surveillance Requirements

APRM Function 2.a, "Neutron Flux- High (Setdown)"

The Channel Calibration frequency will be changed from every 184 days to every 24 months. This change is functionally implemented by deleting SR 3.3.1.1.9 and incorporating the Channel Calibration for APRM Function 2 into SR 3.3.1.1.1 0 with its 24-month list. The notes from SR 3.3.1.1.9 were not carried over to SR 3.3.1.1.1 0, because they are already included in SR 3.3.1.1.1 0 (see Reference 4.2, Section 8.3.4.3).

APRM Function 2.b, "Simulated Thermal Power- High" The Channel Calibration frequency will be changed from every 184 days to every 24 months (SR 3.3.1.1.9 replaced with SR 3.3.1.1.1 0 as previously described).

Calibration of the recirculation flow hardware will be included in the overall Channel Calibration of this function every 24 months. The existing requirement to verify the APRM Flow Biased Simulated Thermal Power- High Function time constant as :5 7 seconds (SR 3.3.1.1.11) is being deleted consistent with Section 8.3.4.4.2 of the LTR (see References 4.2 and 4.33).

APRM Function 2.c, "Neutron Flux- High" The Channel Calibration frequency will be changed from every 184 days to every 24 months (SR 3.3.1.1.9 replaced with SR 3.3.1.1.1 0 as previously described).

APRM Function 2.d, "lnop" No change in requirement (i.e., no calibration applies). SR 3.3.1.1.7 was removed from the required surveillances for this APRM function, consistent with the approach specified in the NUMAC PRNM LTR. However, SR 3.3.1.1.7 remains applicable to APRM Functions 2.a, 2.b, and 2.c.

Proposed APRM Function 2.f, "OPRM Upscale" The OPRM Upscale trip function will have a Channel Calibration requirement with a frequency of every 24 months, which is the same as the frequency as the existing OPRM System. The channel calibration will include the recirculation flow transmitters that feed the APRMs, which is not specified in the NUMAC PRNM LTR. The OPRM Upscale trip function will have an SR with a frequency of every 24 months to confirm the OPRM auto-enable settings, which is the same as the existing OPRM System. The auto-enable settings will be defined in the COLR (see Reference 4.1.g, Sections 1.5.2 for further discussion).

The above changes have been previously reviewed and approved (Reference 4.2, Section 8.3.4.3 for the APRM-related changes, and Reference 4.3, Section 8.4.4.3.2 for the OPRM upscale changes). Therefore, each is acceptable.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION 4.3.2.2.3.4 Logic System Functional Test (LSFT) Surveillance Requirements

The only portion of the PRNMS that is not directly confirmed by other tests is the actual voting logic through and including the voter output relays. Hence, the logic system functional test (LSFT) SR (SR 3.3.1.1.14) for APRM Functions 2.a, 2.b, 2.c, and 2.d will be deleted. Similarly, the proposed APRM Function 2.f, "OPRM Upscale," does not require an LSFT SR. Therefore, only the proposed APRM Function 2.e, "2-0ut-of-4 Voter," will include an LSFT requirement with a frequency of every 24 months (SR 3.3.1.1.14).

The proposed Channel Test frequency of 24 months is consistent with the frequency in the approved LTR (see References 4.2 and 4.3) and therefore, is acceptable. Further, the licensee has clarified that LSFT requirements for APRM Functions 2.a, 2.b, 2.c, and 2.d will be deleted and only the 2-0ut-of-4 Voter logic will be tested for LSFT (see Reference 4.2, Section 8.3.5.2).

4.3.2.2.3.5 Response Time Testing Surveillance Requirements

The LPRM detectors, APRM channels, OPRM channels, and 2-0ut-of-4 Voter channels digital electronics are exempt from response time testing. The requirement for response time testing of the RPS logic and RPS contactors will be retained by including a response time testing requirement for the new APRM Function 2.e, "2-0ut-of-4 Voter."

The response time testing requirement for existing APRM Function 2.c, "Neutron Flux- High" will be deleted (SR 3.3.1.1.15).

A new response time testing requirement for APRM Function 2.e, "2-0ut-of-4 Voter," will be added. Note 4 is inserted to SR 3.3.1.1.15 to identify for Function 2.e that "n" equals eight channels (four channels for APRM and four for OPRM) and that testing of the APRM and OPRM outputs shall alternate. The NUMAC PRNM LTR provides justification for the frequency of response time testing of the PRNMS.

The above changes have been reviewed and approved in Section 8.3.4.4 of Reference 4.3.

CGS has further clarified that one RPS interface relay will be tested using the APRM output for one cycle and the OPRM output for the next cycle. This will result in testing rate of once per eight operating cycles for all RPS interface relays. The APRM and the OPRM output relays of each channel are connected in series to the coil of the respective RPS trip relay. There are a total of eight RPS interface relays. This is acceptable, because it is equivalent to the response time testing frequency approved in NEDC-3241 OP-A, Supplement 1 (see Reference 4.3, Section 8.3.4.4).

4.3.2.2.4 Changes Involving Table 3.3.1.1-1, Reactor Protection System Instrumentation In addition to the new functions previously discussed, the following changes toTS Table 3.3.1.1-1 are proposed. These changes are consistent with the NUMAC PRNM LTR except where noted. Changes related to ARTS/MELLLA are included.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION 4.3.2.2.4.1 Minimum Number of Operable APRM/OPRM Channels The required minimum number of operable APRM channels will change from two per RPS trip system to three. The applicability is modified by Note (b) as described below.

The required minimum number of operable OPRM channels will change from four channels (specified in current LCO 3.3.1.3) to three channels in new APRM function 2.f, "OPRM Upscale."

Proposed new APRM Function 2.e, "2-0ut-of-4 Voter," will have a requirement that all four Voter channels must be operable (two per RPS trip system).

The above changes have been reviewed and approved in the LTRs (see References 4.2 and 4.3). Note (b), as mentioned above, is addressed in Section 4.3.2.2.4.3 of this SE and is also consistent with References 4.2 and 4.3. Therefore, each is acceptable.

4.3.2.2.4.2 Applicable Modes of Operation, Setpoints, and Allowable Values

New APRM Function 2.e, "2-0ut-of-4 Voter," will be required to be operable in Modes 1 (RUN) and 2 (STARTUP), which is the same as the existing APRM lnop function. APRM Function 2.e in Table 3.3.1.1-1 specifies that the Condition referenced from Required Action 0.1 is G and Condition G requires that the plant be placed in Mode 3 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Application of Condition G is the same as the existing APRM lnop function.

The above changes have been reviewed and approved in References 4.2 and 4.3. Therefore, each is acceptable.

New APRM Function 2.f, "OPRM Upscale," proposes that the applicable mode of Operation be "THERMAL POWER greater than or equal to value specified in the COLR." This is a change from LCO 3.3.1.3 which specifies that the OPRM Instrumentation shall be operable when "THERMAL POWER~ 25% RTP."

The licensee states that this change is based on the CGS current licensing basis, because CGS uses thermal power limits based on the cycle-specific COLR analysis (see Reference 4.1, , Page 8). In addition, Note (g) in Table 3.3.1.1-1 states, "OPRM Upscale does not have an Allowable Value. The Period Based Detection Algorithm (PBDA) trip setpoints are specified in COLR." Similar changes were approved for Monticello plant (see Reference 4.12, Section 3.2.13). This action is also in accordance with Section 8.4.6 of the approved LTR (see Reference 4.2) and is, therefore, acceptable.

The applicable Modes of operation for the remainder of the APRM functions will be unchanged from the existing design.

The proposed changes related to ARTS/MELLLA will alter the AV for Function 2.b, "Simulated Thermal Power- High," for dual-loop operations to:

~ 0.63W + 64.0% RTP and~ 114.9% RTP.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION This change will necessitate that a note be added for this AV to define a different value to be applied for SLO, because in the current TS, the value for the SLO is the same as for the value for the dual-loop operation in the existing OPRM system. Note (c) will be added to define the single-loop AV as:

5 0.63W + 60.8% RTP and :5 114.9% RTP.

The Extended Load Line Limit Analysis (ELLLA) power/flow upper boundary is being modified to include the operating region bounded by the rod line which passes through the 100 percent of CL TP I 80.7 percent of the rated core flow point, the RTP line, and the rated load line. The power/flow region above the current ELLLA boundary is referred as MELLLA region. The licensee states that MELLLA expansion of the power/flow map provides improved operational flexibility by allowing operation at RTP with less than rated core flow (see Reference 4.1.n, Section 1). This operational improvement is consistent with prior NRC-approved operating domain improvements for other BWRs.

Existing OPRM's ELLLA operating domain and power/flow map, the APRM Flow-Biased STP scram line AV is defined as 0.58 Wd + 62 percent of the RTP for both the two-loop operation (TLO) and SLO. The APRM Flow-Biased STP Scram clamp AVis at 114.9 percent of RTP. Wd is defined as the recirculation drive flow for TLO in percent of rated flow. The APRM Flow-Biased STP rod block AVis currently set at 0.58 Wd +53 percent for both TLO and SLO.

Currently, CGS does not have an APRM Flow-Biased STP Rod Block clamp. A Rod Block clamp AV of 111 percent will be implemented for ARTS/MELLLA (see Reference 4.1.n, Section 1.2.2).

To accommodate this expanded operating domain and to restore the original margin between the MELLLA boundary line and the APRM Flow-Biased STP rod block line, the following AVs are redefined:

APRM Flow-biased STP High Scram for Flow-biased Equation AV changes for TLO:

From "0.58 Wd + 62%" to "0.63*Wd + 64.0%."

AV for SLO:

From "0.58Wd + 62%" to "0.63*Wd + 60.8%."

Flow-Biased Clamp: There is no change from the current value of 114.9 percent for either TLO or SLO.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION APRM Flow-biased STP Rod Block for Flow-biased Equation AV changes for TLO:

From "0.58Wd +53%" to "0.63*Wd + 60.1 %."

AV for SLO:

From "0.58Wd +53%" to "0.63*Wd + 56.9%."

Flow-Biased Clamp for both TLO and SLO will be 111 %.

In the preceding equations, Wd is the recirculation loop drive flow and b.W is the difference in percent flow between the TLO and SLO loop drive flow at the same core flow. For TLO, b.W is 0 percent, and for SLO, b.W is 5 percent.

The above changes are plant-specific based on the implementation of MELLLA (see Reference 4.4.c, Sections 1.1 through 1.6).

The staffs review and approval of MELLLA is provided in SE Section 3.0 above. In addition, there is no change to the current APRM STP scram clamp value and the current APRM STP rod block clamp value. The STP scram and rod block clamps are the same as they were before the implementation of MELLLA. Therefore, the above changes are acceptable to the NRC staff.

4.3.2.2.4.3 Table 3.3.1.1-1 Notes The licensee proposed surveillance notes to add the requirement to address operability of the subject functions in the TSs as discussed in TSTF 493, Revision 4, Option A. The following notes are added to Table 3.3.1.1-1, and are applicable to APRM Functions 2.a, 2.b, 2.c, 2.d, and 2.f:

(b) Each APRM/OPRM channel provides inputs to both trip systems.

This note is consistent with References 4.2 and 4.3 and, therefore, is acceptable.

(c) ~ 0.63W + 60.8% RTP and~ 114.9% RTP when reset for single loop operation per LCO 3.4.1, "Recirculation Loops Operating."

As described in Section 4.3.2.4.2 above, note (c) is being added to define the SLO AV for APRM Function 2.b, which is different from the dual-loop operation value with the implementation of ARTS/MELLLA.

This note clarifies that SLO will be limited to the current ELLLA limits and that operation in the MELLLA region will not be used for SLO. Because there is no effective change to the current limits, this note is acceptable.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION (d) If the as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

This note is consistent with the guidance of TSTF-493, Option A (see Reference 4.13) and is reviewed above in SE Section 2.0.

(e) The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the Limiting Trip Setpoint (LTSP) at the completion of the surveillance; otherwise, the channel shall be declared inoperable. Setpoints more conservative than the LTSP are acceptable provided the as-found and as-left tolerances apply to the actual setpoint implemented in the surveillance procedures (Nominal Trip Setpoint) to confirm channel performance. The LTSP and the methodologies used to determine the as-found and as-left tolerances are specified in the Licensee Controlled Specifications.

Notes (d) and (e) are applicable to APRM Functions 2.a, 2.b, 2.c, and 2.f. These notes are not specified in the NUMAC PRNM LTR. These notes address the annotation of footnotes as described in TSTF-493 (see Reference 4.13) for the functions affected by this proposed change.

This note is consistent with the proposed inclusion into the CGS TS of applicable portions of the guidance of TSTF-493, Option A, as reviewed above in SE Section 2.0.

(f) THERMAL POWER greater than or equal to the value specified in the COLR.

This plant-specific parameter, the value of which is cycle-specific, is included in the COLR. This is consistent with the current CGS TS and is acceptable, as discussed earlier in this SE.

(g) The OPRM Upscale does not have an Allowable Value. The Period Based Detection Algorithm (PBDA) trip setpoints are specified in the COLR.

The NUMAC PRNM LTR Section 8.4.6.1 requires that the PBDA setpoints be identified in the appropriate document and does not provide for them in the sample TS markups. The current LCO 3.3.1.3 requires documentation of the PBDA setpoints in the COLR. Acceptability of this change is discussed under SE Section 4.3.2.4.2.

Note (g) is consistent with of the approved LTR (see Reference 4.2, Section 8.4.6 and Reference 4.3, Table 3.3.1.1-1) and is, therefore, acceptable.

4.3.2.3 TS 3.3.1.3, Oscillation Power Range Monitor (OPRM) Instrumentation Items 1, 2, and 3, as described in SE Section 4.3.2 (listed just prior to the detailed listing of TS changes), applies to the changes in TS 3.3.1.3. As stated earlier, the existing TS 3.3.1.3 Applicability will be updated to include "(Prior to Implementation of PRNM Upgrade)." After the implementation of the PRNM modification, TS 3.3.1.3 will not be applicable.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION LCO 3.3.1.3 is deleted and the trip function is added to LCO 3.3.1.1 as APRM Function 2.f, "OPRM Upscale," to remain consistent with the OPRM implementation in the NUMAC PRNM LTR. The specific changes involved with the relocation of LCO 3.3.1.3 elements to LCO 3.3.1.1 are evaluated in the following paragraphs.

4.3.2.3.1 OPRM LCO 3.3.1.3 Conditions and Required Actions The Completion Time for LCO 3.3.1.3 Condition A has been changed from 30 days to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , consistent with the NUMAC PRNM LTR, and is relocated to LCO 3.3.1.1 Condition A. The associated Required Actions of LCO 3.3.1.1 Condition A will be applied to APRM Function 2.f, "OPRM Upscale," which is same as applied to the current APRM Functions 2.a, 2.b, 2.c, and 2.d. Required Actions A.2 and A.3 for LCO 3.3.1.3 are deleted.

The current LCO 3.3.1.3 Conditions B and C will be replaced with LCO 3.3.1.1 Conditions I and J. These conditions apply when LCO 3.3.1.1 Condition A or Condition C (and associated follow-through Condition D) Required Actions and associated Completion Times are not met.

Required Action 8.1 of LCO 3.3.1.3 is relocated to Required Action 1.1 of LCO 3.3.1.1 and retains the allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to initiate alternate methods of detecting and suppressing instabilities.

A new requirement is proposed with Required Action 1.2 of LCO 3.3.1.1 to allow a Completion Time of 120 days to restore the OPRM operability. This action is consistent with the NUMAC PRNM LTR. There is no equivalent requirement in CGS's current LCO 3.3.1.3. This Required Action is modified by a Note that states that "LCO 3.0.4 is not applicable," which is not specifically addressed in the NUMAC PRNM LTR. The justification for this change has been explained earlier in this SE.

Condition C of LCO 3.3.1.3 is relocated to Condition J of LCO 3.3.1.1 and retains the allowed Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to reduce thermal power to less than the value specified in the COLR. Condition J applies if the Completion Times for Required Actions 1.1 or 1.2 are not met.

The current Required Action for Condition C of LCO 3.3.1.3 is a reduction to less than 25 percent RTP. In contrast, the proposed Required Action relocates the specific percent RTP value to the COLR. Use of the COLR is in accordance with the current CGS licensing basis, because the percent RTP value is cycle-specific.

LCO 3.3.1.3 currently states, Four channels of the OPRM instrumentation shall be OPERABLE within the limits as specified in the COLR.

LCO 3.3.1.1 requires that if one or more channels are inoperable, then the channel is to be placed in the trip mode within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Per the approved LTRs (see References 4.2 and 4.3) only three out of four channels are required to be operable. Therefore, the applicability of LCO 3.3.1.3 is now moved to LCO 3.3.1.1. This change meets the guidance of LTR (see References 4.2 and 4.3) and is acceptable. Changes related to the relocation of Conditions B and C of LCO 3.3.1.3 to be with Conditions I and J of LCO 3.3.1.1, along with the other two paragraphs are acceptable based on the discussions under SE Section 4.3.2.2.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION The current CGS TS 3.3.1.3 was established to support the implementation of the existing OPRM Stability Option Ill system. With the implementation of the NUMAC PRNM with OPRM, the Option Ill stability solution is digitally integrated within the APRM functions in LCO 3.3.1.1 and corresponding TS Bases, so that TS 3.3.1.3 is no longer needed. Specification 3.3.1.3, along with the associated TS Bases, is proposed for deletion. The appropriate actions are now included in TS 3.3.1.1 in accordance with the approved LTRs (see References 4.2 and 4.3).

Therefore, it is acceptable to delete TS 3.3.1.3 following the implementation of the NUMAC PRNM with OPRM incorporated as part of the PRNMS channel functional test.

4.3.2.3.2 OPRM Surveillance Requirements Many of the OPRM SRs were relocated to LCO 3.3.1.1 as discussed above. SRs that are currently located in LCO 3.3.1.3 but were not previously discussed include the following:

SR 3.3.1.3.2 is deleted. The calibration of the LPRMs is redundant with required SR 3.3.1.1. 7, which is not changing with this LAR.

SR 3.3.1.3.6 to verify the RPS RESPONSE TIME is within limits is deleted.

SR 3.3.1.3.5 is relocated to SR 3.3.1.1.17. Specific values of THERMAL POWER and rated core flow are proposed for relocation to the COLR.

Regardless, relocation of specific values to the COLR has already been discussed within this SE.

The above changes are consistent with LTRs (see References 4.2 and 4.3) and are, therefore, acceptable.

4.3.2.4 TS 3.3.2.1, Control Rod Block Instrumentation Item 4, as described in SE Section 4.3.2 (listed just prior to detailed listing of TS changes},

applies to the changes in TS 3.3.2.1 and it proposes two versions of TSs, the current version and the post-change version. Therefore, the header of the existing version of TS 3.3.2.1 will be updated to include "(Prior to Implementation of PRNM Upgrade)" and the header of the revised version of TS 3.3.2.1 after implementation of PRNMS will be updated to include "(After Implementation of PRNM Upgrade)."

4.3.2.4.1 Surveillance Changes to RBM The following changes are proposed for surveillances affecting the RBM function, and are consistent with the NUMAC PRNM LTR:

The frequency for performing the Channel Functional Test for SR 3.3.2.1.1 is being changed from every 92 days to every 184 days.

The frequency for verifying that the RBM is not bypassed for SR 3.3.2.1.4 is being changed from every 92 days to every 24 months.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

The frequency for performing the Channel Calibration for SR 3.3.2.1.5 is being changed from every 92 days to every 24 months.

These changes and their acceptability have been discussed earlier in this SE (see Section 4.3.2.2.3.2), meet the guidance of the LTR (see References 4.2 and 4.3) and are, therefore, acceptable.

4.3.2.4.2 Changes Related to Implementation of ARTS/MELLLA 4.3.2.4.2.1 Preventing Bypass of RBM Power Range- Upscale Functions SR 3.3.2.1.4 would be revised to require verification that the ARTS-based power-dependent RBM Power Range- Upscale Functions are not bypassed at the appropriate power levels. This change is consistent with improved Standard Technical Specifications, NUREG-1433, Revision 3, "Standard Technical Specifications General Electric Plants, BWR/4," dated March 2004" (see Reference 4.15). Additionally, the change is acceptable per the LTRs (see References 4.2 and 4.3).

Regarding changes to SR 3.3.2.1.4, an insert (Insert E) was added to state the verification requirements for the low, intermediate, and high-power ranges (see Reference 4.1.b). The RTP value for each range is slightly different than the values in the LTRs and NUREG-1433. The allowable values and the nominal trip setpoints for CGS are established based on the COLR

cycle-specific analysis and are therefore slightly different from the values established in the LTRs and NUREG-1433. Therefore, this difference, which is based on the COLR cycle-specific analysis, is acceptable.

4.3.2.4.2.2 Control Rod Block Instrumentation Changes Table 3.3.2.1-1, "Control Rod Block Instrumentation," would be revised as follows:

The current Rod Block Monitor (RBM) Functions 1.a, "Upscale," and 1.c, "Downscale" would be deleted.

New power-dependent RBM Functions 1.a, "Low Power Range- Upscale," 1.b, "Intermediate Power Range- Upscale," and 1.c, "High Power Range- Upscale," would be added in lieu of the current Function 1.a. Appropriate requirements for the Applicable Modes or Other Specified Conditions, Required Channels, Surveillance Requirements, and Allowable Value columns of the table are shown in Table 3.3.2.1-1 for these new functions (see Reference 4.1.b). As explained above, the STP values for these functions are slightly different than those shown in the LTRs (see References 4.2 and 4.3) due to use of COLR-based values.

Deletion of Function 1.c, "Downscale" from Table 3.3.2.1-1 was not addressed in the LTRs (see References 4.2 and 4.3). CGS has provided the rationale that the inclusion of the Downscale Function in addition to the lnop Function had some merit for an analog RBM, because the analog equipment had some failure modes that could result in a reduction of signal, but not a full failure. However, the NUMAC digital RBM will replace the original analog RBM equipment, and all of the original analog processing will be replaced by digital processing. There are no normal operating conditions that are intended to be detected by the RBM Downscale Function. In OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION addition, no credit is taken for the RBM Downscale Function in the establishment of the RBM upscale trip setpoints or AVs for CGS. Finally, a very similar change was approved by NRC on February 27, 2008, for Nine Mile Point Nuclear Station, Unit 2 (see Reference 4.14). Based on the above discussion, this change is acceptable.

The current RBM Function 1.b, "lnop," would be re-designated Function 1.d. This is only a change in the sub-number of the function and is editorial in nature. Therefore, this change has no safety significance and is acceptable.

The current note (a) would be deleted.

New notes (a) through (c) would be added. These notes identify the Applicable Modes or Other Specified Conditions for the new RBM Functions 1.a through 1.c. No peripheral control rod selected was part of the original note and is contained in the new notes (a), (b), and (c).

The current notes (b) and (c) would be re-designated (g) and (h), respectively.

The applicability of SR 3.3.2.1.4 would be deleted for re-designated Function 1.d. This is consistent with the LTRs and the equivalent requirement has been addressed in notes (a), (b),

and (c).

The following new notes would be added:

(d) If the as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

(e) The instrument channel setpoint shall be reset to a value that is within the as-left tolerance around the Limiting Trip Setpoint (L TSP) at the completion of the surveillance; otherwise, the channel shall be declared inoperable. Setpoints more conservative than the LTSP are acceptable provided that the as-found and as-left tolerances apply to the actual setpoint implemented in the surveillance procedures (Nominal Trip Setpoint) to confirm channel performance. The LTSP and the methodologies used to determine the as-found and as-left tolerances are specified in the Licensee Controlled Specifications.

Notes (d) and (e) are applicable to new Functions 1.a, 1.b, and 1.c and are not specified in the NUMAC PRNM LTR. These notes address the annotation of footnotes as described in TSTF-493, Option A (see Reference 4.13) for the functions affected by this proposed change.

This change is consistent with the propos~d inclusion of TSTF-493 in the CGS TS.

A new note (f) would be added, which would state:

Allowable Value Specified in the COLR.

Note (f) would specify that the AVs for RBM Functions 1.a, 1.b, and 1.c are identified in the COLR which provides the cycle-specific values for RBM.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION 4.3.3 PRNMS Interfaces Including Digital Instrumentation Communications Paragraph 10 CFR 50.55a(h}, "Protection and safety systems," approved the 1991 version of Institute for Electrical and Electronics Engineers (IEEE) Standard 603, "IEEE Standard Criteria for Safety Systems for Nuclear Power Generating Stations," for incorporation by reference including the correction sheet dated January 30, 1995. IEEE 603-1991 Clause 5.6, "Independence," requires independence between (1) redundant portions of a safety system, (2) safety systems and the effects of design basis events, and (3) safety systems and other systems. SRP Chapter 7, Appendix 7.1-C, Section 5.6, "Independence," provides acceptance criteria for this requirement, and among other guidance, provides additional acceptance criteria for communications independence. Section 5.6 states that where data communication exists between different portions of a safety system, the analysis should confirm that a logical or software malfunction in one portion cannot affect the safety functions of the redundant portions.

It also states that if a digital computer system used in a safety system is connected to a digital computer system used in a nonsafety system, a logical or software malfunction of the non safety system must not be able to affect the functions of the safety system.

IEEE 7-4.3.2-2003, endorsed by Regulatory Guide 1.152, "Criteria for Use of Computers in Safety Systems of Nuclear Power Plants," Clause 5.6, "Independence," provided guidance on how IEEE 603 requirements can be met by digital systems. This clause of IEEE 7-4.3.2 states that, in addition to the requirements of IEEE Standard 603-1991, data communication between safety channels or between safety and nonsafety systems shall not inhibit the performance of the safety function. SRP Chapter 7, Appendix 7.1-D, Section 5.6, "Independence," provides acceptance criteria for independence. This section includes a restatement from 10 CFR 50, Appendix A, GDC 24, "Separation of protection and control systems," that, The protection system shall be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system, and that interconnection of the protection and control systems shall be limited so as to assure that safety is not significantly impaired.

Additional guidance on interdivisional communications is contained in "Interim Staff Guidance, Digital Instrumentation and Controls (DI&C), DI&C-ISG-04, Task Working Group #4, Highly-Integrated Control Rooms Communications Issues (HICRc}," Revision 1, dated March 6, 2009.

The transmittal letters approving the LTR in 1995 (see Reference 4.2) and its supplement in 1997 (see Reference 4.3) states:

Should NRC criteria or regulations change so as to invalidate the conclusions concerning the acceptability of the report, GE or the applicants referencing the topical report will be expected to revise or resubmit their respective documentation, or submit justification for the continued effective applicability of the topical report without revision of their respective documentation.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Since these prior reviews and approval of the LTRs (see References 4.2 and 4.3), further NRC staff guidance has been made available that provides evaluation criteria applicable to safety-to-nonsafety interfaces of DI&C to include interchannel communication. Guidance applicable to safety-to-nonsafety interfaces is provided in (1) Regulatory Guide 1. 75, "Criteria for Independence of Electrical Safety Systems," (2) Branch Technical Position (BTP) 7-11, "Guidance on Application and Qualification of Isolation Devices," and (3) DI&C-ISG-04, "Task Working Group #4: Highly-Integrated Control Rooms-Communications Issues (HICRc)." This set of guidance applies to the proposed change, because the CGS PRNMS is digital instrumentation that performs safety functions and includes safety-to-nonsafety interfaces and interchannel communications. While physical and electrical independence via separation and isolation devices were previously evaluated (see Reference 4.2, Sections 3.5 and 3.6) and remain valid, the PRNMS interfaces were not previously evaluated against the data independence criteria for interchannel communications in DI&C-ISG-04.

The base LTR and its supplement contain information on the interfaces associated with a non-BWR/6 large core plant. The CGS configuration is similar to the configuration shown in Figure E.1.5 in Volume 2 of NEDC-3141 OP-A. A more detailed configuration of CGS is shown in Figure 6 PRNM System-Level Architecture (see Reference 4.4.h).

The GEH NUMAC PRNMS configuration has the following types of communications:

Safety channel to safety channel communication: This type of communication includes communication between each of the four APRM modules and all four of the 2-0ut-of-4 Voter logic modules, safety channel to safety channel communication between all four of the 2-0ut-of-4 Voter logic modules, and safety channel to safety channel communication between the four 2-0ut-of-4 Voter logic modules and the Bypass Switch (Optical).

Between safety and nonsafety systems: Safety system to nonsafety system communication exists between each of the four APRM and LPRM safety modules and the two nonsafety RBM modules.

Nonsafety to nonsafety communications: Nonsafety to nonsafety communication occurs between the two RBM modules and the NIC, and between NIC and the CGS 'primary plant computer (PPC) through a secure link.

4.3.3.1 lntrachannel Communications Between Safety Components DI&C-ISG-04 does not directly address interfaces between safety-related components within a channel; nevertheless, the following two items provide the NRC staffs evaluation of two PRNMS interfaces within a PRNMS channel: (1) 2-0ut-of-4 Voter to APRM and (2) Interfaces to Support Maintenance and Monitoring, to determine whether the intrachannel communications depends upon data external to the channel in such a way that could adversely affect reliable performance of the safety functions within the otherwise independent PRNMS channels.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION (1) 2-0ut-of-4 Voter to APRM DI&C-ISG-04 "Interdivisional Communications" Staff Position 1.8 states that "Data exchanged between redundant safety divisions should be processed in a manner that does not adversely affect the safety function of the sending divisions, the receiving divisions, or any other independent divisions." DI&C-ISG-04 "Interdivisional Communications" Staff Position 1.11 states, in part, that "The progress of a safety function processor through its instruction sequence should not be affected by a message from outside its division." The "NUMAC PRNM Requirement Specification" identifies both the 2-0ut-of-4 Voter and APRM as safety-related (see Reference 4.1.h, Specification 24A5221, Section 4.2.1.1), and each contains safety function processing.

The NRC staff evaluated the 2-0ut-of-4 Voter to APRM safety-to-safety interface to determine whether the data associated with interchannel communications between 2-0ut-of-4 Voters could be propagated to each APRM channel by the 2-0ut-of-4 Voter to APRM communications in a way that could reasonably have an adverse effect on the APRM safety functions. Both the 2-0ut-of-4 Voter and APRM have been qualified as safety-related Class 1E equipment. ((

)) In this way, the processing of data communications does not affect the timing or complicate performance of the safety functions.

((

))

and this interface is also shown on Figure 2, 2-0ut-of-4 Logic Module Interfaces, in Reference 4.1.k. The data provided by this communication path is not used by the APRM safety functions, and the licensee described compliance to DI&C-ISG-04 for this interface (see Reference 4.1.k). In its response to DI&C-ISG-04 "Interdivisional Communications" Staff Position 1.2, the licensee stated that the APRM does not receive data from any other safety channel. Therefore, the communications from the 2-0ut-of-4 Voter to APRM does not include data from another safety channel that could influence the APRM safety functions.

In its response to DI&C-ISG-04 "Interdivisional Communications" Staff Position 1.8, the licensee stated that communications between safety divisions is validated by the receiving destination.

As such, the NRC staff determined that the receiving interface of each safety-related Class 1E 2-0ut-of-4 Voter that shares its channel with the APRM is responsible to ensure interchannel communications between 2-0ut-of-4 Voters cannot propagate errors to the APRM channel. The communications between 2-0ut-of-4 Voters is evaluated in Section 3.3.2, Item 1.

Based on the determination that the 2-0ut-of-4 Voter to APRM communications utilizes the methods previously reviewed and approved for the LTR (see Reference 4.2), does not include data from another safety division, and contains data that cannot adversely affect the safety function as further supported by the evaluation in Section 3.3.2, Item 1, the NRC staff determined that the 2-0ut-of-4 Voter to APRM interface does not compromise the OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION independence between safety channels such that operability of interconnected channels would be adversely affected.

(2) Interfaces to Support Maintenance and Monitoring As referenced by DI&C-ISG-04 "Multidivisional Control and Display Stations" Staff Position 3.1, DI&C-ISG-04 "Interdivisional Communications" also governs communications between a safety division and shared maintenance and monitoring equipment to ensure that performance of maintenance and monitoring does not present the potential to simultaneously adversely affect the safety functions in more than one redundant and independent channel.

The licensee confirmed that the PRNMS does not have a common operator maintenance workstation to control or monitor multiple PRNMS channels (see Reference 4.1.k). Divisional separation is maintained in the PRNM and all displays including displays on the control room monitoring displays are divisional.

Each PRNMS channel has built-in local front panels to perform maintenance and monitoring activities. These built-in maintenance and monitoring features are included within the APRM and LPRM and are part of the front panel of the APRM chassis which is developed and qualified as part of the safety-related Class 1E equipment in accordance with the "NUMAC PRNM Requirement Specification" (see Reference 4.1.h). These maintenance and monitoring features include local front panels, switches and software maintenance modes. The licensee also confirmed that the PRNMS safety functions cannot be modified in the field using maintenance equipment; and instead, all programmable devices are controlled as hardware configuration items by the original equipment manufacturer.

((

))

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION The number of APRM channels that can be simultaneously bypassed is restricted to one channel by the Technical Specification and the PRNMS 2-0ut-of-4 Voter logic design. By specification and design, the PRNMS requires maintenance activities to first place the instrument into bypass, use of the keylock switch and password (both administratively controlled), and additional operator confirmatory actions via the local front panel display and keypad input.

((

)) Thus the probability of entering a wrong gain factors is significantly reduced. Should wrong gain factors get entered inadvertently, then this situation is covered under diversity and defense-in-depth as described in Section 3.4 of this document.

The licensee's approach does not include any common operator workstation to control or monitor multiple PRNMS channels and only includes hardwired control and indicating devices in the operator bench board. Therefore, the NRC staff determined that Section 3 of DI&C-ISG-04 does not apply to the PRNMS. The NRC staff determined the design features of the proprietary protocol assure the active communications associated with nonsafety equipment external to the PRNMS do not impact the APRM's ability to perform its safety functions. Thus, the NRC staff determined that these communications do not compromise the independence of the safety channels or adversely affect the operability of the safety functions.

4.3.3.2 Interchannel Communications Between PRNMS Safety Components DI&C-ISG-04 states that digital instrumentation communication interfaces between independent safety channels should meet the same criteria as established for communication interfaces between nonsafety and safety equipment. The following two numbered items provide the NRC staff's evaluation of two PRNMS interfaces for a PRNMS channel, (1) 2-0ut-of-4 Voter to 2-0ut-of-4 Voters and (2) APRM to 2-0ut-of-4 Voters, against the DI&C-ISG-04 Staff Position "1. Interdivisional Communications."

(1) 2-0ut-of-4 Voter to 2-0ut-of-4 Voters In DI&C-ISG-04, the NRC staff acknowledged the need to share trip signals from otherwise independent channels to perform a voting function; however, this does not directly address the licensee's approach to share bypass switch status information among voter channels. The proposed approach shares bypass signals between voters to allow the programmed voter logic to determine whether multiple channels are in bypass, and if so to take conservative actions.

These actions include alarm annunciation and removal of all channels from bypass, as performed within each 2-0ut-of-4 Voter's programmable logic. The voter logic will change from 2-0ut-of-4 to 2-0ut-of-3 by eliminating the bypassed channel from the voting when one-and-only-one channel is bypassed. The "NUMAC PRNM Requirement Specification" identifies the 2-0ut-of-4 Voter as safety-related (see Reference 4.1.h, Appendix A, Specification 24A5221 ).

A block diagram identifies the interface from each 2-0ut-of-4 Voter to all other 2-0ut-of-4 Voters (see Reference 4.1.k, Figures 4 and 6). ((

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

))

The NRC staff reviewed licensee responses that pertain to this interface to ensure that this interchannel communications satisfies the criterion established under DI&C-ISG-04 Staff Position "1. Interdivisional Communications" (see Reference 4.1.k, Sections 3.1, 3.2, 3.5, and 3.8). This review confirmed that this signal is not the type of digital data communications that DI&C-ISG-04 Staff Position "1. Interdivisional Communications" was created to specifically consider; therefore, this review confirmed that the licensee's approach satisfies the applicable criterion of DI&C-ISG-04 for signal isolation and independence. The approach, as described, satisfies the basis that was previously reviewed and approved in the LTR (see Reference 4.2),

and its functionality is tested during formal PRNMS verification and validation (V&V) activities.

((

)) In this way, the processing of data communications does not affect the timing or complicate performance of the voting logic.

Failure of the interface only results in no channels in bypass or multiple channels in bypass, and both of these failure modes will result in conservative action by enabling safety function trip signals.

Based on the NRC staff's review of the 2-0ut-of-4 Voter to 2-0ut-of-4 Voter communications, the NRC staff determined that these interdivisional communications do not compromise the independence of the safety channels or adversely affect the operability of the safety functions.

(2) APRM to 2-0ut-of-4 Voters In DI&C-ISG-04, the NRC staff acknowledged the need to share trip signals from otherwise independent channels to perform a voting function; nevertheless, the design of these interdivisional communications should not compromise the independence of the safety channels or adversely affect the operability of the safety functions. As stated earlier, the "NUMAC PRNM Requirement Specification" identifies both the APRM and 2-0ut-of-4 Voter as safety-related, and each contains a safety function processor.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Block diagrams identify the interface from each APRM to all 2-0ut-of-4 Voters (see Reference 4.4.h, Figure 6 and Reference 4.2, Figure 1.5). ((

)) In this way, the processing of data communications does not affect the timing or performance of the safety functions.

The NRC staff reviewed the licensee responses that pertain to this interface in the D&IC-ISG-04 compliance matrix (see Reference 4.4.h) to ensure that this interchannel communications satisfies the criterion established under DI&C-ISG-04 Staff Position "1. Interdivisional Communications." This review confirmed that the licensee approach satisfies the applicable criterion of DI&C-ISG-04. The approach, as described, satisfies the basis that was previously reviewed and approved in the LTR (see Reference 4.2), and its functionality is tested during formal PRNMS V&V activities. ((

))

Based on the NRC staff's review of the APRM to 2-0ut-of-4 Voter communications, the NRC staff determined that these interdivisional communications do not compromise the independence of the safety channels or adversely affect the operability of the safety functions.

4.3.3.3 Interfaces with the Operator Bench Board Other than isolation requirements, DI&C-ISG-04 does not directly address interfaces between safety-related components within a channel and discrete switches or analog indications that may be shared among channels; nevertheless, in the following three numbered items, the NRC staff evaluated the this type of interface to confirm that components shared among PRNMS channels do not adversely affect reliable performance of the safety functions within independent PRNMS channels.

(1) Operator Bench Board Bypass Switch to each 2-0ut-of-4 Voter A single operator bench board bypass switch provides an intermediary signal path to allow each PRNMS channel to independently determine its bypass status. The single bypass switch is designed to return one and only one of the signals provided by the 2-0ut-of-4 Voters to the originating channel when that channel is selected for bypass. The signal that is returned to OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION each 2-0ut-of-4 Voter allows each 2-0ut-of-4 Voter to share its bypass signals with other channels (see discussion in Section 4.3.3.2, item (1 )). As noted earlier, both the multi-channel Bypass Switch and the 2-0ut-of-4 Voter are safety-related.

Block diagrams identify this interface between the bypass switch and each 2-0ut-of-4 Voters (see Reference 4.1.k, Figure 4 and Reference 4.4.h, Figure 6). ((

))

Based on the determination that the bypass switch to 2-0ut-of-4 Voter communication satisfies the basis previously reviewed and approved in the LTR (see Reference 4.2) and does not include data from another safety division, the NRC staff determined that the bypass switch to 2-0ut-of-4 Voter interface does not compromise the independence or isolation between safety channels such that operability of safety functions within multiple channels would be adversely affected.

(2) PRNMS to Operator Displays The PRNMS and its interfaces will be contained in the Main Control Room (MCR) at CGS. The APRM/OPRM bypass switch will also be located in the MCR on panel H13-P603 at the bench board section of the panel. Access to the MCR is controlled by plant procedures.

CGS design for interfaces with the plant varies somewhat from the guidance in the LTR (see Reference 4.2). The existing meters and indicators will be replaced by the Operator Display Assemblies (ODAs) (see Reference 4.1.h, Enclosure 2). The APRM ODAs will reside in the operator console and are separate and different from the NUMAC APRM/LPRM front panel display and keyboard which are located in each APRM/LPRM chassis. The operator displays are digital and they use two ODAs for APRM/LPRM functions and two ODAs for RBM functions.

Each of the APRM/LPRM ODAs display signals from the two channels that are in the same electrical division (i.e., one ODA unit displays channels 1 and 3 while the second ODA unit displays channels 2 and 4). The two RBM ODAs display signals from each of the two RBM channels (RBM A and RBM B) (see Reference 4.4.h, Figure 15).

The APRM ODAs are designed to provide various signals from LPRM regarding the status of the plant for use by the operator. The ODAs can display status but are not capable of sending commands to the associated APRM instrument. Fiber optic isolation is provided to the ODAs (see Reference 4.4.h, Figure 29).

((

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

)) This assures isolation of data transmission for the ODA interfaces.

Based on the NRC staff's review of the PRNMS configuration, the NRC staff determined that the provisions of DI&C-ISG-04 for independence and isolation for the ODAs are met, because ODAs have one-way isolated inputs for display within the same electrical division and cannot provide a control command to the APRM/LPRM instrument of the two associated channels.

(3) 2-0ut-of-4 Voter to RPS Trip System

((

11 The NRC staff reviewed the licensee proposal for the 2-0ut-of-4 Voter to RPS Trip System interface and confirmed that the approach satisfies the basis that was previously reviewed and approved in the LTR (see Reference 4.2). Furthermore, the NRC staff confirmed that the provisions of DI&C-ISG-04 do not apply.

Based on the determination that the 2-0ut-of-4 Voter to RPS Trip System interface continues to satisfy the basis that was previously reviewed and approved, the NRC staff determined that this interface does not compromise the independence of the safety channels or adversely affect the operability of the safety functions.

4.3.3.4 Interchannel Communications between PRNMS Safety Components and PRNMS Nonsafety Components DI&C-ISG-04 establishes criteria for bidirectional communication interfaces between a safety division and nonsafety equipment to ensure that these communications do not adversely affect the operability of the safety functions. The following two numbered items provide the NRC staff's evaluation of two types of PRNMS interfaces with the nonsafety RBM subsystem, (1) APRM and LPRM to RBM and (2) RBM to APRM and LPRM, against the DI&C-ISG-04 Staff Position "1. Interdivisional Communications."

(1) APRM to RBM and LPRM to RBM The communication from the RBM to the APRM and the LPRM are nonsafety to safety digital communication interfaces. The "NUMAC PRNM Requirement Specification" identifies the RBM as nonsafety (see References 1. h, Specification 24A5221, Section 4. 2. 1.1. 1). The RBM is classified as nonsafety because it does not perform safety functions. However, all RBM hardware is qualified as safety-related but the RBM software is not safety-related (see Reference 4.1.k). The RBM racks are separate from the APRM equipment. There are two RBM chassis and each chassis communicates with two APRM channels and two LPRM channels. ((

)) RBM chassis A communicates with APRM1, LPRM2, APRM3, and LPRM4.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Similarly RBM chassis 8 communicates with LPRM1, APRM2, LPRM3, and APRM4. The safety-related communication isolation modules (FOOl modules) for each APRM and LPRM channel are located within the APRM/LPRM subsystem (see Reference 4.4.h, Figure 6). The communication isolation modules meet the guidance set forth in OI&C-ISG-04 for interchannel and safety to nonsafety communication. ((

))

The licensee provided a block diagram that identifies these interfaces (see Reference 4.4.h, Figure 22) and addressed conformance with OI&C-ISG-04 Staff Position "1. Interdivisional Communications" (see Reference 4.4.h). ((

))

The NRC staff reviewed the licensee response that described conformance of APRM and LPRM to RBM safety-to-nonsafety interfaces against the applicable evaluation criteria of OI&C-ISG-04 Staff Position "1. Interdivisional Communications" (see References 4.6 and 4.h).

The NRC staff review confirmed that the licensee's communication approach uses a ((

)) and that this approach continues to satisfy the basis that was previously reviewed and approved in the LTR (see Reference 4.2).

Based on conformance with OI&C-ISG-04 Staff Position "1. Interdivisional Communications" and confirmation of adherence to the previously reviewed and approved basis, the NRC staff determined the APRM and LPRM to RBM safety-to-nonsafety interfaces do not compromise the independence of the safety channels or adversely affect the operability of the safety functions.

Operational history for other PRNMS systems provides additional assurance, because the history demonstrates continued operability of similar safety functions in instrumentation that use the same data communication architecture that was previously reviewed and approved by the NRC (NEOC-3241 OP-A Volume 1, "Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option Ill Stability Trip Function," October 1995; NEOC-3241 OP-A Volume 2 -Appendices, "Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option Ill Stability Trip Function,"

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION October 1995; and NEDC-3241 OP-A, Supplement 1, "Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option Ill Stability Trip Function," November 1997).

(2) RBM to APRM The communication interface from the RBM to APRM is a nonsafety-to-safety digital communication interface. The "NUMAC PRNM Requirement Specification" identifies the RBM as nonsafety-related. In addition, the RBM software was not subjected to an evaluation against safety-related development standards; nevertheless, the nonsafety RBM hardware has been qualified to safety-related levels.

The licensee provided a block diagram that identifies these interfaces and addressed conformance with DI&C-ISG-04 Staff Position "1. Interdivisional Communications" (see Reference 4.4.h, specifically Figure 6). These interface signals are not associated with the safety function and the signals are coming from RBM, a nonsafety component and going to APRM which is safety-related. The signals transmitted from ((

)) includes provisions to preclude the communication processing activity from adversely affecting performance of the safety functions (see Reference 4.4.h, Figure 6).

DI&C-ISG-04, "Interdivisional Communications" Staff Position 1.2 states that the safety function of each safety channel should be protected from adverse influence from outside the division of which that channel is a member. DI&C-ISG-04 "Interdivisional Communications" Staff OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Position 1.3 states that a safety channel should not receive any communication from outside its own safety division unless that communication supports or enhances the performance of the safety function. However, the licensee identified nonsafety messages to the APRM that originate from outside its safety division when addressing PRNM conformance with the Staff positions (see Reference 4.1.k, Section 3.4 and pages E1-8 to E1-1 0). The licensee identified two messages in addition to the APRM gain factors, which have already been discussed above.

Proprietary licensee responses addressed each of these messages to justify their presence as necessary to the overall simplicity (and thus performance) of the PRNMS design. The licensee's response also described the simple operation and low priority of the messages, and that the presence of these messages does not adversely affect performance of safety functions.

The NRC staff review confirmed that RBM transmits data to APRM and LPRM channels through dedicated FDDI channels which are received by APRM and LPRM dedicated safety-related FDDI channels. ((

)) Therefore, the NRC staff concludes this communication interface meets the guidance of DI&C-ISG-04 Staff Position 1 and continues to meet the basis of previous approvals (see References 4.2 and 4.3).

4.3.3.5 Nonsafety PRNM Interfaces Between RBM Channels and PPC and RMCS (Reactor Manual Control System)

DI&C-ISG-04 establishes criteria for interdivisional communications to ensure these communications do not adversely affect the operability of the safety functions. However, beyond isolation requirements, DI&C-ISG-04 does not establish criteria for bidirectional communications between nonsafety and nonsafety equipment even when the equipment is in different divisions. Therefore, the following subsection provides the NRC staff's evaluation of two bidirectional interfaces between the RBM channels and the (1) PPC and (2) reactor manual control system (RMCS) to ensure these communications do not have an adverse impact on the safety functions performed by the PRNMS equipment.

(1) PPC to RBM The licensee provided block diagrams that identify these interfaces (see Reference 4.4.h, Figure 6). Both channels of the RBM communicate with the PPC through the NUMAC Interface Computer (NIC). The NIC is not a safety-related component and it does not perform any safety-related function. ((

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

))

The design prevents a data storm from NIC to RBM ((

)) Based on these features, the NRC staff determined the nonsafety-to-nonsafety communication between the NIC and PPC will not adversely affect a PRNMS safety function.

(2) RMCS to RBM The licensee provided block diagrams that identify this interface between the RBM and the RMCS (see Reference 4.4.h, Figure 9). This interface is a nonsafety to nonsafety communication. Since both RBM channels communicate with the APRM/LPRM channels the evaluation of this interface is to assess possible adverse impact on any safety function due to this type of data communication. ((

11 There is no RMCS-related data that is communicated from RBM to PRNMS. Isolation of data between the RBM and the APRM/LPRM subsystems are assured by the communication through the FDDI modules located in the APRM/LPRM subsystem as explained earlier.

Therefore, any adverse impact on the PRNMS is prevented. The data from RMCS to RBM is received ((

))

4.3.4 MELLLA Implementation The NUMAC PRNMS is built with the OPRM Option Ill stability function. There is no MELLLA-specific software separate from the PRNMS software. Option Ill supports MELLLA operation, and it is implemented within the APRM functionality and ASP Stability modules.

The licensee noted that there are many factors which restrict the flexibility of a boiling-water reactor (BWR) from low-power/low-flow condition to the high-power/high-flow conditions and even when the rated power is achieved periodic adjustments are needed to compensate for OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION reactivity changes due to xenon effects and fuel burn-up. The following factors presently limit the flexibility of operations at CGS:

the current operating power/flow (P/F) map;

the APRM flow-biased flux scram and flow-biased rod block setdown requirements; and,

the RBM flow-referenced rod block trips.

By implementing the MELLLA option, the current extended load line limit analysis (ELLLA) P/F boundary will be modified and the range of operation will be increased in the MELLLA boundary regions, which exceeds present limitations at CGS. This enhanced P/F map is shown in Figure 1-1 of Reference 4.1.n.

Implementation of the proposed ARTS/MELLLA amendment will result in an expanded operating domain. The APRM flow-biased STP scram AV would be revised to permit operation in the MELLLA region. The current flow-biased RBM would also be replaced by a power-dependent RBM which would also require new AVs. In addition, the flow-biased APRM STP setdown requirements would be replaced by more direct power- and flow-dependent thermal limits to reduce the need for manual APRM gain adjustments and to provide more direct thermal limits administration during operation at other than rated conditions. Operation in the MELLLA region will provide improved power ascension capability by extending plant operation at rated power with less than rated flow. Operation in the MELLLA region can result in the need for fewer control rod manipulations to maintain rated power during the fuel cycle. Replacement of the flow-biased APRM STP setdown requirement with power and flow-based limits on Minimum Critical Power Ratio (MCPR) and Linear Heat Generation Rate (LHGR) will provide more direct protection of thermal limits. Licensee has not taken any credit for either the APRM Flow-Biased STP Scram or the APRM Flow-Biased STP rod block in any of the safety analyses although both are part of the proposed design for CGS. This approach provides conservatism with respect to the protection of public health and safety. Additionally, CGS will not operate in the MELLLA region during SLO.

4.3.5 Diversity and Defense-in-Depth BTP 7-19 and DI&C-ISG-02 provide guidance to address diversity and defense-in-depth (D3).

BTP 7-19 provides guidance to evaluate an applicant/licensee's defense-in-depth assessment and the design of manual controls and displays to ensure conformance with the NRC positions on defense-in-depth. These positions apply to I&C systems that incorporate digital computer-based reactor trip systems. The evaluation must confirm that vulnerabilities to common-cause failures (CCFs) have been adequately addressed. DI&C-ISG-02 provides acceptable methods for implementing D3 in digitaii&C system designs and clarifies the criteria the NRC staff would use to evaluate whether a digital system design satisfies the defense-in-depth guidelines.

Taken together, the guidance in BTP 7-19 and DI&C-ISG-02 establishes evaluation criteria to provide reasonable assurance that CCFs do not defeat either the protection provided by alternative means (i.e., an independent and diverse safety function) or an echelon of defense that provides defense-in-depth.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION The PRNMS safety functions are a portion of the overall reactor protection system (RPS) and are required to be operable in MODES 1 and 2 when reactor power is greater than or equal to 25 percent RTP. Each PRNMS channel is a digital computer-based system that acquires neutron flux data via LPRM detector strings and uses this data to calculate parameters for comparison against APRM, OPRM, and MELLLA setpoint criteria. Each PRNMS channel's voter logic then subjects the comparison results to criterion that requires at least two non-bypassed trips. When the voter logic is satisfied, a 2-0ut-of-4 Voter provides its APRM scram requests to the RPS Trip System.

Each PRNMS channel contains the same safety processor software and voter logic, and this approach remains unchanged from the previously reviewed and approved LTRs. Because a common implementation exists in each of the four PRNMS channels, the LTR discusses the PRNMS approach to 03 to address potential vulnerabilities to CCFs (see Reference 4.2, Section 6.4). ((

)) is not adverse to public health and safety.

The LTR establishes that diversity in the overall plant system, which is beyond the PRNMS scope, will provide the 03 to protect against a CCF of the PRNMS. The LTR reaffirms this approach by presuming CCFs of the PRNMS could occur and concluding that the replacement system may have failure effects which are different from those evaluated in a plant's safety analysis report (SAR) (see Reference 4.2, Appendix G). Licensees that apply the LTRs have the action to confirm that their plant meets the expectation that a CCF is not adverse to public health and safety. This confirmation requires the licensee to demonstrate that the analyzed set of anticipated operational occurrences and events within the plant's design basis remain valid and bounding following the incorporation of the PRNMS and with full consideration for the complete common-mode loss of the entire set of PRNMS safety functions.

The NRC staff reviewed the PRNMS using the guidance provided in BTP 7-19 and DI&C-ISG-02 to establish whether vulnerabilities to CCFs had been adequately addressed by the licensee. BTP 7-19 establishes that the licensee should analyze each postulated CCF coincident with each anticipated operational occurrence (AOO) and postulated accident within the design basis using a best-estimate (i.e., realistic assumptions) approach. The licensee's analysis should demonstrate adequate diversity for each of these events.

The licensee provided documentation to analyze the diversity and defense-in-depth for CGS following implementation of the PRNMS (see Reference 4.1.j). This analysis notes that the existing APRM/OPRM subsystem provides a single-sensor input to the RPS. Therefore, replacing the APRM/OPRM subsystem within the PRNMS does not change or alter the diversity between APRM/OPRM and other plant systems that provide input to the RPS. The licensee stated that other diverse sensors (e.g., reactor pressure, etc.) provide diverse trip inputs to RPS and thereby maintain their diverse trip functions which provide adequate mitigation against the CCF of the APRM/OPRM (see Reference 4.1.j, Section 2). The OPRM uses neutron flux inputs OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION from the LPRMs to determine power oscillations in the core. When power oscillations exceed the setpoint, the PRNMS generates an OPRM upscale signal to trip the reactor.

The NRC-approved LTR (Reference 4.2) provided a common cause software analysis for the PRNMS that includes both APRM and OPRM. The licensee stated that previous conclusions were included in Sections 6.4 and 6.5 of the LTR (see Reference 4.2) and these conclusions are applicable to CGS, because they remain within the CGS design bases. LTR Section 6.4.2 refers to operator actions to prevent severe damage in most cases. Though the criteria for diversity in the LTR does not meet the current regulatory guidance, CGS procedures require immediate operator action to reduce reactor power or increase core flow in order to mitigate possible high growth rate power oscillations following unanticipated core flow reduction events, such as the concurrent loss of both recirculation pumps. The status of recirculation pumps is available to the operators independently from the PRNMS. Flow information is available from the recirculation flow system, and power level information is available from either the electrical power output or a core thermal power calculation. Furthermore, the Recirculation Flow control system, RMCS, and manual scram are unaffected by the CCF. The procedures and independently available plant status information provide additional assurance that CGS would be able to cope with a CCF.

To demonstrate sensor diversity, the licensee provided Table 2-1 (see References 4.1.j) which tabulates the initiating events against scram sensors that provide the needed diversity. This table shows that there is one or more diverse sensor to cause the RPS trip for each initiating event. The licensee provided clarification notes to explain any differences between the LTR and its response. For example, one note states that CGS design does not include scram on Main Steam Isolation Valve (MSIV) high radiation. However, this note goes on to state that it does not affect the diversity conclusion, because there are other diverse sensors that cause the scram for the same event.

Section 6.6 of the PRNM LTR states the licensee must confirm applicability of these conclusions by:

(1) Confirming the events, defined in Electrical Power Research Institute (EPRI)

Report No. NP-2230, "ATWS: A Reappraisal, Part 3: Frequency of Anticipated Transients," January 1982 (see Reference 4.16) or Appendices F and G of NEDC-30851 P-A, "Technical Specification Improvement Analysis for BWR (Boiling Water Reactors) Reactor Protection System," March 1988 (see Reference 4.17), encompass the events that are analyzed for the plant; (2) Confirming the configuration implemented by the plant is within the limits described in the PRNM LTR; and (3) Preparing a plant-specific 10 CFR 50.59 evaluation of the modification per applicable plant procedures.

The licensee provided Table 2-2 (see Reference 4.1.j), which demonstrates that the CGS analysis encompasses the events defined in Appendices F and G of NEDC-30851 P-A.

Table 2-2 lists the events identified in Appendices F and G of Reference 4.1.j and identifies the applicable section in Chapter 15, Accident Analyses, of the CGS FSAR in which the event is OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION discussed. The licensee system configuration down to the block level provided in Reference 4.h shows that the licensee configuration is within the LTR (see Reference 4.2).

The licensee provided an analysis to address the worst-case CCF possibility. In this worst-case scenario either the entire PRNMS or a part of the system could fail. An additional analysis assumption is that the failure is not detectable until the system is stressed by an event or an accident, at which time all PRNM channels will be considered absent or incorrect. As such, the assumption is that the system may provide no advance notice of trouble, fail to provide correct responses to rod blocks and trips during a transient, and may provide misleading indications to the plant operators. This analysis basis meets the current regulatory guidance. The licensee performed an analysis of different and partial failures and determined that the worst-case CCF is the case when the entire PRNMS fails. The licensee further cited the results of the analysis for various failures including failure of two-out-of-four logic modules, partial failure of one APRM channel, or a combination of these two failures. It was determined that the APRM system will either still provide protection or some type of indication to the operator will prompt action to trip the reactor.

As stated previously, the licensee noted that PRNMS replaces a single-sensor input to the RPS and as such it does not alter the plant-level diversity between RPS and other plant systems.

Other plant systems do not utilize the PRNM platform. Therefore, these other plant systems are not subject to the same CCF. As explained earlier, other sensor inputs to the RPS system provide diverse RPS trips which are not affected due to the PRNMS failure.

The purpose of BTP 7-19 is to provide guidance for evaluating an applicant's 03 assessment, design, and the design of manual controls and displays to ensure conformance with the NRC position on 03 for instrumentation and controls systems incorporating digital, software-based or software-logic-based reactor trip system or engineered safety features, auxiliary supporting features, and other auxiliary features as appropriate. The BTP has the objective of confirming that vulnerabilities to CCF have been addressed in accordance with the guidance of the NRC's staff requirements memorandum (SRM) on SECY-93-087 and clarification provided in this staff guidance, specifically:

Verify that adequate diversity has been provided in a design to meet the criteria established by NRC guidance.

Verify that adequate defense-in-depth has been provided in a design to meet the criteria established by NRC guidance.

Verify that the displays and manual controls for (plant) critical safety functions initiated by operator action are diverse from digital systems used in the automatic portion of the protection systems.

The BTP establishes a method acceptable to the NRC staff for meeting, in part, the regulatory requirements of 10 CFR 50.55a(h) and 10 CFR Part 50, Appendix A, GOCs 21, 22, and 24.

The licensee provided analysis demonstrating how the PRNMS meets BTP 7-19 for 03 to further support the conclusion of adequate diversity in case of a total failure of PRNM due to CCF (see in Reference 4.1.j, Section 3). BTP 7-19 provides nine criteria for acceptance. The OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION licensee provided responses to each of these criteria and the results are summarized as part of this analysis.

Criteria 1 and 2 state that when applying realistic assumptions for each AOO and for each design-basis accident (DBA), the plant response should neither exceed the applicable radiation release criteria nor violate the containment integrity. The response should maintain the integrity of the primary coolant pressure boundary through identification of sufficient diversity that addresses any vulnerabilities and documents any necessary actions to overcome those vulnerabilities. In response to these two requirements, the licensee provided an evaluation of each AOO and DBA per Chapter 15.1 of the FSAR (see Reference 4.1.j, Table 4-1 ). This table includes credited alternate trips and evaluation/discussion to address any specific comments or applicability. In general an alternate trip means is available or no specific action is required (e.g.

on loss of feedwater flow heating no specific action is required because the analysis does not take any credit for a PRNMS response). Rod Withdrawal Error (RWE) at power would result in an unblocked rod withdrawal error event and the radiological consequences for this event are bounded by the radiological consequences of the control rod drop accident (CRDA). The CRDA event is more severe than the RWE event, because RWE rod movement under RWE conditions is slower than for a CRDA event, where the analysis already precludes fuel damage. The licensee provided BWR best-estimate calculations to demonstrate the RWE is bounded by the CRDA within its diversity analysis (see Reference 4.18). Figures 4-1, 4-2, and 4-3 in Reference 4.1.j also address the same issue. Therefore, the RWE event analysis fulfills BTP 7-19 criteria 1 and 2. The licensee provided similar satisfactorily analysis for every other AOO or DBA from FSAR Chapter 15 to adequately address Criteria 1 and 2.

BTP 7-19 acceptance Criterion 3 states that an analysis should be done to address any common element or signal source shared by a control system and reactor trip system (RTS) when a CCF can be postulated that creates a condition requiring a reactor trip while simultaneously impairing the ability to trip. To address Criterion 3, the licensee explained that PRNMS is not used for plant automatic control except for providing the rod block signal. The rod block function is not credited as a safety function. Therefore, this type of CCF is not applicable to CGS's LAR, and BTP 7-19 Criterion 3 is satisfied.

BTP 7-19 acceptance Criterion 4 requests an analysis to address any common element or signal source shared by a control system and engineered safety features actuation system (ESFAS) when a CCF can be postulated that creates a condition that requires an engineered safety feature (ESF) actuation while simultaneously impairing the ESF. To address Criterion 4, the licensee explained that PRNMS is not used for plant automatic control and cannot cause a plant condition that requires an ESF actuation. Furthermore, neither the existing CGS system nor the replacement PRNMS perform ESF functions or interface with the ESFAS. Therefore, this type of CCF is not applicable to CGS's LAR, and BTP 7-19 Criterion 4 is satisfied.

BTP 7-19 acceptance Criterion 5 states that no failure in a monitoring and display systems should influence the functioning of the RTS or the ESFAS, and if a failure in the monitoring and display systems should result in operating the plant outside the safety limits or in violation of a LCO then the analysis must show that such operator-induced transients will be compensated by protection system function. In case of CGS, the PRNMS does not rely on receiving any input from the monitoring and display echelon (one of the four echelons of defense cited in BTP 7-19). Therefore, a failure or display in the monitoring or display system will not propagate OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION to the PRNMS. Should a failure in the monitoring and display system result in operator-induced transients, the automatic protective functions of PRNMS are available for compensation.

Therefore, CGS design meets BTP 7-19 Criterion 5.

BTP 7-19 acceptance Criterion 6 states that means should be available to manually initiate automatic RTS and ESF functions, and these manual means should involve a minimum number of manual manipulations. If the manual means are independent and diverse from the safety-related automatically initiated RTS and ESFAS functions, then the design meets the system level actuation criteria in Criterion 6 of BTP 7-19. For CGS, the present automatic initiation of RTS and ESFAS are maintained and means of independent manual actuation are available for RTS as well as ESFAS. Therefore, CGS design meets BTP 7-19 Criterion 6.

The licensee noted that the PRNMS is not credited for any response to anticipated transients without scram (ATWS) events for light water-cooled nuclear power plants per 10 CFR 50.62 (see Reference 4.1.f, Table 4-1 ). Based on this information, the criteria of NUREG-0800, Section 7.8, Diverse Instrumentation and Control Systems, do not apply to this CGS LAR.

BTP 7-19 acceptance Criteria 7, 8, and 9 states that an evaluation should be done of the methods for accomplishing the independent and diverse means for actuating the protective safety function when the D3 analysis reveals the potential for a CCF. The NUMAC platform is not used in RTS except for the PRNMS, and is not present in the ESFAS. The RTS and ESFAS systems are not affected by the design of the PRNMS and these systems are not vulnerable to PRNMS CCF. Therefore, CGS design meets the BTP 7-19 acceptance Criteria 7, 8, and 9.

Because the OPRM function is incorporated into the PRNMS, the OPRM function was evaluated for the vulnerabilities due to CCFs with special consideration that the OPRM function is not addressed in the AOO or DBE analyses per Table 4-1 (see Reference 4.1.j). As explained earlier, this table includes only AOO and DBA events. The LTR (see Reference 4.2, Section 6.4) addresses CCF defense-in-depth and in Section 6.4.2 it addresses CCF for OPRM.

((

)) Normally, the PRNMS displays oscillations in power when it is available.

However, the growth or potential growth of unacceptably high power oscillations must still be prevented whenever this display functionality fails. When this display functionality fails, CGS procedures require immediate action to reduce reactor power or increase core flow in order to mitigate potential oscillations and their growths, which may occur following unanticipated core flow reduction events including the trip of two recirculation pumps. Available systems that are independent of the PRNMS will continue to provide plant status to the operator. These independent indications include pump status, calculated core thermal power or power output, and flow information. The flow control system, the rod manual control system, and manual scrams will remain available to the operator. Based on the independent information that is available, the plant operators can take defensive steps and cope with these transients.

Therefore, for the total loss of APRM and OPRM functions, credit is taken for other indications independent of the PRNMS that support manual actions where these manual actions can be taken by means independent of the PRNMS. The licensee provided a defense-in-depth OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION analysis in further support of BTP 7-19. This analysis addresses the four echelons of defense (see Reference 4.1.j, Section 5). Each echelon of defense is addressed separately as follows:

(1) The Control System echelon, which is usually comprised of nonsafety equipment, is used for normal plant operation to routinely prevent unsafe operation of the nuclear power plant. CGS fits this definition. The PRNMS is a part of this echelon, because it provides inputs to the RMCS. As explained under BTP 7-19, acceptance Criterion 3, the PRNMS is not used for automatic control of plant operations except to provide rod block signals. Therefore, no postulated CCF that prevents a rod block signal, can, in and of itself, create a plant response that requires a reactor trip.

(2) The Reactor Trip System echelon, which consists of safety equipment, is designed to reduce reactivity rapidly in response to an uncontrolled excursion by tripping the reactor so that no radioactive release occurs. The CGS safety equipment collectively referred to as the RPS fits this definition. The PRNMS is one part of this echelon. Therefore, the PRNMS upgrade does not affect other equipment or other actuation systems.

(3) The Engineered Safety Features Actuation System (ESFAS) echelon, which consists of safety equipment, removes heat and assists in maintaining the integrity of the three physical barriers to radioactive release. The CGS ESFAS fits this definition. The PRNMS is independent of this echelon, because it does not interface with ESFAS.

(4) The Monitoring and Indications echelon consists of sensors, displays, data communication systems, and independent manual controls that are relied upon by the operators to respond to operating events. Failure of this echelon should not affect the RTS or ESFAS echelons. The PRNMS provides input to the Monitoring and Indications echelon, but does not receive any input from it.

Therefore, a failure of any monitoring and indication system cannot affect any automatic PRNMS function.

As described in the summary provided for each echelon of defense, the NRC staff evaluation determined that the four echelons of defense have been maintained in accordance with the guidance of BTP 7-19, because a CCF in one of the echelons does not compromise a required safety function of another echelon.

When describing the PRNM system defense-in-depth, the LTR states, in part, ((

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

)) In its operating experience over many years and in many plants, PRNMS has not exhibited a CCF that led to total PRNMS failure.

Based on the guidance of DI&C-ISG-02 and BTP 7-19, the licensee provided an analysis to support the acceptance criteria of BTP 7-19 including the independence of the four echelons of defense. The NRC staff reviewed this analysis and determined that the CGS PRNMS modification satisfies the acceptance criteria governing sufficient diversity and defense-in-depth.

4.3.6 Setpoint Methodology and Calculations The regulations in 10 CFR 50.36(c)(1 )(ii)(A) define the LSSS. Regulatory Guide (RG) 1.1 05, Revision 3, "Setpoints for Safety related Instrumentation," describes a method acceptable to the NRC staff for complying with the NRC's regulations to ensure that setpoints for safety-related instrumentation are initially within and remain within the TS limits. The RG endorses Part I of ISA-S67.04-1994, "Setpoints for Nuclear Safety Related Instrumentation," subject to NRC staff clarifications. Part I defines a framework for ensuring that setpoints for nuclear safety-related instrumentation are established and maintained within specified limits. The RG does not address or endorse Part II of ISA-S67.04-1994, "Methodologies for the Determination of Setpoints for the Nuclear Safety related Instrumentation." Part II of the standard provides recommended practices and guidance for implementing Part I.

RG 1. 105 establishes acceptance criteria that there is a 95 percent probability that the constructed limits contain 95 percent of the population of interest for the surveillance interval selected. BTP 7-12 provides guidance for NRC staff reviewers for evaluating the process an applicant or a licensee follows to establish and maintain instrument setpoints.

To support an evaluation of digital instrumentation, licensees identify digital elements (hardware and software) where error could be introduced into the measurement. These elements are related to the overall instrument channel accuracy and typically defined in accordance with Instrument Society of America (ISA)-S67.04-1994, Part I. The NRC staff's setpoint review is performed in conjunction with NRC Regulatory Issue Summary (RIS) 2006-17, "NRC Staff Position on the Requirements of 10 CFR 50.36, Technical Specifications, Regarding Limiting Safety System Settings During Periodic Testing and Calibration of Instrument Channels," dated August 24, 2006 (ADAMS Accession No. ML051810077). In part, RIS 2006-17 highlights the importance of assuring setpoints and their tolerances do not mask equipment inoperability.

TSTF-493 provides additional guidance to assure identification of instrument degradation as soon as possible using as-left and as-found values. TSTF-493, Option A further provides guidance to include suitable TS notes regarding the as-found and as-left values.

The LAR included a summary description of the setpoint methodology, and a summary of the methodology but did not include a representative calculation for the NRC staff review (see Reference 4.1.h, Section 9.3.8, and References 4.c and 4.d), so the NRC staff requested the licensee to provide a representative calculation used to establish the limiting trip setpoint (LTSP) and the nominal trip setpoint (NTSP) and the acceptable as-found and as-left values for the PRNMS setpoints for NRC staff review. The licensee response proposed that the NRC audit the calculations in lieu of submitting the calculation. In a follow-up telephone clarification call, OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION the licensee explained that the data in support of the calculations were contained in large data bases, so it would be difficult to provide the data for the licensee and it would take more NRC time and resources to review the calculations, if submitted. The NRC staff agreed to audit the calculations. Licensee response to RAI 18 (see Reference 4.6) provides further details of the methodology including the explanation of calculation of AFT and AL T and how the calculations assure with high probability 95 percent that the setpoint used will not exceed the analytical limit (AL) and with almost an equally high probability (( ]) that the AV will not be exceeded. These high probability values are intended to avoid licensee events reports (LERs).

The licensee's responses address OPRM setpoints differently from the other PRNMS setpoints for APRM functions. For the APRM setpoints, the licensee stated that its method is based on, but not identical to, ISA Method 2 of ISA Recommended Practice RP67.04.02, "Methodologies for the Determination of Setpoints for Nuclear Safety Related Instrumentation," in a way that leads to more conservative setpoints. NEDC-31336P-A, "General Electric Instrument Setpoint Methodology," September 1996, documents this methodology along with the NRC staff's SE. In contrast, for the OPRM setpoints, the licensee stated that the setpoints are considered as nominal values and their selection is based on a comprehensive Boiling Water Reactor Owners' Group (BWROG) methodology for stability analysis which was approved by the NRC (see Reference 4.19). There is no AL or AV with defined instrumentation margins to the NTSP for these OPRM setpoints. Additionally, OPRM setpoints are not considered to be limiting safety system setpoints (LSSSs), because power oscillations are treated as a special event and not as an AOO, which define LSSSs. The "OPRM Upscale" setpoint is based on cycle-specific reload stability analysis and will be included in the Core Operating Limits Report (COLR) pursuant to TS 5.6.3. The documented approach for the "OPRM Upscale" setpoint is consistent with the TSs reviewed in Section 4.3.2.2.

For the APRM setpoints, the licensee stated that the setpoint method uses single-sided distributions in the development of setpoint AVs and NTSPs, because each of these PRNMS trips are generated by a setpoint that is approached from only one direction. The licensee stated that the setpoint methodology applies vendor instrument error specifications conservatively to provide setpoints that meet margin requirements to a high degree of confidence. The licensee confirmed that all setpoints are reset to the NTSP within the AL T after calibration (see Reference 4.1.h, and Reference 4.6, RAI 18). The licensee provided further clarification to ensure that the AFT will be verified prior to performing any calibration activity.

The licensee also identified the method by which the ALT is ensured following calibration.

For the calculation of ALT and AFT, the licensee used the guidance of TSTF-493, Option A (see Reference 4.13), consistent with the licensee's proposed addition of surveillance notes in accordance with Option A of TSTF-493, Revision 4, to address instrumentation limiting condition for operation issues that could occur during periodic testing and calibration of instrumentation, as discussed in SE Section 1.3 above. TSTF-493 requires that ALT may be less than or equal to the Square Root Sum of Squares (SRSS) of instrument reference accuracy, measurement and test equipment error, and meter reading error. Similarly the AFT may be less than or equal to the SRSS of instrument reference accuracy, measurement and test equipment error, meter reading error, and the drift over the calibration period (see Reference 4.13). The licensee includes both random as well as bias drift when applicable (see Reference 4.1 0). The as-found value is compared to the allowable AFT prior to the calibration procedure. If the difference between the as-found value and the NTSP is found to be within the designated AFT, then the OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION calibration proceeds. If this difference is found to exceed the designated AFT then an evaluation is performed and appropriate actions are taken based on the plant procedures.

These procedures include a comparison of the as-found value to the allowable value to determine whether the equipment remained capable of performing its safety function. In response to an RAI, the licensee made a commitment to ensure that the affected calibration procedure will be reviewed to ensure that the corrective action program is used to track and evaluate when the as-found channel value is outside its predicted AFT for the setpoint (see Reference 4.6, Attachment 5). Further, the licensee stated that after each calibration the instrument will be reset to the final NTSP within the AL T (see Reference 4.1.h, Section 9.3.8).

The licensee uses values corresponding to a 3-sigma error confidence level for some of its inputs to specific setpoint calculations. The NRC staff requested additional information to justify the licensee's use of this higher-than-typical confidence level. The licensee responded that for each random instrument error used by GEH in a setpoint calculation, a sigma number is assigned based on the confidence held in that error being the maximum error. In general, the default number for this error is 2. However, a 3-sigma number is used for a specific error when there is high confidence that the error represents the maximum error. In support of its position, the licensee stated that some vendors test 100 percent of their instruments to confirm that the instrument error is within the specifications. Another example addresses having a higher confidence in calibration tools, because the performance of these tools is repeatedly verified against calibration standards. Similarly, the AL Ts and leave-alone tolerances are considered as 3-sigma, because they represent the maximum deviation permitted by procedures (see Reference 4.6). Based on the specific explanation provided for each case where a 3-sigma number was used for an error term, the NRC staff concludes that the licensee provided adequate justification for the increased confidence level.

The neutron flux-high setpoint remains the same as before but the STP high setpoint AV has changed from :5 0.58W + 62 percent RTP and :5 114.9 percent RTP to :5 0.63W + 64.0 percent RTP and :5 114.9 percent RTP (see Reference 4.1.b) and as explained earlier in Section 4.3.2.2.4.2. Additionally, the licensee will add clarifying notes to the TS where needed.

To support this setpoint calculation, the licensee provided calculations for some of the nonsafety functions. These calculations include, but are not limited to, APRM STP Scram Clamp, APRM STP RB Clamp and Low/Intermediate/High Power Trip Setpoints. The NRC staff reviewed these calculations and found them consistent with the approved GEH methodology.

The NRC staff performed an audit of the related setpoint calculations on April 3, 2013 (see Reference 4.20). This audit reviewed calculations pertaining to Rod Block Monitor High Power Trip Setpoint (HTSP) (see Reference 4.4.c), Rod Block Monitor High Power Setpoint (HPSP)

(see Reference 4.1.n), and APRM STP Scram Clamp and APRM STP RB Clamp (see Reference 4.20). During the audit of the setpoint methodology and calculations, the NRC staff confirmed that the random errors and bias terms were identified and that random terms are combined using the SRSS method while non-conservative bias errors are algebraically summed. The NRC staffs audit also confirmed that surveillance intervals are identified and form the basis for the drift errors that are applied in the calculations. Rounding errors are conservative and the calculations account for any changes in environmental conditions. The first step in GEH methodology is to calculate the limiting trip setpoint (LTSP) based on reducing the total uncertainty (including drift) from the analytical limit and this value is usually labeled as OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION NTSP1. The actual setpoint cannot be less conservative than this value. The actual setpoint is almost always more conservative than this value because it includes LER avoidance margin and setting tolerances. The AVis calculated by reducing all certainties from the analytical limit except drift. Where applicable, GEH setpoint methodology checks for spurious trips and if needed, adjusts the setpoint to prevent spurious trips or alarms.

During the setpoint audit, the NRC staff noted that the RBM setpoint calculation showed that the AL and NTSP included filtered and unfiltered values. GEH explained that NEDC-33507P described that "the effect of applying a filter to the LPRM signals input to the RBM (see Reference 4.1.n, Attachment A). The filter delays the response of the RBM. A lower setpoint is therefore required to support the minimum critical power ratio (MCPR) operating limit specified in the core operating limits report (COLR) to provide the same level of MCPR safety limit protection as the unfiltered setpoint." The licensee's initial response stated that the value (to be used at CGS filtered or unfiltered) will be determined during the plant startup testing. However, the NRC staff requested the licensee to clarify which value, filtered or unfiltered, would be used at CGS. In response to the NRC staff RAI, the licensee stated that implementation of RBM setpoints is based on the use of the unfiltered setpoint value for the low, intermediate, and high trip setpoints, because analysis has concluded that the analytical limit associated with an RWE event will be met when unfiltered setpoints are used (see Reference 4.1 0). The licensee will need to perform a 10 CFR 50.59 evaluation if the setpoints need to be changed from unfiltered to filtered setpoints.

Based on the NRC staff's review of the methodology and calculations to determine the AV, NTSP, AFT, and ALT for each PRNMS setpoint, as documented in the responses to the RAis, the proposed setpoint methodology provides an acceptable method for the CGS PRNMS setpoints. In addition, the application of the methodology to the PRNMS setpoints satisfies the system design basis in accordance with the safety analysis, TSs, and expected maintenance practices. Therefore, the NRC staff determined that the methodology is acceptable for determining PRNMS setpoints that comply with the regulatory requirements of 10 CFR 50.36(c)(1 )(ii)(A).

4.3.7 Response Time Performance The accident analyses of design basis events at nuclear power plants include the determination of how soon protective actions are needed to mitigate those design basis events. The basis for this determination is contained in 10 CFR 50.55a, "Codes and Standards," of 10 CFR, "Domestic Licensing of Production and Utilization Facilities." Section 50.55a(h)(2) requires, in part, that protection systems must meet the requirements set forth in editions or revisions of the Institute of Electrical and Electronics Engineering Standard: 'Criteria for Protection Systems for Nuclear Power Generating Stations,' (IEEE-279) or IEEE Std. 603-1991. This regulation remains applicable with respect to response time performance, because CGS's design basis for safety-related equipment is IEEE Std. 279-1971 Once the total time required for a protective action has been determined, licensees allocate portions of that time to portions of the protective system (e.g., the time required for the sensors response to changes in plant conditions, the time required for sensor processing, the time required for the actuation logic, and the time required for a valve to close or rods to insert, etc.).

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION BTP 7-21 provides "Guidance on Digital Computer Real-Time Performance," and identifies acceptance criteria for timing . BTP 7-21 criteria establishes that an applicant should demonstrate that limiting response times are sufficient to satisfy applicable safety requirements and that digital computer timing is sufficient to satisfy the limiting response times for the system's implementation including hardware, software, and data communication systems. The link between the setpoint analyses and limiting response times should be demonstrated.

As reflected in the discussion of Section 3.5, the safety bases for the NTSPs, AVs, AL Ts, and AFTs of APRM setpoints are not being changed and the safety bases for OPRM setpoints continue to match previously the LTRs (see References 4.2 and 4.3). The LTRs which rely upon a BWROG methodology for stability analysis that was previously reviewed and approved by the NRC (see Reference 4.19).

The LTRs established digital response time specifications for each PRNMS trip function (see References 4.2 and 4.3, Section 3.3.2). The safety-related trip functions for PRNMS are:

APRM Neutron Flux High APRM STP High- Trip APRM Neutron Flux- High (Setdown)

OPRM Instability Detect-and-Suppress Trip For these functions, the PRNMS relay output must transition to the tripped state within a specified time after the average flux level reaches the respective trip setpoint. For the APRM STP (Flow Biased) High, the PRNMS relay output must transition to the tripped state within a specified time after the plant parameters reach the trip setpoint (while excluding the time constant of the STP algorithm from the measurement). Similarly the APRM Neutron Flux - High (Setdown Trip) must function for low-power settings (RTP::; 20 percent) within the specified time once the trip setting is reached in the startup mode (Mode 2). For the OPRM Upscale trip, the PRNMS relay output must transition to the tripped state within specified time after the plant parameters reach a setpoint determined by any of the instability detect-and-suppress algorithms. For trip setpoints that are calculated based on recirculation flow, the time from a change in the process flow value until this value is reflected in the trip setpoint shall not exceed a specified time. These limiting response times for the PRNMS have not changed since they were established and previously reviewed and approved.

The setpoint for the APRM STP High-High trip has changed as part of this LAR. However, the plant safety analysis does not take credit for the APRM STP High trip in any of the design basis events. Therefore, the conclusions of the plant safety analysis cannot be adversely affected.

Reactor coolant recirculation flow signals are also processed by the PRNMS for determining the flow-biased APRM trip set points.

Because the safety bases for the PRNMS safety-related setpoints have not changed and the limiting APRM and OPRM response times associated with these setpoints have not been proposed to be changed, the safety bases values and digital response times have not been reanalyzed as part of this SE. Rather, this I&C SE limits its review to an assessment of the CGS PRNMS performance given its equipment configuration in order to provide reasonable assurance that the applicable safety requirements to suppress power oscillations and prevent fuel design limits from being exceeded will be maintained. The NRC staff documented its OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION determination that the prior NRC staff evaluations in the LTRs remain applicable, because the NRC staff's review of the CGS PRNMS equipment configuration determined that the proposed CGS PRNMS instrument configuration and its descriptions continue to satisfy the basis that was previously evaluated (see Section 4.3.2). In addition, impl~mentation of ARTS/MELLLA is within the PRNMS software does not change the basic system configuration.

The NRC staff's review of response time performance included an evaluation of the PRNMS hardware, software, and data communication architecture for the safety signal path to which the limiting response times apply. To facilitate this review, the licensee provided the "Columbia Generating Station Power Range Neutron Monitoring System Response Time Analysis Report" (see Reference 4.1.i) to demonstrate that the plant-specific system response time requirements applicable to the RPS with the current APRM continue to apply to the response time performance established for its PRNMS modification. The Columbia Generating Station Power Range Neutron Monitoring System Response Time Analysis Report (Reference 4.1.i) meets the criteria of the BTP 7-19 and NRC Staff Positions 1.19 and 1.20 of D&IC-ISG-04. The licensee clarified in this response (see Reference 4.1.i) that only 40 milliseconds of the total 90 milliseconds of response time that is used in the transient analysis for this function is used in the CGS FSAR Chapter 15 Accident Analyses. RPS response time of 90 milliseconds (0.09 seconds) is documented in the Columbia Licensee Controlled Specifications Manual. The design basis for the RPS response time from the opening of a trip sensor contact up to and including opening of the trip actuator contacts is less than 50 milliseconds, which leaves 40 milliseconds for the PRNMS APRM functions (see Reference 4.1.i). The NRC staff evaluated the licensee's responses (see Reference 4.1.i) and determined that response time performance requirements that are established in the LTRs have been maintained. The NRC staff also determined that the specified response time performance requirement for PRNMS was established by the design basis of the current APRM and it has not changed. The NRC staff compared these two response time performance requirements and determined them to be consistent with one another. Therefore, the NRC staff determined that the prior LTR response time performance requirement remains bounding, applicable to the PRNMS modification, and consistent with the plant's safety requirements.

The licensee described the potential impact of data throughput and data error rates on worst-case response time (see Reference 4.1.i). There are two digital communication links associated with the safety function response time: (1) from the LPRM to APRM and (2) from the APRM to 2-0ut-of-4 Voter. The analysis demonstrated that the bandwidth of each communication link is adequate for its respective message transmission protocol. The response in Reference 4.1.i also identified the intervals at which safety-related messages are transmitted from the LPRM to the APRM and from the APRM to the 2-0ut-of-4 Voter. ((

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION 11 The licensee identified the response time requirements for safety functions identified in the LTRs and compared the response time requirements to the calculated response times both with and without the maximum delay associated with data error rates (see Reference 4.1.g, Tables 2.3.1, in comparison to References 4.2 and 4.3, Sections 3.3.2). This analysis demonstrates that the response time requirements will continue to be met in the presence of the established data error rates with margin.

The licensee further addressed conformance to BTP 7-21 by describing the processing delays that contribute to the overall PRNMS response time. The licensee identified the magnitude of response time delays for each individual processing activity and summarized the total delay in comparison to the individual response time requirements. The sum of the individual delays satisfies the overall PRNMS response time requirements. The licensee also provided test data which shows that the error rate during testing was well within the criteria established for the maximum data error rate and the response time delay based on the maximum data error rate is acceptable with margin in all cases (see Reference 4.1.g, Reference 4.4.f, and Reference 4.28, RAI 22). These data confirm that the PRNMS responds as expected and that each safety function response time requirement has been satisfied and will continue to be met.

Based on the specification, analysis, testing, and successful test results for PRNMS response time performance, the NRC staff has determined that the PRNMS meets the CGS response time requirements and that these response time requirements satisfy the CGS PRNMS safety bases.

4.3.8 System and Software Development for the CGS PRNMS This section evaluates the CGS PRNMS and software development life-cycle to assess the consideration for the reuse of components. The CGS PRNMS development emphasized and systematically applied components with applicable operating experience that are based on previously approved LTRs and prior similar PRNMS applications. This evaluation based upon BTP 7-14 applies NRC staff technical judgment in the determination of whether the development processes applied to the CGS PRNMS, along with compensatory measures that were also identified and performed, are considered equivalent methods to those methods currently endorsed in regulatory guidance for system and software development.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION The initial NUMAC PRNMS development completed in the early to mid-1990s, and the acceptability of the system level approach, functionality to be provided, and software development processes, including V&V, was determined using the applicable regulatory evaluation criteria applicable at that time. The approvals of the LTRs and the earlier NRC staff reviews were performed to enable improvements in regulatory efficiency without adversely affecting regulatory effectiveness (see References 4.2 and 4.3). However, the applicable regulatory evaluation criteria have changed since these earlier reviews and approvals, and these changes include criteria against which the PRNMS development processes had not been previously evaluated. As applicable to software-based digital safety systems, a series of regulatory guides (RGs) did not yet exist in 1995, and these include:

RG 1.168, which addresses with software-based system development and independent V&V throughout the development life-cycle;

RG 1.169, which addresses software configuration control;

RG 1.170, which addresses software test documentation;

RG 1.171, which addresses software unit testing;

RG 1.172, which addresses software requirements specifications; and

RG 1.173, which addresses life-cycle process development.

Each of the preceding regulatory guides was originally released in 1997 and only RG 1.168 was subsequently revised in 2004. Also, RG 1.152, which addresses high functional reliability and design requirements for computers used in safety systems of nuclear power plants, has been revised since the earlier reviews and approvals. NUREG-0800 SRP Chapter 7, "Instrumentation and Controls," BTP 7-14, which provides guidance to the NRC staff when performing software reviews for digital computer-based I&C systems that perform safety system functions, directly references each of these regulatory guides. However, BTP 7-14 did not exist before the revision to the SRP in 1997 and was unavailable for consideration during the original LTR reviews.

The following subsections address the software life-cycle and development process aspects of RG 1.152, 1.168, 1.169, 1.170, 1.171, 1.172, and 1.173, as applied within this CGS PRNMS SE.

4.3.8.1 Applicability of Current Regulatory Evaluation Criteria to Changes Per 10 CFR. 50.92(a), in determining whether an amendment to a license will be issued to the applicant, the Commission will be guided by the considerations which govern the issuance of initial licenses to the extent applicable and appropriate. For operating licenses, those considerations include 10 CFR. 50.57(a)(3), which requires findings that there is reasonable assurance (i) that the activities authorized by the operating license can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the regulations in this chapter.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Prior to the current license amendment request, the licensee submitted a LAR in support of implementing APRM/ARTS/MELLLA in 2010. In its letter dated May 11, 2010 (see Reference 4.22}, the licensee requested implementation of PRNM/ARTS/MELLLA for CGS.

During the acceptance review process, the NRC staff identified that the submittal package lacked some of the required information with regard to software development documents. The NRC staff requested the licensee to provide supplemental information to determine the acceptability of the licensee's application. By letter July 30, 2010 (see Reference 4.23), the licensee provided the supplemental information. The NRC staff reviewed the supplemental information and concluded that the information was insufficient to accept the submittal for review. The NRC issued a non-acceptance letter to the licensee dated September 13, 2010 (see Reference 4.24).

Even though the NRC staff review ended after the issuance of the non-acceptance letter, the licensee requested follow-up meetings with NRC staff to clarify what the NRC staff needed in support of the LAR in the revised package for re-submittal for NRC staff review. One such meeting was held with the licensee on January 18, 2011 (see Reference 4.25). During this meeting, the licensee stated that it intended to follow the guidance of RG 1.168 through RG 1.173 in the revised license amendment. The licensee also stated that GEH intends to provide a roadmap of its processes and procedures and corresponding branch technical position guidance sections to show how the BTP 7-14 guidance is met. The NRC staff requested that any clarifications be adequate to assess conformance with BTP 7-14 and other SRP guidance that would be included in the roadmap. The licensee stated that there may be some differences with BTP 7-14. The NRC staff stressed that these differences must be fully evaluated, resolved, and documented to show that the alternative provides equivalent safety assurance to the SRP guidance. One of the variances identified by the licensee was the lack of fully independent verification and validation (IV&V). The NRC staff stated the licensee's program must provide an adequate verification and validation (V&V) effort.

To resolve the issue of IV&V, the licensee proposed a critical review of the software by an independent third party. This review would include preparation of a report identifying any deficiencies and the resolution of the deficiencies. The NRC staff agreed to the licensee's alternative approach which would include independent IV&V activities wherever the third-party assessment determined the licensee's IV&V approach at the time of development of the software did not provide equivalent safety assurance to the current NRC guidance. A subsequent public meeting was held between the NRC staff and the licensee on July 6, 2011 (see Reference 4.26). In this meeting, the licensee re-confirmed the potentiaiiV&V inadequacies and its plan to address them. With regard to the plan to address these inadequacies, the licensee advised the NRC that it had initiated an independent assessment which was being conducted by ProDesCon as the independent third party to perform the critical review. This critical review identified gaps between the IV&V requirements of IEEE Standard 1012-1998, "IEEE Standard for Software Verification and Validation," and the actual testing performed. In this meeting, the licensee did not explicitly identify all the gaps and measures to be taken to compensate for those gaps. However, the licensee stated that it would be creating a few additional documents and performing additional testing to address these gaps.

The NRC staff suggested the licensee describe the additional testing to be conducted to supplement the earlier testing, that was not performed in accordance with IEEE 1012. The NRC staff further requested the licensee provide analysis justifying that its approach with this OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION additional testing provides equivalent safety assurance to the guidance of IV&V contained in IEEE 1012.

The PRNMS development processes leveraged the prior LTRs by systematically evaluating the current CGS-specific system requirements to produce a replacement PRNMS modification that uses components that had been qualified through earlier developments previously reviewed and approved by the NRC staff. This approach maximizes reuse of the previously reviewed PRNMS architecture and components (hardware and software) that are used in other nuclear power plant systems. The components used in digital safety systems are not expected to remain static during the maintenance phase of a product's life-cycle, and the processes used to develop them may also be changed to affect improvements. In accordance with 10 CFR Part 50 Appendix B, all changes must be controlled through an overall quality assurance program, which the licensee maintains. The licensee provided a detailed list of changes to hardware and software to demonstrate sufficient design control measures are in place (see Reference 4.1.k, Tables 1-1 through 1-5).

The LTR was developed and reviewed prior to the issuance of BTP 7-14 and it did not fully meet the guidance of BTP 7-14 and some current regulations. GEH had followed the procedures that existed within their organization to develop the original software. These procedures were reviewed and approved by NRC staff with the LTRs. In addition, the software had been in use for several years (since 1997) in several plants without any major software flaws which providing confidence the software, with whatever minor changes might have been made, was reliable. GEH relies on prior applicable successful operating experience of widely used components, and has tracked all hardware and software changes since the PRNMS was developed and first used on the Hatch project in 1997. The Edwin I. Hatch Nuclear Power Plant PRNMS is identical with the platform described in the LTR (see Reference 4.2). Therefore, the Hatch project PRNMS provided a basis for comparison against the CGS application of the PRNMS. Software platform changes since the Hatch plant have been tracked and the licensee provided these changes to NRC (see Reference 4.1.k). A summary of the changes is described in the following paragraph.

Table 1-5 in Reference 4.1.k, Enclosure 2, identifies changes made to the safety-related generic APRM/OPRM software since the original design up to and including changes made for the CGS PRNM. The PRNMS software resides in programmable read-only memory which is also referred to as firmware in this table. The table lists the files containing revised software and a description of the changes. These changes have been made in accordance with three major NUMAC documents (i) Software Management Plan (SMP), (ii) Software Configuration Management Plan (SCMP), and iii) Software Verification & Validation Plan (SWP). These plans and procedures were previously reviewed and approved by the NRC, as stated in Section 3.2 of the SE report (SER) in NEDC-3241 OP-A. A Project Work Plan (PWP) was also included as the plan primarily addressing project management aspects of the project's execution. ((

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

))

Since the NRC first reviewed and approved the NUMAC software development plans, several changes have been made to these documents. The changes to these documents were made in accordance with GEH procedures and in accordance with the required engineering and quality assurance reviews as committed to the NRC by GEH at the time NEDC-32410P-A when these NUMAC software development plans were first reviewed and approved. There are no fundamental changes to the software life-cycle process that was originally reviewed and approved by the NRC. Table 1-5 summarizes the software (firmware) changes whereas Table 1-6 (see Reference 4.1.k) summarizes the revision history of the NUMAC software plans since they were first reviewed and approved by the NRC. The NRC staff reviewed these changes and found most of the changes were minor in nature or were based on feedback from plant-specific issues to correct or enhance performance. Changes to software plans included changes in SCMP, SMP, and SWP plans. There were only two changes identified in each plan. The changes are minor in nature or reflect changes in terminology. The NRC staff concludes these changes acceptable, because the changes are relatively insignificant and were carried out using the appropriate document control procedures.

The licensee used the guidance of BTP 7-14, as demonstrated in Table 4.4-1 of Reference 4.1.h, which provides a cross reference between the software planning documents in BTP 7-14 and corresponding Applicable GEH Project Documents and Applicable GEH Policies and Procedures. For each document listed in BTP 7-14, the licensee described how the documents listed in Table 4.4-1 (see Reference 4.1.h) meet the guidance of BTP 7-14 in a fairly detailed manner under Section 4.4. As an example, the SMP describes the process to be used for the design, development, and maintenance of NUMAC product software, which is closely aligned with the purpose of a Software Development Plan (SOP) defined by criteria in BTP 7-14.

The PWP defines the project management aspects of the SMP per the guidance of BTP 7-14.

The SMP defines standards, conventions, and design processes applicable to the various phases of the project. The PWP addresses all the elements of project plan and management per the guidance of RG 1.173. In addition, the PWP addresses the software project risk management per clause 5.3.6 of IEEE Std. 7-4.3.2-2003, which was endorsed by RG 1.152.

The PWP identifies the scope and deliverables of the project, critical paths in achieving the schedule, the associated activities to complete the project, project monitoring, and resources needed to execute the plan. The PWP also contains a project risk management plan. The interfaces between the licensee and GEH are also defined to ensure proper oversight by the licensee. The GEH documents that are applicable to the SMP are listed in Table 4.4-1 of Reference 4.1.h. These documents provide adequate information to meet the guidance of BTP 7-14. The licensee provided a similar detailed explanation for other documents required by BTP 7-14. The NRC staff has reviewed these documents and concludes that they meet the guidance of BTP 7-14. However, for the SWP, the licensee has identified a deficiency with regard to the independent software V&V organization, as explained in the following paragraph.

Section 4.4.5 of Reference 4.1.h describes the built-in organizational independence that existed during development and programming of microprocessor software. BTP 7-14 identifies that the SMP should ensure that the quality assurance organization, the software safety organization, and the software V&V organization maintain independence from the development organization.

In particular, the plan should ensure these organizations do not report to the development OFFICIAL USE ONLY - PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION organization, and not be subject to the financial control of the development organization. The deficiency identified below relates to IV&V testing of module test and integration test.

This deficiency was identified while reviewing the compliance of the software V&V plans for meeting the current guidance per BTP 7-14 and IEEE Std. 1012-1998. This standard requires that the V&V should be conducted by a team which is independent of technical, management, and financial teams. The licensee recognized that the desired independence was not fully compliant with IEEE Std. 1012-1998. Per the guidance in IEEE Std. 1012-1998, the IV&V responsibility should be vested in an organization that is separate from the development organization (i.e., the technical team). GEH had followed all the IV&V steps except for full independence of the V&V reviewers. Therefore, the GEH IV&V program followed the guidance for software integrity level 3 for safety-related software testing, whereas the NRC's RG 1.168 endorsement of IEEE Std. 1012-1998 requires following the guidance of software integrity level4 for these activities. The licensee identified the specific activities that were not compliant and offered to take compensatory measures. These measures were later implemented and they are described in the Software V&V process and IEEE 1012-1998 Requirements section (see Section 4.4.8 of Reference 4.1.h). Based on the NRC staff's determination that actions taken by GEH were appropriate to address the deficiency and achieved acceptable results, the NRC staff concludes that the licensee's approach achieved an equivalent level of safety assurance.

In addition to the procedures and processes described above, the licensee and GEH implemented additional steps in accordance with 10 CFR 50, Appendix B requirements for independent design verification, technical reviews, quality assurance, and other engineering activities for microprocessor software development. A combination of these activities, along with baseline reviews, and technical design reviews provides assurance that the design has adequate quality, safety, reliability, and performance except for the deficiency described above.

Regardless of the identified deficiency, GEH had carried out several steps in the V&V cycle that provided limited independence in V&V activities due to its organizational limitations. For example, design verifications (even though by an individual within the same organization), were performed by a responsible verifier. These activities include some technical independence measures, such as requiring the responsible verifier to not have a role in specifying or establishing the design approach, design details, design inputs (including ruling out any specific design).

A baseline review is conducted for deliverable of each life-cycle baseline. The baseline reviews by GEH have been established to provide formal set of standards and procedures for NUMAC software products. Following the process also results in assurance that the hardware design is correct and compatible with the software. The baseline reviews assure the hardware requirements are met and software testing of the product is carried out as an integrated test.

Design verification is performed on all documents listed in the V&V plan for verification per independent design verification procedure, CP-03-09. Testing per specifications and procedures is conducted to assure the designed system operates per the requirements. In addition, integration testing is conducted on the assembled components to confirm that all instrument functions are working properly and the hardware, display software, and functional software are properly integrated and perform correctly in the target hardware. Eventually, the entire PRNMS testing was performed by GEH along with licensee personnel. These measures assure the quality of hardware and software used in the microprocessors. The steps OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION enumerated above provide reasonable assurance to the NRC staff that the microprocessor software development process is compliant with 10 CFR 50, Appendix B quality requirements except for the current IV&V requirements for certain tests of non-developmental software.

The processes described above were in place prior to the current regulations and the licensee has provided a roadmap as to how the new requirements have been met by the procedures that existed prior to the new regulations along with compensatory actions when needed. Therefore, the NRC staff has reasonable assurance that the licensee meets the current regulations with regard to software changes, with the exception noted above.

The licensee further described how it meets the guidance of various other Sections of DI&C-ISG-06 in Sections 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4. 7, and 4.4.8 (see Reference 4.1.h, Section 4.4). These sections provide further discussion of Software Safety Plan, Microprocessor and Programmable Logic devices firmware development and testing tools, and legacy programmable logic devices firmware development. A review of Section 4.4 of Reference 4.1.h provided the NRC staff a reasonable assurance that the licensee meets the guidance of DI&C-ISG-06 with regard to the overall software quality.

Even though the licensee did not follow the current regulatory guidance when the original software was developed and the LTR was approved, it has shown how the original guidance maps with the current software development documents that were reviewed and approved by the NRC staff when the LTR was approved. The licensee also stated the experience from the operation of various BWRs for more than two decades with over 10,000 years of combined operating experience, and there are no adverse reports on NUMAC equipment due to undesirable behavior of connected systems, inadvertent access to the system, or network connectivity from any of those plants nor are there any reports of incorporation of undocumented code, malicious code, or other unwanted and undocumented features (see Reference 4.1.h, Section 11.5.6).

In support of the NRC staff's engineering judgment, the NRC staff determined that the level of operating experiences described and demonstrated by the licensee exceeds that proposed for commercial off-the-shelf products in NUREG/CR-6421, "A Proposed Acceptance Process for Commercial Off-the-Shelf (COTS) Software in Reactor Applications," March 1996 (ADAMS Accession No. ML063530384). While not an endorsed method to meet the regulations, this document nevertheless proposed the criteria that the product have a significant (greater than 1 year) operating time, with severe-error-free operating experience, where at least two independent operating locations used a product of identical version, release, and operating platform encompassing the same or nearly the same usage as the proposed usage.

Based on the use of previously approved software development documents and plans and procedures with mapping provided to the current regulations, the experience history, and the compensatory actions taken due to lack of full independence in the IV&V testing, the NRC staff has reasonable assurance the software meets the current regulatory guidance.

4.3.8.2 System and Software Requirements Development Approach Regulatory Guide 1.172, "Software Requirements Specifications for Digital Computer Software Used in Safety Systems of Nuclear Power Plants," September 1997, describes a method OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION acceptable to the NRC staff for complying with the NRC's regulations as they apply to preparation of software requirement specifications for safety system software through its endorsement of IEEE Std. 830-1993. BTP 7-14 provides guidance to the NRC staff when performing software reviews for digital computer-based instrumentation and control systems.

However, the CGS PRNMS safety-related software and system components were not developed according to the current guidance, but in accordance with prior reviewed and approved LTRs.

The licensee's approach to the CGS PRNMS development has characteristics that differ from typical system and software developments for new safety systems, because the CGS PRNMS development is based on a previously reviewed and approved LTR. This licensee approach reuses the architecture, functionality, hardware, and software that are defined within the LTRs that had been previously reviewed and approved by the NRC staff. Furthermore, the CGS PRNMS firmware is not loaded into a fielded system, but rather is configured and embedded as part of the hardware configuration. The NRC staff identified and reviewed these characteristics keeping in mind that current regulatory guidance was written to address a new system's development and contains considerations applicable to the use of general-purpose computer hardware that requires software to be loaded into the system when installed in the plant. The licensee provided a high level description of the development processes that were applied to the CGS PRNMS development (see Reference 4.1.h, Section 4.4.1.2).

The CGS PRNMS life-cycle did not include typical concept development, because the previously reviewed and approved LTR defines an overall system concept, functionality, and architecture to allocate functions to hardware and software components. Conformance to the previously reviewed and approved LTR acts to fulfill the need for a typical concept development and includes identification of deviations from the LTR along with the plant-specific actions required to apply the LTR (see Reference 4.2, Section 2.3.1 ). To develop the CGS PRNMS, the licensee's plant-specific system requirements have been mapped to the architecture and components identified in the LTR. The licensee provided the generic "NUMAC Requirements Specification," 23A5082AA, and the CGS-specific "NUMAC PRNM System Requirements Specification," 24A5221TC (see Reference 4.1.h, Appendix A), to demonstrate that the LTR concepts have been translated into specific system requirements during the definition and planning phase.

In lieu of performing a confirmatory audit, the NRC staff reviewed requirement traceability through a sample set of the system requirements to software specifications within docketed information, assessed the applicable operating experience for prior NUMAC products developed in accordance with documented NUMAC processes (see Reference 4.1.f), assessed the final CGS NUMAC V&V Report's documentation of anomalies and corrective actions (see Reference 4.4.e), and confirmed the anomalies were resolved satisfactorily. Based upon these reviews and assessments, the NRC staff determined the system and software requirement development approach is acceptable and continues to satisfy the intent of the LTRs, because conformance to the previously reviewed and approved LTRs has been established and the licensee has provided documentation that demonstrates the LTR concepts have been translated into specific system requirements and V&V activities with formally documented traceability.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION 4.3.8.3 Software Configuration Control Regulatory Guide 1.169, "Configuration Management Plans for Digital Computer Software Used in Safety Systems of Nuclear Power Plants," describes a method acceptable to the NRC staff for complying with the NRC's regulations as they apply to the configuration management of safety system software.

The licensee described its configuration control processes and tools, which limit access and changes to formal baselines of the software. The controlled products and baselines are established in accordance with the "NUMAC Software Management Plan," 23A5162, and performed in accordance with the "NUMAC Software Configuration Management Plan,"

23A5161 (see Reference 4.1.h, Appendix A). The NRC staff review confirmed that a software baseline is established at defined points in the software life cycle process and that independent reviews are performed at these points to assess the adequacy of the software products and documentation throughout the development. The licensee treats the final software end-product configuration in a manner which is similar to hardware configuration control. A part number for firmware is issued and affixed on the electronic programmable read-only memory similar to a part number on a hardware device. NUMAC firmware/software does not use software maintenance tools. Any change in firmware/software results in a new part number. This meets the intent of BTP 7-14 and NUREG-0800, Appendix 7.1-D.

The NRC staff determined the approach described above is acceptable, because the device programming process verifies the correct version at the time the device is programmed and labeled, and this further allows for confirmation that the software is the correct version upon receipt inspection at the plant. Assurance that the received version is not subsequently modified is provided, because the PRNMS does not include provisions for plant personnel to subsequently change the configuration of the installed operational safety software.

The licensee provided detailed configuration and change information that demonstrates appropriate configuration control processes are in place (see Reference 4.1.h, Sections 4.4.1.11 and 4.4.7).

Based on the NRC staffs review and evaluation of the licensee's configuration control processes, applicable operational history of products based on these configuration control processes, and in further consideration of its approach to treat programmed devices as hardware configuration items, the NRC staff determined the licensee's software development includes adequate reviews and configuration control measures to satisfy the acceptance criteria of RG 1.169.

4.3.8.4 Software Safety Plan CGS'S safety plan is explained in Section 4.4.1.9 of Reference 4.1.h and it refers to PWP which invokes NEDC-32410P-A (see Reference 4.2), the SCMP, the SMP, the SWP, and standard GEH policies and procedures. The CGS safety plan also lists 10 CFR 50.59 evaluation, and policies and procedures CP-03-04 and CP-03-09 (see Reference 4.1.h, Table 4.4-1). Project risk management is a key element of the PWP. The Project Manager and the project team are responsible for identifying the risks and abatement actions for the identified risks. The Project Manager with the project team develops and documents an organized, comprehensive, and OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION interactive plan that identifies responsibilities and associated actions. The Project Manager is responsible for project safety issues which include software safety as well as software hazard issues. The software safety addresses various aspects of CGS safety plan. The design basis of the replacement system is consistent with the design basis originally approved by the NRC for Plant Hatch, and addresses the CGS plant-specific design basis (see Reference 4.1.h, Section 8.4). The CGS PRNMS development followed the required safety functions enumerated in the LTR, met regulatory requirements, and evaluated the effect(s) of equipment failures. The licensee addressed plant-specific implementation actions identified in the LTR.

The V&V activities followed processes that included technical oversight by the Chief Engineer's office. The LTR established safety-significant aspects of the PRNMS system, and the design and execution of the software requirements addressed additional safety attributes, which were confirmed during the overall system design effort through its V&V activities (see Reference 4.1.h, Appendix A).

Per the LTR, GEH's design processes minimize the potential of CCF and ensure that the plant maintains the defense-in-depth capability (see Reference 4.2, Section 6.4.3). The evaluation for common-cause software failure (CCF) is described under 03 in Section 4.3.4 of this SE.

The NRC staff determined that this approach to a software safety plan is acceptable, because conformance to the previously reviewed and approved LTRs has been established and the licensee has provided a 03 analysis that addresses software failures.

4.3.8.5 Hazard Analysis No separate Hazards Analysis is performed as part of the system V&V tasks during each software life-cycle stage to determine the integrity level required for individual software components during the development, as is required for by RG 1.168. However, the licensee has provided a comparison between IEEE Std. 1012-1998 and the GEH software V&V process for CGS PRNMS (see Reference 4.1.h, Table 4.4-5). This comparison includes hazard analysis, which is conducted in accordance with GEH document CP-03-102 to analyze the hazards from the conceptual stage through the execution stage. CP-03-1 02 is one of the policies of GEH to define the requirements for product safety assessment. The resulting analysis identifies the potential system hazards; assesses the severity of each hazard, assesses the probability of each hazard, and identifies mitigation strategies for each hazard.

The hazard analysis verifies that the logic design and associated data elements are implemented correctly and introduce no new hazards. It also ensures that software modifications are implemented correctly and do not introduce new hazards The licensee also committed to a specific software integrity level for each set of processing software that is contained within individual PRNMS components. The overall software integrity level is based on the safety-significant aspects of the PRNMS system and whether any portion of a set of processing software is required to perform a safety function. This safety basis is defined by the previously reviewed and approved LTRs, and each software unit within an individual PRNMS component must be developed to the highest safety integrity level applicable to any software within that component.

The licensee described the hazard analysis in its comparison between IEEE Std. 1012-1998 and the GEH Software V&V Process for CGS PRNMS (see Reference 4.1.h, Table 4.4-5).

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Under Section 5.4.1.5 of this table, the licensee defined that hazard analysis begins from the conceptual system and will identify the potential system hazards, severity of each hazard, probability of each hazard, and mitigation strategies for each hazard per the guidance in CP-03-04. This analysis is conducted as part of the product safety assessment and can generate anomaly reports. Section 5.4.2.8 of this table requires determination of software contributions to the hazard analysis and appropriate mitigation of hazards. Section 5.4.3.8 of this table requires that the logic design and associated data elements correctly implement the critical requirements and introduce no new hazard. Further requirements address verification of the implementation of the data elements, operating procedures and environment, before installations to ensure each is correctly implemented and introduces no new hazard.

The NRC staff determined this approach is acceptable, because conformance to the previously reviewed and approved LTRs has been established, the highest software integrity level within an individual PRNMS component is applied to all software within that component, and the licensee has provided a D3 analysis that addresses software performance (including failures) that may contribute to hazards.

4.3.8.6 Verification and Validation (V&V) Testing The licensee performed unit test, integration test, system test, and factory acceptance testing in accordance with the "NUMAC Software Verification and Validation Plan," 23A5163 (see Reference 4.1.h, Enclosure 1). The NRC staff reviewed the plan and reviewed the activities that were performed in accordance with this plan. This evaluation identified satisfactory compliance with RG 1.168 except for independently developed unit structured and documented testing of safety software (see discussion in Section 4.3.8.1 ). The licensee provided V&V summary reports to document the software V&V activities, including the compensatory measures previously identified (see References 1.h and 4.e). The NRC staff reviewed these reports and evaluated the test activity summary and the independence applied when performing the compensatory measures against the acceptance criteria established in RG 1.168.

The NRC staff determined that the acceptance criteria established in RG 1.168 have been satisfied for the CGS PRNMS based on performance of the compensatory measures in addition to the V&V activities as originally planned, organized, and performed.

4.3.8.7 Secure Software Development and Operations The licensee addresses secure software development and operations throughout the product development to ensure the system is reliable (see Reference 4.1.h, Section 11 ). The licensee has demonstrated how it has met the guidance in Section D.12.2 of DI&C-ISG-06 for vulnerability assessment, Secure Development and Operational Environment, and secure environment and operations following the guidance of applicable regulatory requirements including GDC 21, IEEE Std. 603-1991 in accordance with 10 CFR 50.55a(h), and RG 1.152.

The licensee performed a vulnerability assessment of the connected systems and identified the vulnerability concerns. The licensee stated the security controls that were in place during the various phases of the design and development phase including testing. Furthermore, the licensee planned and implemented appropriate controls during the operational phase. As defensive measures to prevent vulnerabilities to the safety system, the licensee described the OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION various measures protecting the safety systems from unwanted access and incorrect data.

These measures include, but are not limited to, data buffering, data validation including range checking, reasonability checks, transmission validation, and operator or automatic actions to accept reject data. The licensee further addressed regulatory positions 2.1 through 2.5 of RG 1.152, Revision 2 and how each of the regulatory positions have been met for CGS. These positions address all phases of development, design, and testing including factory acceptance tests.

The administrative controls established in the original LTR (see Reference 4.2, Section 5.3.13) have been confirmed for the CGS PRNMS (see Reference 4.1.h, Section 11.5.4) and these requirements are included in Section 1.4.6 of Reference 4.1.h. Also, the development process includes specific code and design reviews between defined life-cycle phases, which in part act to verify that undocumented or unwanted code is not included in the delivered product. The specified features are confirmed as part of the product's V&V. Once fielded, the safety-related software is contained in programmed devices that are part of the documented system configuration and cannot be subsequently modified by the licensee. The correct software configuration is verified prior to delivery of the PRNMS equipment.

The configuration and control processes and tools limit access and changes to formal baselines of the software, which are established in accordance with the "NUMAC Software Management Plan," 23A5162, and performed in accordance with the "NUMAC Software Configuration Management Plan," 23A5161 (see Reference 4.1.h Appendix A). These formal configuration control processes limit personnel access to the software at the correct version.

The NRC staff review of equipment security features is limited to ensuring their inclusion is not adverse to the reliability of equipment safety functions. The licensee identified the use of a protocol that employs encryption techniques. The NRC staff confirmed this protocol is not included within the safety processors of the PRNMS; therefore, the inclusion of this feature cannot adversely affect reliable performance of the PRNMS safety functions. The security protocol is implemented between the nonsafety NIC and its connection to the nonsafety RBM (see Reference 4.4.h, Section 4.1.2). Because the encryption is used between the nonsafety RBM and the nonsafety NIC, it does not complicate or otherwise adversely affect the safety functions.

The NRC staff concludes that these approaches provide an acceptable method to meet the evaluation criteria established in RG 1.152, Staff Positions 2.1 through 2.5 for the previously approved software and for all software changes since the approved LTRs. The NRC staff conclusion is based on the use of a secure development and operational environment, configuration control procedures and design review procedures providing reasonable assurance that undocumented, malicious, or unwanted code is not included in the delivered product. The NRC staff conclusion is further based on the implementation of security features that do not adversely affect the safety functions.

4.3.9 Equipment Qualification Two objectives of the PRNMS system environmental testing are (1) to demonstrate the system will not experience failures due to abnormal service conditions of temperature, humidity, power source, radiation, or seismic, and (2) to verify those tests meet the CGS requirements.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Equipment qualification is further supported by failure mode and effects analysis (FEMA) and reliability analysis which were also reviewed and found acceptable by the NRC staff (see References 4.a and 4.b).

Criteria for environmental qualifications of safety-related equipment are provided in 10 CFR Part 50, Appendix A, "General Design Criterion (GDC) 2, "Design bases for protection against natural phenomena," and GDC 4, "Environmental and dynamic effects design bases."

The equipment will be installed in the CGS control room, which is a mild environment. The licensee performed equipment qualification on the PRNMS equipment and some of the nonsafety equipment including APRM ODAs, RBM ODAs, RBM equipment, and NIC to establish operating envelopes applicable to the CGS installation. Qualifications that were performed include environmental, seismic, and electromagnetic compatibility. Some of the testing defines an operating envelope for the NIC that is different than that of PRNMS; regardless, this section primarily addresses the PRNMS equipment, because it is the only equipment associated with safety functions.

Documentation of equipment qualification, that confirms that the equipment qualification envelopes plant-specific requirements, is required in the plant-specific license amendment when referencing the previously approved LTRs (see References 4.2 and 4.3). The LAR (Reference 4.1) provided equipment qualification details in Section 5 of Reference 4.1.h. The qualification includes environmental qualification, seismic qualification, and electromagnetic compatibility (EMC) qualifications of the safety-related and the associated nonsafety equipment to the extent needed to ensure adequate seismic mounting, EMC interfaces, and environments where the equipment is located. On further request, the licensee provided a Qualification Summary Report (see Reference 4.6, Enclosure 1) which summarizes the environmental, seismic, and EMC qualification status of CGS equipment which is housed in Panels P608 and the operator's benchboard panel P603. Panel P608 houses the PRNM equipment and panel P603 houses the fiber optic bypass switch and the ODAs for PRNM and RBM (see Reference 4.6, Enclosure 1). The seismic qualification of Panel P603 is addressed in Section 5.4.6.4 of Reference 4.1.h.

The licensee performed equipment qualification activities on the PRNMS to comply with IEEE Standard 603 Clause 5.4, and described the approach to equipment qualification by the combination of type test, previous operating experience, and analysis (see Reference 4.1.h, Section 5, and 9.2.4). The approach qualifies equipment on an instrument basis and on a panel basis. The approach includes analysis of prior qualifications based on design similarities and differences of each instrumentation chassis to justify extending the applicability of prior tests through similarity and/or analysis. The approach analyzes the panels to establish bounding specifications for temperature rise, seismic spectrum, and electromagnetic compatibility for the installed instrumentation. The licensee provided a detailed description of the environmental qualification, the seismic qualification, and electromagnetic compatibility qualification (see Reference 4.1.h, Sections 5, and Reference 4.6, Enclosure 1). In these references the licensee provided and compared the environmental qualification levels of generic testing of PRNM equipment and the equipment in the CGS main control room. All testing was performed in accordance with test procedures and all test results were analyzed and verified in a test report.

The NRC staff's evaluation of each equipment qualification test is discussed in the following subsections.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION 4.3.9.1 Environmental Qualification Regulatory Guide 1.209, "Guidelines for Environmental Qualification of Safety Related Computer-Based Instrumentation and Control Systems in Nuclear Power Plants," endorses and provides guidance for compliance with IEEE Standard 323-2003 which describes a method acceptable to the NRC staff for satisfying the environmental qualification of safety-related computer-based I&C systems for service in mild environments. Equipment that, (1) is required to accomplish the APRM and OPRM trip functions and (2) is necessary to assure that there is no inadvertent bypass, is required to be environmentally qualified.

In response to a NRC staff request, the licensee provided a Qualification Summary report as to Reference 4.6. This qualification summary is specific for CGS equipment and addresses all qualification requirements. The CGS PRNM and NIC equipment qualification is based on analysis of requirements, comparisons with generic PRNM components, and similarity analysis of previously qualified components. The NIC is not safety-related and performs no safety function. However, its qualification is based on the environmental conditions at its location in the control room.

The instrument qualification is based on the PRNM generic qualification of instruments. This qualification is based on identifying the instrument qualification requirements for CGS instruments and comparing them with the generic instrument qualification then analyzing any differences between the two, as needed. Per the LTR the instruments are qualified to the environments listed in Table 5-2 of Reference 4.1.h, Section 5.4, and Table 3-1 of Reference 4.6, Enclosure 1. The instrument requirements for CGS are met by the temperature requirements shown in Table 5-2 of Reference 4.1.h and Table 3.1 of Reference 4.6, . These instrument qualification requirements are also listed in the NUMAC Requirements Specification 23A5082 (see Reference 4.1.h, Appendix A). Because the generic instrument requirements and the plant-specific requirements are the same, it can be concluded the instruments are qualified for CGS's operating conditions.

Panel qualification is similarly based on comparing the generic panel qualifications with the plant-specific panel qualification requirements and analyzing any differences that are not deemed conservative by comparison. The qualification is for PRNM instruments and PRNM panels located in the control room. For equipment mounted in the panels, the panel qualification requirements are bounding, because these requirements have to include any panel specific issues including panel temperature rise. It should be noted that there are two main panels (P608 and P603) in the control room housing the PRNM equipment. The NIC is located in a separate panel in the control room.

The licensee identified the CGS specific environmental qualification levels for the PRNM equipment (see Reference 4.1.h, Section 5). The CGS panel qualification requirements are shown in Table 5-3 in Reference 4.1.h, Section 5.4. The maximum control room temperature is 104 degrees Fahrenheit (°F). For the equipment mounted in the panel, the normal temperature rise is 10 °F but a temperature rise of 15 °F has been included in the qualification requirements.

Adding a margin of 5 °F, the panel is to be qualified to 124 °F. IEEE 323-1974 requires a test margin of 15 °F which would require that the panel be tested to an internal temperature of 139 °F. Per Section 5.4.1 of Reference 4.1.h and Section 4.2.2.1 of Reference 4.6, the OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION temperature maintained during the qualification testing was (( )), which provides an additional margin over that required . The lowest control room temperature is 40 °F and for conservatism no panel temperature rise has been assumed. The equipment is qualified to this temperature. Therefore, the panel mounted equipment meets the temperature requirements.

The generic PRNM testing covers all other CGS control room environmental conditions except for humidity. Equipment mounted in the control room panels may be subject to a humidity ranging from a low of 10 percent to a maximum of 60 percent. ((

)) The NRC staff concludes the PRNM equipment has been satisfactorily qualified for the operating low humidity environment. The high humidity requirement for CGS is met by the generic PRNM qualification which is qualified to 90 percent non-condensing humidity.

((

))

CGS control room normal radiation dose is 0 millirem/hour and the maximum dose is 1 millirem/hour and the total integrated dose over 40 years is 350 Rads (see Reference 4.1.h, Appendix A, Specification 23A5082). The PRNMS instruments are qualified to normal operating dose rate of 5.0E-4 Rads/hour and a total integrated radiation dose of 1000 Rads (see Reference 4.1.h, Appendix A, Data Sheet 24A5221TC). Therefore, the LTR radiation qualifications meet the CGS requirements and satisfy the radiation qualification requirements.

The NIC is not safety-related and it is located in the control room. It was subjected to partial equipment qualification testing. ((

)) Therefore, the NRC staff concludes NIC has been satisfactorily qualified for the CGS main control room environment.

Based on the specification for a mild environment, analysis, testing, and availability of test results for PRNMS environmental performance, the NRC staff has determined that the PRNM equipment satisfies the CGS environmental requirements.

4.3.9.2 Seismic Qualification PRNM equipment is located in the control room in panels P608 and P603 while the NIC is located in a separate panel in the control room.

PRNM control room electronics were qualified by type testing and analysis to IEEE 344-1975 per Reference 4.2. The licensee is also committed to IEEE 344-1975. Based on the licensee OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION qualification report, the analyzed seismic acceleration is based on the required response spectra at the panel mounting location and the actual equipment location within panel P608.

The generic testing performed in Reference 4.2 envelopes the seismic levels at equipment location in panel P608 throughout the frequency range of interest with significant margin. Based on the site-specific analysis and comparison with the actual test data, the NRC staff concludes that panel P608 is seismically qualified for use at CGS. Reference 4.6, Enclosure 1 contains a summary of the qualifications and addresses seismic qualification.

It should be noted that NIC has not been qualified for seismic adequacy because it is not a safety-related component and it is not mounted in a safety-related panel or near safety-related equipment (see Reference 4.1.h, Section 5.4.8).

Seismic qualification of panel P603 was originally based on IEEE 344-1971. In March 1979, NRC notified the licensee that it would review the CGS equipment seismic qualifications to an upgraded criterion defined as IEEE 344-1975 as supplemented by RG 1.100 and as further supplemented by the applicable SRP sections of NUREG-0800. The licensee undertook an equipment requalification program to ensure that all Class 1E equipment would perform its safety functions during seismic loading conditions postulated to occur at CGS. This program identified and corrected any identified deficiencies in the documentation. All 1E equipment was designed to withstand the safe shutdown earthquake (SSE). Furthermore, safety-related class 1E instrumentation was reevaluated to ensure that it will perform its safety function during and after the operating basis earthquake (OBE), SSE, loss of coolant accident, or other design basis event. Equipment testing on test tables, searches for resonance frequency and actual testing with monitoring of functionality before, during, and after the seismic testing was confirmed and the equipment was qualified to IEEE 344-1975 (see FSAR Section 3.1 0.1 and Reference 4.1.h, Section 5.4.6.4). Thus panel P603 was qualified to IEEE 344-1975. Further analyses have been conducted and recorded in calculations (see Reference 4.1.h, Section 5.4.6.4) to ensure seismic qualification is maintained for mounting two ODAs for APRM and two ODAs for RBM. The same calculation also addresses the mounting of the bypass switch. The conclusion of the calculation is that seismic adequacy is maintained. Based on the preceding discussion, the NRC staff concludes that panel P603 is seismically qualified.

4.3.9.3 Electromagnetic Compatibility Qualification Regulatory Guide 1.180, "Guidelines for Evaluating Electromagnetic and Radio-Frequency Interference in Safety Related Instrumentation and Control Systems," Revision 1, describes a method acceptable to the NRC staff for the design, installation, and testing practices to address the effects of electromagnetic and radio-frequency interference (EMI/RFI) and power surges on safety-related instrumentation and control (I&C) systems.

The licensee identified the APRM/RBM equipment is to be installed in the main control room (MCR) which is an administratively controlled area. The licensee collected CGS MCR emissions levels for tests RE101, RE102, and CE101 based on the methodologies recommended in MIL-STD-461 E. The emissions data was collected in June 2004. Since these data were collected the licensee has met all the EMC qualifications per plant qualification requirements and procedures. In addition, the use of portable transceivers is administratively controlled by CGS plant procedures (see Reference 4.1.h, Section 5.4.7).

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION The licensee provided a summary of the EMC qualification of the PRNMS (see Reference 4.1.h, and Reference 4.6, Enclosure 1). Table 5-4 in Reference 4.1.h addresses the susceptibility requirements and the EMC tests performed per the topical report (see Reference 4.2) and it lists the equivalent tests required by RG 1.180. This summary was provided to demonstrate that CGS PRNMS components were qualified by type testing or analysis to demonstrate the PRNMS will perform all specified functions when operated with the specified EMC limits and when mounted in accordance with the specified methods. The test levels for the LTR and RG 1.180 are compared and are generally consistent with the qualification requirements in RG 1.180. Any differences are minor in nature and were not found to have any effect on EMC qualification levels of the CGS equipment.

Similar to Table 5-4 the licensee provided Table 5-5, which addresses emission requirements for power leads and electric fields, and Table 5-6, which addresses EMC and EMI requirements (see Reference 4.1.h). Table 5-5 lists the PRNM test levels with the RG 1.180 test requirements and provides clarification notes to justify any minor deviations. Table 5-6 lists tests that are mostly more restrictive than the tests required by RG 1.180. ((

)) but RG 1.180 does not specifically require an equivalent test. ((

)) such that it can be reasonably concluded that PRNM instrumentation meets the intent of RG 1.180. Table 5-7 lists three specific tests that were not performed for CGS equipment. However, CGS performed two of the three tests to meet the requirements of RG 1.180 and the licensee justified why the third test (radiated emissions, magnetic test) need not be performed for the CGS equipment. These tests are Susceptibility Tests (Conducted susceptibility, ring wave, power and signal cables),

Emissions Tests (Power leads, low frequency conducted), and Emissions Tests (Radiated emissions, magnetic). For the conducted susceptibility test, the licensee explained that electrostatic discharge tests, even though not required by RG 1.180, were conducted at maximum level and to higher radiated field strength to indicate a very high level of immunity to frequency distortion including immunity to EMI noise and thus the PRNM equipment was qualified to the levels required by RG 1.180. ((

)) The Radiated Emissions magnetic tests were not conducted for CGS equipment, because the equipment is not located near equipment that could potentially be affected by radiated magnetic fields. Also the PRNM channel is encapsulated in its own bay, to provide sufficient shielding to protect itself against magnetic susceptibility from adjacent equipment at CGS.

The licensee provided a summary of the EMC qualification of the NIC (see Reference 4.1.h, Section 5.4.8.3). The licensee performed EMC testing to demonstrate CGS NIC components satisfy the guidance provided in EPRI TR-102323, "Guidelines for Electromagnetic Interference Testing in Power Plants," Revision 2. The licensee clarified that electromagnetic and radio frequency susceptibility information for the NIC was not required, because the NIC does not perform a safety function and as such RG 1.180 does not apply. Based on the EMC testing performed, the NIC is compatible with the EMC environment at CGS, is unlikely to interfere with other equipment, and is unlikely to malfunction due to EMI from other equipment in its proximity.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION Based on the analysis, testing, and availability of test results for PRNMS electromagnetic compatibility, the NRC staff has determined the PRNMS satisfies the electromagnetic compatibility guidance provided by RG 1.180 to support installation within the CGS control room.

4.3.1 0 Deviations from the Prior LTRs The licensee amendment submittal identified and provided technical basis justifying three deviations from the NUMAC PRNM LTR (see Reference 4.1.g, Enclosure 1, Table 1). This section identifies and addresses the acceptability of each of these three deviations.

(1) APRM Upscale I OPRM Upscale, APRM INOP Function Logic (see Reference 4.1.g, Enclosure 1, Table 1, Item 1)

The licensee provided the technical basis for this deviation in GEH Report 0000-0101-7647-R3, Columbia NUMAC PRNM LTR Deviations (see Reference 4.1.g, Enclosure 1, pages A-2 through A-5). The justification for this deviation is that it improves operating flexibility.

((

))

The NRC staff reviewed the justification and determined the proposed change is conservative relative to the current LTR approach. Furthermore, the OPRM has been operating successfully in a number of plants for number of years without spurious trips. This history justifies the combination of either an APRM INOP or OPRM trip functions. The improvement to operating flexibility is explained in Reference 4.1.g, Enclosure 1. Additionally, the NRC staff confirmed the deviation request satisfies the basis of previously approved precedents for GGNS and Monticello Nuclear Generating Plant (see Reference 4.1.g, Enclosure 1, pages A-2 through A-6 and Reference 4.27, RAI 25). Therefore, the NRC staff determined that this plant-specific deviation is acceptable.

(2) Time to Calculate Flow-biased Trip Setpoint (see Reference 4.1.g, Enclosure 1, Table 1, Item 2)

The licensee provided technical basis for this deviation in GEH Report 0000-01 01-7647-R3, Columbia NUMAC PRNM LTR Deviations (see Reference 4.1.g, Enclosure 1, pages A-2 through A-5) due an increase from the approved trip time for the flow-biased trip setpoint. The justification for this deviation is that it is inconsequential and it does not affect any safety functions.

((

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

)) The flow transmitters used at CGS are widely used in the industry. This deviation was discovered during the execution of CGS PRNMS project and GEH has notified other customers of this problem. The licensee's evaluation of the increased delay concluded that there are no adverse effects on safety, because STP trip does not protect against fast transients. The APRM neutron flux high trip is intended to cover fast transients.

The STP trip is intended to cover slow transients (e.g., loss of feedwater heating) that add positive reactivity. In such cases, the thermal power and the flow rates increase gradually and the slow response time is of no consequence. The licensee further stated that the safety analysis does not take credit for STP high trip in any of the design basis events.

The NRC staff evaluated the impact of this deviation and determined that the impact of the proposed change does not adversely affect the safety functions (see Reference 4.1.g, Enclosure 1, Item 2, and Reference 4.27, RAI 26). Therefore, the NRC staff determined that this plant-specific deviation is acceptable.

(3) Abnormal Conditions Leading to Inoperative Status (see Reference 4.1.g, Enclosure 1, Table 1, Item 3)

The licensee provided technical basis for this deviation in GEH Report 0000-0101-7647-R3, Columbia NUMAC PRNM LTR Deviations (see Reference 4.1.g, Enclosure 1, pages A-2 through A-6). The justification for this deviation is that PRNMS is provided with an alarm when a module is missing, but it provides a trip when performance of the safety function is affected (see Reference 4.27, RAI 27).

A missing module will cause an alarm whereas a missing module that can affect performance of the safety function will also cause the trip (see Reference 4.2, Section 3.2.1 0.1 and Reference 4.1.g, Enclosure 1, Page A-6). This assures that any module having a critical function, if missing, will cause a trip.

The NRC staff confirmed that the deviation request does not adversely affect safety functions and provides the necessary alarms to inform the operator of the status of the modules; therefore, the NRC staff determined that this plant-specific deviation is acceptable.

4.3.11 Confirmation of Plant-Specific Actions The SE for the LTR identifies six plant-specific actions that are required when a licensee references the LTR as part of a license amendment submittal (see Reference 4.2). This section identifies each of these actions and summarizes the steps taken by the licensee to fulfill each action to address each required confirmation.

(1) Confirm applicability of NEDC-32410 and reconcile any differences between the specific plant design and the topical report description.

The license amendment submittal identified the specific CGS PRNMS configuration option from those available in NEDC-3241 0 to demonstrate general applicability (see Reference 4.1.g).

There are three deviations from the LTR and each one of the deviations has been explained and justified and evaluated in Section 4.3.1 0 of this SE.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 100-This I&C evaluation reviewed the confirmation of applicability and the reconciliation of differences between the plant-specific design and the topical report description for the CGS PRNMS, as provided by the licensee. Based on the information provided by the licensee and the evaluation by the NRC staff, the NRC staff determined that this plant-specific action has been fulfilled.

(2) Confirm the applicability of the BWROG topical reports that address the PRNMS and its associated instability functions, set points and margins.

The license amendment submittal provided this confirmation through its direct reference to the BWROG topical reports and their uses when developing the PRNMS setpoints to include the reload-related aspects (see Reference 4.1.g, Section 8.4.6.1 and Reference 4.1.h, Section 1 and Section 9.3.8).

This I&C evaluation reviewed the confirmation of applicability of the BWROG topical reports to the PRNMS and its associated instability functions, set points and margins, as provided by the licensee. Based on the information provided by the licensee and evaluated by the NRC staff, the NRC staff determined that this plant-specific action has been fulfilled.

(3) Provide plant-specific revised Technical Specification pages for the PRNMS functions consistent with NEDC-32410, Appendix H.

The license amendment submittal provided an initial set of plant-specific revised TS pages (see Reference 4.1 and References 4.1.a, 4.1.b, 4.1.c, and 4.1.d). Subsequently, the licensee provided additional revisions to the TS pages to clarify the pre- and the post-implementation changes in some of the TSs.

This I&C evaluation identifies the proposed Technical Specification changes and evaluates each proposed change (see Section 3.2). Based on the information provided by the licensee and evaluated by the NRC staff, the NRC staff determined this plant-specific action has been fulfilled.

(4) Confirm the plant-specific environmental conditions are enveloped by the PRNMS equipment qualifications values.

The license amendment provided analysis to support this confirmation (see Reference 4.1.h, Section 5). This submittal also addresses the CGS plant-specific conditions. In response to an RAI, the licensee provided the analysis to support the low humidity conditions at CGS (see Reference 4.6, RAI14). NRC staff determined the licensee response is acceptable.

This I&C evaluation reviewed the equipment qualification to determine that CGS installation-specific environmental requirements have been suitably enveloped (see Section 3.9). Based on the information provided by the licensee and evaluated by the NRC staff, the NRC staff determined that this plant-specific action has been fulfilled.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 101 -

(5) Confirm that administrative controls are provided for manually bypassing APRM/OPRM channels or protective functions, and for controlling access to the panel and the APRM/OPRM channel bypass switch.

The license amendment submittal stated the design features that control access to the PRNMS for setpoint adjustments, calibrations, and test points are not proposed to change from the approach previously reviewed and approved. The license amendment submittal also confirmed that administrative controls will be provided for manually bypassing APRM/OPRM channels or protective functions, and for controlling access to the panel and the APRM/OPRM channel bypass switch (see Reference 4.1.h, Section 9.2.9).

This I&C evaluation reviewed the specifications for and commitment to administrative controls, as provided by the licensee. Based on the information provided by the licensee and evaluated by the NRC staff, the NRC staff determined that this plant-specific action has been fulfilled.

(6) Confirm that any changes to the plant operator's panel have received human factors reviews per plant-specific procedures.

The license amendment submittal provided a brief review of the human factors in Section 9.2.14 of Reference 4.1.h. It addresses that the design meets the intent of NUREG-0700.

This section of the SE does not include the safety determination for human factors reviews. The SE completed by Health Physics and Human Performance Branch has concluded that CGS has provided an acceptable response for the human factors evaluation (see SE Section 4.5).

4.4 Instrumentation and Controls Conclusion The NRC staff determined the proposed replacement of the CGS PRNM/ARTS/MELLLA with a digital GEH NUMAC PRNMS satisfies the applicable 10 CFR Part 50, Appendix A, General Design Criteria (GDC 1, GDC 2, GDC 4, GDC 10, GDC 12, GDC 13, GDC 15, GDC 20, GDC 21, GDC 22, GDC 23, GDC 24, GDC 25, and GDC 29). As evaluated in Section 4.3 using the current and applicable regulatory evaluation criteria that is identified in Section 4.2, the NRC staff concludes that the proposed replacement meets 10 CFR 50.36(c)(2)(i), 10 CFR 50.36(c)(3), 10 CFR 50.55a(a)(1 ), 10 CFR 50.55a(h). Therefore, the NRC staff concludes that there is reasonable assurance (i) that the activities authorized by the operating license can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the applicable regulations, and issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

On this basis, the NRC staff determined that the proposed I&C changes are acceptable.

4.5 References 4.1 Sawatzke, B. J., Energy Northwest, letter to U.S. Nuclear Regulatory Commission, "Columbia Generating Station, License Amendment Request to Change Technical Specifications in Support of PRNM/ARTS/MELLLA Implementation," dated January 31, 2012 (ADAMS Accession No. ML120400144), and enclosures/attachments as noted below:

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 102-

a. Description of Technical Specification (TS), Enclosure 1 (ADAMS Accession No. ML12040A072).

b. Markups, Enclosure 1, Attachment 1 (ADAMS Accession No. ML12040A072).

c. Retyped TS Pages, Enclosure 1, Attachment 2 (ADAMS Accession No. ML12040A072).

d. TS Bases Markups, Enclosure 1, Attachment 3 (ADAMS Accession No. ML12040A072).

e. Sample Pages of Proposed COLR Changes, Enclosure 1, Attachment 4 (ADAMS Accession No. ML12040A072).

f. Technical and Regulatory Evaluation of the Proposed TS Changes Involving PRNM, Enclosure 2 (ADAMS Accession No. ML12040A072).

g. 0000-0101-7647-R3, "Columbia Generating Station (CGS) Plant-Specific Responses Required by NUMAC PRNM Retrofit Plus Option Ill Stability Trip Function Topical Report (NEDC-3241 OP-A)," October 2011 (ADAMS Accession No. ML12040A073).

h. GE Hitachi Nuclear Energy, NEDC-33685P, Revision 1, "Digital I&C-ISG-06 Compliance for CGS NUMAC Power Range Monitoring Retrofit Plus Option Ill Stability Trip Function," January 2012 (not publicly available; non-proprietary version designated as NED0-33685, Revision 1, available at ADAMS Accession No. ML12040A074).

i. GE Hitachi Nuclear Energy, NEDC-33690P, Revision 0, "CGS Power Range Neutron Monitoring System (PRNMS) Response Time Analysis Report,"

November 2011 (not publicly available; non-proprietary version designated as NED0-33690, Revision 1, available at ADAMS Accession No. ML12040A075).

j. GE Hitachi Nuclear Energy, NEDC-33694P, Revision 1, "CGS PRNMS Diversity and Defense-in-Depth (D3) Analysis," (not publicly available; non-proprietary version designated as NED0-33694, Revision 1, available at ML12040A076).

k. GE Hitachi Nuclear Energy, NEDC-33697P, Revision 1, "CGS PRNMS Design Analysis Report, January 2012 (not publicly available; non-proprietary version designated as NED0-33697, Revision 1, available at ADAMS Accession No. ML12040A077).

I. GE Hitachi Nuclear Energy, NEDC-33698P, Revision 1, "CGS PRNMS Design Report on Computer Integrity, Test and Calibration, and Fault Detection,"

January 2012 (not publicly available; non-proprietary version designated as NED0-33698, Revision 1, available at ADAMS Accession No. ML12040A079).

m. List of Commitments (ADAMS Accession No. ML12040A079).

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 103-

n. GE Hitachi Nuclear Energy, NEDC-33507P, Revision 1, "CGS APRM/RBM/TS/Maximum Extended Load Line Limit Analysis (ARTS/MELLLA),"

January 2012 (not publicly available; non-proprietary version designated as NED0-33507, Revision 1, available at ADAMS Accession No. ML12040A080).

4.2 GE Hitachi Nuclear Energy, NEDC-3241 OP-A, "Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option Ill Stability Trip Function, Volumes 1 and 2," October 1995 (not publicly available).

4.3 GE Hitachi Nuclear Energy, NEDC-3241 OP-A, "Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option Ill Stability Trip Function, Supplement 1," November 1997 (not publicly available).

4.4 Sawatzke, B. J., Energy Northwest, letter to U.S. Nuclear Regulatory Commission, "Submittal of Phase 2 Information in Support of License Amendment Request to Change Technical Specifications in Support of PRNM/ARTS/MELLLA Implementation," dated July 31, 2012 (ADAMS Accession No. ML12219A255) and enclosures/attachments.

a. GE Hitachi Nuclear Energy, NEDC-33750P, Revision 0, "CGS PRNMS Failure Mode and Effect Analysis," June 2012 (not publicly available; non-proprietary version designated as NED0-33750, Revision 0, available at ADAMS Accession No. ML12219A255).

b. GE Hitachi Nuclear Energy, NEDC-33751 P, Revision 2, "CGS PRNMS Reliability Analysis," June 2012 (not publicly available).

c. GE Hitachi Nuclear Energy, NEDC-33753P, Revision 0, "CGS Instrument Limits Calculation Average Power Range Monitor (NUMAC ARTS-MELLLA)," June 2012, (not publicly available; non-proprietary version designated as NED0-33753, Revision 0, available at ADAMS Accession No. ML12219A255).

d. GE Hitachi Nuclear Energy, NEDC-33754P, Revision 0, "CGS Instrument Limits Calculation Rod Block Monitor (NUMAC ARTS-MELLLA)," June 2012 (not publicly available; non-proprietary version designated as NED0-33754, Revision 0, available at ML12219A255).

e. GE Hitachi Nuclear Energy, NEDC-33756P, Revision 2, "CGS Power Range Neutron Monitor V&V Test Summary Report," June 2012 (not publicly available).

f. GE Hitachi Nuclear Energy, NEDC-33758P, Revision 0, "CGS PRNMS Response Time Confirmation Report," June 2012 (not publicly available; non-proprietary version designated as NED0-33758, Revision 0, available at ML12219A255).

g. Creech, J., GE Hitachi Nuclear Energy, letter to James Snyder, Energy Northwest, "CGS DI&C-ISG-06 Enclosure B, Phase 2 Items 2.2., 2.3, and 2.9," dated June 12, 2012 (ADAMS Accession No. ML12219A255-Non Proprietary, and ML12219A258-Proprietary).

h. GE Hitachi Nuclear Energy, NEDC-33696, Revision 1, "CGS PRNMS System Architecture and Theory of Operations Report," July 2012 (not publicly available; OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 104-non-proprietary version designated as NED0-33696, Revision 1, available at ML12219A255).

4.5 Gibson, L. K., U.S. Nuclear Regulatory Commission, letter to Mark E. Reddemann, "Columbia Generating Station- Request for Additional Information Regarding License Amendment Request to Implement PRNM/ARTS/MELLLA (TAG No. ME7905)," dated September 5, 2012 (ADAMS Accession No. ML12249A011 ).

4.6 Sawatzke, B. J., Energy Northwest, letter to U.S. Nuclear Regulatory Commission, "Response to Request for Additional Information Regarding License Amendment Request to Implement PRNM/ARTS/MELLLA," dated October 5, 2012 (ADAMS Accession No. ML122920735).

4.7 Lyon, C. F., U.S. Nuclear Regulatory Commission, letter to Mark E. Reddemann, "Columbia Generating Station - Request for Additional Information Regarding License Amendment Request to Implement PRNM/ARTS/MELLLA (TAG No. ME7905)," dated March 12, 2013 (ADAMS Accession No. ML13067A106).

4.8 Lyon, C. F., U.S. Nuclear Regulatory Commission, letter to Mark E. Reddemann, "Columbia Generating Station- Request for Additional Information Regarding License Amendment Request to Implement PRNM/ARTS/MELLLA (TAG No. ME7905)," dated April1 0, 2013 (ADAMS Accession No. ML13099A043).

4.9 Sawatzke, B. J., Energy Northwest, letter to U.S. Nuclear Regulatory Commission, "Response to Request for Additional Information Regarding License Amendment Request to Implement PRNM/ARTS/MELLLA," dated April 11, 2013 (ADAMS Accession No. ML13116A013).

4.10 Sawatzke, B. J., Energy Northwest, letter to U.S. Nuclear Regulatory Commission, "Response to Request for Additional Information Regarding License Amendment Request to Implement PRNM/ARTS/MELLLA," dated May 9, 2013 (ADAMS Accession No. ML13141A581).

4.11 Columbia Generating Station, Final Safety Analysis Report, Amendment 60 (not publicly available).

4.12 Tam, P. S., U.S. Nuclear Regulatory Commission, letter to Timothy J. O'Connor, Northern States Power Company," Monticello Nuclear Generating Plant (MNGP)-

Issuance of Amendment Regarding the Power Range Monitoring System," dated January 30, 2009 (ADAMS Accession No. ML083440681 ).

4.13 Technical Specifications Task Force, letter to U.S. Nuclear Regulatory Commission, "Transmittal of TSTF 493, Revision 4, Errata," dated April 23, 2010 (ADAMS Accession No. ML101160026); and Federal Register Notice, Docket ID NRC-2009-0487, dated May 11, 2010 (75 FR 26294).

4.14 David, M. J., U.S. Nuclear Regulatory Commission, letter to Keith J. Polson, Nine Mile Point Nuclear Station, LLC, "Nine Mile Point Nuclear Station, Unit 2 -Issuance of Amendment Re: Implementation of ARTS/MELLLA," dated February 27, 2008 (ADAMS Accession No. ML080230230).

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 105-4.15 U.S. Nuclear Regulatory Commission, NUREG-1433, Revision 3, "Standard Technical Specifications General Electric Plants, BWR/4," March 2004" (ADAMS Accession No. ML041910194).

4.16 Electric Power Research Institute, EPRI Report No. NP-2230, "ATWS: A Reappraisal, Part 3: Frequency of Anticipated Transients," January 1982 (not publicly available).

4.17 Klapproth, J. F., GE Nuclear Energy, April4, 1988, letter to U.S. Nuclear Regulatory Commission enclosing proprietary NEDC-30851 P-A, "Technical Specification Improvement Analysis for BWR (Boiling Water Reactors) Reactor Protection System,"

March 1988 (ADAMS Legacy Accession No. 8804210061 ).

4.18 GE Energy, Nuclear and Global Nuclear Fuel, presentation slides, "BWR Control Rod Drop Accident (CRDA)," dated November 9, 2006 (ADAMS Accession No. ML063190108), provided at U.S. Nuclear Regulatory Commission November 9, 2006, Public Workshop on Interim Reactivity-initiated Accidents Criteria (meeting summary dated December 1, 2006 (ADAMS Accession No. ML063260310).

4.19 Beck, G. J., BWR Owners' Group, letter to U.S. Nuclear Regulatory Commission enclosing NED0-32465-A, "Licensing Topical Report, Reactor Stability Detect and Suppress Solutions Licensing Basis Methodology for Reload Applications, Licensing Topical Report," Class I, August 1996 (ADAMS Accession No. ML072260045; Non-Public).

4.20 Thorp, J. E., memorandum to Michael T. Markley, U.S. Nuclear Regulatory Commission, "Audit Report Columbia Calculation Review, Columbia Generating Station, License Amendment Request to change Technical Specifications in support of PRNM/ARTS/

MELLLA implementation," dated April 22, 2013 (not publicly available).

4.21 Thadani, M. C., U.S. Nuclear Regulatory Commission, letter to Mark E. Reddemann, Energy Northwest, "Columbia Generating Station -Amendment Re: Increased Boron Concentration in Standby Liquid Control System," dated May 18, 2011 (ADAMS Accession No. ML111170370).

4.22 Oxenford, W. S., Energy Northwest, letter to U.S. Nuclear Regulatory Commission, "Columbia Generating Station, Docket No. 50-397 License Amendment Request to change Technical Specifications in Support of PRNM/ARTS/MELLLA Implementation,"

dated May 11, 2010 (ADAMS Accession No. ML101390369).

4.23 Oxenford, W. S., Energy Northwest, letter to U.S. Nuclear Regulatory Commission, "Columbia Generating Station, Docket No. 50-397 Response to Request for Supplemental Information for Completion of Acceptance Review for PRNM/ARTS/

MELLLA System Upgrade," dated July 30, 2010 (ADAMS Accession No. ML102360357).

4.24 Lyon, C. F., U.S. Nuclear Regulatory Commission, letter to Mark E. Reddemann, Energy Northwest, "Columbia Generating Station -Columbia Generating Station - Non-acceptance of Request to Change Technical Specification in Support of OFFICIAL USE ONLY- PROPRIETARY INFORMATION

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 106-PRNM/ARTS/MELLLA Implementation (TAC No. ME3981)," dated September 13, 2010 (ADAMS Accession No. ML102420659).

4.25 Singal, B. K., U.S. Nuclear Regulatory Commission, "Summary of January 18, 2011, Category 1 Meeting with Energy Northwest - Pre-Licensing Meeting to Discuss the Proposed Installation of a of a Digital (PRNMS), Average Power Range Neutron Monitoring Systems (PRNMS), Average Power Range Monitor/Rod Block Monitoring Specifications (ARTS), and Extended Load Line Limit Analysis (MELLLA) License Amendment Request (TAC No. ME5129)," dated February 3, 2011 (ADAMS Accession No. ML110210130).

4.26 Thadani, M. C., U.S. Nuclear Regulatory Commission, "Summary of July 6, 2011, Category 1 Meeting with Energy Northwest- Pre-Licensing Meeting to Discuss the Proposed Installation of a of a Digital (PRNMS), Average Power Range Neutron Monitoring Systems (PRNMS), Average Power Range Monitor/Rod Block Monitoring Specifications (ARTS), and Extended Load Line Limit Analysis (MELLLA) License Amendment Request (TAC No. ME5129)," dated August 4, 2011 (ADAMS Accession No. ML111990074).

4.27 Swank, D. A., Energy Northwest, letter to U.S. Nuclear Regulatory Commission, "Responses to Request for Additional Information Related to License Amendment Request for PRNM/ARTS/MELLLA (TAC No. ME7905)," dated August 6, 2013 (ADAMS Accession No. ML13233A287).

4.28 Shoop, U. S., memorandum to Michael Markley, U.S. Nuclear Regulatory Commission, "Safety Evaluation Input Relating to Columbia Generating Station License Amendment Request: Change to Technical Specifications In Support of Power Range Neutron Monitoring System (PRNM)/Rod Block Monitor Technical Specification (ARTS)/

Maximum Extended Load Line Limit Analysis (MELLLA) Implementation (TAC No. ME7905)," dated November 20, 2013 (not publicly available).

4.29 Jackson, C. P., memorandum to Michael T. Markley, U.S. Nuclear Regulatory Commission, "Safety Evaluation of Columbia Generating Station License Amendment Request- Proposed Technical Specification Changes to Implement the ARTS/MELLLA Expanded Operating Domain," dated March 7, 2013 (not publicly available).

4.30 Wunder, G. F., U.S. Nuclear Regulatory Commission, letter to Christopher Crane, Exelon Nuclear, "Peach Bottom Atomic Power Station License Amendment Request RE:

Activation of Oscillation Power Range Monitor Trip," dated March 21, 2005 (ADAMS Accession No. ML050270020).

5.0 HUMAN PERFORMANCE EVALUATION 5.1 Introduction The NRC staff conducted a human factors review of the licensee's application, since the proposed changes include operator manual actions (OMAs). The results of the NRC staff's review are documented below.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 107-5.2 Regulatory Evaluation The regulatory requirements and guidance which the NRC staff considered in its review of the LAR are as follows:

Appendix A to Title 10 of the Code of Federal Regulations (1 0 CFR) Part 50, "General Design Criteria (GDC)," Criterion 19 - Control room. "A control room shall be provided from which actions can be taken to operate the nuclear power unit safely under normal conditions and to maintain it in a safe condition under accident conditions, including loss-of-coolant accidents.

Equipment at appropriate locations outside the control room shall be provided (1) with a design capability for prompt hot shutdown of the reactor, including necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown, and (2) with a potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures."

10 CFR 50.120, "Training and qualification of nuclear power plant personnel"

NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition":

Chapter 13 addresses "Conduct of Operation," specific sub-chapters considered in this review were Chapters 13.2.1, "Reactor Operator Requalification Program; Reactor Operator Training," Rev. 3, and 13.5.2.1, "Operating and Emergency Operating Procedures" Rev. 2.

Chapter 18, Rev. 2, provides review guidance for "Human Factors Engineering."

NUREG-1764, Revision 1, "Guidance for the Review of Changes to Human Actions," September 2007 (ADAMS Accession No. ML072640413);

NRC Generic Letter (GL) 1982-33, "Supplement 1 to NUREG-0737-Requirements for Emergency Response Capability," dated December 17, 1982 (ADAMS Accession No. ML031080548);

NUREG-0700, Revision 2, "Human-System Interface Design Review Guidelines,"

May 2002 (ADAMS Accession No. ML021700373);

NUREG-0711, Revision 2, "Human Factors Engineering Program Review Model," February 2004 (ADAMS Accession No. ML110140727); and

NRC Information Notice (IN) 1997-78, "Crediting Operator Actions in Place of Automatic Actions and Modifications of Operator Actions, Including Response Times," dated October 23, 1997 (ADAMS Accession No. ML031050065).

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 108-In accordance with the generic risk categories established in Appendix A to NUREG-1764, the tasks under review are involved in the safety injection sequence, are actions performed during shutdown, and are actions involving risk-important systems, and are, therefore, considered "risk-important." Because of its estimated risk importance, the NRC staff performed a "Level One" review (i.e., the most stringent of the graded reviews possible under the guidance of NUREG-1764).

Note: The NRC staff assessment of risk for this section is only for purposes of seeping the particular area of review. It may not coincide with the licensee's assessment of risk importance, and should not be considered as an accurate assessment of risk when compared to other methods, e.g., those using plant-specific data and NRC-accepted methods of Probabilistic Risk Analysis and Human Reliability Analysis, PRA/HRA.

5.3 Technical Evaluation 5.3.1 Description of Operator Action(s) Added/Changed/Deleted In an RAI response letter dated August 22, 2012, the licensee stated that no operator actions are being changed, added, or deleted as a result of the PRNMS modifications or the change in the licensing basis for the number of required SLC pumps needed to mitigate ATWS. The licensee stated, however, that with the implementation of MELLLA, the operators will be required to change the setpoints for the flow-biased recirculation system input to the APRM when transitioning from normal two-loop reactor recirculation operations to single-loop operations (SLO). This change will be captured in the transition to SLO procedure. Based on the operator action to change the setpoints during this transition being controlled in the transition procedure, the NRC staff concludes that the expected change is acceptable.

5.3.2 Operating Experience Review The licensee reviewed numerous industry issues related to digital systems and the Power Range Neutron Monitoring System (PRNM) in particular. The RAI response letter dated August 22, 2012, contains a list of the relevant operating experience summary and discusses how CGS is applying the insights learned. The NRC staff has reviewed this list and summaries and determined that the licensee has adequately and appropriately reviewed and is applying the operating experience for the proposed changes.

5.3.3 Functional Requirements Analysis and Function Allocation Because the existing operator actions associated with the proposed change are simple, are part of existing Plant Procedures, and do not add significant workload, a re-analysis of the functional requirements analysis and function allocation is not necessary. The licensee's engineering analysis was sufficient to identify procedure and training impacts, and to confirm the human system interface design requirements which will change as a result of this LAR. No further analysis is needed beyond that provided by the licensee. The NRC staff concludes that the changes are acceptable based on the fact that there are no additional operator actions and, therefore, no significant change operator workload.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 109-5.3.4 Task Analysis Operations with the ARTS/MELLLA improvements do not change the required operator actions with the exception of a procedurally controlled change in operating setpoints when transitioning to SLO. As there have been no changes to operator actions or functions, no new task analysis was performed.

The NRC staff concludes that revision of the licensee's task analysis is not necessary, because the actions associated with this proposed change are not new and are proceduralized. In addition, the existing actions are simple, easy, and do not require changes to physical interfaces.

5.3.5 Staffing Based on the simplicity of operation, no new or additional staff are required, nor are there any new or additional qualifications required to perform the actions within the time constraints established. The NRC staff concludes that no additional staffing or qualifications, or changes thereto, are required, and concludes that this human performance aspect of the LAR is acceptable.

5.3.6 Probabilistic Risk and Human Reliability Analyses The licensee chose not to submit a risk-informed application using PRAIHRA and, therefore, did not identify any additional human reliability insights that might be applicable to operator performance. However, because a probabilistic basis for plant changes is not strictly required, this approach is acceptable to the NRC staff.

5.3. 7 Human-System Interface Design In an RAI response letter dated August 22, 2012, the licensee provided a list of changes to physical interfaces for the Control Room Operator. These changes include:

Replacing two existing APRM bypass switches on the main operator console with a single mechanical fiber optic bypass switch,

Replacing the LPRM meters with four Operator Display Assembly (ODA)

NUMAC units on the main operator console, which provide OPRM status information as well as conventional Source Power Range Monitor (SPRM) and LPRM data,

Removing two existing flow unit bypass switches on the main operator console because the switch functions have been moved to the fiber optic bypass switch and indication/status will be displayed at the ODA,

Removing eight existing intermediate range monitor (IRM)/ APRM/ RBM selector switches on the main operator console. Each IRM/APRM/RBM input will instead be wired to a dedicated channel on one of four recorders.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 110-

Updating or deleting various annunciator window tiles, status lights, and computer points per the modification package,

Installing a NUMAC PRNM System back-panel, containing LPRM/APRM/RBM chassis, RBM interface units, Two-out-of-Four Logic system and power supply chassis, into the existing LPRM/APRM/Fiow Unit cabinetry, and

Removing the existing OPRM interface computer.

The NRC staff has reviewed these changes, and concludes that they are adequate to support human-system interface, because they will still allow the necessary SPRM, LPRM and APRM information and status to be displayed. A single bypass switch minimizes operator movement because there is only one switch instead of two. This improves the ability of the Operation staff to take appropriate action from one centralized location when necessary. The NRC staff concludes that these changes are appropriate and acceptable.

5.3.8 Procedure Design The following procedures will be revised as a result of the proposed LAR:

Reactor Recirculation Procedures: Abnormal, Operating, and Surveillance procedure changes will include the new power-to-flow map (two-loop operation) which reflects the MELLLA operating domain. The transition to recirculation SLO will include requirements to reduce rod line as necessary to get below the Extended Load Line Limit Analysis (ELLLA) boundary by inserting control rods.

This does not constitute a change in operator actions since the current transition to SLO already requires that rod line be reduced to avoid operation in plant instability regions. A change in setpoints for the APRM system simulated thermal power trip will also be required since the plant will not be retaining the MELLLA setpoints while in SLO. This change in setpoint will be controlled by the SLO transition procedures and involves selecting new digital setpoints in the PRNMS.

Establishing the new setpoints will not challenge TS completion time requirement of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months forTS 3.4.1 Condition B.

Alarm Response Procedures: These are impacted by a reduction in the number of annunciators. The reduction will occur because the APRMs were previously divided into two groups or divisions, but the PRNM System has grouped the APRMs into one group, which is non-divisional. Therefore, the same alarm is actuated from any of the four APRM channels or OPRM channels. There are no new operator actions required to support alarm responses.

Administrative procedure changes: This includes control of Plant Operating Keys procedure. The change will require removing keys that are no longer needed and adding keys related to bypassing the PRNMS. Based on the procedure changes described by the licensee, the NRC staff concludes that appropriate revisions to plant procedures have been made or will be made in support of the proposed LAR.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 111 -

5.3.9 Training Program Design In an RAI response to training impacts dated August 22, 2012, the licensee stated that simulator training involving operations in the MELLLA domain will be conducted for Licensed Operators prior to operating in the MELLLA domain and is currently scheduled to occur in December of 2014. The training will occur after the simulator is updated to include the PRNM modifications.

Operations in the MELLLA domain are not anticipated until 2015. The licensee also stated that simulator training on the PRNMS will be conducted for Licensed Operators after the simulator is updated to include PRNM modifications. This training will be completed prior to startup from the planned implementation outage in 2015. Based on the licensee's statements that operators will be trained on the PRNM modifications and on operation in the MELLLA domain prior to implementation the staff finds the expected revisions to the training program acceptable.

5.3.1 0 Human Factors Verification and Validation (V&Vl In an RAI response dated November 12, 2012, the licensee stated that no operator actions are being changed, added, or deleted as a result of this upgrade, and that no new task analysis were being performed. With no operator actions changing, the need for a human-system task support verification is not needed. The design of the PRNM replacement equipment meets the intent of NUREG-0700. The base design for the plant operator's panel uses the existing operator interface devices, so there is no effect on the plant human factors evaluations. Energy Northwest confirmed the diagnosis of minimal operator impact during the Factory Acceptance Test using the new hardware attached to a plant simulator. For the upgrade to the PRNMS, an integrated system validation is not warranted as there is no change in required operator actions for the replacement hardware. Operator tasks remain unchanged, hence there is no impact to the task dynamics, complexity, or workload for the Operations staff. The PRNMS provides the same information as the current Neutron Monitoring System, such that there is reasonable expectation that there will be little or no overall effect on the operations staff with regards to workload or the likelihood of error.

5.3.11 Human Performance Monitoring Strategy There are no changes being made to operator actions with the installation of the new system, and no integrated system validation was warranted. Since the system provides automatic functions for the reactor protection system which are the same as the existing analog systems, there are no changes in required operator actions. Therefore, there is no need to monitor the human actions for degradation in performance, and hence, there is no need for a human performance monitoring program for this system upgrade.

5.4 Conclusion Based on the information provided in the LAR and the RAI letters dated August 22, 2012, and November 12, 2012, the NRC staff concludes that the proposed changes in support of PRNM/ARTS/MELLLA implementation are acceptable because there are no changes to operator actions and minimal changes to procedures. Training will be conducted prior to implementation of the PRNM or operation in the MELLLA domain. The human interface design changes are adequate to support these changes because the design will still provide the status information the operators require.

OFFICIAL USE ONLY- PROPRIETARY INFORMATION

- 112-

6.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Washington State official was notified of the proposed issuance of the amendment. The State official had no comments.

7.0 ENVIRONMENTAL CONSIDERATION

The amendment changes a requirement with respect to the installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendment involves no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendment involves no significant hazards consideration and there has been no public comment on such finding published in the Federal Register on September 11, 2012 (77 FR 55867). Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

8.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors: G. Singh, NRR/DE/EICB M. Keefe, NRR/DRA/AHPB M. Razzaque, NRR/DSS/SRXB K. Bucholtz, NRR/DSS/STSB Date: January 31, 2014

Attachment:

List of Acronyms and Abbreviations OFFICIAL USE ONLY- PROPRIETARY INFORMATION

Attachment A List of Acronyms and Abbreviations AIMSAR ARTS/MELLLA safety analysis report ABA Amplitude based algorithm ABB ASEA Brown Boveri ADAMS Agencywide Documents Access and Management System AFT As-found tolerance AGAF Automatic gain adjustment factor AL Analytical limit ALT As-left tolerance AOO Anticipated operational occurrence APRM Average power range monitor ARI Alternate rod insertion ARTS Average Power Range Monitor/Rod Block Monitorfiechnical Specifications ASME American Society of Mechanical Engineers ATWS Anticipated transient without scram AV Allowable value BSP Backup stability protection BT Boiling transition BTP Branch technical position BWR Boiling-water reactor BWROG Boiling Water Reactor Owners' Group CAP Corrective action program CCF Common-cause failure CFR Code of Federal Regulations CGS Columbia Generating Station CLTP Current licensed thermal power COLR Core operating limits report CPR Critical power ratio CRDA Control rod drop accident 03 Diversity and defense-in-depth DI&C Digital instrumentation and controls DIVOM Delta CPR Over Initial MCPR Versus Oscillation Magnitude DSS Detection and suppress ECCS Emergency core cooling system EDS Electrostatic discharge ELL LA Extended load line limit analysis EMC Electromagnetic compatibility EMI/RFI Electromagnetic and radio-frequency interference FOOl Fiber direct data interface FRTP Fraction of rated thermal power FSAR Final safety analysis report FW Feedwater FWCF Feedwater controller failure GDC General design criterion GEH General Electric-Hitachi GRA Growth rate algorithm HPCS High pressure core spray HPSP high power setpoint

HPTS High power trip setpoint I&C Instrumentation and controls IN Current-to-voltage ICF increased core flow IEC International Electrotechnical Commission IEEE Institute for Electrical and Electronics Engineers IORV Inadvertent opening of a relief valve IRLS Idle recirculation loop start-up ISA Instrument Society of America IV&V Independent verification and validation LAR License amendment request LCO Limiting condition for operation LER Licensee event report LFWH Loss of feedwater heating LHGR Linear heat generation rate LOCA Loss-of-coolant accident LOOP Loss-of-offsite power LPRM Local power range monitor LRNBP Load rejection with no bypass LSFT Logic system functional test LSSS Limiting safety system setpoint LTR Licensing topical report LTS Long-term stability solution LTSP Limiting trip setpoints MAPLHGR Maximum average planar linear heat generation rate MCC Motor control center MCHFR Maximum critical heat flux ratio MCPR Minimum critical power ratio MELLLA Maximum extended load line limit analysis MFLPD Maximum fraction of limiting power density MG Motor generator MHLGR Maximum linear heat generation rate MSIV Main steam isolation valve MSIVC Closure of all MSIVs MSIVF Main steam isolation valve closure with a flux scram MWt megawatts-thermal NIC NUMAC interface computer NMS Neutron Monitoring System NRC U.S. Nuclear Regulatory Commission NSSS Nuclear Steam Supply System NUMAC Nuclear Measurement Analysis and Control OBE Operating basis earthquake ODA Operator display assembly OLMCPR Operating limit minimum critical power ratio OM Code Code for Operations and Maintenance of Nuclear Power Plants OPRM Oscillation power range monitor P/F power flow PBDA Period based detection algorithm PCT Peak cladding temperature

PPC Primary plant computer PRFO Pressure regulatory failure open PRNM Power range neutron monitoring PRNMS Power range neutron monitoring system Psid pounds per square inch differential Psig pounds per square inch gauge PWP Project Work Plan RAI Request for additional information RBM Rod block monitor RCF Rated core flow RCPB Reactor coolant pressure boundary RCS Reactor coolant system RFI Recirculation flow increase RG Regulatory guide RMCS Reactor manual control system RPS Reactor protection system RPT Recirculation pump trip RSLB Recirculation suction line break RTP Rated thermal power RTS Reactor trip system RWE Rod withdrawal error SAFDL Specified acceptable fuel design limit SAR Safety analysis report SCMP Software Configuration Management Plan SOP Software development plan SE Safety evaluation SER Safety evaluation report SL Safety limit SLCS Standby liquid control system SLMCPR Safety limit minimum critical power ratio SLO Single-loop operation SMP Software Management Plan SPRM Source power range monitor SR Surveillance requirement SRLR Supplemental reload licensing report SRSS Square root sum of squares SSE Safe shutdown earthquake STP Simulated thermal power SWP Software Verification and Validation Plan TLO Two-loop operation TRACG GE proprietary version of transient reactor analysis code TS Technical Specification TSTF Technical Specifications Task Force TTNBP Turbine trip with no bypass V&V Verification and validation

ML133178620 _{proprietary); ML133178623 (non-proprietary)~ *SE memo dated OFFICE NRR/DORULPL4-1/PM N RRIDORULPL4-1/LA NRR/DE/EICB/BC* NRR/DSS/SRXB/BC*

NAME FLyon JBurkhardt JThorp SMiranda (A)

DATE 1/31/14 12/18/13 9/27113 3/7/13 OFFICE NRRIDRA!AHPB/BC* NRRIDSS/STSB/BC* OGC NRRIDORULPL4-1/BC NRRIDORULPL4-1/PM NAME US hoop REIIiott DRoth NLO MMarkley FLyon DATE 11/20/12 5/10/13 1/27/14 1/31/14 1/31/14

v t e Letter Sequence Approval
TAC:ME7905, Clarify Application of Setpoint Methodology for LSSS Functions (Approved, Closed)
Initiation Request, Request, Request, Request, Request, Request, Request, Request, Request, Request, Request, Request, Request, Request, Request, Request, Request Acceptance Administration Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance, Withholding Request Acceptance Questions 15 June 2012 15 June 2012 10 July 2012 10 July 2012 17 September 2012 23 July 2012 5 September 2012 15 October 2012 18 December 2012 12 March 2013 8 April 2013 10 April 2013 26 April 2013 3 June 2013 10 July 2013 23 August 2013 Answers 22 August 2012 5 October 2012 12 November 2012 11 April 2013 9 May 2013 6 August 2013 Results Approval Other:
MONTHYEAR2012-07-10 [Table View]

ML13317B623: Difference between revisions

Latest revision as of 01:12, 20 March 2020

Text

SUBJECT:

Dear Mr. Reddemann:

Enclosures:

Attachment:

1.0 INTRODUCTION

6.0 STATE CONSULTATION

7.0 ENVIRONMENTAL CONSIDERATION

8.0 CONCLUSION

1.0 INTRODUCTION

6.0 STATE CONSULTATION

7.0 ENVIRONMENTAL CONSIDERATION

8.0 CONCLUSION

Attachment:

Navigation menu

ML13317B623: Difference between revisions

Latest revision as of 01:12, 20 March 2020

Text

SUBJECT:

Dear Mr. Reddemann:

Enclosures:

Attachment:

1.0 INTRODUCTION

6.0 STATE CONSULTATION

7.0 ENVIRONMENTAL CONSIDERATION

8.0 CONCLUSION

1.0 INTRODUCTION

6.0 STATE CONSULTATION

7.0 ENVIRONMENTAL CONSIDERATION

8.0 CONCLUSION

Attachment:

Navigation menu

Search