ML23284A425

10 CFR 50.59 and 10 CFR 72.48 Changes, Tests, and Experiments Summary Report; Commitment Summary Report; and Update to the Fire Protection Report

ML23284A425
Person / Time
Site:	Sequoyah
Issue date:	10/11/2023
From:	Marshall T Tennessee Valley Authority
To:	Office of Nuclear Material Safety and Safeguards, Office of Nuclear Reactor Regulation, Document Control Desk
References
Download: ML23284A425 (1)

Text

Sequoyah Nuclear Plant, Post Office Box 2000, Soddy Daisy, Tennessee 37384 October 11, 2023 10 CFR 50.59 10 CFR 72.48 10 CFR 50.71 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Sequoyah Nuclear Plant, Units 1 and 2 Renewed Facility Operating License Nos. DPR-77 and DPR-79 NRC Docket Nos. 50-327, 50-328, and 72-034

Subject:

10 CFR 50.59 and 10 CFR 72.48 Changes, Tests, and Experiments Summary Report; Commitment Summary Report; and Update to the Fire Protection Report

Reference:

1. TVA letter to NRC, 10 CFR 50.59 and 10 CFR 72.48 Changes, Tests, and Experiments Summary Report and Commitment Summary Report, dated May 9, 2022

2. TVA letter to NRC, Update to Fire Protection Report, dated April 18, 2022 In accordance with 10 CFR 50.59(d)(2) and 10 CFR 72.48(d)(2), Enclosure 1 is the Sequoyah Nuclear Plant (SQN), Units 1 and 2, Summary Report regarding the implemented changes, tests, and experiments for which evaluations were performed in accordance with 10 CFR 50.59(c) and 10 CFR 72.48(c). The summarized evaluations provided in the enclosure were implemented since the Reference 1 Letter through September 18, 2023.

Since last reported in the Reference 1 Letter, SQN has revised a regulatory commitment in accordance with NEI 99-04, the Nuclear Energy Institute's "Guidelines for Managing NRC

[Nuclear Regulatory Commission] Commitment Changes," as endorsed in NRC Regulatory Issue Summary 2000-17. The commitment change summary is provided in Enclosure 2.

Since last reported in Reference 2 Letter, SQN has not made a revision to the SQN Fire Protection Report (FPR). The SQN FPR is incorporated by reference into the SQN Updated Final Safety Analysis Report and this letter serves to meet the periodic reporting requirement of 10 CFR 50.71(e).

U.S. Nuclear Regulatory Commission Page 2 October 11, 2023 There are no new commitments contained in this letter. If you have any questions concerning this submittal, please contact Mr. Rick Medina, SQN Licensing Manager at (423) 843-8129 or rmedina4@tva.gov.

Respectfully, Digitally signed by Marshall, Marshall, Thomas B. Thomas B.

Date: 2023.10.11 06:56:38 -04'00' Thomas Marshall Site Vice President Sequoyah Nuclear Plant Enclosures 1. 10 CFR 50.59, and 10 CFR 72.48 Changes, Tests, and Experiments Summary Report

2. Commitment Change Report cc (w/Enclosures):

NRC Regional Administrator - Region II NRC Senior Resident Inspector - Sequoyah Nuclear Plant Director, Division of Fuel Management, Office of Nuclear Material Safety and Safeguards NRC Project Manager - Sequoyah Nuclear Plant

ENCLOSURE 1 SEQUOYAH NUCLEAR PLANT 10 CFR 50.59 AND 10 CFR 72.48 CHANGES, TESTS, AND EXPERIMENTS

SUMMARY

REPORT E1-1

DESIGN DESCRIPTION SAFETY ANALYSIS CHANGES SQN-18-052 The scope of work associated with this Unit 1 design change The addition of relays in control circuits for the Steam Generator ARVs and Stages 10 and will address the following sets of circuits that were previously Containment VRIVs have been identified in the 10 CFR 50.59 screening review 11 identified by TVA to have the Ground Fault Equivalent Hot as having an adverse effect on Updated Final Safety Analysis (UFSAR) design Shorts (GFEHS) issue / spurious conditions: functions.

1. Prevent spurious opening of the Steam Generator Based on the responses to all 10 CFR 50.59 Evaluation Questions it is Atmospheric Relief Valves (ARVs) due to GFEHS. concluded that this activity to modify circuits for the Steam Generator ARVs and

2. Prevent spurious opening of the Containment Sump Containment VRIVs does not result in an increase of frequency and Isolation Valves due to GFEHS. consequences of an accident previously evaluated in the UFSAR or create a

3. Prevent spurious closure of the Containment Vacuum possibility for an accident of a different type than any previously evaluated in Relief Isolation Valves (VRIVs) due to GFEHS. the UFSAR. This activity does not result in an increase in the likelihood of

4. Prevent spurious closure of the Essential Raw Cooling occurrence and consequences of a malfunction of an structure, system, and Water (ERCW) to Diesel Generator (DG) Heat Exchanger component (SSC) important to safety previously evaluated in the UFSAR or Valves which has the potential to fail all four DGs. create a possibility for a malfunction of an SSC important to safety with a

5. Prevent spurious opening and stall condition for cold different result than any previously evaluated in the UFSAR. This activity does shutdown valves due to GFEHS. not affect the design basis limit for a fission product barrier as described in the UFSAR. This activity does not result in a departure from a method of evaluation described in the UFSAR used in establishing the design bases or in the safety analyses.

This conclusion is based on the following:

The new relays are safety related components whose reliability is equal to components in the same circuit. New relays simply duplicate the original circuit signal. Relays are seismically mounted and are qualified for the environment.

For the VRIVs the increase in response time of the B solenoid energization does not increase the consequences of an accident previously evaluated in the UFSAR. Based on above statements, there is no increase in the likelihood of occurrence of a malfunction of the affected SSCs and there is no increase in the consequences of an accident previously evaluated in the UFSAR and, therefore, there is no impact on any of the SSCs functions.

Therefore, this activity may be implemented per plant procedures and does not require a License Amendment Request.

E1-2

SQN-18-053 The scope of work associated with this Unit 2 design change The addition of relays in control circuits for the Steam Generator ARVs and Stages 1-11 package will address the following sets of circuits that were VRIVs have been identified in the 10 CFR 50.59 screening review as having an previously identified by TVA to have the GFEHS issue / adverse effect on UFSAR design functions.

spurious conditions:

Based on the responses to all 10 CFR 50.59 Evaluation Questions it is

1. Prevent spurious opening of the Steam Generator ARVs concluded that this activity to modify circuits for the Steam Generator ARVs and due to GFEHS. Containment VRIVs does not result in an increase of frequency and

2. Prevent spurious opening of the Containment Sump consequences of an accident previously evaluated in the UFSAR or create a Isolation Valves due to GFEHS. possibility for an accident of a different type than any previously evaluated in

3. Prevent spurious closure of the Containment VRIVs due to the UFSAR. This activity does not result in an increase in the likelihood of GFEHS. occurrence and consequences of a malfunction of an SSC important to safety

4. Prevent spurious closure of the ERCW to DG Heat previously evaluated in the UFSAR or create a possibility for a malfunction of Exchanger Valves which has the potential to fail all four an SSC important to safety with a different result than any previously evaluated DGs. in the UFSAR. This activity does not affect the design basis limit for a fission product barrier as described in the UFSAR. This activity does not result in a departure from a method of evaluation described in the UFSAR used in establishing the design bases or in the safety analyses.

This conclusion is based on the following:

The new relays are safety related components whose reliability is equal to components in the same circuit. New relays simply duplicate the original circuit signal. Relays are seismically mounted and are qualified for the environment.

For the VRIVs the increase in response time of the B solenoid energization does not increase the consequences of an accident previously evaluated in the UFSAR. Based on above statements, there is no increase in the likelihood of occurrence of a malfunction of the affected SSCs and there is no increase in the consequences of an accident previously evaluated in the UFSAR and, therefore, there is no impact on any of the SSCs functions.

Therefore, this activity may be implemented per plant procedures and does not require a License Amendment Request.

SQN-19-328 The existing Unit Main Feed Pump Turbine (MFPT) control This evaluation has determined that the MFPT Control System and DCS will (Unit 1) system is obsolete and is replaced by a new control system. continue to meet its design requirements following the implementation of the The replacement system adds equipment to the plants proposed modification that converts to a digital control system. The use of the SQN-19-329 Distributed Control System (DCS) for MFPT control and uses new Feedwater Pump Control DCS Human-System Interface (HMI) displays (Unit 2) electric actuators for positioning of the High Pressure (HP) and will not adversely impact any MFPT control functions or create additional Low Pressure (LP) MFPT steam control valves. operator burden. The deletion of the seal injection water trip will also not create additional operator burden. The design functions of the existing DCS Nuclear E1-3

The system incorporates the control, protective, and monitoring Safety Support Systems/Balance of Plant (NSSS/BOP) and Auxiliary Control functions of the existing MFPT controls with enhancements applications are not changed or modified.

designed to improve fault tolerance. The system provides automatic and manual speed control. The system is designed Since the new MFPT Control System components are more reliable than the to minimize the potential for the failure or malfunction of any existing components and no new system level failure mode effects are single component adversely impacting MFPT and plant introduced, the proposed modification does not result in more than a minimal operation. Failures and malfunctions will be alarmed. The increase in the frequency of occurrence of an accident or transient previously system is configured to support on-line maintenance such as evaluated in the SQN UFSAR.

hot swappable modules and power supplies.

The new equipment being installed will not result in any component malfunctions that could increase the potential for a trip or transient, nor will any malfunction result in an increase in the potential for a required protective function to be performed (tripping the MFPT). Therefore, the modification does not result in more than a minimal increase in the likelihood of occurrence of a malfunction of an SSC important to safety previously evaluated in the UFSAR.

Performance requirements associated with core cooling are unaltered such that fuel integrity will be maintained and the UFSAR analysis of radiological consequences remains bounding. The new equipment will not initiate any new accidents. The modification will not impair or prevent the emergency core cooling system (ECCS) from mitigating the consequences of any design basis accidents. Therefore, this activity does not result in more than a minimal increase in the consequences of an accident previously evaluated in the UFSAR.

Failure or malfunction of the new equipment will not prevent or affect the ability of safety related systems or systems important to safety to respond to the accidents described in the UFSAR. Therefore, implementation of the proposed modification does not result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the UFSAR. The potential malfunctions of the modified equipment are bounded at a system level in the UFSAR. Therefore, the possibility for an unanalyzed malfunction of an SSC important to safety or an accident of a different type than any previously evaluated in the UFSAR is not created.

As described in the UFSAR accident analysis, no malfunction of the MFPT Control System or DCS can cause a transient sufficient to damage the fuel barrier or exceed the nuclear limits as required by the safety design basis.

Therefore, the possibility for an unanalyzed malfunction of an SSC important to E1-4

safety that can challenge a fuel barrier or an accident of a different type than any previously evaluated in the UFSAR is not created.

The new digital equipment does not necessitate a revision or replacement of any currently used evaluation methodology. The modification does not result in a departure from the method of evaluation described in the UFSAR in establishing the design bases or in the safety analyses.

The 50.59 screening review concludes that implementation of the modification does not require a Technical Specification change. This evaluation concludes that implementation of the modification does not require a License Amendment, and therefore may proceed without NRC approval.

SQN-20-1082 This activity replaces the Spent Fuel Handling Bridge (SFHB) The activity being addressed by this evaluation is the replacement of the to eliminate age-related degradation and obsolescence issues existing SFHB control system with a digital control system. The existing control and to improve efficiency. The SFHB replacement consists of system consists of a relay-based control system. The replacement control replacing the existing SFHB steel structure in its entirety and all system consists of a PLC based platform with touch screen displays and VFDs.

associated components and equipment with a new SFHB The PLC based system employs the use of boundary zones to enhance system structure and modern electrical systems and control systems safety as well as enabling automatic and semi-automatic bridge and hoist (including a programmable logic controller (PLC), AC induction trolley operation. The lifting hoists continue to be manually operated. The HMI motors, variable frequency drives (VFDs), control panels, design is similar to the design used on fuel handling equipment used at other pendant control consoles (PCCs), and monitoring stations). nuclear utilities as well as at Browns Ferry Nuclear Plant and has been reviewed and accepted by SFHB operating personnel. The remaining basic The existing SFHB analog control system is being replaced design functions of the SFHB are retained and are not adversely impacted by with a new control system. The new control system is a digital the proposed activity.

system with touch screen operator interfaces. The existing control system is relay based and utilizes pushbuttons, Digital device quality assurance measures include: 1) development of a project switches and indicator lights in the operator interfaces. specific software quality assurance plan, 2) performance of critical digital reviews, 3) performance of a failure modes and effects analysis (FMEA), 4)

The following control system functions have a potentially extensive acceptance testing and 5) a qualitative assessment to support a adverse effect on the method of performing the SFHB function conclusion that the digital control system upgrade has a sufficiently low to safely transport fuel assemblies: likelihood of failure. The use of these quality assurance measures provides x the replacement of the relay based SFHB control system reasonable assurance that the use of digital controls in the SFHB does not with a digital SFHB control system may potentially result in increase the probability or the consequences of any Fuel Handling Accident a marginal increase in the likelihood of failure due to the described in the UFSAR, nor will it introduce the possibility of a new type of introduction of software/firmware, accident not previously considered. The assumptions and conclusions of the x combining previously separate functions into one SFHB existing Fuel Handling Accident analyses remain valid. No reductions in the digital device (i.e., the PLC) may potentially create new existing margins of safety are created by implementing this modification. The malfunctions, existing shutdown margins during refueling operations are maintained. The E1-5

x converting the manual operation of the bridge and trolley to existing submergence limits and radiation shielding margins are retained. No automatic operation when using the semi-automatic and changes to the Technical Specifications or their Bases are required.

automatic modes of operation may potentially increase the likelihood of a malfunction, Therefore, this activity may be implemented per plant procedures and does not x the new control system utilizes enhanced HMIs that require a License Amendment Request.

employ "touch screen" technology, video displays, and joy sticks for improved information presentation and ergonomics. This is conservatively considered a fundamental change in data presentation and operator interaction and is screened in as being potentially adverse.

These control system functions may have a potentially adverse effect on the SFHB function to safely handle fuel assemblies.

SQN-20-1174 This modification addresses an Appendix R issue with the Based on the responses to all 10CFR50.59 Evaluation Questions, the activity to Stages 1-4 Residual Heat Removal (RHR) pump minimum flow valves. modify the RHR pump minimum flow valve circuits:

The following aspects of the activity have been identified as x does not result in an increase of frequency and consequences of an having an adverse effect on UFSAR design functions: accident previously evaluated in UFSAR or create a possibility for an x addition of interposing relays in the valve control circuits accident of a different type than any previously evaluated in the UFSAR x reconfiguring the valve handswitch auto permissive x does not result in an increase in the likelihood of occurrence and contact. consequences of a malfunction of an SSC important to safety previously evaluated in the UFSAR or create a possibility for a malfunction of an SSC This Design Change Package modifies the control logic and important to safety with a different result than any previously evaluated in annunciation for Motor Operated Valves (MOVs) and installs the UFSAR interposing relays. After the modification, postulated control x does not affect the design basis limit for a fission product barrier as building fire induced faults will not prevent the valve automatic described in the UFSAR control logic from opening the valves. Thus, the automatic x does not result in a departure from a method of evaluation described in the operation of the minimum flow valves will be assured, UFSAR used in establishing the design bases or in the safety analyses.

preventing any possibility of a deadhead condition due to a fire induced spurious start of an RHR pump. This conclusion is based on the following:

The new relays are safety related components whose reliability is equal to components in the same circuit. New relays simply duplicate the original MCR initiated circuit signals. Relays are seismically mounted and are qualified for their environment. There is no increase in the likelihood of occurrence of a malfunction of the affected SSCs and there is no increase of the consequences of an accident previously evaluated in the UFSAR. Therefore, there is no impact on any of the SSCs functions.

E1-6

Therefore, this activity may be implemented per plant procedures and does not require a License Amendment Request.

SQN-20-1239 Units 1 and 2, will transition from Framatome high thermal The transition from Framatome HTP fuel to WEC RFA-2 fuel includes rerunning Stages 1-2 performance (HTP) fuel to Westinghouse Electric Company and revising safety analyses currently documented in the UFSAR and use of (WEC) 17x17 Robust Fuel Assembly-2 (RFA-2) Fuel, new methodologies in support of the fuel transition design. As noted in the commencing with Unit 1 Cycle 26 and Unit 2 Cycle 26. The 10 CFR 50.59 screen, methodologies currently stated in the UFSAR will be transition will occur over the course of three outage cycles. replaced with new methodologies. The methodologies used are methods The screening activity specifically addressed portions of the approved by the NRC and/or are addressed in the Reload Transition Safety change activity that were not considered by License Report (WCAP-18459-P, Rev. 1) associated with the change. Methodologies Amendment Request (LAR) letter CNL-20-014. (Those used in the revised safety analyses are described in the associated license activities were already determined to be authorized or amendment request, letter CNL-20-014, Application to Modify the Sequoyah otherwise in support of 10 CFR 50.90 and are not required to Nuclear Plant Units 1 and 2 Technical Specification to Allow for Transition to undergo further 10 CFR 50.59 evaluation.) Westinghouse RFA-2 Fuel (SQN-TS-20-09)," dated September 23, 2020. The use of MULTFLEX 3.0, however, is described in the UFSAR as applicable to a Of the remaining activities that require 10 CFR 50.59 previous version and is not addressed by license amendment request.

consideration, the following activities screened in and require However, the use of MULTIFLEX 3.0 has been previously accepted at a evaluation: number of TVA sites, and NRC staff considered the use of MULTIFLEX 3.0 as

1. The replacement fuel design requires rerunning various part of its Safety Evaluation for WCAP-15029-P-A, Westinghouse Methodology safety analyses in the UFSAR, updates fuel design and for Evaluating the Acceptability of Baffle-Former-Barrel Bolting Distribution analysis parameters in the UFSAR (including changes to Under Faulted Load Conditions, Jan. 1999. In that Safety Evaluation the NRC the core bypass flow design value) and utilizes new concluded that given the limitations applied in the Safety Evaluation the method methodologies that will replace methodologies currently was acceptable based upon the following:

described in the UFSAR. Most of these methodology changes screened out per the guidance allowed per ...modifications are included in the MULTIFLEX 3.0 program that is used to Nuclear Energy Institute (NEI) 96-07 Section 4.2.1.3 or estimate the LOCA hydraulic forces on the vessel and consequential forces were considered in support of the activities of the LAR per induced on the fuel and reactor vessel internal structures. The staff concurs CNL-20-014. However, use of new methodologies, with the WOG that MULTIFLEX 3.0 provides a more accurate and realistic namely MULTIFLEX 3.0 and WCAP-11394-P-A/WCAP- modeling approach 11395-P-A, to support the various safety analyses were considered potentially adverse and require further The use of MULTFLEX 3.0 ultimately is determined to have been previously evaluation. approved for use by the NRC in identical fashion to the intended use at

2. A proposed change will extend the time available to trip the Sequoyah and therefore does not represent a departure of methodology that reactor coolant pumps (RCPs) in response to a small requires NRC review pursuant to 10 CFR 50.59(c)(2)(vii).

break loss of coolant accident (SBLOCA) from 5 minutes to 10 minutes. The 5 minute time availability is currently Likewise, the use of WCAP-11394-P-A/WCAP-11395-P-A in lieu of WCAP-documented in UFSAR Section 15.3.1.4; moving forward, 10297-P-A for transient response, peaking factor analysis and departure from it will be controlled outside of the UFSAR with site nucleate boiling ratio (DNBR) basis confirmation for rod drop safety analysis calculation SQS20110, "Emergency and Abnormal meets the guidance of NEI 96-07 Section 4.3.8 and is determined to not Operating Procedure Setpoints, and procedures.

E1-7

represent a departure of methodology that requires NRC review pursuant to 10 CFR 50.59(c)(2)(vii).

The change to revise the available time to trip the RCPs in response to a SBLOCA was determined to not have a more than minimal effect on accidents and malfunctions previously evaluated in the UFSAR.

With respect to the scope of the 10 CFR 50.59 screened activities, the 10 CFR 50.59 Evaluation questions have been evaluated, all with an answer of NO. The screened in activities do not result in more than a minimal frequency of an accident previously evaluated in the UFSAR. The screened in activities do not result in a more than minimal impact to the likelihood of occurrence of a malfunction of an SSC important to safety previously evaluated in the UFSAR.

The screened in activities do not result in more than a minimal increase in the consequences of an accident previously evaluated in the UFSAR. The screened in activities do not result in a more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the UFSAR. The screened in activities do not create a possibility for an accident of a different type than any previously evaluated in the UFSAR.

The screened in activities do not result in a design basis limit for a fission product barrier as described in the UFSAR being exceeded or altered. Finally, the screened in activities do not result in a departure from a method of evaluation described in the UFSAR used in establishing the design bases or in the safety analyses.

While it is understood that an existing License Amendment Request per letter CNL-20-014 has been approved by NRC on October 26, 2021, the screened in activities do not require any additional license amendment to be issued.

Therefore, this activity may be implemented per plant procedures and does not require a license amendment request.

SQN-20-1684 This Engineering Change Package (ECP) installs Category C The digital DCS system replaces existing analog controls in the existing (Unit 1) (Distributed Control System Equipment & Valve Controllers) balance of plant (BOP) systems with digital control systems and reduces many and E (Transmitters) digital equipment per SS-E18.15.01, single point failure vulnerabilities with reliability improvements. The impacts of SQN-20-1764 Requirements for Digital Systems (Real-Time Data Acquisition SPVs are reduced by eliminating single components that can fail and cause a (Unit 2) and Control Computer Systems). This ECP involves a digital transient of greater than 5% in the system. The remaining SPVs are hardened upgrade which upgrades the level control for the SQN Unit 1 by eliminating the pneumatic positioners and level indicating controllers, and 2 Feedwater Heaters (FWHs) to eliminate and harden thereby reducing the number of components that can cause an SPV. In Single Point Vulnerabilities (SPVs). The field devices (level addition, the impacts of the SPVs remaining are reduced by detection and E1-8

transmitters) for the FWHs will provide input to the local annunciation of faults and failures in the DCS and DVCs. The new system Foxboro I/A Distributed Control System (DCS) remote provides redundant inputs, redundant processors, networks, power supplies input/output (I/O) field cabinets. The Foxboro I/A DCS will use with backup power, etc. The new system is designated as "Quality Related" these inputs to send a control output to each digital valve and is designed to meet Quality Related requirements; the reliability of the new controller (DVC) to actuate valve position and provide Highway system is superior to the old analog system. The modification does not Addressable Remote Transducer (HART) communication for negatively impact any SSC that is important to safety nor does it impact the valve position/readback. The terminology DCS is used consequences or the frequency of their occurrence. The upgraded DCS does referencing the Foxboro I/A system and/or the replacement not cause a new type of malfunction or accident to be created. The upgraded system as a whole, pending the application described within DCS reduces the likelihood of failures and their consequences by providing a the statement. more reliable and redundant control system. In addition, this modification provides the capability to reduce manual operator actions, thereby, allowing This modification will require several tasks which include: greater opportunity for assessment, monitoring and response.

x Replacing level indicating controllers and level modifiers with new field equipment tied into the Foxboro DCS The upgrade to DCS and replacement systems results in overall improvement x Adding Redundant Guided Wave Radar level transmitter in the plant and the ability to function with individual devices out of service as:

monitoring to Feedwater Heaters x DCS provides for use of additional input signals for control. The DCS will x Upgrading existing level modifiers to Fisher DVC6200 continue to maintain function with the loss of a single input for controls with positioners multiple inputs. In the case of a single input, the last good value prior to the x Adding new Foxboro field cabinets to integrate the new I/O failure will be used. The DCS will provide an alarm on the DCS Visual for the FWH DCS components Display Unit (VDU) for loss of an input.

x Adding new Foxboro Field Control Processors (FCPs) for x The DCS is powered from redundant power sources, thus in the loss of any the FWH level controls to the existing cabinets in the single power supply or power source the DCS will continue to maintain Auxiliary Instrument Room (AIR). control in normal operation.

x The signal output to plant control devices, such as valves, use redundant The following components for the FWHs are impacted and FBMs such that should one FBM fail the other FBM maintains the control of considered as SPVs: Level Indicating Controller (LIC), the device.

Positioner, Control Air Pressure Regulator, Tubing / Sense x Important functions are separated on a pair of DCS processors for Lines, Power Supply, and Fuse. Field instrumentation could segregation.

potentially fail and cause the loss of indication of that instrument in the DCS. The loss of these devices, and the As the primary source for the FWH equipment is the Preferred Power Board I impact of this loss, are discussed in the Single Point Failure (Unit 1) and Preferred Power Board II (Unit 2) and the secondary sources are (SPF) Analysis SPF-SQN-2020-0003, Rev. 000, Sequoyah, from their respective unit Turbine MOV Boards, losing power to both DCS Unit 1, FWH Level & DCS Upgrade Single Point Failure power sources would require dual failures of equipment, which are not Analysis, Review, and Acceptance, and Single Point Failure considered in the failure analysis. The proposed modification does not (SPF) Analysis SPF-SQN-2021-0004, Rev. 000, Sequoyah, increase the frequency or likelihood of accidents or malfunctions or create a Unit 2, FWH Level & DCS Upgrade Single Point Failure new type of accident. A hardware-related common cause failure (CCF)

Analysis, Review, and Acceptance. conclusion of unlikely (Not credible) and a software-related CCF conclusion of not unlikely (Credible) were determined from the design changes Single Point Failure (SPF) Analysis and other supporting documentation. The likelihood of E1-9

This design change eliminates/hardens the SPV(s) associated these failures was qualitatively determined to result in no more than a minimal with LIC through: increase in the frequency of occurrence. In addition, the system was x The functionality of the LIC is now being provided by a segmented so as to prevent software and hardware CCFs for critical functions.

combination of the level transmitters, DCS, and the DVC The segmentation strategy was implemented using the previous evaluation Positioners. The use of multiple (triple redundant) performed for the Unit 1 & 2 DCS calculation. Therefore, the credible software transmitters as input to proportional-integral-derivative CCFs do not introduce a new failure mode failure or cause more than a minimal (PID) controllers in DCS removes single failure increase in the failures already assumed in the UFSAR.

vulnerabilities associated with the LICs and improves the reliability and robustness of the control system. As a result of this evaluation, it is concluded that this activity does not meet any x The installation of the DVCs for the main and bypass of the criteria of 10CFR50.59(c)(2), and therefore obtaining prior NRC approval valves for FWHs provides significant hardening for each is not required to implement this activity. Therefore, this activity may be control loop. All analog DCS control is provided through implemented per plant procedures and does not require a License Amendment redundant output channels. The FWHs have pneumatic Request.

level controllers which are comprised of several component SPVs including the bellows, input connections, output connections, supply air, internal tubing, nozzles, mechanical linkages, and other components. The replacement of the pneumatic level controllers and positioners with DVCs does not eliminate the SPVs; however, DVCs have fewer components and are more reliable.

Local Foxboro I/A DCS remote I/O field cabinets are installed in the Turbine Building on EL. 685.0. The new cabinets will contain the necessary field bus modules (FBMs) and field communications modules (FCMs) for accommodating the process level control of FWHs and will interface with the FCPs and DCS Server Platform located in the Auxiliary Instrument Room (AIR). As appropriate, the system architecture will be configured to address SPV design issues ensuring that a loss of a single controller, transmitter, power supply, etc. will not result in a system failure, which could cause a plant trip or runback.

The existing Foxboro DCS consists of 4 operator stations (thin clients) in the Unit 1 Main Control Room (MCR) and 4 in the Unit 2 MCR, one engineering station in the Unit 1 AIR and one in the Unit 2 AIR, and multiple field I/O cabinets. The existing workstation computers supporting the operator and engineering E1-10

stations are updated to include the new FWH displays. A Human Factors Evaluation is performed as a part of the ECP to evaluate the acceptability of the displays. Monitoring and control of the FWHs are performed in the MCR via the operator stations. The Engineering Workstation is in the AIR for FCP programming and configuration.

SQN-22-046 Certain anticipated operational occurrences for pressurized The UFSAR described Spurious SI at Power event will not generate a more water reactors can cause an unplanned increase in Reactor serious condition. Requiring letdown in a specific timeframe in response to a Coolant System (RCS) inventory. Depending on the properties Spurious SI at Power does not increase the frequency of the Spurious SI at of the injected inventory and the response of the automated Power, and ensures the event does not escalate to a Loss of Coolant Accident controls, this could result in over filling the RCS. One such (LOCA) via pressurizer safety valve malfunction. The new time requirement for event is an Inadvertent Operation of the Emergency Core establishing letdown has been demonstrated to be feasible and can be reliably Cooling System (Spurious [safety injection] SI at Power). Once completed within the allowed time using the reactor vessel head vents. The started, the ECCS does not automatically stop, and therefore design of the head vent system precludes single malfunctions which could the Spurious SI at Power must be mitigated by manual action prevent establishing the head vent flowpath; therefore, this change does not prior to incurring damage to the reactor coolant pressure increase the probability or consequences of any malfunction or the boundary (RCPB). consequences of the accident.

The Spurious SI at Power is analyzed to prevent overfill of the The changes to the Spurious SI at Power analysis to support the change do not pressurizer, as pressurizer overfill can result in a loss of constitute changes to elements of the analysis methodology.

coolant via the pressurizer power operated relief valves or safety valves. Therefore, the event ends when the net Therefore, this activity may be implemented per plant procedures and does not inventory addition to the RCS is terminated. The limiting require a License Amendment Request.

scenario is when the RCS is already pressurized and the pressurizer level corresponds to 100% power at the beginning of the event; for this scenario, the charging pumps are the only ECCS pumps providing forward flow. Since the charging pumps are aligned to the RCS via the cold leg injection, or Boron Injection Tank (CCPIT) path, the event has historically been considered terminated when the operators diagnose that the ECCS actuation was inadvertent and subsequently terminate ECCS flow via isolation of the CCPIT path. The analysis assumes this action occurs 15 minutes from the start of the event and demonstrates no over pressurization or liquid water relief from the pressurizer relief valves if the event is terminated at this time.

With the CCPIT path isolated, however, RCS mass addition can continue to reach the RCS via the reactor coolant pump E1-11

(RCP) seal injection. Although the Safety Injection Termination procedure requires the re-establishment of pressurizer level control after terminating the ECCS flow, this action is not time critical. As a result, the current analysis assumes all injection stops at 15 minutes and doesnt account for seal injection. The activity therefore consists of updating the design documentation to document the new time critical action to establish letdown via the Reactor Vessel Head Vent valves (RVHV) during mitigation of Spurious SI at Power.

SQN-21-036 This proposed documentation-only design change reverts the Based on the responses to the 50.59 Evaluation Questions, this activity to previously issued FSAR Change back to the requirements for change the voltage acceptance criteria during EDG load sequencing:

undervoltage criteria. A discussion of overvoltage criteria is x does not result in an increase of frequency or consequences of an accident also added to clarify SQN's compliance with applicable FSAR previously evaluated in the FSAR or create the possibility of an accident of requirements. A statement added to FSAR Section 8.3.1.2.1 a different type than any previously evaluated in the FSAR; was based on criteria in Regulatory Guide (RG) 1.9 Rev 1; x does not result in an increase in the likelihood of the occurrence or however, SQN is licensed to RG 1.9 Rev 0, except for consequences of a malfunction of an SSC important to safety previously frequency and voltage recovery numerical values. SQN is only evaluated in the FSAR or create the possibility for a malfunction of an SSC committed to the numerical values in RG 1.9 Rev 1. This important to safety with a different result than any previously evaluated in statement is removed by SQN-21-036, and requirements to the FSAR; comply with RG 1.9 are clarified so that FSAR Section x does not affect design basis limits for a fission product barrier as described 8.3.1.2.1 remains consistent with SQN's licensing basis. in the FSAR; and x does not result in a departure from a method of evaluation described in the SQN-21-036 also implements changes to the overvoltage FSAR used in establishing the design bases or in the safety analyses.

acceptance criteria in surveillance procedure 2-SI-OPS-082-026.A, which is considered adverse. The new overvoltage The new acceptance criteria accounts for momentary voltage swells which are acceptance criteria allows for momentary voltage swells during an expected equipment response. Analysis performed to support this design Emergency Diesel Generator (EDG) load sequencing, which change concludes that a momentary voltage swell does not degrade could affect equipment life. performance of an EDG or the loads sequenced onto an EDG. The new voltage acceptance criteria meets industry standards with respect to RG 1.9, General Design Criteria (GDC) Criterion 17, and the Institute of Electrical and Electronics Engineers (IEEE) Standard 308 guidance and criteria pertaining to equipment performance and capabilities. It is concluded that SQN meets the intent of RG 1.9 Rev 0. There is no increase in the likelihood of the occurrence of a malfunction of the affected SSCs, and there is no increase of the consequences of an accident previously evaluated in the FSAR. Therefore, there is no impact on any of the SSC's functions.

Therefore, this activity may be implemented per plant procedures and does not require a License Amendment Request.

E1-12

TEMPORARY DESCRIPTION SAFETY ANALYSIS MODIFICATI ON (TMOD)

WO-TM The digital SQN Unit 1 Annunciator System (Beta) Channel B This WO-TM has no effect on the frequency of occurrence of an accident or 123010535 Universal Multiplexer (UMUX) "Alarm Filter Panel" is replaced consequences of an accident as malfunctions will continue to be annunciated with an analog RS232 to Fiber Optic Converter. The in the MCR and testing validated the remote logic unit functionality during non-Channel B Annunciation Channel will not contain alarm accident conditions. The potential occurrence of mismatched alarms between buffering, filtering, or ADDS CRT TERM functions. the Channel A and Channel B Annunciator system is sufficiently low.

This work order temporary modification (WO-TM) is necessary Therefore, this activity may be implemented per plant procedures and does not to maintain the B Channel of the SQN Unit 1 Annunciation require a License Amendment Request.

System while a permanent modification is engineered. The Annunciation System is not safety related, does not provide a design basis function, and is not credited for accident mitigation. However, reliable two-channel operation ensures the function of the annunciator system to alarm SSC malfunctions.

E1-13

Core DESCRIPTION SAFETY ANALYSIS Operating Limits Report SQN Unit 1 A core design and COLR were developed for SQN Unit 1 Cycle Only question 8 is required to be answered. The method of evaluation affected Cycle 26 26. A linked change is elimination of the fuel densification by elimination of the densification spike penalty, R. O. Meyer, "The Analysis of COLR spike penalty. Fuel densification causes the fuel pellets to Fuel Densification," Division of Systems Safety, USNRC, NUREG- 0085, July shrink. The pellet shrinkage combined with random hang-up of 1976, is replaced by adopting an entirely new method: Kersting, P. J., et al, fuel pellets resulted in gaps in the fuel column when the pellets Assessment of Clad Flattening and Densification Power Spike Factor below the hung-up pellet settle in the fuel rod. The gaps varied Elimination in Westinghouse Nuclear Fuel, WCAP-13589-A, March 1995. The in length and location in the fuel rod. Because of decreased new method was approved by the NRC for elimination of the densification spike neutron absorption in the vicinity of the gap, power peaking penalty. The application of the methodology is consistent with Sequoyahs occurred in the adjacent fuel rods resulting in an increased licensing basis. There are no plant-specific commitments related to the power peaking factor. Axial gaps occur very infrequently and densification spike penalty. In conclusion, elimination of the densification spike are extremely small in current (after 1993) Westinghouse fuel penalty is not a departure from a method of evaluation because the method is designs (WCAP-13589-A, March 1995, Kersting, P. J., et al, appropriate for the intended application, the terms and conditions for its use as Assessment of Clad Flattening and Densification Power Spike specified in the safety evaluation report have been satisfied, and the method Factor Elimination in Westinghouse Nuclear Fuel). Therefore, has been approved by the NRC for the intended application.

the power spike factor can be reduced to 1.0. The densification spike penalty is eliminated by updating the Therefore, this activity may be implemented per plant procedures and does not UFSAR to reflect the elimination of the penalty from the design require a License Amendment Request.

basis. This change is also applicable to Unit 2 cycles with RFA-2 feed fuel. It was previously shown that the peaking increase associated with axial pellet column gaps is negligible in HTP fuel (UFSAR Section 4.5.3.2.2.1), so no special considerations need to be made for elimination of the spike penalty for core designs containing a mix of HTP and RFA-2 fuel types.

Technical DESCRIPTION SAFETY ANALYSIS Specification Bases Technical The proposed activity is to implement the Westinghouse The SSCs affected by implementation of the DRWM test are the NIS and RTS.

Specification Dynamic Rod Worth Measurement (DRWM) test (WCAP- During the DRWM test, one power range neutron flux channel will be placed in Bases B 13360-P-A, Revision 1, Westinghouse Dynamic Rod Worth a tripped condition to comply with TS 3.3.1. This condition effectively places 3.1.8, Measurement Technique) for Sequoyah Unit 1 and Unit 2. the NIS trip logic in a one-out-of-three coincidence status. In this status, the PHYSICS The DRWM test measures the reactivity worth of individual operable NIS channels are more likely to result in a trip when an associated TESTS control and shutdown banks. DRWM is accomplished by process variable exceeds a setpoint. For example, one of the operable NIS E1-14

Technical DESCRIPTION SAFETY ANALYSIS Specification Bases Exceptions - inserting and withdrawing the bank at the maximum stepping channels could result in a trip before the signal develops on a second channel MODE 2 speed, without changing boron concentration, and recording that would be needed for two-out-of-four coincidence. An evaluation of the the signals on the excore detectors. One channel is placed in reliability of the Reactor Protection System actuation following initiation of a tripped condition effectively placing the Nuclear Condition II events has been completed for the relay protection logic and solid Instrumentation System (NIS) trip logic in a one-out-of-three state protection system design (UFSAR Chapter 15.2). Common-mode failures coincidence status. The cables are then disconnected from the were also qualitatively investigated. It was concluded from the evaluation that back of that NIS power range drawer and connected to the the likelihood of no trip following initiation of Condition II events is extremely Advanced Digital Reactivity Computer (ADRC) NIS field small. This result is not affected by having one power range neutron flux connectors. The recorded signals are processed on the channel in a tripped condition. Spurious signals are also more likely to cause a ADRC, which solves the inverse point kinetics equation with reactor trip. Reactor trip is a Condition I transient implicitly bound by results of proper analytical compensation for spatial effects. malfunctions previously evaluated in the UFSAR. Implementation of the DRWM test does not result in an increase in the likelihood of occurrence of a The SSCs impacted by the change are the NIS and the malfunction of the RTS or create a possibility for a malfunction of RTS with a Reactor Trip System (RTS). different result than any previously evaluated in UFSAR. Neither a reactor trip due to a valid trip signal nor a reactor trip due to a spurious signal can result in The present condition is that Dilution or Rod Swap tests are an accident.

used to measure the reactivity worth of Rod Cluster Control Assembly (RCCA) banks. The DRWM test differs from the The malfunction evaluated in the UFSAR that could have its consequences current tests in that: affected as a result of implementing the DRWM test is the Feedwater System x boron concentration is not changed during the test Malfunction. A Feedwater System Malfunction continues to be mitigated by the x the worth of each bank is determined directly without other same RTS functions during the DRWM test as during other rod worth control banks present in the core measurements. Therefore, the DRWM test does not increase the radiological x analytically determined static and dynamic spatial factors consequences of a malfunction of an SSC important to safety.

are used to account for spatial effects.

Accidents that have been evaluated in the UFSAR that are potentially affected This measurement is to determine the worth of RCCA banks. It by the implementation of the DRWM test are uncontrolled boron dilution, is part of the physics test program required to determine if the uncontrolled rod cluster control assembly bank withdrawal from a subcritical operating characteristics of the core are accurately represented condition (RWSC), and rod control cluster assembly (RCCA) misalignment by the design predictions, and to ensure that the core can be (dropped RCCA, dropped RCCA bank, or misaligned RCCA). An uncontrolled operated as designed. boron dilution during startup could be caused by operator error. Unlike current rod worth measurement tests, boron dilution is not intentionally initiated during Implementation of the DRWM test is necessary to take the DRWM test. A RWSC or RCCA misalignment could be caused by advantage of the best available technology to perform RCCA malfunction of the reactor control or control rod drive systems or operator error.

bank worth measurements. The DRWM test has the following The current rod worth tests (Dilution and Rod Swap) require dilution of a bank advantages over current tests: of control rods into the core. This process reduces shutdown margin (SDM).

x boron concentration is not changed during the test The DRWM test does not dilute a bank into the core, thereby maximizing SDM E1-15

Technical DESCRIPTION SAFETY ANALYSIS Specification Bases x the worth of each bank is determined directly without other during rod worth testing. Thus implementation of the DRWM test has a positive control banks present in the core effect on (tends to increase) SDM. Additionally, the DRWM test procedure is x the DRWM test procedure is simpler to perform, thus simpler to perform, thus reducing the possibility of human error. An operator reducing the possibility of human error error resulting in uncontrolled boron dilution is qualitatively less likely during the x the DRWM test procedure can save critical path time DRWM test than during current rod worth measurement tests. Therefore, during startup, relative to other rod worth test procedures. implementation of the DRWM test does not increase the frequency or result in an increase in the consequences of an accident previously evaluated in the UFSAR. Implementation of the DRWM test does not create a possibility for an accident of a different type than any previously evaluated in the UFSAR.

No fission product barrier design basis limits are affected by implementation of the DRWM test. Nuclear peaking factors (that assure that Design Bases Parameters such as DNBR, fuel temperature, and linear heat rate are not exceeded) are preserved as long as the power level is limited to less than or equal to 5% rated power and the reactor coolant temperature is kept greater than or equal to 531°F. In the DRWM test, the worth of each bank is determined directly without other banks present in the core. This configuration will decrease nuclear peaking factors relative to those that would be observed during Rod Swap at the same near-zero power level. Therefore, implementation of the DRWM test does not result in a design basis limit for the fuel cladding described in the UFSAR being exceeded or altered.

Therefore, this activity may be implemented per plant procedures and does not require a License Amendment Request.

DOCUMENT NUMBER/72.48 EVALUATION DESCRIPTION SAFETY ANALYSIS TRACKING NUMBER None E1-16

ENCLOSURE 2 SEQUOYAH NUCLEAR PLANT COMMITMENT CHANGE REPORT Commitment Evaluation No./ Source Summary of Summary of Basis/Justification Commitment Document Original Commitment Commitment Changes for Changes Tracking No.

123408712 and TVA letter to Currently, Sequoyah Sequoyah will be revising site Sequoyah Nuclear Plant has implemented NCO070011006 NRC dated maintains the Spent Fuel procedures to remove the significant SFP defense-in-depth February 26, Pool [SFP] in a thermally requirement to maintain the strategies (aka FLEX strategies,) as part 2007 dispersed configuration Spent Fuel Pool in a thermally of the response to the Fukushima beyond-design-basis accident. These include outside of outages. This dispersed configuration at all changes in SFP level instrumentation, allows for initiation of times. This will require additional equipment, procedures, and supplemental spray in 5 Sequoyah to maintain the ability training.

hours. With the Spent Fuel to provide makeup to the Spent Pool in a non-dispersed state Fuel Pool within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> at all Two specific items relevant to SFP (ex. during outages), makeup times or comply with the mitigation measures are:

to the Spent Fuel Pool is original requirement of thermal required within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. dispersion with a 5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> Time Constrained Manual Actions Restoration to a thermally makeup time. The requirement (TCMAs) required by implementing dispersed state is currently to restore a thermally dispersed procedure, Extensive Damage Mitigation Guideline (EDMG-2), ensure that the required 60 days post- state within 60 days will be equipment required to provide SFP outage. removed. makeup and to install SFP spray could be operational in the required times to maintain SFP inventory and prevent an impact on fuel rod integrity. The capability to meet these times is verified on a periodic basis. These TCMAs are a previously existing mitigating strategy implemented by SQN that is independent of FLEX strategies.

E2-1

Commitment Evaluation No./ Source Summary of Summary of Basis/Justification Commitment Document Original Commitment Commitment Changes for Changes Tracking No.

Two-train, safety-related level instrumentation was installed in the SFP as part of FLEX strategies. SFP levels and associated alarms are available in the El. 732 Board Rooms on Unit 1 and Unit 2 to provide early indication of the potential need to implement the TCMAs in accordance with procedure.

Additionally, the site FLEX strategy added additional equipment to the plant that may aid in maintaining spent fuel pool cooling.

This additional FLEX equipment adds connections for the ERCW and Demineralized Water Systems to maintain SFP water inventory to mitigate beyond design basis external events.

The proposed change to the SFP thermal management measure does not therefore impact any design basis event.

E2-2