ML19070A218

Issuance of Amendment Nos. 208, 208, and 208 - Regarding Response Time Testing of Pressure Transmitters

ML19070A218
Person / Time
Site:	Palo Verde
Issue date:	04/03/2019
From:	Siva Lingam Plant Licensing Branch IV
To:	Bement R Arizona Public Service Co
Lingam S, 301-415-1564
References
EPID L-2018-LLA-0161
Download: ML19070A218 (23)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 April 3, 2019 Mr. Robert S. Bement Executive Vice President Nuclear/

Chief Nuclear Officer Mail Station 7602 Arizona Public Service Company P.O. Box 52034 Phoenix, AZ. 85072-2034

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 - ISSUANCE OF AMENDMENTS REGARDING RESPONSE TIME TESTING OF PRESSURE TRANSMITTERS (EPID L-2018-LLA-0161)

Dear Mr. Bement:

The U.S. Nuclear Regulatory Commission (NRC, the Commission) has issued the enclosed Amendment Nos. 208, 208, and 208, to Renewed Facility Operating License Nos. NPF-41, NPF-51, and NPF-74 for the Palo Verde Nuclear Generating Station (PVNGS), Units 1, 2, and 3, respectively. The amendments document approval of elimination of periodic response time testing for a specific pressure transmitter, consistent with PVNGS Technical Specifications (TSs) in response to your application dated May 25, 2018, as supplemented by letters dated October 12, 2018, and January 31, 2019.

Specifically, the amendments document approval of elimination of periodic response time testing for Rosemount Series 3150 and 3051 N pressure transmitters consistent with PVNGS TS 1.1 to permit allocated response time verification usage for a specific set of replacement components in lieu of directly measured response time testing.

The PVNGS TS 1.1 currently authorizes the elimination of periodic response time testing for specific transmitter models that have been reviewed and approved by the NRC staff. The specific vendor transmitter models approved by the NRC staff that are exempt from periodic response time testing have become obsolete and are being replaced by new models of similar design and construction. As a result, you initially requested NRC approval of the engineering evaluation methodology for eliminating periodic response time testing with the appropriate engineering evaluation, not only for the replaced transmitter models but also for future models if the replacement models become obsolete.

By supplemental letter dated October 12, 2018, you reduced the scope of the license amendment request to eliminate periodic response time testing for a specific pressure transmitter replacement model manufactured by Rosemount, and are no longer seeking approval of an engineering evaluation methodology to permit you to exempt future transmitter model changes from periodic response time testing without prior NRC approval.

R. Bement A copy of the related Safety Evaluation is also enclosed. The Notice of Issuance will be included in the Commission's next biweekly Federal Register notice.

Sincerely,

~(f * ~

Siva P. Lingam, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. STN 50-528, STN 50-529, and STN 50-530

Enclosures:

1. Amendment No. 208 to NPF-41

2. Amendment No. 208 to NPF-51

3. Amendment No. 208 to NPF-74

4. Safety Evaluation cc: Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

DOCKET NO. STN 50-528 PALO VERDE NUCLEAR GENERATING STATION, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 208 License No. NPF-41

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, El Paso Electric Company, Southern California Edison Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated May 25, 2018, as supplemented by letters dated October 12, 2018, and January 31, 2019, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 1

2. Accordingly, by Amendment No. 208, Renewed Facility Operating License No. NPF-41 is hereby amended to authorize elimination of periodic response time testing for Rosemount Series 3150 and 3051 N pressure transmitters consistent with Palo Verde Nuclear Generating Station Technical Specification 1.1, as set forth in the licensee's application dated May 25, 2018, as supplemented by letters dated October 12, 2018, and January 31, 2019, and the NRC staffs safety evaluation dated April 3, 2019.

3. This license amendment is effective as of the date of issuance and shall be implemented within 30 days of the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: April 3, 2019

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

DOCKET NO. STN 50-529 PALO VERDE NUCLEAR GENERATING STATION, UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 208 License No. NPF-51

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, El Paso Electric Company, Southern California Edison Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated May 25, 2018, as supplemented by letters dated October 12, 2018, and January 31, 2019, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application , the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 2

2. Accordingly, by Amendment No. 208, Renewed Facility Operating License No. NPF-51 is hereby amended to authorize elimination of periodic response time testing for Rosemount Series 3150 and 3051 N pressure transmitters consistent with Palo Verde Nuclear Generating Station Technical Specification 1.1, as set forth in the licensee's application dated May 25, 2018, as supplemented by letters dated October 12, 2018, and January 31, 2019, and the NRC staff's safety evaluation dated April 3, 2019.

3. This license amendment is effective as of the date of issuance and shall be implemented within 30 days of the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: April 3, 2019

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

DOCKET NO. STN 50-530 PALO VERDE NUCLEAR GENERATING STATION, UNIT 3 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 208 License No. NPF-74

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, El Paso Electric Company, Southern California Edison Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated May 25, 2018, as supplemented by letters dated October 12, 2018, and January 31, 2019, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 3

2. Accordingly, by Amendment No. 208, Renewed Facility Operating License No. NPF-74 is hereby amended to authorize elimination of periodic response time testing for Rosemount Series 3150 and 3051 N pressure transmitters consistent with Palo Verde Nuclear Generating Station Technical Specification 1.1, as set forth in the licensee's application dated May 25, 2018, as supplemented by letters dated October 12, 2018, and January 31, 2019, and the NRC staff's safety evaluation dated April 3, 2019.

3. This license amendment is effective as of the date of issuance and shall be implemented within 30 days of the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: April 3, 2019

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NOS. 208, 208, AND 208 TO RENEWED FACILITY OPERATING LICENSE NOS. NPF-41, NPF-51, AND NPF-74 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 DOCKET NOS. STN 50-528, STN 50-529, AND STN 50-530 1.0

• INTRODUCTION By application dated May 25, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18145A303), as supplemented by letters dated October 12, 2018 (ADAMS Accession No. ML18285A575), and January 31 , 2019 (ADAMS Accession No. ML19031C905), Arizona Public Service Company (APS, the licensee) submitted a license amendment request (LAR) seeking approval to eliminate periodic response time testing (RTT) for a specific pressure transmitter, consistent with Palo Verde Nuclear Generating Station (PVNGS or PVGS) Technical Specification (TS) 1. 1, for PVNGS, Units 1, 2, and 3.

The NRC staffs evaluation and approval of the selected transmitter models is specific to the supplemental LAR (Items 1 and 2 as described in Section 2. 1 below) and shall not be considered generic approvals of any other components that are not within the scope of this supplemental LAR or approval of a generic methodology.

2.0 REGULATORY EVALUATION

2.1 Background The LAR as originally submitted would have revised TS requirements regarding RTT of pressure transmitters. The pressure transmitters subject to the LAR are for the reactor protective system (RPS) and engineered safety feature actuation systems (ESFAS).

The PVNGS TS 1. 1 currently authorizes the elimination of periodic RTT for specific transmitter models that have been reviewed and approved by the U.S. Nuclear Regulatory Commission (NRC, the Commission) staff. The specific vendor transmitter models approved by the NRC staff have become obsolete and are being replaced by new models of similar design and construction. As a result, the licensee initially requested NRC approval of the engineering evaluation methodology for eliminating periodic RTT with the appropriate engineering Enclosure 4

evaluation, not only for the replaced transmitter models but also for future models if the replacement models become obsolete.

By supplemental letter dated October 12, 2018, the licensee reduced the scope of the LAR to request approval to eliminate periodic RTT for a specific replacement pressure transmitters model manufactured by Rosemount, and is no longer seeking approval of an engineering evaluation methodology to permit the licensee to exempt future transmitter model changes from periodic RTT without prior NRC approval.

The supplemental letters dated October 12, 2018, and January 31, 2019, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the NRC staff's original proposed no significant hazards consideration determination as published in the Federal Register on July 31, 2018 (83 FR 36973).

The original scope of the LAR sought approval for the following aspects:

1. Approval of an allocated response time verification usage for a specific set of replacement components (i.e., Rosemount 3150 and 3051N series transmitters) in lieu of directly measured RTT.

2. Approval of the proposed changes in TS Bases to support the LAR to allow the licensee to update' older transmitters model (i.e., the Rosemount 1150 series) to the more current models (i.e., Rosemount 3150 and 3051N series transmitters).

3. Generic approval for the methodology for allocated RTT, in lieu of measured RTT, presented in the subject LAR to permit APS to exempt future transmitter model changes from periodic RTT without prior NRC approval.

Items 1 and 2 above are consistent with NUREG-1432, "Standard Technical Specifications -

Combustion Engineering Plants," Volume 1 - Specifications and Volume 2 - Bases (ADAMS Accession Nos. ML12102A165 and ML12102A169, respectively). The definitions in NUREG-1432 allow for the response times of specified pressure transmitters to be verified using an approved methodology in lieu of being periodically measured. The approved methodology establishes a basis for exempting periodic RTT for certain instruments using design analysis techniques. With regard to Item 3 above, the licensee requested a time response test exemption based on use of an NRG-approved methodology rather than approving time response testing exemptions for specific components. The NRC staff did not agree that there was sufficient information for generic approval of the analytical framework. The NRC has previously approved topical reports, which provided analysis for specific transmitters. The NRC staff approved use of the topical reports for specific sets of transmitters, which used Electric Power Research Institute (EPRI) Report NP-7243, "Investigation of Response Time Testing Requirements." However, the NRC did not provide generic approval for the use of the analysis methods.

• By letter dated October 12, 2018, APS committed to limiting the scope of the original LAR specific to request approval for only Rosemount pressure transmitters, and no longer seeks generic approval of an engineering evaluation methodology.

By an e-mail dated January 8, 2019 (ADAMS Accession No. ML19008A361 ), the NRC staff provided requests for additional information (RAls) to support completion of the LAR review. By

letter dated January 31, 2019, the licensee submitted responses to the NRC staff's RAls, as well as the supplemental LAR that limited the scope of the LAR, to include only Items 1 and 2 as described above. The licensee removed references regarding approval of a generic methodology. The licensee also submitted corresponding changes to the PVNGS TS Bases for informational purposes.

The NRC staff reviewed the proposed amendments and found them acceptable with one exception. The exception taken within the safety evaluation is made to clarify the NRC staff's position regarding a statement made by the licensee regarding the credibility of non-specific microprocessor failures. The exception, as discussed below, does not affect the overall safety conclusion of the evaluation.

2.2 Regulatory Requirements, Guidance Documents, and Licensing Information The NRC staff identified the following regulatory requirements, associated regulatory guidance, and licensing information that are applicable to this supplemental LAR:

The regulations in Title 10 of the Code of Federal Regulations (10 CFR) Section 50.36 "Technical specifications, " establish the requirements related to the content of the TS.

The regulation in 10 CFR Section 50.36(a)(1), states:

Each applicant for a license authorizing operation of a production or utilization facility shall include in his application proposed technical specifications in accordance with the requirements of this section. A summary statement of the bases or reasons for such specifications, other than those covering administrative controls, shall also be included in the application , but shall not become part of the technical specifications.

Appendix A to 10 CFR Part 50, General Design Criteria (GDC) 13, "Instrumentation and control," states:

Instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems. Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges.

Appendix A to 10 CFR Part 50, GDC 21 , "Protection system reliability and testability, " states:

The protection system shall be designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

Redundancy and independence designed into the protection system shall be sufficient to assure that (1) no single failure results in loss of the protection function and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

The protection system shall be designed to permit periodic testing of its functioning when the reactor is in operation , including a capability to test

channels independently to determine failures and losses of redundancy that may have occurred.

Appendix A to 10 CFR Part 50 , GDC 23, "Protection system failure modes," states:

The protection system shall be designed to fail into a safe state or into a state demonstrated to be acceptable on some other defined basis if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air),

or postulated adverse environments (e.g., extreme heat or cold, fire, pressure, steam, water, and radiation) are experienced.

Regulatory Guide (RG) 1.118, Revision 3, "Periodic Testing of Electric Power and Protection Systems," dated April 1995 (ADAMS Accession No. ML003739468), which endorses Institute of Electrical and Electronics Engineers (IEEE) Standard (Std.) 338-1987, "Criteria for the Periodic Surveillance Testing of Nuclear Power Generating Station Safety Systems," as acceptable for satisfying NRC regulations, with certain exceptions. The regulatory guide describes an acceptable method for complying with NRC regulations pertaining to periodic testing of protection systems and power systems. In particular, clause 6.3.4 of IEEE Std. 338-1987, states in part:

Response time testing of all safety-related equipment is not required if, in lieu of response time testing , the response time of safety system equipment is verified by functional testing, calibration checks, or other tests, or both. This is acceptable if it can be demonstrated that changes in response time beyond acceptable limits are accompanied by changes in performance characteristics that are detectable during routine periodic tests.

NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR [Light-Water Reactor] Edition," Branch Technical Position (BTP) 7-17, Revision 6, "Guidance on Self-Test and Surveillance Test Provisions," dated August 2016 (ADAMS Accession No. ML16019A316), directs the NRC staff to verify that "[f]ailures detected by hardware, software, and surveillance testing should be consistent with the failure detectability assumptions of the single-failure analysis and the failure modes and effects analysis."

PVNGS TS 1.1 provides definitions of terms used throughout the TSs. PVNGS TS 1.1, "Engineered Safety Feature (ESF) Response Time" and "Reactor Protective System (RPS) Response Time" state in part, that "[i]n lieu of measurement, response time may be verified for selected components provided that the components and methodology for verification have been previously reviewed and approved by the NRC. "

2.3 Description of Proposed Amendment Consistent with the supplemental LAR scope, the proposed amendment requests approval of elimination of response testing for specific components at PVNGS, Units 1, 2, and 3, based on this evaluation.

The proposed amendment requests approval to eliminate periodic RTT for a specific pressure transmitter consistent with PVNGS TS 1.1.

3.0 TECHNICAL EVALUATION

3.1 Reason for the Proposed Amendment The licensee provided the technical basis to support allocated RTT of replacement pressure transmitters for PVNGS in Section 1.1, "Background," of the Engineering Evaluation in Attachment 3 of the supplemental LAR. In this study, the licensee stated:

In December 1994, Electric Power Research Institute (EPRI) published report NP-7243, Revision 1, "Investigation of Response Time Testing Requirement" (Ref. C.3). This report used failure modes and effects analysis (FMEA) to determine that periodic response time testing of selected protection channel sensors is not required where routine surveillance, such as calibrations and drift monitoring, demonstrate that sensor response time remains within a pre-allocated value. Based upon this report the Combustion Engineering Owners Group (CEOG) developed topical report CE NPSD-1167-A, revision 2, "Elimination of Pressure Sensor Response Time Testing Requirements" [ADAMS Accession No. ML010240308]. This was submitted to the Nuclear Regulatory Commission (NRC) to support a request to eliminate the requirement to periodically measure the response times of the protection system sensors. On July 24, 2000, the NRC issued a Safety Evaluation Report (SER) defining the basis for NRC acceptance of the report. Section 2 of the SER identifies that the basis for elimination of RTT is provided in Regulatory 1.118. The Regulatory Guide endorses IEEE 338-1997, "Periodic Testing of Electric Power and Protection Systems," (Ref. C.2), section 6.3.4, paragraph 3 (page 11 ), which states:

• Response time testing of all safety-related equipment, per se, is not required if, in lieu of response time testing, the response time of the safety equipment is verified by functional testing, calibration checks or other test, or both. This is acceptable if it can be demonstrated that changes in response time beyond acceptable limits are accompanied by changes in performance characteristics which are detectable during routine periodic tests.

In the enclosure to the supplemental LAR, the licensee also stated that "[i]n accordance with Section 3.1 of the NRC Safety Evaluation for the CEOG report (Reference 6.2), the allocated response times are obtained from two sources: either from the original equipment manufacturer specification or from a statistical analysis of the results of previous RTTs."

The licensee noted that on April 19, 2001, the NRC issued Amendment No. 135 (ADAMS Accession No. ML011130056) to PVNGS, Units 1, 2, and 3, which amended TS 1.1 to allow either allocated or measured response times for specified RPS and ESFAS pressure sensors.

Under PVNGS TS 1.1, periodic RTT is required unless the NRC has previously approved exemption from periodic RTT for the selected components. The Rosemount 1150 series pressure transmitters, which were previously approved by the NRC for time response exemption, have become obsolete and are being replaced by new Rosemount 3150 series and the 3051 N series pressure transmitters. These new transmitters are of similar design and construction to the 1150 series transmitter. The licensee, therefore, requested that the NRC approve the elimination of periodic RTT requirements for the Rosemount 3150 and 3051 N series pressure transmitters. The licensee provided the instrument specific analysis to

justify elimination of periodic RTT, which is contained in the supplemental LAR, rather than in a separate topical report, as was the case for previous amendments.

3.2 Technical Basis for Proposed Amendment The supplemental LAR contains the licensee's engineering evaluation that describes the technical basis that supports the amendment request. The content of the licensee's engineering evaluation was based, in part, on a report issued by Emerson Electric Company (the Rosemount transmitter vendor), Emerson Report D2015006, "3150 Series Pressure Transmitter FMEA and Evaluation Related to Elimination of Pressure Sensor Response Time Testing,"

Revision A, dated November 8, 2017. The Emerson Report was not submitted to the docket, however the NRC staff determined that the licensee's engineering evaluation provided a sufficient amount of information summarizing the findings of the Emerson Report, such that it was not necessary for the licensee to submit the Emerson report to support the supplemental LAR. The licensee's engineering evaluation describes the following three primary areas to support the supplement LAR:

• Similarity Analysis performed between the currently used pressure transmitter model (i.e., Rosemount 1150 series) and the new model that is the subject of this supplemental LAR (i.e., Rosemount 3150 and 3051N series).

• FMEA of the Rosemount 3150 and _3051 N series pressure transmitters.

• Operating History and Experience with the Rosemount 3150 and 3051 N series pressure transmitters.

The primary difference between the Rosemount 3150 series pressure transmitters and the 3051 N series pressure transmitters is in the design of the electronics module. The details of the electronics module are provided in Sections 3.2.1 and 3.2.2 of this safety evaluation.

The supplemental LAR contains the licensee's responses to the NRC staffs RAls. These RAI responses, along with the Engineering Evaluation in Attachment 3, form the technical basis that supports the supplemental LAR.

3.2.1 Similarity Analysis between Current and Replacement Pressure Transmitter Models The detailed similarity analysis is located in Section 2.1, "Similarity Review," of the licensee's Engineering Evaluation in Attachment 3 of the supplemental LAR. The objective of the similarity analysis is to compare the design, construction, and operation of the original Rosemount 1150 series pressure transmitters and the new Rosemount 3150 and 3051 N series pressure transmitters. The licensee compared the two designs to determine if there are design aspects that could affect the FMEA conclusions of the Rosemount 1150 series pressure transmitters, such that new failure modes potentially introduced by new components would not affect response time performance of the new transmitters and the design function of RPS and ESFAS. Essentially, the similarity analysis serves to demonstrate that the FMEA results for the Rosemount 1150 series would bound the postulated failures of the Rosemount 3150 and 3051 N series transmitters.

The Rosemount 1150 series pressure tr~nsmitters and the Rosemount 3150 and 3051 N series have the same basic design elements that comprise their basic construction as follows:

1. Process flange,

2. Process seal,

3. Sensor module,

4. Electronics, and

5. Electronics housing.

Mechanical Design Comparison In Section 2.1.1, "Mechanical Design Comparison, " in the Engineering Evaluation of the supplemental LAR, the licensee states that there are differences in the architecture of the flanged interface. For example, the 1150 series sensing diaphragms were located on two separate planes while the 3150 series diaphragms are located on the same plane (coplanar).

The major benefit of the coplanar design is that the sensing diaphragm is isolated from flange and welding stresses within the module. The coplanar design also enables the use of improved sensor elements, resulting in lower seating load. These changes address historical causes for oil loss failures in the 1150 series design.

The licensee further states that there are differences in the construction of the oil filled portions. The original 1150 series uses a direct weld method for attaching the sensor to the sensor module, while the 3150 series uses brazed joints. The brazing method in the application is considered less stressful to the sensor materials because it does not directly melt or fuse the sensor material as is the case with direct welding. The entire 3150 series oil-filled system is encapsulated in silicon potting, which provides robust vibration support to mitigate mechanical stresses.

The licensee states that the 3150 series uses the same sensing element and coplanar architecture for the sensing diaphragms as the 3051 N series. Based upon this fact, the NRC staff finds that operating experience of the 3150 series transmitters is also applicable to the 3051 N series. The NRC staff also determined that 3150 series transmitters demonstrate comparable levels of reliability to the 3051 N transmitters. The NRC staff notes that 1150 series and 3150 and 3051 N series of transmitters have the same theory of operation and that the differences in the mechanical design are not significant. Therefore, the NRC staff finds that potential failures modes that would affect response time of the new transmitters are similar to the failure modes of the 1150 transmitters such that previous FMEA results are still bounding and allocated response time analysis is still valid.

The NRC staff reviewed the comparison of the mechanical designs and finds that the licensee demonstrated similarity in the mechanical design of the Rosemount 1150 series and the Rosemount 3150 and 3051 N series transmitters.

Electrical Design Comparison As stated in the LAR, the Rosemount 1150 series and 3150 series are based on bipolar semiconductor technology and both use analog circuitry. According to the licensee's evaluation, the 1150 series and 3150 series have the same basic analog circuitry architecture. The 3150 series has improved accuracy, linearity, electro-magnetic conductance performance along with being simpler to calibrate.

Other improvements in the electronics of the 3150 series include:

• Oscillator frequency has an increased value of 110 kilohertz.

• Temperature stable E-core transformer has replaced the toroidal core transformer used in the 1150 series.

• General improvements in stability, reliability, and qualified life over the 1150 series.

The licensee states that while the 1150 series circuitry is portioned into five circuit boards, the 3150 series electronics circuitry is partitioned onto only three circuit boards. This reduction in circuit boards also reduces the number of interconnections between circuit boards, which means fewer potential failures due to those interconnections. The licensee also states that the 3150 series transmitters also utilize a "surface-mount packaging," which provides better protection of the circuitry from vibrations and shocks.

The licensee further states that the principal difference between the 3150 and 3051 N series is that the 3051 N series utilizes a digital microprocessor architecture while the general 3150 series utilizes analog circuitry. The licensee states, in Section 2.1.2, "Electrical Design Comparison,"

of the Engineering Evaluation in the supplemental LAR:

The module receives the analog pressure signal from the capacitive sensor and converts it to a digital value. This is then converted to a 4-20 mA [milliampere]

signal that is proportional to the pressure changes in the sensor. The 3051 N is referred to as a Smart transmitter because it provides features such as more calibration and processing functions without the need for additional analog circuitry or complex M&TE [measurement and test equipment]. The digital design also provides self-diagnostics and the ability to output a high or low signal in the event of a detected failure. Similar to the damping options in the 1150 and 3150 series transmitters, the 3051N has a programmable damping option which in this case is applied via the microprocessor function.

The NRC staff notes that the move to digital technology is generally driven by improved reliability and performance over older analog technology. The licensee has adequately described the improvements in the 3150 series and 3051N series over the 1150 series. The NRC staff notes that reduction is the number of electrical components with the 3150/3051 N series transmitters means a less complex design with fewer potential failure modes that can result from increased complexity. The NRC staff finds that inclusion of self-diagnostic features in the 3051 N series helps ensure that failure modes unique to digital technology will be detected and/or alarmed to operators. The NRC staff determined that differences in the electrical design do not result in a situation where potential new failure modes would affect response time of the new transmitters such that previous FMEA results are still bounding and allocated response time analysis is still valid .

The NRC staff reviewed the comparison of the electrical design, and finds that the licensee demonstrated similarity in electrical design of the Rosemount 1150 series and the Rosemount 3150 and 3051N series transmitters.

Response Time Comparison Section 2.1.3, "Response Time Comparison," of the Engineering Evaluation in the supplemental LAR, provides a discussion about the actual response time performance between the 1150 series and 3150 series. In particular, Table 2-1, "Specified Response Time Comparison," provides a comparison of the vendor specified response times for the 3150 series in various RPS/ESFAS applications such as Steam Generator High and Low Level detection.

Table 2-1 also includes an example replacement 3051 N series transmitter response time. In all cases, the 1150 series had the same response time as the 3150 and 3051 N series. The NRC staff notes that this is an expected performance, given the similarities in mechanical design operation as well as electrical input/output design.

The NRC staff reviewed the comparison of actual response time performance and finds that the licensee demonstrated similarity in response time of the Rosemount 1150 series and the Rosemount 3150 and 3051 N series transmitters.

3.2.2 Failure Modes and Effects Analysis Emerson Report D2015006 provides the detailed FMEA worksheet for the 3150 series pressure transmitters that informed the overall failure analysis contained in the licensee's Engineering Evaluation in Attachment 3 of the supplemental LAR. The supplemental LAR provides a summary of the results from the Emerson Report. The licensee states that the analysis identified two failure modes that were not applicable to the 1150 series but are unique to the 3150 series pressure transmitters:

• The first failure mode is leakage through the brazed joint in the pressure sensor.

Leakage through this location may increase response as the affected isolation diaphragm moves toward the convolution plate.

• The second failure mode is leakage through the sensor signal wire path. This potential failure has the same effect as leakage through the brazed joint.

The evaluation states that a small amount of leakage would be detected by drift in the signal or change in range. For both failure modes, a large amount of leakage would be considered gross failure, immediately affecting the range and resulting in larger signal drift. Other failure modes identified in the Emerson Report were common to both the 1150 series and the 3150 series. As described later in this evaluation, self-diagnostics features provide assurance that the effects of these failures would be detected. In addition, these types of failures would be apparent through other periodic testing.

The licensee also notes that Section 10 of the *Emerson Report D2015006 provides failure data on both the 3150 series (as of 2009) and 3051 N series (as of 2001 ). The report states that of the known population of 3150 series (approximately 12, 117 components) and 3051 N series (approximately 2,767 components) that there were only 15 total failures for each model. The report states that none of these failures were related to fill-oil leakage (a traditionally known failure mode) and that none of the failures would affect response time of the affected transmitters. The report also states that of the 15 total failures for each model, 12 of the 15 failures for the 3051 N series were "Observed In-Service" failures while 3 of the 15 failures for the 3150 series were "Observed In-Service" failures.

The engineering analysis summary of the Emerson Report, which includes documentation of the relatively low known failures rates of the 3150 series and 3051 N series transmitters, in conjunction with the licensee's evaluation, demonstrates that the original failure analysis conclusions with the 1150 series transmitters are still valid and bounding to the 3150 and 3051 N series transmitters, even with the inclusion of the two unique failure modes of the 3150 series transmitters.

The NRC staff reviewed the overall failure analyses and determined it sufficiently identified and addressed overall failure modes of the Rosemount 3150 and 3051 N series.

Self-Diagnostic Features and Non-Specific Failures of the 3051 N Series Electrical Module In Attachment 3 of the supplemental LAR, the licensee states the following with regard to self-diagnostic features and non-specific failures of the 3051 N electrical module, which is microprocessor-based:

Non-specific failures in the processor hardware or software routines that delay the processing function could theoretically increase response time without proceeding to gross failure. However, this is extremely unlikely and, unique to the Rosemount 3051 N, the processing function is supervised by a self-diagnostic routine that can be configured to alarm and drive the process value signal beyond saturation high or low.

The NRC staff's RAls EICB-2 and 3 asked the licensee to clarify self-diagnostic feature functionality of the 3051 N series transmitters and to clarify the meaning of "non-specific failures."

In RAI EICB-2, the NRC staff noted that Section 2 of the Engineering Evaluation in the original LAR, refers to the existence of self-testing or self-diagnostics features in the 3051 N series pressure transmitters. The staff further noted that the evaluation did not provide a description of what those features are, and how they provide assurance with regard to the FMEA for the 3051 N series.

In its response to RAI EICB-2, the licensee clarified that the self-diagnostics of the 3051 N electronics module monitors parameters such as output signal, electronics board, memory verification, and transmitter configuration. The self-diagnostics provide detection and alarms for these parameters, as each of these parameters could potentially affect transmitter operation, and thereby affect response time. The licensee explained that errors or faults within the electronics module that could affect response time are expected to result in gross output changes that would be detected by self-diagnostics and ultimately resulting in the faulted condition annunciated to operators.

The licensee noted error codes are categorized in the following two different groups:

1. Error Message Set 1 - Messages that refer to conditions that could affect transmitter operation. Error messages alert when the sensor module is disconnected or malfunctions due to conditions such as errors occurring in non-volatile memory or if pressure or temperature updates are not being received.

2. Error Message Set 2 - Warning message that reflect operational conditions but do not necessarily affect transmitter operation. Error messages include process variable temperature out of range.

In RAI EICB-3, the NRC staff noted that Section 2 of the Engineering Evaluation in the original LAR states that "non-specific failures" in the processor hardware or software routines that delay the processing function could theoretically increase time without an apparent gross failure of the device. The staff further noted that it was not clear whether this refers to issues such as errors in code or component failure within the electronic module and requested a description of the non-specific failures that could affect response time.

The licensee clarified that non-specific failures are a subset of failures that can result in a condition of the transmitter referred to as "fail-slow" condition . A fail-slow condition is a state where the microprocessor is still active and operating, but at a reduced rate of speed or performance. This can occur as a result of software or hardware faults, although the licensee states that this would not occur in the microprocessor itself. For example, the licensee states a hardware fault that could result in a fail-slc;>w condition would be an internal power supply that causes the microprocessor to run at a lower voltage capacity. This would affect the microprocessor clock speed and performance. This in turn would affect signal processing speed of the pressure signal. However, the clock speed (in the megahertz range) by which the signal processing speed is dependent, operates at a much higher speed than the speed at which the transmitter would sense a change in the actual mechanical pressure (in the hertz range). This suggests that a potential hardware failure would not immediately affect the response time of the transmitter. Lastly, the licensee concluded that a reduced voltage would result in a complete failure of the processor before affecting response time. With regard to software/firmware, the licensee suggested that corruption of the software routine or memory errors could theoretically lead to a fail-slow condition. The licensee states that corruption of software routines that lead to internal reboots of the processor, would be a self-revealing failure, or its effects would be similar to the hardware faults discussed above and thus, would not impact the signal processing speed of the transmitter unless a gross failure occurs.

In response to RAI EICB-3, the licensee also stated that when applying these theoretical fail-slow conditions to the 3051 N pressure transmitter, it is not credible that these would result in undetected fail-slow conditions.

The NRC staff considers the potential for an undetectable fail-slow conditions to be credible.

However, based upon the information provided by the licensee in its engineering evaluation, there is sufficient technical basis for the NRC staff to consider an undetected fail-slow condition to be credible but unlikely, given the self-diagnostic mechanism in place along with other periodic testing for the system.

The NRC staff reviewed the licensee's engineering evaluation of the self-diagnostic features of the 3051N model series using the guidance in NUREG-:0800, BTP 7-17. The NRC staff finds that the self-diagnostics coverage adequately supports the FMEA (e.g. Table 2-2 of the Engineering Evaluation) in the licensee's engineering evaluation. The operational parameters monitored by the self-diagnostics, as well as resultant error codes produced (as described above), adequately demonstrate that potential failures in the electronics module and mechanical portions that could affect transmitter response time would be detected and alerted to operators.

The self-diagnostics of the 3051 N module adequately address the potential for non-specific processor failures due to adequate monitoring of processor and transmitter operations in which

failures would potentially affect response time. The engineering evaluation adequately demonstrates that for non-specific failures of the electronics module microprocessor, the failure effects would either be detected through other periodic surveillance activities, the self-diagnostics features, or the effects of the failure would be self-revealing such that operators can take appropriate actions through monitoring of the channel. The self-diagnostic features, as described in the licensee's engineering evaluation, consistent with the guidance in NUREG-0800, BTP 7-17 and will provide reasonable assurance of safety.

3.2.3 EPRI Report Recommendations The supplemental LAR adopts three of the four original recommendations made in EPRI Report NP-7243 regarding pressure transmitter maintenance and operation, including:

• Perform hydraulic RTT before installation of new transmitters and/or switches or after refurbishment.

• Transmitters and/or switches that utilize capillary tubes have RTT performed after initial installation and after each maintenance or modification that has the potential to damage the capillary tubes.

• If variable damping is used, implement a method to assure that the potentiometer is at the required setting and cannot be inadvertently changed.

The licensee states, in both the supplemental LAR and the Engineering Evaluation in of the supplemental LAR, that these recommendations will be retained for the Rosemount 3150 and 3051 N series pressure transmitters. For example, in the 3051 N series, the variable damping function is performed by the microprocessor through software considering that variable damping is still a calibration option.

The recommendations in the ERPI Report NP-7243 were originally provided as actions that a licensee should add to its response time testing program upon eliminated sensor/transmitter response time testing. The recommendations were evaluated by NRC staff in the SE for EPRI NP-7243. These recommendations were carried forward into Topical Report CE NPSD-1167-A and the NRC staff's evaluation and approval of that report. The recommendations facilitate continued compliance of the design in accordance with 10 CFR 50.36 and continued safe operation of the design when implementation of the periodic response time testing exemption is performed upon approval of the supplemental LAR. The NRC staff finds that the retention of the above recommendations is appropriate because they address all potential conditions, which would affect time response of the applicable instruments.

3.3 NRC Staff Technical Conclusions The NRC staff evaluated the supplemental LAR for compliance with applicable regulations and conformance with associated regulatory guidance.

The regulations in 10 CFR 50.36 establish the requirements related to the content of the TSs.

The proposed amendment would approve the elimination of the required or periodic RTT, as provided in PVNGS TS 1.1 for the Rosemount 3150 and 3051 N series pressure transmitter/sensor components . The proposed amendment does not eliminate required surveillance testing for the entirety of the instrument channel or the system as a whole (e.g.

RPS). After reviewing the licensee's supplemental LAR, the NRC staff determined that the TSs

continue to be based on the analyses and evaluation included in the safety analysis report, and amendments thereto, and the requirements of 10 CFR 50.36(a)(1) will continue to be met. The NRC staff concludes that the TS Bases continue to describe the bases for the TSs and follow the "Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors" (58 FR 39132).

Appendix A to 10 CFR Part 50 provides GDC for nuclear power plants. Plant-specific design criteria are described in the Updated Final Safety Analysis Report for PVNGS. The proposed amendment has no effect on the design, fabrication, use, or methods of testing the instrumentation channels. Additionally, the proposed amendment will not affect the ability of the instrumentation to perform the functions assumed in the safety analysis and no potential new failure modes will be introduced that could affect protection system functions. Therefore, the NRC staff finds that the design will remain in compliance with GDC 13, GDC 21, and GDC 23.

RG 1.118 endorses IEEE Std. 338-1987. The NRC staff concludes that the supplemental LAR complies with the criteria of IEEE Std . 338-1987, Clause 6.3.4, because it adequately demonstrates that the use of allocated response times, for replacement Rosemount 3150 and 3051 N series transmitters, would maintain response times within acceptable limits, and that changes in performance are detectable through other periodic tests.

NUREG-0800, BTP 7-17, Revision 6, states, in part:

Failures detected by hardware, software, and surveillance testing should be consistent with the failure detectability assumptions of the single-failure analysis and the failure modes and effects analysis.

• The NRC staff finds that the licensee has adequately demonstrated that assumptions in the single-failure analysis and the FMEA for the system are maintained in the presence of the new replacement 3150 and 3051 N series pressure transmitters in conformance with NUREG-0800.

Based upon the information provided in the licensee's engineering evaluation, the licensee has adequately demonstrated that the FMEA for the Rosemount 1150 series pressure transmitter, as described in CE NPSD-1167-A and EPRI Report NP-7243, are still valid for the 3150 series and 3051 N series pressure transmitters. The NRC staff also concludes that the licensee adequately demonstrated that new failures modes unique to the 3150 series and 3051 N series transmitters, due to either differences in design or construction, would not alter the applicability of the conclusions of the FMEA for the 1150 series pressure transmitters. The FMEA, as described in Attachment 3 of the supplemental LAR, demonstrates that failure modes unique to the design of the 3051 N Rosemount transmitters are detectable, and the design renders certain software-based failures unlikely to occur. Therefore, the NRC staff has reasonable assurance that failures detected by hardware, software, and surveillance testing is consistent with the failure detectability assumptions of the single-failure analysis, and the failure modes and effects analysis.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Arizona State official was notified of the proposed issuance of the amendments on March 6, 2019. The State official had no comments.

5. 0 ENVIRONMENTAL CONSIDERATION The amendments change a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, published in the Federal Register on July 31, 2018 (83 FR 36973), and there has been no public comment on such finding. Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b ), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

• Principal Contributor: W. Morton, NRR Date: April 3, 2019

R. Bement

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 - ISSUANCE OF AMENDMENTS REGARDING RESPONSE TIME TESTING OF PRESSURE TRANSMITTERS (EPID L-2018-LLA-0161)

DATED APRIL 3, 2019 DISTRIBUTION:

PUBLIC RidsRgn4MailCenter Resource RidsACRS_MailCTR Resource RidsNrrDeEicb Resource RidsNrrDorllpl4 Resource WMorton, NRR RidsNrrDssStsb Resource RStattel, NRR RidsNrrLAPBlechman Resource MHamm, NRR RidsNrrPMPaloVerde Resource ADAMS Access1on No. ML19070A218 **b1y e-ma, *b,v memoran d um OFFICE NRR/DORL/LPL4/PM NRR/DORL/LPL4/LA NRR/DE/EICB/BC* NRR/DSS/STSB/BC NAME SLingam PBlechman MWaters VCusumano DATE 3/13/19 3/12/19 3/6/19 4/3/19 OFFICE OGC (NLO)** NRR/DORL/LPL4/BC NRR/DORL/LPL4/PM NAME RSusko RPascarelli SLingam DATE 4/2/19 4/3/19 4/3/19 OFFICIAL RECORD COPY