n. sr. vice president & chief nuclear officer brltt t ...ppml ppi s.5 .-* h1ar 1 19opx u. s....

N.

/-Brltt T. McKinney

Sr. Vice President & Chief Nuclear OfficerPPL Susquehanna, LLC

769 Salem BoulevardBerwick, PA 18603

Tel. 570.542.3149 Fax [email protected]

PPI 5 .- *ppml s.

H1AR 1 19OPX

U. S. Nuclear Regulatory CommissionAttn: Document Control DeskMail Stop OP1-17Washington, DC 20555-0001

SUSQUEHANNA STEAM ELECTRIC STATIONPROPOSED LICENSE AMENDMENTNO. 279 FOR UNIT 1 OPERATING LICENSE NO. NPF-14 ANDNO. 248 FOR UNIT 2 OPERATING LICENSE NO. NPF-22ARTS/MELLLA IMPLEMENTATION - SUPPLEMENT DPLA-6168

ocket Nos.and

50-38750-388

Reference: 1) PLA-5931, B. T McKinney (PPL) to Document Control Desk (USNRC),"Susquehanna Steam Electric Station Proposed License Amendment No. 2 79forUnit 1 Operating License No. NPF-14 and 248for Unit 2 Operating LicenseNo. NPF-22 ARTS/MELLLA Implementation, "dated November 18, 2005.

In accordance with 10 CFR 50.90, PPL Susquehanna, LLC (PPL) submitted a requestfor a license amendment to the Susquehanna Steam Electric Station (SSES) Unit 1 andUnit 2 Technical Specifications to implement an expanded operating domain resultingfrom the implementation of Average Power Range Monitor/Rod Block Monitor/Technical Specifications/Maximum Extended Load Line Limit Analysis (ARTS/MELLLA) (Reference 1).

The purpose of this letter is to provide a supplement based on teleconferences held onMarch 6, 8, and 9, 2007 with the NRC staff.

PPL respectfully requests that NRC expeditiously complete the review and approval ofthe proposed ARTS/MELLLA License Amendment Request proposed in Reference 1.PPL continues to install ARTS/MELLLA in Unit 2 and request approval prior to startupfrom the Spring 2007 Outage.

- 2 - Document Control DeskPLA-6168

If you have any questions or require additional information, please contactMr. Michael Crowthers at (610) 774-7766.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on: 3 /Z-/07

B. T. cKinney

Enclosure: PPL ARTS/MELLLA Supplement

cc: NRC Region IMr. A. J. Blarney, NRC Sr. Resident InspectorMr. R. V. Guzman, NRC Project ManagerMr. R. R. Janati, DEP/BRP

ENCLOSURE TO PLA-6168

PPL ARTS/MELLLA SUPPLEMENT

Enclosure to PLA-6168Page 1 of 9

NRC requested PPL provide supplemental information in the three areas provided below:

1. Describe the reliability of the RBM system and the quality standards to which theRBM has been designed, procured, tested and will be maintained. Describe theseismic design basis. Describe the power supply design and quality, and what wouldoccur if the RBM lost power.

Response:

RBM Function

The Power Range Neutron Monitoring System (PRNMS) RBM system is comprised oftwo RBM channels each comprised of a RBM chassis and one RBM Interface Module.The two RBM channels are intended to be redundant to each other but were not designedfor any specific safety function. To meet this redundancy objective, there is no directconnection between RBM channels. The RBM channels are mounted in the same panelbay with physical space between them. Per Section 5.2.2.2 of NEDC 32410P-A, theRBM receives LPRM signals and a Simulated Thermal Power (STP) signal from anassigned "master" APRM and receives the identity of the selected control rod from thereactor manual control system. Each RBM selects half of the LPRM detectorssurrounding the selected control rod, generates an average signal of the selected LPRMusing detector levels B, C, and D signals and applies a gain adjustment to this localizedaverage value to make it equal to 100%. The gain adjustment is applied only if thelocalized average value is less than 100%. The STP is used to select one of threepredefined setpoints.

A rod block signal is generated when the average of the selected LRPM signals reachesor exceeds the setpoint. The RBM is automatically disabled from generating rod blocksif a peripheral control rod is selected or if the STP value from the master APRM is lessthan approximately 28% of rated core thermal power.

An RBM Interface Module is provided to act as an electrical connector adapter betweenthe cables and compact chassis connectors. The module also provides a mountinglocation for solid state relays which interface between the RBM and the equipmentoutside the PRNMS panel, implements and maintains the trip and rod block bypass statesindependent of the associated RBM chassis, and provides the multiplexing function toconvert the relay contact rod select signal input to multiplexed form for the RBM chassis.

RBM Quality and Seismic Design Base

As stated in General Electric Licensing Topical Report NEDC-3241OP-A SafetyEvaluation Report, Section 3.3, page 10, "The RBM chassis (where applicable), RBMInterface Panels (where applicable), remote I/O Interface Panels (where applicable), andoperator interface equipment mounted in the main control board are not required to


operate to accomplish a system safety function. However, these components mustmaintain physical integrity under all conditions such that a failure or fault cannot disablepower to the components required to perform safety functions, or cause a loss of the RPSAC power busses coming into the PRNMS panels." The RBM and APRM/OPRM aremounted in separate bays in the panel with metal barriers so a major fault is containedwithin an enclosure and will not propagate from an RBM to any single or multipleAPRM channels. All communication from the APRM/OPRM to the non-safety relatedplant computer is via the RBM and a second fiber-optic link to computer interfacingequipment.

All interfaces between the safety-related equipment and that performing system safetyfunctions are via fiber optics. Per NEDC 324 1OP-A, Section 3.6.1, page 18, the PRNMSsystem is isolated in accordance to IEEE Std. 279-1971 which "requires that thetransmission of signals from protection system equipment for control system use shall bethrough isolation devices which shall be classified as part of the protection system. In thePRNMS design, all interface connections between control and protections systems aremade through fiber optic-based isolation devices of the same classification as theprotection system. Additionally, all control wiring is separated from protection systemwiring via the use of conduits and physical separation."

The quality standards to which the PRNMS RBM has been designed, manufactured, andqualified is as outlined in PLA-5880 (Adams Ascension Number ML051870394) Section7, Plant-Specific Evaluation Required by NUMAC PRNM Retrofit Plus Option IIIStability Trip Function Topical Report (NEDC-3241OP-A).

The ARTS Performance Specification, Safety Classification section, specifies that "TheRBM Instrument is designed, manufactured, and qualified to the same standards as Class1 E equipment, but the RBM instrument provides no safety function."

The procurement and factory acceptance testing of the PRNMS from General Electricwas in accordance with the procurement technical requirements outlined in PPL NuclearEngineering Specification for Procurement of a Power Range Neutron MonitoringSystem (PRNMS). This specification document is a safety related document outliningboth the safety-related and non-safety related functions.

The RBM parts were supplied by General Electric with system safety classification aslisted in the following Table:


Table PRNMS System Safety Classification of Main Components

Name Safety ClassificationAverage Power Range Monitor QRod Block Monitor SQuad Low Voltage Power Supply Chassis Q2/4 Logic Module QRBM Interface Module SFiber Optic Cables QPower Range Monitor Cabinet QCables QRBM Cal & Monitoring Panel SAPRM Cal & Monitoring Panel QLPRM Connector Panel QMulti Vendor Data Acquisition System N

N = Non-Safety RelatedQ = Safety RelatedS = Special Requirements

The Special Requirements classification "S" that is applicable to the RBM is applied tothose components that do not perform a safety function but are designed, produced, anddocumented with considerations similar to safety related. This classification is used inapplications where the component itself performs no safety function; however, it islocated near safety related components and thus, it is desirable to ensure a failure of thenon-safety component will not degrade in a way that it will affect any safety function.

RBM materials were purchased by General Electric as "Q," safety related. Since thehigher level system classification must take into account non-safety portions of the RBMoperation, the General Electric system classification is "S."

Maintenance of the RBM system is performed during required surveillance testing and onan as needed basis. Should corrective maintenance be required, a plant component workorder (PCWO) would be initiated and planned per the requirements of a non-safetyrelated system. Physical work on the PRNM system including RBM is performed byINPO accredited station qualified technicians. If parts replacement is required, the partsare purchased from General Electric in accordance with the original material identifica-tion and requisition drawing and requirements. Upon return to service of the RBMsystem, the appropriate surveillance testing would be performed to ensure operability inaccordance with the Technical Specifications.


PLA-5880, Section 7, Table Section 4.4.2.3.4 discusses the Seismic DesignConsideration for PRNMS. Specifically stated therein is, "The seismic qualificationresults will be documented in a plant-specific "Qualification Summary." ThisQualification Report, supplied to the NRC via PLA-5880, summarizes the qualificationand testing of the PRNMS RBM components. Table 1.1 of this report shows the RBMchassis, the RBM Interface Module, and RBM Interface Panel as all being included. Thisequipment was included to require Seismic and Electromagnetic Compatibility (EMC)emissions qualification in order to prevent them from becoming a missile or interferingwith other equipment in the PRNMS panel. Additionally, equipment qualification wasperformed on both a testing and analysis level. Section 3.3 outlines the results for boththe instrument and panel testing.

The qualification standards and guidelines outlined in the Qualification Summary Reportare as stated in Section 2.3, "Qualification Standards," and include:

IEEE Std. 323-1974

IEEE Std. 344-1975

MIL-STD-461D

MIL-STD-462D

IEC 801-2

IEC 801-4

IEC 801-5

EPRI TR- 102323

IEEE Standard for Qualifying Class 1E Equipment forNuclear Power Generating Stations

IEEE Recommended Practice for Seismic Qualificationof Class 1 E Equipment for Nuclear Power GeneratingStations

Requirements for the Control of ElectromagneticInterference Emissions and Susceptibility

Measurement of Electromagnetic InterferenceCharacteristics

Electromagnetic compatibility for industrial-processmeasurement and control equipment;Part 2: Electrostatic discharge requirements

Electromagnetic compatibility for industrial-processmeasurement and control equipment;Part 4: Electrical fast transient/burst requirements

Electromagnetic compatibility for industrial-processmeasurement and control equipment;Part 5: Surge immunity requirements

Guidelines for Electromagnetic Interference Testing inPower Plants, September 1994


Since the equipment is physically mounted in "Q," safety-related panels, PPL seismicqualification binder calculations have been prepared to support the installation of allPRNMS equipment. The PRNMS equipment is to be located in plant panels 1(2)C608located in the Control Structure, Lower Relay Room.

RBM Power Supply

The RBM chassis is powered from the Quad Low Voltage Power Supply Chassis.This chassis receives two AC power inputs, one from each RPS channel bus. The RBMchassis receives low voltage power, +5 VDC and +15 VDC, from two redundant LowVoltage Power Supplies contained in a Quad Low Voltage Power Supply (LVPS)chassis, each of which operate from a different RPS AC power bus. The outputs of theredundant power supplies are auctioned and monitored by the respective RBM chassis,both locally and at the Quad LVPS chassis.

At the Quad LVPS, the loss of a single supply's output, either due to hardware failure orinput AC power failure, causes a self test alarm at control panel 1(2)C608. The loss ofredundant outputs causes an INOP condition and a trip for the affected RBM channel.

Per NEDC 32410P-A, Section 5.3.8, upon loss of input power, the affected RBM chassistrip and alarm outputs default to the safe condition and remain in that condition untilpower is reapplied and one self-test cycle has completed without detection of a criticalfailure, at which point the INOP trip will clear. For the RBM, this safe condition initiatesa rod block. Loss of all input power to an RBM causes the fail-safe RBM Inop outletrelay to de-energize and the associated normally open contact will open, resulting in a rodblock.

Power to the RBM Interface Module is supplied by one of the 120 VAC RPS buses(one bus for each RBM). The AC power goes to an internal LVPS that supplies DCpower to the interface circuitry.

Conclusion:

Based on the above, the RBM system is a highly reliable and high quality system that isdesigned to criteria and standards identical in many ways to the safety related portions ofthe PRNMS. The system does include redundancy features, fail-safe features and self-monitoring features. This high quality design is consistent with the original SusquehannaRBM System design as described and evaluated in NUREG 0776 "Safety EvaluationReport Related to the Operation of Susquehanna Steam Electric Station Units 1 and 2."


2. Describe what would occur as a worst case for an RWE event.

The response provided below is a qualitative discussion. No risk calculations or fueldamage calculations have been performed.

Response:

The Susquehanna FSAR Section 15.4.2 describes the Rod Withdrawal Error as "... thereactor operator makes a procedural error and withdraws the maximum worth control roduntil the Rod Block Monitor (RBM) System inhibits further withdrawal or the control rod isfully withdrawn." The RWE analysis is performed in a conservative manner.

Station administrative and operations control procedures provide assurance against anoperator error. Station procedures require that all control rod manipulations be performedby an active licensed operator and verified by a second licensed operator or other qualifiedmember of the technical staff. Both the operator and verifier monitor the plant to ensure theresponse is as expected. In addition, the on-shift SRO routinely provides added oversightduring reactivity manipulations to ensure error-free performance. These requirements arereinforced during periodic operator re-qualification training sessions.

In the unlikely event that both RBM channels become inoperable after the operator errorand all administrative controls required by station procedures are not effective while acontrol rod is being withdrawn, the event could result in exceeding the MCPR Safety Limit.The increase in overall core power from this scenario is not expected to be large enough toactuate the Reactor Protection System (RPS). The highly reliable RBM design as describedin the response to the first question provides the basis for concluding that the probabilitythat both RBM channels could fail while the control rod is being withdrawn in such a waythat RBM blocks would not occur is extremely unlikely. The reliability of the PRNMSRBM module is enhanced through its internal self-test function. The RBM moduleautomatically and continuously tests itself to ensure operability during normal operation.The loss of an essential function (termed a critical self-test fault) results in an inoperablesystem trip (i.e., a rod block and a self-test alarm condition). Examples of critical self-testfaults include failure of an RBM communication card, RBM supply voltage not in range,failure of EPROM memory integrity, and loss of input signal from the Reactor ManualControl System.

The Susquehanna Technical Specifications require that both RBM channels be operable toensure that no single instrument failure can preclude initiation of a rod block. Per stationprocedures, it is the intent that the RBM remain operable as required by TechnicalSpecifications and not be bypassed for convenience.

With one RBM channel bypassed, the remaining RBM channel is adequate to perform therod block function; however, a single failure in the remaining channel can result in loss of


control rod block capability. The RBM channel TS completion times are based on the lowprobability of the Rod Withdrawal Error (RWE) event coincident with a failure of theremaining RBM channel. If the inoperable channel is not restored within the specifiedcompletion time, one RBM channel must be placed in a trip (block) condition.

Conclusion:

Multiple human errors and equipment failures that collectively are beyond theSusquehanna Licensing basis have to occur for an RWE event to possibly result inexceeding the MCPR Safety Limit. Consistent with GDC 25, the licensing basisrequirements for the RWE are to assume a malfunction of the reactivity control system(i.e., the operator error). Subsequent failure of the RBM is not required to be assumed.


3. Do the GDC 25 requirements apply to the RBM and the RWE event?

GDC 25 states:

"The protection system shall be designed to assure that specified acceptable fuel designlimits are not exceeded for any single malfunction of the reactivity control systems, suchas accidental withdrawal (not ejection or dropout) of control rods."

The FSAR Design Conformance to GDC 25 (FSAR Section 3.1.2.3.6) states:

"Design Conformance

The reactor protection system provides protection against the onset andconsequences of conditions that threaten the integrity of the fuel barrier and theRCPB. Any monitored variable which exceeds the scram set point will initiate anautomatic scram and not impair the remaining variables from being monitored,and if one channel fails, the remaining portions of the reactor protection systemshall function.

The reactor manual control system is designed so that no single failure can negatethe effectiveness of a reactor scram. The circuitry for this system is independentof the circuitry controlling the scram valves. This separation of the scram andnormal rod control functions prevents failures in the reactor manual controlcircuitry from affecting the scram circuitry. Because each control rod is controlledas an individual unit, a failure that results in energizing any of the insert orwithdraw solenoid valves can affect only one control rod. The effectiveness of areactor scram is not impaired by the malfunctioning of any one control rod.

The design of the protection system ensures that specified acceptable fuel limitsare not exceeded for any single malfunction of the reactivity control systems asspecified in Criterion 25.

For further discussion, see the following sections:

1) Principal Design Criteria 1.2.1

2) Reactivity Control System 4.1

3) Nuclear Design 4.3

4) Thermal and Hydraulic Design 4.4

5) Reactor Protection System 7.2

6) Reactor Manual Control System 7.7

7) Accident Analysis 15.0"


Conclusion:

The GDC describes design requirements for the "protection system." The GDC 25"protection system" for SSES is the "reactor protection system". FSAR Section 1.2.2.4.1describes that the reactor protection system "initiates a rapid, automatic shutdown(scram) of the reactor. This action is taken in time to prevent excessive fuel claddingtemperatures and any nuclear system process barrier damage following abnormaloperational transients. The Reactor Protection System overrides all operator actions andprocess controls."

The RBM is not part of the reactor protection system. The RBM does not initiate "arapid, automatic shutdown (scram) of the reactor." Failure of the RBM cannot preventRPS from affecting a scram. Its function is to apply a rod block. As a result, therequirements of GDC 25 do not apply to the RBM.

n. sr. vice president & chief nuclear officer brltt t ...ppml ppi s.5 .-* h1ar 1 19opx u. s....

Documents