DCL-15-023, License Amendment Request 15-01 - Incorporation Into Licensing Basis of Pressurizer Filling Analysis for Major Rupture of a Main Feedwater Pipe Accident

License Amendment Request 15-01 - Incorporation Into Licensing Basis of Pressurizer Filling Analysis for Major Rupture of a Main Feedwater Pipe Accident

ML15056A773
Person / Time
Site:	Diablo Canyon
Issue date:	02/25/2015
From:	Welsch J Pacific Gas & Electric Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
DCL-15-023
Download: ML15056A773 (73)

Text

lrl,

• Pacific Gas and

~~ ~ Electric Company James M. Welsch Diablo Canyon Power Plant Site Vice President Mail Code 104/6 P. 0. Box 56 Avila Beach, CA 93424 February 25, 2015 805.545.3242 Internal: 691.3242 Fax: 805.545.4884 PG&E Letter DCL-15-023 U.S. Nuclear Regulatory Commission 10 CFR 50.90 ATTN: Document Control Desk Washington, D.C. 20555-0001 Docket No. 50-275, OL-DPR-80 Docket No. 50-323, OL-DPR-82 Diablo Canyon Units 1 and 2 License Amendment Request 15-01 Incorporation into Licensing Basis of Pressurizer Filling Analysis for Major Rupture of a Main Feedwater Pipe Accident

Dear Commissioners and Staff:

Pursuant to 10 CFR 50.90, Pacific Gas and Electric Company (PG&E) hereby requests approval of the enclosed proposed amendment to Facility Operating License Nos. DPR-80 and DPR-82 for Units 1 and 2, respectively, of the Diablo Canyon Power Plant (DCPP). The enclosed license amendment request (LAR) proposes to incorporate into the licensing basis an analysis of pressurizer filling concerns associated with the main feedwater pipe rupture accident summarized 1n DCPP Updated Final Safety Analysis Report (UFSAR) Section 15.4.2.2. The proposed amendment involves the addition of time critical operator actions and modifications of the PG&E Design Class I backup nitrogen accumulators, which are credited in the new pressurizer filling analysis.

The enclosure provides technical and regulatory evaluations of the changes.

Proposed UFSAR markups are included as Attachment 1 and Technical Specification Bases markups are provided in Attachment 2 to the enclosure, both for information only.

The changes in this LAR are not required to address an immediate safety concern.

PG&E requests approval of this LAR no later than February 19, 2016. PG&E requests the license amendments be made effective upon NRC issuance to be implemented following PG&E implementation of Design Class I backup nitrogen accumulator modifications, planned for the Unit 1 and Unit 2 nineteenth refueling outages ( 1R 19 and 2 R 19, respectively).

In accordance with site administrative procedures and the Quality Assurance Program, the proposed amendment has been reviewed by the Plant Staff Review Committee.

A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway

• Diablo Canyon

• Palo Verde

• Wolf Creek

Document Control Desk PG&E Letter DCL-15-023 February 25, 2015 Page 2 This letter contains no regulatory commitments (as defined by NEI 99-04).

Pursuant to 10 CFR 50.91 (b)(1), PG&E is sending a copy of this proposed amendment to the California Department of Public Health.

If you have any questions or require additional information, please contact Mr. Philippe Soenen at 805-545-6984.

I state under penalty of perjury that the foregoing is true and correct.

Executed on February 25, 2015.

Sincerely,

~~

Site Vice President mlkk/50407034 Enclosure cc: Diablo Distribution cc/enc: Marc L. Dapas, NRC Region IV Regional Administrator William M. Dean, NRC/NRR Director Thomas R. Hipschman, NRC Senior Resident Inspector Siva P. Lingam, NRC Project Manager Gonzalo L. Perez, California Department of Public Health A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway

• Diablo Canyon

• Palo Verde

• Wolf Creek

Enclosure PG&E Letter DCL-15-023 License Amendment Request 15-01 Incorporation of Pressurizer Filling Analysis for Major Rupture of a Main Feedwater Pipe Accident Table of Contents

1.

SUMMARY

DESCRIPTION ...................................................................................... 3

2. DETAILED DESCRIPTION ....................................................................................... 4 2.1 Changes to UFSAR Section 15.4.2- Major Secondary System Pipe Rupture ... 4 2.2 Changes to UFSAR Section 6.5.3- Safety Evaluation ...................................... 5 2.3 Technical Specification Bases 83.4.11 Changes ............................................... 5 2.4 Reason for Proposed Amendment ..................................................................... 6 2.4.1 PORVs Credited for a SSI Event ................................................................ 6 2.4.2 Current FLB Analysis .................................................................................. 7 2.4.3 New Pressurizer Filling Analysis for FLB Event .......................................... 8 2.4.4 50.59 Evaluation ......................................................................................... 8 2.4.5 Continued Operability Until License Amendment is Implemented ............... 9

3. TECHNICAL EVALUATION ...................................................................................... 9 3.1 System Description ............................................................................................ 9 3.2 Transient Descriptions ...................................................................................... 11 3.2.1 FLB Transient ............................................................................................ 11 3.2.2 PORV and PSV Operation during FLB Transient ....................................... 11 3.3 Time Critical Operator Action (TCOA) Program ................................................ 12 3.4 FLB Pressurizer Filling Analysis ........................................................................ 13 3.4.1 Acceptance Criteria ................................................................................... 13 3.4.2 Method of Analysis .................................................................................... 13 3.4.3 Assumptions .............................................................................................. 16 3.4.4 Analysis Results ........................................................................................20 3.5 Demonstration of TCOAs ..................................................................................22 3.6 PORV Qualification Evaluation .........................................................................24

3. 7 PORV Discharge Piping Evaluation .................................................................. 25

4. REGULATORY EVALUATION .................................................................................25 4.1 Applicable Regulatory Requirements I Criteria .................................................. 25 4.2 Precedents .......................................................................................................27 4.3 No Significant Hazards Consideration Determination ........................................ 27 4.4 Conclusions ......................................................................................................30 1

Enclosure PG&E Letter DCL-15-023

5. ENVIRONMENTAL CONSIDERATION .................................................................... 30

6. REFERENCES ........................... ............................... .. ............................................ 30 ATTACHMENTS:

1. Diablo Canyon Power Plant UFSAR Markups (For Information Only)

2. Technical Specification Bases Markup (For Information Only) 2

Enclosure PG&E Letter DCL-15-023 LICENSE AMENDMENT REQUEST 15-01

1.

SUMMARY

DESCRIPTION This evaluation supports a request to amend Facility Operating License Numbers DPR-80 and DPR-82 for Units 1 and 2, respectively, of the Diablo Canyon Power Plant (DCPP).

The proposed amendment would permanently incorporate into the licensing basis an analysis of pressurizer filling concerns associated with the main feedwater pipe rupture accident, which is summarized in DCPP Updated Final Safety Analysis Report (UFSAR) Section 15.4.2.2. The proposed amendment involves the addition of four credited operator. actions and modification of the Pacific Gas and Electric (PG&E) Design Class I backup nitrogen accumulator capacities, which are credited in the pressurizer filling analysis.

The spurious safety injection (SSI) pressurizer overfill analysis (UFSAR 15.2.15.3) is currently credited for the feedwater line break (FLB) pressurizer filling condition (UFSAR 15.4.2.2.3). The results of the new FLB pressurizer filling analysis indicate the response time for the operator action to ensure a pressurizer power operated relief valve (PORV) available during a FLB and the backup nitrogen requirement are not bounded by the existing analysis for the SSI pressurizer filling event.

The new FLB analysis demonstrates that with worst case scenarios resulting in a pressurizer filling condition during a FLB accident, liquid water (hereinafter referred to as water) relief through the pressurizer safety valves (PSVs) is prevented assuming the following operator actions: (1) ensure a PORV is available within 8.6 minutes, (2) isolate the faulted steam generator within 10 minutes, (3)' isolate charging flow within 25 minutes, and (4) stop reactor coolant pump (RCP) seal injection flow within 45 minutes. In addition, based on the new analysis, PG&E determined that increasing the capacities of the PG&E Design Class I backup nitrogen accumulators is necessary to assure operators sufficient time to perform the above actions. PG&E is modifying the Class I PORV backup nitrogen supply systems to accommodate cycling the PORVs for the duration required by operators to complete the above actions. The modifications are scheduled to be completed during the Unit 1 and Unit 2 Nineteenth Refueling Outages (1R19 and 2R19, respectively). This license amendment request (LAR) is not requesting approval of the modifications, which do not require prior NRC approval per 10 CFR 50.59.

PG&E has evaluated continued operation and determined the condition addressed by this proposed amendment does not pose an operability concern. A prompt operability assessment (POA), discussed in Section 2.4.5, documents the basis for continued operation.

3

Enclosure PG&E Letter DCL-15-023

2. DETAILED DESCRIPTION The proposed license amendment would revise UFSAR. Chapter 15, Section 15.4.2 to incorporate an analysis of pressurizer filling concerns associated with the main feedwater pipe rupture accident. Details of the analysis changes, background, and reason for the proposed amendment are as follows.

2.1 Changes to UFSAR Section 15.4.2- Major Secondary System Pipe Rupture The proposed amendment revises UFSAR, Revision 21, by adding a new Section 15.4.2.4, "Major Rupture of a Main Feedwater Pipe for Pressurizer Filling."

The specific changes to the UFSAR are noted in the marked-up copies of the current UFSAR Section 15.4.2, provided for information only in Attachment 1. A summary of the changes to Section 15.4.2 is provided below:

a) Section 15.4.2.2.3 is revised to reference new section 15.4.2.4 for pressurizer filling concerns.

b) Section 15.4.2.2.4.1 is revised to reference new section 15.4.2.4 for pressurizer filling concerns.

c) Section 15.4.2.4 is added to incorporate the new pressurizer filling analysis for the FLB event. The new section includes five subsections similar to Section 15.2.15.3, including Acceptance Criteria, Identification of Causes and Accident Descriptions, Analysis of Effects and Consequences, Results, and Conclusion. In addition, Figures 15.4.2-22 through 27 are added and Table 15.4-8 is revised to add timelines for pressurizer filling during a FLB event.

d) The operator actions (Time Critical Operator Actions or TCOAs) credited in the FLB pressurizer filling analysis are shown in Table 2-1.

The analysis calculates the minimum time to the first PSV lift during a FLB event, which provides the basis for TCOA 1 to ensure a PORV is available in 8.6 minutes (provides pressurizer pressure relief to prevent water relief through the PSVs). The analysis credits TCOAs 2, 3, and 4 in determining the maximum number of PORV water-relief cycles required until the actions are completed. The number of cycles is used to determine the capacity of the nitrogen accumulators as discussed in e) below.

4

Enclosure PG&E Letter DCL-15-023 Table 2-1, TCOAs Proposed for FLB Pressurizer Filling Event Proposed TCOA Time TCOA Description (minutes)

1. Ensure a PORV is available 8.6

2. Isolate the faulted SG 10

3. Isolate charging flow 25

4. Stop RCP seal injection flow . 45 e) The PG&E Design Class I backup nitrogen accumulators are used to operate the PORVs when instrument air is not available. The capacity of the nitrogen accumulators currently provides enough nitrogen to cycle the PORVs for approximately 100 cycles. To accommodate cycling the PORVs for the 45-minute duration assumed to terminate the filling transient, PG&E will modify the PG&E Design Class I backup nitrogen accumulators for a design capability of 300 PORV cycles. The modifications ensure sufficient nitrogen is available to operate the PORVs until pressurizer water level is reduced such that water relief through the PSVs is no longer a concern or until pressurizer pressure is below the PORV setpoint.

2.2 Changes to UFSAR Section 6.5.3- Safety Evaluation a) Section 6.5.3.7, "[AFW System Safety Evaluation] General Design Criterion 37, 1967- Engineered Safety Features Basis for Design," is revised to add a reference to the new FLB pressurizer filling analysis (UFSAR 15.4.2.4) and a summary of the treatment of the auxiliary feedwater system (AFWS) in the new analysis.

b) Table 6.5-1, "Criteria for Auxiliary Feedwater System Design Basis Conditions," is revised to add a design criterion for the FLB condition that water relief through the pressurizer safety valves is precluded.

c) Table 6.5-2, "Summary of Assumptions- AFWS Design Verification," is revised to add assumptions for the new analysis.

2.3 Technical Specification Bases B3.4.11 Changes The proposed amendment results in a change to Technical Specification (TS) Bases B3.4.11, "Pressurizer Power Operated Relief Valves," to add that the PORVs mitigate the consequences of a pressurizer filling condition during the FLB event, in addition to the SSI event. Details of the changes to the TS Bases B3.4.11 are noted in the marked-up copies of the current TS Bases pages provided in Attachment 2.

5

Enclosure PG&E Letter DCL-15-023 2.4 Reason for Proposed Amendment Under certain accident conditions, such as those experienced following a FLB event, it is predicted that the pressurizer could reach a water-solid (filled) condition. If this occurs, water relief through the PSVs may also occur. The PSVs may fail open after water relief, which would result in an unisolable breach of the reactor coolant pressure boundary. The current licensing basis provides an analysis of the pressurizer filltng condition during a SSI event, which includes credited operator actions. As discussed in UFSAR Section 15.4.2.2, the current licensing basis does not include analysis of the pressurizer filling scenario specific to the FLB event and credits the SSI pressurizer filling analysis in Section 15.2.15.3 as the limiting scenario. Hence there was no verification that the operator response times and backup nitrogen capacities established for the SSI event are adequate to prevent water relief through the PSVs during a FLB event. The proposed amendment would revise UFSAR Section 15.4.2 to incorporate the results of a bounding pressurizer filling analysis and credited TCOAs specific to the FLB pressurizer filling event. The following discussion provides background on this issue.

2.4.1 PORVs Previously Credited for a SSI Event In 1998, Westinghouse issued a notification (Reference 3) regarding new information on a key assumption made in their previous 1988 analyses (Reference

2) of PSV water relief capability. Specifically, Westinghouse determined the water temperature must remain above 613°F to justify stable PSV operation. Based on the new information, PG&E determined the PSVs could relieve water at a temperature low enough such that they might not properly reseat during a SSI event, which could potentially create a small break loss-of-coolant accident (SBLOCA).

This is contrary to UFSAR Section 15.2, which requires that Condition II faults (or events) do not progress to cause a more serious Condition Ill or IV fault (the subject of RIS 2005-29, Reference 5).

In response to the Westinghouse notification in 1998, PG&E submitted LAR 01 -08 (Reference 4) that proposed a change to credit automatic actuation of the PG&E Design Class I PORVs for response to a pressurizer filling scenario during a SSI event instead of crediting the PSVs. This change was supported by the upgrade of the PORV pneumatic operator to Instrument Class lA and the automatic control circuitry to Class IE. A new operator action was introduced in the LAR for operators to ensure a PORV is available (check/open a PORV block valve) within 11 minutes of event initiation. This bounded the calculated maximum time of 12.1 minutes until the fourth PSV water lift.

In response to NRC requests for additional information (RAis) regarding the LAR (Reference 6), PG&E provided a discussion of the design adequacy of the PORVs, the associated discharge piping, and pressurizer relief tank during a SSI event. The NRC approved LAR 01-08 and issued License Amendments 171 and 172 for DCPP Units 1 and 2, respectively (Reference 7). In the safety evaluation (SE), the NRC 6

Enclosure PG&E Letter DCL-15-023 concluded that automatic actuation of the PG&E Design Class I PORVs may be credited for mitigation of the SSI event, and that the TCOAs defined for mitigation of the SSI event were acceptable.

The License Amendments 171 and 172 resulted in the addition of TS requirements for PORV operability (TS 3.4.11) and addition of the analysis of pressurizer filling during a SSI event, including discussion of the assumed operator actions, into Revision 16 of UFSAR Section 15.2.15. Section 15.4.2.2.2 was also revised to credit the SSI pressurizer filling analysis in Section 15.2.15 for the FLB event.

2.4.2 Current FLB Analysis The current UFSAR (Revision 21 }, Section 15.4.2.2.3 states that the FLB analysis does not address pressurizer filling during a FLB because (a) it is evaluated in Section 15.2.15.3 for the SSI pressurizer filling event, (b) pressurizer filling concerns during FLB were generically dispositioned by Westinghouse [in 1988 WCAP-11677],

and (c) operator action is credited to preclude water relief by the PSVs [based on actions responding to SSI event in Section 15.2.15.3]. Section 15.4.2.2.4.1 also states that pressurizer filling does not require specific evaluation for FLB.

In 2010, the NRC issued a Severity Level IV noncited violation (NCV) to PG&E (Reference 8) for failing to update the UFSAR in accordance with 10 CFR 50.71 (e).

Specifically, PG&E did not update UFSAR Section 15.4.2.2.2 (of Revision 18) to reflect the 1998 changes (Reference 3) to the original Westinghouse analysis (Reference 2). The need to revise UFSAR Section 15.4.2 for this issue had previously been identified by Westinghouse and PG&E. Although appropriate changes had been made for SSI in UFSAR Section 15.2, changes had not been made for FLB as of 2010, when the NRC identified the violation during the Component Design Basis Inspection (CDBI) (Reference 8). The violation was entered into the DCPP corrective action program. The proposed amendment resolves the issue identified by the NCV, by updating the FLB pressurizer filling analysis in the UFSAR to address the issue with water relief through the PSVs.

The proposed amendment also resolves an issue identified by the Licensing Basis Verification Project (LBVP) during preparation of the UFSAR change to address the NCV. The LBVP discovered that TCOAs established for a SSI pressurizer filling event are non-conservative for responding to the FLB accident due to the differences in overpressure characteristics between the two events. Because the SSI TCOAs are currently credited for responding to a FLB pressurizer filling event (UFSAR Section 15.4.2.2.3) without verification that during a FLB these actions can be completed in time to prevent PSVs from relieving water, it was concluded the UFSAR does not provide sufficient requirements to prevent the PSVs from relieving water during a FLB. This nonconforming condition was entered into the DCPP corrective action program. The proposed amendment resolves the nonconforming condition by establishing TCOAs specific to a FLB pressurizer filling event that prevent the PSVs from relieving water during a FLB.

7

Enclosure PG&E Letter DCL-15-023 2.4.3 New Pressurizer Filling Analysis for FLB Event As requested by PG&E, Westinghouse performed a new bounding analysis that demonstrates water relief through the PSVs will not occur during a FLB event assuming appropriate and timely actions are taken by operators. The results of the analysis provide bounding conditions that are used to define the appropriate operator actions and equipment design/response that mitigate the consequences of the event. The new analysis credits the PG&E Design Class I pressurizer PORVs for pressure relief during the accident, and calculates the maximum time operators have to ensure a PORV is available to prevent water relief through the PSVs.

In addition, the Westinghouse analysis calculates the maximum number of PORV open and close cycles with steam or water that could occur through termination of the FLB event assuming operator actions are taken as shown previously in Table 2-1 (TCOAs 2-4). Modifications to the dedicated PG&E Design Class I backup nitrogen system are planned to provide the pressurizer PORVs the increased capacity to function for the number of cycles calculated. Increasing the nitrogen supply to accommodate cycling the PORVs for at least 300 cycles will ensure sufficient time for operators to terminate a FLB pressurizer filling event before water relief through the PSVs occurs.

Because the new bounding analysis calculated the number of PORV cycles needed to terminate a FLB event is greater than the current design maximum, additional analyses were performed to confirm that the PORVs and the pressurizer discharge piping system can withstand the thermal hydraulic loading from the increased cycles.

The purpose of this LAR is to request NRC approval to incorporate into the licensing basis the analysis of pressurizer filling concerns associated with the main feedwater pipe rupture accident. This analysis would be summarized in UFSAR Section 15.4.2.

2.4.4 50.59 Evaluation Updating the UFSAR to incorporate the results of the new Westinghouse analysis and the credited TCOAs was evaluated in accordance with 10 CFR 50.59 to determine if NRC approval is required prior to making the changes. The results of the new analysis indicate the operator actions required to prevent water relief through the PSVs during a FLB event are not bounded by the actions required by the existing analysis for the SSI event, contrary to the current UFSAR FLB

• discussion in Section 15.4.2.2. Because the new analysis credits an operator action that is not bounded by the existing analysis, this change could result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component (SSC) important to safety previously evaluated in the UFSAR.

8

Enclosure PG&E Letter DCL-15-023 As a result, the proposed change requires prior NRC approval in accordance with 10 CFR 50.59(c)(2)(ii).

Note that PG&E is not requesting approval of the backup nitrogen supply modifications in this LAR, since prior NRC approval of the backup nitrogen supply modifications is not required per 10 CFR 50.59.

2.4.5 Continued Operability Until License Amendment is Implemented PG&E performed an operability assessment, which provides the basis for continued operation with the nonconforming condition until long term corrective actions can be completed.

To demonstrate interim operability in the event of a FLB, PG&E commissioned Westinghouse to perform additional analysis with more realistic assumptions than were used in the FLB pressurizer filling analysis. The analysis results demonstrate that, using the existing TCOAs for SSI, operators have sufficient time to terminate a limiting pressurizer filling scenario before the number of PORV cycles exceeds the current back-up nitrogen supply capacity.

In addition, plant simulator demonstrations of the FLB event were conducted to demonstrate that operators could perform the existing TCOAs within the analyzed timeframes. The simulations demonstrated that operators progressed through appropriate operating procedures when responding to the FLB event, and the associated TCOAs were performed within the analyzed timeframes without challenging the PSVs with water relief. The results of the simulator runs are documented in the DCPP corrective action program.

3. TECHNICAL EVALUATION 3.1 System Description DCPP Units 1 and 2 are Westinghouse-designed, four-loop, pressurized water reactor (PWR) power plants. Each unit has one pressurizer, which controls reactor coolant system (RCS) pressure (and prevents boiling in the remainder of the RCS) by maintaining water and steam in equilibrium using electrical heaters or water sprays. Each pressurizer is equipped with three PSVs, three PORVs, and three block valves (one for each PORV), which provide protection against RCS overpressurization. The supply piping to the PORVs and PSVs connects to the head of the pressurizer; therefore, the PORVs and PSVs discharge steam unless the water level in the pressurizer has increased to the level where the piping connections are located, resulting in pressurizer filling. The PORVs and PSVs discharge into the pressurizer relief tank (PRT) where the steam is condensed and cooled by mixing with water. The PRT is equipped with rupture disks that have a relief capacity equal to the combined capacity of the PSVs.

9

Enclosure PG&E Letter DCL-15-023 The three PG&E Design Class I PSVs are self-actuated, spring-loaded valves with back-pressure compensation. The PSVs were converted from water-seated to steam-seated, and the water loop seal was eliminated by providing a continuous drain.

The three PORVs are air-operated globe valves, capable of automatic operation via high pressure signal or remote manual operation, and designed to fail closed to prevent a loss of the reactor coolant pressure boundary. The PORVs are actuated by controlling actuator gas supply with 125-volts, direct current (Vdc) solenoid valves that are energized-to-open, spring-to-close. Two PORVs are credited to mitigate a pressurizer filling event. These two PORVS are qualified as PG&E Design Class I and are provided with PG&E Design Class I backup nitrogen accumulators as a motive source when instrument air is lost to containment. Control power for the two PG&E Design Class I PORVs is Class 1E 125-Vdc. The two PG&E Design Class I PORVs are environmentally qualified to operate under the harsh environmental conditions that are possible during a FLB transient. As discussed in Section 2.4.1, the NRC previously accepted crediting the automatic actuation of the PG&E Design Class I PORVs in a safety-related application in License Amendments 171 and 172.

A remotely operated PG&E Design Class I PORV block valve is provided to isolate the inlet of each PORV if excessive seat leakage occurs in the PORV. All three block valves are motor operated valves powered by Class 1E AC buses. Block valve position indication is safety-related, powered by Class 1E 125-Vdc and provided in the Main Control Room.

As described in DCPP TS 3.4.11, isolation of a PORV with seat leakage by closing its block valve does not render the PORV or its block valve inoperable, provided the automatic pressure relief function remains available with timely operator actions to open the associated block valve (if closed) and assure the PORV handswitch is in the automatic position.

The PSVs are designed to prevent the RCS from exceeding 110 percent of design pressure and the PORVs are designed to prevent system pressure from exceeding the normal operating pressure by more than 100 pounds per square inch (psi). The normal operating pressure of the RCS is 2235 (pounds per square inch, gage) psig.

The PSV setpoint is set at 2485 psig to prevent the RCS from reaching 11 0 percent of design pressure. The pressurizer PORV setpoints are set to lift at 2335 psig, which prevents actuation of the fixed high-pressure reactor trip for all design transients up to and including the design step load decrease, with steam dump but without reactor trip. The PORVs also limit undesirable opening of the PSVs.

The instrument air supplied to containment is utilized, in part, to provide a motive force for the pressurizer PORVs. If instrument air to containment is lost, such as due to a Phase A containment isolation signal as discussed in UFSAR Section 6.2.4, then the PG&E Design Class I backup nitrogen supply system provides the motive force for the PORVs (discussed in UFSAR Section 9.3.1.6).

10

Enclosure PG&E Letter DCL-15-023 3.2 Transient Descriptions 3.2.1 FLB Transient The main feedwater system is the primary means of removing heat from the RCS through the steam generators (SGs). The FLB transient, addressed in UFSAR Section 15.4.2.2, is defined as a break in the main feedwater line located between a main feedwater isolation valve and its associated SG, downstream of the last check valve. Following a FLB accident, secondary water level decreases in the SGs, as SG inventory is lost through the break until auxiliary feedwater (AFW) flow is initiated, after which level will begin to recover in the SGs being fed with AFW (i.e.,

the intact SGs). Depending on the AFW flow available, there is the potential for an increase in reactor coolant temperatures in the early part of the post-trip transient, along with an increase in RCS volume due to thermal expansion. Also, following initiation of the FLB accident, a low steam line pressure setpoint will be reached in the faulted loop, causing actuation of the safety injection (SI) signal and start of the two PG&E Design Class I charging pumps. The reactor coolant inventory addition from the charging flow and RCS thermal expansion contributes to pressurizer filling.

The Sl signal also results in isolation of instrument air from containment.

The RCS heatup is eventually mitigated by the combined effects of the AFW flow to the intact SGs and charging flow to the RCS. If pressurizer filling occurs, the

• PORVs are available to relieve liquid inventory from the RCS, as long as an air supply is available from instrument air to containment or from the PG&E Design Class I backup nitrogen accumulators. Also, since TSs define a PORV as operable if its block valve is closed (and the PORV is otherwise functional), operators may need to take action to open the block valve to enable the PORV to provide water relief. In addition, operator actions are taken to control pressurizer level by isolating charging flow, establishing instrument air to containment, and establishing normal RCS letdown. Operating procedures will be revised to direct operators to cycle the PG&E Design Class I charging pumps off and on as necessary to control pressurizer level (while maintaining RCP seal cooling), if letdown cannot be established. This eliminates reliance on PG&E Design Class II systems (instrument air and RCS letdown). Once the pressurizer level is reduced and controlled, or the pressurizer pressure is lower than the PSV setpoint, the potential for water relief through the PSVs is eliminated and the FLB pressurizer filling event is terminated.

3.2.2 PORV and PSV Operation during FLB Transient As RCS pressure increases during a FLB transient, the pressurizer PORV setpoint pressure is reached and steam is relieved through the PORVs. If the PORVs are unavailable, steam would be relieved through the PSVs to prevent RCS pressure from reaching 110 percent of design pressure. Eventually: if the pressurizer level increases until the pressurizer is filled, the PORVs relieve water. If the PORVs are rendered unable to actuate, the water would discharge through the PSVs once their 11

Enclosure PG&E Letter DCL-15-023 setpoint pressure is reached. As discussed in Section 2.4.1, PG&E determined the PSVs could fail to properly reseat after relieving water. If a PSV fails open, then a SBLOCA would occur due to a breach of the RCS pressure boundary. Therefore, operator actions are taken to ensure a PORV is available to prevent water relief through the PSVs.

The Sl signal, which is expected to actuate following a FLB, results in a Phase A containment isolation si.gnal, which isolates instrument air to containment. The backup nitrogen supply system then provides the motive force for the PORVs until the operators reestablish instrument air to the PORVs or terminate the event. If the PG&E Design Class I backup nitrogen accumulators run out of nitrogen before the pressurizer level is lowered and stabilized, RCS pressure would increase and the water would discharge through the PSVs once their setpoints are reached. The pressurizer filling analysis includes a calculation of the maximum number of PORV cycles required to provide RCS pressure relief for the duration of a FLB event (crediting certain operator actions), which is used to establish the minimum nitrogen capacity required for each PORV to prevent water relief through the PSVs.

3.3 Time Critical Operator Action Program When an operator action is credited in a design basis analysis, the action may be designated as a TCOA. TCOAs are established and controlled by Administrative Procedure OP1.1D2, "Time Critical Operator Action." The procedure establishes a process to communicate to operations the analysis assumptions associated with operator actions and to validate that plant personnel can successfully accomplish the actions as assumed in the analysis.

Three different performers (or crews) are used to validate a new TCOA; revalidation of a TCOA requires one performer or crew. The qualifications of the TCOA performers on the validation team should be typical of the level of experience and training of personnel expected to perform the actions during an actual event.

Simulator validation is typically used for testing Control Room procedures; in-plant walkthrough validation is used for local actions. A completion time of less than 80 percent of the TCOA required time is considered adequate assurance that operators can reliably perform the TCOA. A TCOA completion time within 80-100 percent of the required time is considered acceptable. In addition, the TCOA procedure requires evaluating for a degrading trend in completion time and considering additional validations with other performers. If the ability to meet the required time is challenged, the TCOA procedure specifies steps to evaluate the TCOA and take corrective actions as necessary to ensure a high degree of confidence that credited TCOAs can be accomplished. TCOA validations are documented in the corrective action program and procedures affected by TCOAs are entered into the procedure commitment data base.

Operator actions designated as TCOAs are typically steps included in plant operating procedures. Annotations are used in the procedures to indicate steps that 12

Enclosure PG&E Letter DCL-15-023 impact TCOAs. The specific TCOAs identified for the FLB pressurizer overfill event are discussed in Section 3.5.

3.4 FLB Pressurizer Filling Analysis The current analysis provided in UFSAR Section 15.4.2.2 for the FLB accident does not include an analysis for pressurizer filling. Instead, the current FLB analysis credits the SSI pressurizer filling analysis in Section 15.2.15. As discussed previously, the operator actions based on the SSI analysis were found to be non~

bounding for the FLB transient. In response to this discovery, PG&E commissioned Westinghouse to perform a pressurizer filling analysis specific to the FLB event. In general, the new analysis credits the PG&E Design Class I pressurizer PORVs for pressure relief during the FLB event, and calculates the limiting time operators have to perform the credited actions in order to prevent water relief through the PSVs.

The analysis acceptance criteria, method, assumptions, and results are described below.

The operator actions credited in the new analysis are to (1) ensure a PORV is available within 8.6 minutes of event initiation (2) isolate the faulted SG within 10 minutes, (3) isolate charging flow within 25 minutes, and (4) stop RCP seal injection flow within 45 minutes. TCOA 1 to ensure a PORV is available provides RCS pressure relief through the PORVs and thus prevents water relief through the PSVs. TCOAs 2-4 ensure the event is terminated before backup nitrogen to the PORVs is depleted.

3.4.1 Acceptance Criteria The purpose of the FLB pressurizer filling analysis is to demonstrate that if pressurizer filling occurs during a FLB event, the reactor coolant pressure boundary will be maintained through operator actions and equipment design/response that mitigate the consequences of the event before water relief through the PSVs occurs.

The analysis minimizes the calculated time to pressurizer filling and maximizes the number of PORV cycles required to provide RCS pressure relief until the FLB filling event is terminated. The minimum time to pressurizer filling and the subsequent first PSV lift are used to specify the maximum time operators have to ensure a PORV is available. The capacity of the backup nitrogen supply (when modified) is confirmed to be adequate to allow operators sufficient time to reduce and control pressurizer level, terminating the event.

3.4.2 Method of Analysis The analysis of record for the FLB accident evaluated the potential for fuel damage, where the limiting result is minimum margin to hot leg saturation to demonstrate the core remains covered. The new analysis uses the same computer code used for the analysis of record, but includes different input assumptions that are selected to accentuate the pressurizer filling concern, where the limiting results are minimum 13

Enclosure PG&E Letter DCL-15-023 pressurizer fill time and maximum PG&E Design Class I pressurizer PORV cycles.

The analysis model, assumptions, sensitivity cases performed, and results are discussed below.

The transient response following a FLB accident was calculated with a detailed simulation of the plant in accordance with the NRC approved methodology for a 4-loop plant using the Westinghouse version of the RETRAN-02 computer code (RETRAN-02W). The NRC's generic approval of the Westinghouse methodology is documented in the safety evaluation report (SER) dated February 11, 1999, which is included in WCAP-14882-P-A (Reference 9). In the SER, the NRC concluded the use of the methodology as described in WCAP-14882-P-A is acceptable provided three conditions are met. These conditions and how they are met are as follows:

1. The transients and accidents for which the code is approved for use are listed in Table 1-1 of WCAP-14882-P-A. This condition is met because feedwater line rupture is included in the list.

2. The WCAP applies to Westinghouse designed 4, 3, and 2-loop plants. This condition is met because DCPP Units 1 and 2 are Westinghouse-designed 4-loop plants.

3. Licensing applications using RETRAN should include the source of and justification for the input data used in the analysis. The following discussion of method and assumptions used in the FLB pressurizer filling analysis fulfill this condition.

The Westinghouse version of RETRAN-02 was used for the existing FLB accident analysis in DCPP UFSAR Section 15.4.2.2, "Major Rupture of a Main Feedwater Pipe.': In addition, the NRC previously accepted the Westinghouse version of RETRAN-02 when modeling the pressurizer in a water-solid condition. Details are provided in Section 4.2, Precedents.

The analysis models a simultaneous loss of main feedwater to all SGs and subsequent reverse blowdown of the faulted SG. The RETRAN-02 code simulates core neutron kinetics, the RCS (with a multi-node vessel model and individual reactor coolant loops), the pressurizer and PSVs, the individual SGs, and the main steam safety valves. The model also simulates various features of the reactor trip system, engineered safety features actuation system, and plant control systems.

These consist of a number of different reactor trip functions including the SG low-low water level, the AFW and Sl systems, and the pressurizer PORVs, spray valves, and heaters. The code computes pertinent variables, including power level, pressurizer pressure, pressurizer water volume, reactor coolant temperatures, SG water level, and core decay heat.

Additional details associated with the calculations performed for this analysis are as follows:

• 14

Enclosure PG&E Letter DCL-15-023

• The pressurizer PORV relief flow is controlled by the choking velocity. As discussed in Section 3.5.2 of WCAP-14882-P-A (Reference 9), the valve flow area is based on the extended Henry-Fauske critical flow correlation for subcooled choking and isoenthalpic expansion model for saturated and superheated conditions. A valve flow area multiplier is included in the PORV model to account for the change in mass flow rate that occurs when water is relieved through the valves.

• Reactor trip and AFW flow are both modeled to be actuated when the SG low-low level trip setpoint is reached in the faulted SG. A description of the method used by the model to calculate SG water level is provided in Section 3.8.2 of WCAP-14882-P-A (Reference 9).

• Primary-to-secondary heat transfer correlation across the SG tubes is adjusted as the shell-side liquid inventory decreases in the SG. Specifically, the heat transfer correlation for the SG tubes (heat conductors) is automatically adjusted for the changing conditions as the tubes uncover.

• The FLB discharge flow and quality during the transient are calculated as a function of temperature and pressure with respect to time.

• There are four TCOAs credited in the analysis of the FLB accident, as described below.

1. Ensure a PORV is available - If no pressurizer PORV relief is available at the start of the FLB accident (e.g., due to a failure of one of the two PG&E Design Class I PORVs and with the other isolated by the block valve), the operators will ensure a PORV is available in time to prevent water relief through the PSVs. This analysis determines the time by which this TCOA must occur.

2. Isolate faulted SG - Similar to the FLB analysis described in Section 15.4.2.2 of the DCPP UFSAR, this analysis models an existing TCOA for the operators to isolate the faulted SG within 10 minutes after the low-low SG water level setpoint is reached to direct all available AFW flow to the intact SGs.

3. Isolate charging flow- Following initiation of the FLB accident, a low steam line pressure setpoint will be reached in the faulted loop, causing an Sl signal to be generated and Sl flow initiation to occur. The Sl flow results in a reactor coolant inventory addition during the transient. To reduce the inventory addition, the operators will take action to isolate charging flow, which stops all flow from the charging pumps except RCP seal injection flow. This analysis determines the time by which this TCOA must occur.

15 .

Enclosure PG&E Letter DCL-15-023

4. Stop RCP seal injection flow - Following the TCOA.to isolate charging flow, the only remaining source of addition to the reactor coolant inventory is RCP seal injection flow. To mitigate this remaining inventory addition, the operators will take action to reset Phase B containment isolation, restore component cooling water (CCW) flow to the RCPs and stop the RCP seal injection flow. This analysis determines the time by which this TCOA must occur.

3.4.3 Assumptions The assumptions made in the new FLB pressurizer filling analysis are similar to those used in the current FLB analysis (UFSAR Section 15.4.2.2). That is, a number of the assumptions that are conservative for the calculation of the minimum margin to hot leg saturation are also conservative for the calculation of the minimum time to pressurizer filling and/or maximum number of pressurizer PORV relief cycles.

However, there are several assumptions used in the calculation of the minimum margin to hot leg saturation that may not be conservative for pressurizer filling concerns. The assumptions for the pressurizer filling analysis are conservatively chosen to minimize the time to reach a water-solid condition and maximize the number of pressurizer PORV relief open/close cycles predicted. Sensitivity studies were performed for the following parameters to determine the appropriate conservative assumptions applicable to the pressurizer filling condition:

• core reactivity feedback modeling

• SG tube plugging level

• main feedwater temperature (Tteed)

• initial vessel average temperature (Tavg)

• initial pressurizer pressure

• refueling water storage tank (RWST) temperature (provides the primary water source for Sl)

• single failure scenarios (AFW pumps or PG&E Design Class I PORV)

• FLB size

• RCS flow asymmetry

• Unit 1 vs. Unit 2 model

• Vantage-S fuel vs the Robust Fuel Assembly design (RFA-2 fuel)

Separate cases to accommodate different limiting assumptions were analyzed to determine the time by which the operators would need to ensure a PG&E Design Class I PORV is available and the times by which the operators would need to isolate charging flow and subsequently stop RCP seal injection flow. Cases were also analyzed both with and without offsite power available to determine the more limiting condition.

The appropriate conservative assumptions were determined. based on a full-power analysis. Part-power analyses that modeled the trip time delay feature of the low-16

Enclosure PG&E Letter DCL-15-023 low SG water level function were then examined with the same assumptions, as appropriate, to confirm that the full-power condition was bounding.

A summary of the limiting critical parameters and major assumptions used in the FLB pressurizer filling analysis is provided below.

1) The plant is initially operating at 102 percent of the nuclear steam supply system (NSSS) rating, including a conservatively large RCP net heat addition of 20 megawatts, thermal (MWt) for the case with offsite power available and 14 MWt for the case without offsite power available. These assumptions maximize the primary side heat that must be removed for each case.

2) Initial reactor coolant average temperature is 5.5 oF below the nominal value, and the initial pressurizer pressure is 60 psi below its nominal value.

3) The initial pressurizer level is set to the nominal full power programmed level plus an uncertainty of +5.7 percent span, resulting in an initial pressurizer level of 66.4 and 66.8 percent span for Units 1 and 2, respectively; initial SG water level is at the nominal value plus 10 percent narrow range span (NRS) in the faulted SG, and at the nominal value minus 10 percent NRS in the intact SGs.

4) No credit is taken for relief through the PORV that is actuated on a comperlsated pressurizer pressure deviation signal (i.e., the non-safety-grade PORV). However, relief through the PORVs that are actuated on the indicated (measured) pressurizer pressure signal (i.e., the PG&E Design Class I PORVs) has been modeled with the assumptions that maximize the number of PORV opening cycles experienced. The number of PG&E Design Class I PORVs available for relief depends on the single failure being considered.

Also, since an Sl signal causes Phase A containment isolation and the instrument air is a PG&E Design Class II (non-safety-grade) system, there is a loss of instrument air to containment due to this signal. Accordingly, the PG&E Design Class I backup nitrogen accumulators are needed to maintain functionality of the PG&E Design Class I PORVs. The backup nitrogen accumulators are each sized and will be leak tested to ensure at least 300 PORV cycles before the backup nitrogen supply is depleted, after which the PORV would be unavailable. Therefore, transient mitigation must be demonstrated to occur before 300 PORV cycles is reached.

5) No credit is taken for the high pressurizer pressure reactor trip.

6) Main feedwater to all SGs is assumed to stop at the time the break occurs (all main feedwater spills out through the break).

17

Enclosure PG&E Letter DCL-15-023

7) The break discharge quality is calculated as a function of pressure and temperature.

8) Reactor trip is initiated when the low-low level trip setpoint in the faulted SG is reached. A low-low level setpoint of 0 percent NRS is assumed.

9) A double ended break area of 0.5184 ft 2 is assumed. This is the flow area of the reducer leading to the feed ring, the largest effective flow area out of the SGs for a FLB event. This minimizes the fluid inventory available for removal of long-term decay heat and stored energy following reactor trip, and thereby maximizes the resultant heatup of the reactor coolant.

Sensitivity analyses showed that the break flow area had very little effect on the limiting results.

10) No credit is taken for heat energy deposited in RCS metal during the RCS heatup.

11) No credit is taken for normal charging or letdown flow.

12) Conservative core residual heat generation based on the 1979 ANS 5.1 decay heat standard (Reference 10) plus uncertainty was used for calculation of residual decay heat levels.

13) The turbine driven auxiliary feedwater pump (TDAFWP) is aligned to all four SGs; whereas, the two motor-driven auxiliary feedwater pumps (MDAFWPs) are each independently aligned to two of the four SGs. The AFW flow for each case analyzed depends on the assumed single failure.

With the single failure of the TDAFWP considered, it is assumed that 390 gallons per minute (gpm) total AFW flow will be delivered to two of the intact SGs at 1 minute after the trip and an additional 195 gpm of AFW flow will be delivered to the third intact SG at 10 minutes after the trip. The AFW flow initiated at 1 minute after the trip is delivered from the MDAFWP that is initially aligned to two intact SGs. All flow from the other MDAFWP aligned to both the third intact SG and the faulted SG is initially assumed to spill out the break. Subsequently, within 10 minutes, operators isolate the faulted SG and thus direct flow from this MDAFWP to the third intact SG. This operator action is an existing TCOA credited in the UFSAR Section 15.4.2.2 FLB analysis.

With the single failure of the PG&E Design Class I pressurizer PORV considered, the AFW flow from the MDAFWPs is the same as described above; however, it is also assumed the TDAFWP will deliver an additional 585 gpm of AFW flow to the three intact SGs at 10 minutes after the trip when the TCOA is taken to isolate the faulted SG.

18

Enclosure PG&E Letter DCL-15-023

14) Maximum Sl flow rates were conservatively modeled with a flow profile that bounds the maximum flow from the two PG&E Design Class I high-head centrifugal charging pumps (CCPs), the PG&E Design Class II CCP, and two intermediate-head Sl pumps. Full Sl flow was conservatively assumed to occur immediately after the Sl actuation signal. The maximum Sl flow profile, which includes RCP seal injection flow, is modeled until the TCOA is taken to isolate charging flow. Note that no flow is actually injected from the intermediate-head Sl pumps, since RCS pressure remains above the shutoff head of these pumps during the transient.

15) Maximum RCP seal injection flow was conservatively modeled until TCOA 4 is taken to stop it. A limiting FL8 inside containment may cause the high-high containment pressure setpoint to be reached, resulting in Phase 8 isolation and a loss of CCW to the RCPs. Accordingly, RCP seal injection flow must be maintained to ensure RCP cooling until operator action is taken to reset the Phase 8 containment isolation and restore CCW flow to the RCPs.

16) The air-operated pressurizer spray valves are assumed to be inoperable, since instrument air to containment is lost on an Sl signal and normal pressurizer spray flow is unavailable following coastdown of the RCPs.

There are auxiliary spray flow lines that are equipped with backup nitrogen if the spray valves are unavailable; however, auxiliary spray requires a manual alignment that will not be completed until after the TCOAs necessary to mitigate this transient are complete.

17) For cases with a loss of offsite power, the pressurizer heaters are assumed to be inoperable, since they are not automatically loaded onto an emergency diesel generator (EDG) bus and will not be manually loaded onto the EDGs until after the TCOAs to mitigate this transient are complete. For cases with offsite power available, the pressurizer heaters are assumed to be operable.

18) For cases with loss of offsite power, the RCPs are assumed to trip automatically following reactor trip. For cases with offsite power, the RCPs continue to operate unless manually tripped by the operators. The emergency operating procedures (EOPs) direct the operators to trip the RCPs within 5 minutes following the Phase 8 containment isolation (to protect the RCP motors, which are cooled by CCW). For the case to determine the time by which the operators need to ensure a pressurizer PORV is available, it is assumed the operators manually trip the RCPs at greater than 90 seconds after FL8 initiation, because Phase 8 containment isolation from high-high containment pressure would not occur before this time. However, for the case analyzed to determine the times by which the operators would need to isolate charging flow and subsequently stop RCP 19

Enclosure PG&E Letter DCL-15-023 seal injection flow, it was conservatively assumed the RCPs are manually tripped following reactor trip.

19) In all cases, it was conservatively assumed that instrument air to containment is unavailable for the entire event, since it is a PG&E Design Class II system.

3.4.4 Analysis Results The full-power cases are limiting when compared to the part-power cases.

The results for Unit 2 are more limiting than those calculated for Unit 1. The primary difference is that the model for Unit 2 considers the plant changes associated with the upflow conversion/upper head temperature reduction. In addition, the upper end of Tavg window is slightly higher for Unit 2, resulting in an initial pressurizer water level that is also slightly higher.

With respect to the single failure scenarios, it was found the failure of the TDAFWP is limiting for the calculation of minimum time to pressurizer filling, unless one of the two PG&E Design Class I PORVs is already blocked at the start of the transient. If a PORV is blocked, the failure of the other PG&E Design Class I PORV is limiting for pressurizer filling. The failure of a Class I PORV is also limiting for the calculation of the operator actions times required to ensure that transient mitigation is complete before the maximum number of PORV cycles is reached.

For cases with offsite power available, pressurizer pressure is maintained after the RCP seal injection flow is stopped, since the pressurizer heaters (specifically, the backup heaters, actuated on high pressurizer level deviation) continue to operate.

However, as a steam bubble forms again in the pressurizer and the pressurizer water volume begins decreasing, relief flow switches from water to steam, and there is no longer a concern relative to water relief through the PSVs, signifying transient mitigation is complete for these cases. For cases with a loss of offsite power, pressurizer pressure decreases after the RCP seal injection flow is stopped and the pressurizer PORV setpoint and PSV setpoint are no longer challenged, signifying transient mitigation is complete.

The results of the analysis demonstrate that if the pressurizer fills, the following TCOAs preclude water relief through the PSVs.

(1) Ensure a Pressurizer PORV is Available within 8.6 minutes If no pressurizer PORV relief is available at the start of the transient because of a failure of one of the PG&E Design Class I PORVs and the other is isolated by its respective block valve, operator action is required to ensure a PG&E Design Class I PORV is available in time to prevent water relief through the PSVs. The analysis determined that the minimum time to pressurizer filling is 8.3 minutes and the 20

Enclosure PG&E Letter DCL-15-023 minimum time to subsequently lift the PSVs is 8.6 minutes. Therefore, the operators must ensure a. PG&E Design Class I PORV is available within 8.6 minutes of event initiation.

It was found that the cases with a loss of offsite power (RCPs coast down following reactor trip and pressurizer heaters inoperable) are more limiting than the corresponding cases with offsite power available (RCPs continuing to operate or manually tripped after 90 seconds and pressurizer heaters operable). This can be attributed in part to the reduced primary-to-secondary heat transfer that occurs in the early portion of the post-trip phase of the transient when the RCPs begin to coast down. Specifically, this reduced heat transfer causes the post-trip RCS heatup to be more severe, as compared to the cases with offsite power available, causing a more severe thermal expansion of the reactor coolant and more rapid pressurizer filling.

The system response for the limiting case with no pressurizer PORV relief available at the start of the transient is presented in new UFSAR Figures 15.4.2-22 and 15.4.2-23 and the calculated sequence of events is listed in Table 15.4-8 (figures and table are included in Attachment 1).

(2) Isolate the Faulted SG within 10 minutes Similar to the main feedwater pipe rupture analysis discussed in UFSAR Section 15.4.2.2, the operators are assumed to isolate the faulted SG within 10 minutes after the low-low SG water level setpoint is reached in accordance with operating procedures. This directs all available AFW flow to the intact SGs.

(3) Isolate Charging Flow within 25 minutes and (4) Stop RCP Seal Injection Flow within 45 minutes The results of the limiting case determined that in order for transient mitigation to .

occur before the maximum number of PORV cycles is reached, the operators must isolate charging flow within 25 minutes after the low-low SG water level setpoint is reached and subsequently stop RCP seal injection flow within 45 minutes after the low-low SG water level setpoint is reached. These actions ensure that a steam bubble is formed in the pressurizer and the pressurizer water volume begins to decrease, causing relief flow to switch from water to steam, before the capacity of the backup nitrogen accumulators is depleted. Once the relief flow switches to steam, there is no longer a concern relative to water relief through the PSVs and the transient mitigation is complete for these cases.

It was found that the cases with offsite power available with the RCPs tripped manually by the operators following reactor trip, are more limiting than the corresponding cases both with offsite power available (RCPs continue to operate and pressurizer heaters operable) and with a loss of offsite power (RCPs coast down following reactor trip and pressurizer heaters inoperable). This can be attributed in part to the reduced primary-to-secondary heat transfer that occurs in the 21

Enclosure PG&E Letter DCL-15-023 early portion of the post-trip phase of the transient when the RCPs begin to coast down. Specifically, this reduced heat transfer causes the post-trip RCS heatup to be more severe, as compared to the cases with RCPs continuing to operate, which subsequently causes a more severe thermal expansion of the reactor coolant. This, combined with the effect that the heaters have on the localized conditions within the pressurizer itself, results in the overall most limiting scenario relative to pressurizer PORV cycling.

The system response showing that the maximum number of PORV cycles is not reached is presented in new UFSAR Figures 15.4.2-24 through 15.4.2-27 and the calculated sequence of events is listed in Table 15.4-8 (figures and table ~re included in Attachment 1).

3.5 Demonstration of TCOAs PG&E conducted simulator demonstrations of the FLB event that demonstrated operators can perform the credited actions within the analyzed timeframes. The simulations demonstrated that operators consistently progressed through the appropriate procedures when responding to the FLB event, and the associated TCOAs were performed within the analyzed timeframes without challenging the PSVs with water relief. Formal documentation and validation of the TCOAs in accordance with the TCOA program described in Section 3.3 will be performed prior to implementation of the license amendment.

The credited operator actions were reviewed relative to the guidelines provided in NRC Information Notice 97-78, "Crediting of Operator Actions in Place of Automatic Actions and Modifications of Operator Actions, Including Response Times." The following discussion addresses the nine criteria typically used by the NRC to evaluate the crediting of operator actions.

1) The operator actions and action times to be credited for the FLB pressurizer filling scenario are:

• ensure a PG&E Design Class I pressurizer PORV is available within 8.6 minutes of event initiation

• isolate faulted steam generator within 10 minutes

• isolate charging flow within 25 minutes

• stop RCP seal injection flow within 45 minutes

2) The potentially harsh or inhospitable environmental conditions expected This criterion is not applicable, because the actions are performed in the main control room.

22

Enclosure PG&E Letter DCL-15-023

3) The ingress/egress paths taken by the operators to accomplish the actions.

This criterion is not applicable, because the operator actions are performed in the main control room.

4) Procedural guidance for the required actions The credited operator actions are covered by existing steps in operating procedures. The action to stop RCP seal injection flow to control pressurizer level currently exists in operating procedures to be performed if letdown cannot be established. DCPP will modify additional appropriate operating procedures to include this action.

5) Operator training necessary to carry out actions including qualifications required.

Because the operating procedures are an integral part of the licensed operator qualification and requalification training programs, training on the proposed action sequence will be included in both initial and continued operator training.

Operators performed simulator runs which demonstrated these actions are consistently completed in time to mitigate the accident and prevent challenging the PSVs with water relief.

The actions proposed by this amendment will be included in DCPP procedure OP1 .1D2, "Time Critical Operator Actions," which provides a means to: (a) ensure that the TCOAs within the scope of the procedure can be accomplished by plant personnel, (b) conduct and document periodic validation of credited action times, and (c) ensure that subsequent changes to the plant, procedures, or programs will not invalidate the credited action times.

6) Additional support personnel and/or equipment required to carry out the actions No additional support personnel and/or equipment are required. The actions can be carried out by the normal level of main control room staffing.

7) Information required by the control room staff to determine whether such operator action is required, including qualified instrumentation used to diagnose the situation and to verify that the required action has successfully been taken 23

Enclosure PG&E Letter DCL-15-023 All of the instrumentation and indications required by the operators, to determine if action is required to diagnose the situation and to verify the success of the actions, is located in the main control room. The required instrumentation and indications are electrically powered from Class 1E power supplies.

8) Ability to recover from credible errors in performing the actions and expected time required to make the recovery.

The action to ensure a PORV is available involves checking that the PORV block valves are open and opening block valves that are closed (unless closed to isolate an open or failed PORV) by manipulating control room switches. The only credible error would involve failing to open the correct valve. Recovery time from this error is expected to be very short, since there is ample indication of valve position and pressurizer pressure in the control room. The pressurizer high pressure alarm (231 0 psig) will sound in the control room before the PSV lift pressure of 2485 psig is reached, alerting operators to take appropriate action.

The steps to isolate the faulted SG, isolate all charging flow , and stop RCP seal injection flow are straight-forward and performed only in the control room allowing errors to be readily detected and corrected. TCOA simulator runs demonstrated the proposed TCOA times allow ample recovery time from any credible error.

9) Consideration of risk significance of actions The risk significance of the actions is low, since existing procedures already include or will include the actions, and simulator runs demonstrated the actions can be completed within the required response time.

• 3.6 PORV Qualification Evaluation The FLB pressurizer filling analysis calculated the maximum number of PORV open and close cycles with water that could be experienced during the time required for operators to terminate a FLB pressurizer filling event. As discussed previously, PG&E will modify the backup nitrogen accumulators to provide a design capability of 300 PORV cycles. Because the number of water relief cycles to which the PORVs could be subjected has increased, PG&E commissioned Westinghouse to qualify the PORVs for 500 water-relief cycles. Westinghouse used a four-pronged approach to qualify the PORVs consisting of (1) a review of the PORV design, (2) a hydraulic qualification of the PORVs for water relief, (3) a structural integrity qualification of the PORVs for the required number of cycles, and (4) a search for historical reliability data applicable to the PORVs. The analysis confirmed the PG&E Design Class I 24

Enclosure PG&E Letter DCL-15-023 PORVs are capable of relieving water successfully for the duration of the FLB pressurizer filling event.

3. 7 Pressurizer Discharge Piping Evaluation PG&E performed an evaluation of the hydrodynamic loads that would be introduced in the piping system from the pressurizer to the pressurizer relief tank if the PORVs experience water relief cycles assumed in the FLB pressurizer filling analysis.

Westinghouse determined the time history fluid characteristics for the pressurizer PORV relief flow from the most limiting cases using RETRAN-02W. These characteristics were then used as input to evaluations performed to address the fluid forces on the downstream piping and pipe supports. The pipe stress levels for the new fluid transient cases were determined and then combined with the normal and seismic stresses. Stresses for piping, pipe supports, valve ends, and reaction loads at the pressurizer nozzles were determined to remain within allowable limits specified in UFSAR Table 3.9-1, "Load Combinations and Acceptance Criteria for Pressurizer Safety and Relief Valve Piping."

4. REGULATORY EVALUATION 4.1 Applicable Regulatory Requirements I Criteria General Design Criteria DCPP conforms to 10 CFR 50, proposed Appendix A, General Design Criteria (GDCs), which were published on July 11, 1967 (Reference 11 ). The following provides assessment against the GDCs applicable to this LAR.

GOG 9, 1967- Reactor Coolant Pressure Boundary (Category A)

The reactor coolant pressure boundary shall be designed and constructed so as to have an exceedingly low probability of gross rupture or significant leakage throughout its design lifetime.

GOG 33, 1967- Reactor Coolant Pressure Boundary Capability The reactor coolant pressure boundary shall be capable of accommodating without rupture, and with only limited allowance for energy absorption through plastic deformation, the static and dynamic loads imposed on any boundary component as a result of any inadvertent and sudden release of energy to the coolant. As a design reference, this sudden release shall be taken as that which would result from a sudden reactivity insertion such as rod ejection (unless prevented by positive mechanical means), rod dropout, or cold water addition.

25

Enclosure PG&E Letter DCL-15-023 GOG 43, 1967- Accident Aggravation Prevention (Category A)

Engineered safety features shall be designed so that any action of the engineered .

safety features that might accentuate the adverse after-effects of a loss of normal cooling is avoided.

The new FLB pressurizer filling analysis meets GDCs 9 and 33 by providing the basis for operator actions that ultimately prevent leakage through the reactor coolant pressure boundary via the PSVs. PSVs could fail to reseat if subjected to .sustained cycles of water relief. The operator actions are designed to avoid adverse after-effects of a loss of normal cooling due to a FLB pressurizer filling event in accordance with GDC 43. The operator actions prevent water relief through the PSVs by ensuring the PORVs are available for pressure relief following a FLB, and by stopping reactor coolant addition via charging flow.

The operator actions specific to the FLB pressurizer filling event will be included in the DCPP TCOA program, which ensures the operators are trained on the actions and the response times for the actions are periodically validated.

NUREG-0737. Item II.D.1 DCPP Unit 1 Operating License Condition 2.C(6)(f) requires compliance with NUREG-0737, Item II.D.1 (Reference 1). Item II.D.1 requires nuclear power generation facilities to develop and execute programs that qualify RCS relief and safety valves under expected operating conditions for design-basis transients and accidents. The qualification is required to include associated control circuitry, piping, and supports, as well as the valves themselves.

The new FLB pressurizer filling analysis demonstrates that timely operator action to ensure PORVs are available during a FLB pressurizer filling event will prevent the PSVs from failing open due to water relief and thus maintain the reactor coolant pressure boundary as required by NUREG-0737. PG&E also performed analyses that confirmed the PG&E Design Class I PORVs and the pressurizer discharge piping are qualified for the hydrodynamic loads resulting from the number of PORV water cycles expected. The PORV pneumatic operators are classified as Design Class I, controls and solenoid valves are Instrument Class lA with Class 1E power.

The pneumatic operators and control circuitry also meet environmental qualification requirements, ensuring the PORVs are capable of operating under the harsh conditions that could occur in the event of a FLB.

26

Enclosure PG&E Letter DCL-15-023 10 CFR 50.34 and 50.71 10 CFR 50.34(b) specifies content requirements for the UFSAR including evaluations required to show that safety functions will be accomplished. In addition, 10 CFR 50.71 (e) requires periodic updates of the FSAR to ensure the information included in the report contains the latest information developed. The proposed license amendment to add the FLB pressurizer filling analysis to the UFSAR would fulfill these requirements.

4.2 Precedents Previously, Seabrook Station used the Westinghouse version of the RETRAN-02 code for evaluation of a SSI pressurizer filling event. This was performed as part of Seabrook's LAR for the Stretch Power Up rate submitted on March 17, 2004 (Reference 12, ML040860307). I The NRC requested additional information (RAI 81 in Reference 13, ML042190085) to show the RETRAN-02 pressurizer model can properly calculate pressure when the pressurizer is water-solid. Seabrook's response (Reference 14, ML042890281) referred to the qualification of the RETRAN-02 pressurizer model as discussed in WCAP-14882-P-A (Reference 9). Appendices A and B ofWCAP-14882-P-A include NRC RAis and Westinghouse responses in support of the qualification. Seabrook referred to the RAI response that addressed the NRC's generic SER and Technical Evaluation Report (TER) limitations on RETRAN-02, in particular General Limitation Item "o" regarding the non-equilibrium pressurizer model.

General Limitation Item "o" states that the TER identified the need for comparison against data for the situation when the simulation switches between a one-region and a two-region problem due to the inconsistency of the field energy and two-region energy equations, and identifies that a drift would occur, but that it would be small. However, in the Westinghouse model, when the pressurizer fills or drains, the inconsistency of these equations becomes insignificant since the total RCS conditions and interfaces combine to determine the pressure. As noted in WCAP-14882-P-A, the Westinghouse RETRAN-02 pressurizer model demonstrates adequate stability for both filling and draining transitions.

The NRC approved the use of the Westinghouse version of RETRAN-02 for the Seabrook SSI pressurizer-filling analysis in the SE for Amendment 101 (Reference 15, ML050140453).

4.3 No Significant Hazards Consideration Determination The proposed amendment would incorporate into the licensing basis an analysis of pressurizer filling concerns associated with the main feedwater pipe rupture accident, summarized in Diablo Canyon Power Plant (DCPP) Updated Final Safety Analysis Report (UFSAR) Section 15.4.2.2. The proposed amendment involves the 27

Enclosure PG&E Letter DCL-15-023 addition of credited operator actions and modification of the Pacific Gas and Electric (PG&E) Design Class I backup nitrogen accumulator capacities, which are credited in the pressurizer filling analysis.

The analysis demonstrates that with worst case scenarios resulting in a pressurizer filling condition during a feedwater line break (FLB) accident, water relief through the pressurizer safety valves (PSVs) is prevented with timely operator actions. These actions include (1) ensure a power operated relief valve (PORV) is available within 8.6 minutes, (2) isolate the faulted steam generator within 10 minutes, (3) isolate charging flow within 25 minutes, and (4) stop reactor coolant pump (RCP) seal injection flow within 45 minutes. PG&E conducted simulator demonstrations of the FLB event that verified operators can perform the credited actions within the timeframes credited in the analysis.

To support the revised FLB accident analysis, PG&E will modify the Class I PORV backup nitrogen supply systems to accommodate the required PORV cycles for the FLB pressurizer filling accident.

PG&E has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed amendment provides an analysis of the FLB accident assuming the worst-case conditions that could result in pressurizer filling wherein water relief through the PSVs may challenge the integrity of the reactor coolant boundary. The purpose of the pressurizer filling a~alysis is to determine the operator actions that preclude water relief through the PSVs if a FLB accident has occurred. The pressurizer filling analysis assumes an accident occurs and evaluates the plant response to the accident; therefore, the proposed amendment results in no change in the probability of an accident previously evaluated.

The proposed amendment does not change any design functions of existing structures, systems and components (SSCs) and does not increase the likelihood of the malfunction of an SSC. The operator actions added by the amendment are designed to ensure the capability of SSCs to perform their design function by ensuring a PORV is available to provide reactor coolant pressure relief and by terminating the pressurizer filling event before water is relieved from the PSVs.

28

Enclosure PG&E Letter DCL-15-023 Therefore, the proposed change does not involve a significant increase in the probability or consequence of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different accident from any accident previously evaluated?

Response: No.

The proposed amendment does not change any design functions of existing SSCs and does not affect the SSCs' operation or ability to perform their design function. The new FLB pressurizer filling analysis identifies operator actions that will prevent water relief through the PSVs. Simulator runs for the FLB pressurizer filling scenario have demonstrated that operator actions credited in the analysis are consistently completed in time to prevent water relief through the PSVs.

Therefore the proposed change does not create the possibility of a new or different accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The UFSAR (Section 15.4.2.2.3) currently credits the SSI pressurizer filling analysis (in UFSAR Section 15.2.15.3) for the FLB pressurizer filling condition.

The results of the new FLB pressurizer filling analysis indicate the response time for the operator action to ensure a PORV available during a FLB is not bounded by the existing analysis for the SSI pressurizer filling event. In addition, the analysis determined the PORVs need to cycle longer than accommodated by the current nitrogen supply to prevent water relief through the PSVs.

The new analysis identifies operator actions to mitigate the pressurizer filling condition specific to a FLB accident. Simulator runs for a FLB scenario have demonstrated that operator actions credited in the analysis are consistently completed in time to prevent water relief through the PSVs.

The new FLB analysis credits an increased number of PORV water-relief cycles, which will be provided by modifications to increase the nitrogen supply to the PORVS. The PORVs have been qualified to perform the increased number of water-relief cycles and are environmentally qualified to withstand the harsh environment that could result from a FLB. Increasing the required number of PORV water-relief cycles does not alter the overall thermal hydraulic response of the RCS and, therefore, has no effect on overall atmospheric steam releases.

The PORV relief is not a source of radiological release since the RCS fluid remains inside containment and therefore is a negligible source of radiological release to the environment.

29

Enclosure PG&E Letter DCL-15-023 Therefore, the proposed amendment does not involve a significant reduction in a margin of safety.

Based on the above, PG&E concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

4.4 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5. ENVIRONMENTAL CONSIDERATION PG&E has determined the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area (as defined in 10 CFR 20). However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b),

no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6. REFERENCES

1. NUREG-0737, "Clarification of TMI Action Plan Requirements," November 1980.

2. WCAP-11677, "Pressurizer Safety Relief Valve Operation for Water Discharge During a Feedwater Line Break," January 1988.

3. Westinghouse Letter ESBU/WOG-98-154, "Notification for Pressurizer Safety Valve Operability Issue (MUHP-8098)," dated July 31, 1998.

4. PG&E Letter DCL-02-115, "License Amendment Request (LAR) 01-08 Credit for Automatic Actuation of Pressurizer Power Operated Relief Valves; Pressurizer Safety Valve Loop Seal Temperature" dated September 25, 2002.

30

Enclosure PG&E Letter DCL-15-023

5. RIS 2005-29, NRC Regulatory Issue Summary 2005-29, "Anticipated Transients That Could Develop Into More Serious Events," dated December 14, 2005.

6. PG&E Letter DCL-03-152, "Response to NRC RAI Regarding LAR 01-08, Credit for Automatic Actuation of Pressurizer Power Operated Relief Valves; Pressurizer Safety Valve Loop Seal Temperature," dated November 21, 2003.

I

7. Letter from G. S. Shukla (USNRC) to Gregory M. Rueger (PG&E), "Issuance of Amendment RE: Credit for Automatic Actuation of Pressurizer Power Operated Relief Valves (TAC Nos. MB6758 and MB6759)," dated July 2, 2004.

8. NRC Inspection Report 05000275/2010007 and 05000323/2010007, "Diablo Canyon Power Plant- NRC Component Design Bases Inspection Report."

9. WCAP-14882-P-A, "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses," April 1999.

10. ANSI/ANS-5.1-1979, American National Standard for Decay Heat Power in Light Water Reactors, 1979.

11. 10 CFR 50, Proposed Appendix A, General Design Criteria, as published in "32 Federal Register 10213," dated July 11, 1967.

12. Letter from FPL Energy to USNRC, "Seabrook License Amendment Request 04-03, Application for Stretch Power Uprate," dated March 17, 2004, (M L040860307).

13. Letter from USNRC to FPL Energy, "Request for Additional Information for Proposed Amendment Request Regarding the Application for Stretch Power Uprate (TAC No. MC2364)," dated August 18, 2004, (ML042190085).

14. Letter from FPL Energy to USNRC, "Seabrook Response to Request for Additional Information Regarding License Amendment Request 04-03," dated October 12, 2004, (ML042890281).

15. Letter from USNRC to FPL Energy, "Seabrook Station, Unit No. 1 - Issuance of Amendment Re: 5.2 Percent Power Up rate," dated February 28, 2005, (ML050140453).

31

Enclosure Attachment 1 PG&E Letter DCL-15-023 Attachment 1 Diablo Canyon Power Plant Updated Final Safety Analysis Report Markup (For Information Only)

Enclosure Attachment 1 PG&E Letter DCL-15-023 UFSAR Changes Attached UFSAR Page Ref No. UFSAR Section Numbers 1 15.4.2.2.3 15.4-32 2 15.4.2.2.4.1 15.4-34 3 15.4.2.4 (added) 15.4-39-44 4 15.4.1 0 References 15.4-73 5 Chapter 15 Contents v 6 Chapter 15 Figures xxxvii- xxxviii 7 Table 15.4-8 Sheets 3- 5 8 Figure 15.4.2-22 (added) 9 Figure 15.4.2-23 (added) 10 Figure 15.4.2-24 (added) 11 Figure 15.4.2-25 (added) 12 Figure 15.4.2-26 (added) 13 Figure 15.4.2-27 (added) 14 6.5.3.7 6.5-16 & 17 15 Table 6.5-1 16 Table 6.5-2

DCPP UNITS 1 & 2 FSAR UPDATE (b) Overtemperature ll T (c) Low-low steam generator water level in any steam generator (d) Safety injection signals from any of the following:

• Low steam line pressure

• High containment pressure (Refer to Chapter 7 for a description of the actuation system.)

(2) An AFW system to provide an assured source of feedwater to the steam generators for decay heat removal (Refer to Chapter 6 for a description of the AFW system.)

15.4.2.2.3 Analysis of Effects and Consequences The feed line break transient is analyzed using the RETRAN-02W computer code described in Reference 70. The RETRAN-02W model simulates the reactor coolant system, neutron kinetics, pressurizer, pressurizer relief and safety valves, pressurizer heaters, pressurizer spray, steam generators, feedwater system, and main steam safety valves. The code computes pertinent plant variables including steam generator mass, pressurizer water volume, reactor coolant average temperature, reactor coolant system pressure, and steam generator pressure.

The feed line rupture analysis methodology presented in Section 15.4.2.2 is not intended to minimize the predicted time to pressurizer eveffilll.o.g, as this scenario is evaluated in Section 15.2.1515.4.2.4. Pressurizer overfill concerns during feed line rupture 'Nere generically dispositioned by VVestinghouse (Reference 64) and determined not to require evaluation since operator action is credited to preclude 'Nater relief by the PSVs Major assumptions are:

(1) The plant is initially operating at 102 percent of the NSSS rating, including a conservatively large RCP heat of 20 MWt for the case with offsite power available and a nominal (minimum guaranteed) RCP heat of 14 MWt for the case without offsite power available. These assumptions maximize the primary side heat that must be removed for each case.

(2) Initial reactor coolant average temperature is 5.0°F above the nominal value, and the initial pressurizer pressure is 60 psi above its nominal value.

(3) The initial pressurizer level is set to the nominal full power programmed level plus an uncertainty of +5.7 percent span for Diablo Canyon Units 1 15.4-32 Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE 15.4.2.2.4 Results Analyses were performed for both Units 1 and 2 separately; the most limiting case with offsite power and the corresponding case without offsite power are presented.

Results for two feed line break cases are presented. Results for a case in which offsite power is assumed to be available are presented in Section 15.4.2.2.4.1. Results for a case in which offsite power is assumed to be lost following reactor trip are presented in Section 15.4.2.2.4.2. The calculated sequence of events for both cases is listed in Table 15.4-8.

15.4.2.2.4.1 Feedline Rupture with Offsite Power Available The system response following a feedwater line rupture, assuming offsite power is available, is presented in Figures 15.4.2-10 through 15.4.2-13. Results presented in Figures 15.4.2-11 and 15.4.2-13 show that pressures in the RCS and main steam system remain below 110 percent of the design pressures, 27 48.5 psi a and 1208.5 psia, respectively. Pressurizer pressure decreases after reactor trip on low-low steam generator water level due to the reduction of heat input. Following this initial decrease, pressurizer pressure increases to the pressurizer safety valve setpoint. This increase in pressure is the result of coolant expansion caused by the reduction in heat transfer capability in the steam generators. Figure 15.4.2-11 indicates a pressurizer water volume equivalent to a water-solid condition; however, this is not an acceptance criteria for the analysis. Pressurizer eveffillln.g during a main feedwater pipe rupture event Gees not require specific evaluation for feed line ruptureis evaluated in Section 15.4.2.4. At approximately 5900 seconds, decay heat generation decreases to a level such that the

• total RCS heat generation (decay heat plus pump heat) is less than auxiliary feedwater heat removal capability, and RCS pressure and temperature begin to decrease.

The results show that the core remains covered at all times and that no boiling occurs in the reactor coolant loops.

15.4.2.2.4.2 Feedline Rupture with Offsite Power Unavailable The system response following a feedwater line rupture without offsite power available is similar to the case with offsite power available. However, as a result of the loss of offsite power (assumed to occur at reactor trip), the reactor coolant pumps coast down.

This results in a reduction in total RCS heat generation by the amount produced by pump operation.

The reduction in total RCS heat generation produces a milder transient than in the case where offsite power is available. Results presented in Figures 15.4.2-14 through 15.4.2-17 show that pressure in the RCS and main steam system remain below 11 0 percent of the design pressures, 2748.5 psi a and 1208.5 psia, respectively.

Pressurizer pressure decreases after reactor trip on low-low steam generator water level due to the reduction of heat input. Following this initial decrease, pressurizer 15.4-34 Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE The analysis concludes that the DNB and fuel centerline design bases are met for the limiting case. Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable and not precluded by the criteria, the above analysis shows that the minimum DNBR remains above the safety analysis limit.

15.4.2.3.5.2 Radiological Section 15.5.18 concludes that potential exposures from main steam line ruptures at full power will be well below the guideline levels specified in 10 CFR Part 100, and that the occurrence of such ruptures would not result in undue risk to the public.

15.4.2.4 Major Rupture of a Main Feedwater Pipe for Pressurizer Filling 15.4.2.4.1 Acceptance Criteria The acceptance criterion is to ensure the major rupture of a main feedwater pipe (hereinafter referred to as feedwater line break or FLB) for pressurizer filling event does not result in liquid water (hereinafter referred to as water) relief through the pressurizer safety valves (PSVs) in order to prevent an unisolable reactor coolant pressure boundary breach due to a PSV failing open. This can be accomplished through appropriate operator actions and equipment design/response that mitigate the consequences of the event before water relief through the PSVs occurs.

15.4.2.4.2 Identification of Causes and Accident Description The causes and accident description for the pressurizer filling analysis of the main feedwater pipe rupture described in this section are discussed generally in Section 15.4.2.2.2. The aspects that relate specifically to pressurizer filling follow.

Following a FLB accident. secondary water level decreases in the steam generators (SGs) until auxiliary feedwater (AFW) flow is initiated. after which level will begin to recover in the SGs being fed with AFW flow (i.e .. the intact SGs). Depending on the AFW flow available. there is the potential for an increase in reactor coolant temperatures in the early part of the post-trip transient. along with an increase in reactor coolant volume due to thermal expansion. Also. following initiation of the FLB accident.

a low steam line pressure setpoint will be reached in the faulted loop. causing actuation of the safety injection (SI) signal and start of the two PG&E Design Class I charging pumps. The reactor coolant inventory addition from the charging flow and reactor coolant system (RCS) thermal expansion contributes to pressurizer filling.

If pressurizer filling occurs. the pressurizer power-operated relief valves (PORVs) are available to relieve water inventory from the RCS, as long as an air supply is available from instrument air to containment or from the PG&E Design Class I backup nitrogen accumulators. Also. since Technical Specifications define a PORV as operable with its block valve closed if the PORV can be made available for automatic pressure relief.

15.4-39 Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE operators may need to take action to open the block valve to enable the PORV to provide water relief. Using the PORVs to relieve water from the RCS precludes water relief through the PSVs. which can render the PSVs inoperable.

Mitigation of the pressurizer filling condition is complete when (1) the heat removal capability of the SGs being fed by AFW exceeds NSSS heat generation and stops thermal expansion of the RCS and (2) operator actions are taken to isolate charging flow. and subsequently stop reactor coolant pump (RCP) seal injection flow. which terminates all remaining reactor coolant inventory addition.

The pressurizer filling analysis models the long term plant response to a FLB to demonstrate that operator actions. if taken in a timely manner. preclude water relief through the PSVs. The operator recovery actions for mitigation of a FLB accident are included in the plant Emergency Operating Procedures (EOPs).

15.4.2.4.3 Analysis of Effects and Consequences The FLB transient is analyzed for pressurizer filling in accordance with the NRC approved methodology for a 4-loop plant (Reference 70) using the Westinghouse version of the RETRAN-02 computer code (RETRAN-02W). which is also used for the analysis of the FLB transient described in Section 15.4.2.2.3.

Separate cases to accommodate different limiting assumptions were analyzed to determine the time by which the operators would need to ensure a PG&E Design Class I PORV is available and the times by which the operators would need to isolate charging flow and subsequently stop RCP seal injection flow. Cases were also analyzed with and without offsite power available to determine the more limiting condition.

The assumptions for the pressurizer filling analysis are conservatively chosen to minimize the time to reach a water-solid condition and maximize the number of pressurizer PORV relief open/close cycles predicted. Sensitivity studies were performed for a number of parameters to determine the appropriate conservative assumptions. Major assumptions are the same as described in Section 15.4.2.2.3 with the following exceptions and additions:

(1) Initial reactor coolant average temperature is 5.5°F below the nominal value. and the initial pressurizer pressure is 60 psi below its nominal value.

(2) No credit is taken for relief through the PORV that is actuated on a compensated pressurizer pressure deviation signal (i.e .. the non-safety-grade PORV).

However. relief through the PORVs that are actuated on the indicated (measured) pressurizer pressure signal (i.e .. the safety-grade. PG&E Design Class I PORVs) has been modeled with assumptions that maximize the number of PORV opening cycles experienced. The number of safety-grade PORVs 15.4-40 Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE available for relief (i.e .. either one or both of the PG&E Design Class I PORVs) depends on the single failure being considered.

Also. since an Sl signal causes Phase A containment isolation and the instrument air is a PG&E Design Class II (non-safety-grade) system, there is a loss of instrument air to containment due to this signal. Accordingly, the PG&E Design Class I backup nitrogen accumulators are needed to maintain functionality of the PG&E Design Class I PORVs. The backup nitrogen accumulators are each sized and leak tested to ensure at least 300 PORV cycles before the backup nitrogen supply is depleted, after which the PORV would be unavailable. Therefore. transient mitigation must be demonstrated to occur before 300 PORV cycles is reached.

(3) No credit is taken for normal charging or letdown flow.

(4) The turbine-driven auxiliary feedwater pump (TDAFWP) is aligned to all four SGs. whereas the motor-driven auxiliary feedwater pumps (MDAFWPs) are each independently aligned to two of the four SGs. The AFW flow for each case analyzed depends on the assumed single failure.

With the single failure of the TDAFWP considered, it is assumed that 390 gpm total AFW flow will be delivered to two of the intact SGs at 1 minute after the trip and an additional 195 gpm of AFW flow will be delivered to the third intact SG at 10 minutes after the trip. The AFW flow initiated at 1 minute after the trip is delivered from the MDAFWP that is aligned to two intact SGs. All flow from the other MDAFWP aligned to both the third intact SG and the faulted SG is initially assumed to spill out the break. Subsequently, a TCOA is taken within 10 minutes to isolate the faulted SG and direct AFW flow from this MDAFWP to the third intact SG.

With the single failure of a PG&E Design Class I pressurizer PORV considered.

the AFW flow from the MDAFWPs is the same as described above. However.

with this scenario it is also assumed the TDAFWP will deliver an additional 585 gpm of AFW flow to the three intact SGs at 10 minutes after the trip when the TCOA is taken to isolate the faulted SG.

(5) Maximum Sl flow rates were conservatively modeled with a flow profile that bounds the maximum flow from the two PG&E Design Class I high-head centrifugal charging pumps (CCP1 and CCP2), plus the non-safety-related CVCS charging pump (CCP3), plus two intermediate-head Sl pumps. Full Sl flow was conservatively assumed to occur immediately after the Sl actuation signal. The maximum Sl flow profile, which includes RCP seal injection flow, is modeled until the TCOA is taken to isolate charging flow. Note that no flow is actually injected from the intermediate-head Sl pumps, since RCS pressure remains above the shutoff head of these pumps during the transient.

15.4-41 Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE (6) Maximum RCP seal injection flow was conservatively modeled until the TCOA is taken to stop it. A limiting FLB inside containment may cause the high-high containment pressure setpoint to be reached, resulting in Phase B isolation and a loss of component cooling water (CCW) to the RCPs. Accordingly, RCP seal injection flow must be maintained to ensure RCP cooling until operator action can be taken to reset the Phase B containment isolation and restore CCW flow to the RCPs.

(7) The air-operated pressurizer spray valves are assumed to be inoperable, since instrument air to containment is lost on an Sl signal and normal pressurizer spray flow is unavailable following coastdown of the RCPs. There are auxiliary spray flow lines that are equipped with backup nitrogen if the spray valves are unavailable; however, auxiliary spray requires a manual alignment that would not be completed until after the TCOAs necessary to mitigate this transient are complete.

(8) For the cases with a loss of offsite power, the pressurizer heaters are assumed to be inoperable, since they are not automatically loaded onto an emergency diesel generator (EDG) bus and will not be manually loaded onto the EDGs until after the TCOAs to mitigate this transient are complete. For cases with offsite power available, the pressurizer heaters are assumed to be operable.

(9) For cases with loss of offsite power, the RCPs are assumed to trip automatically following reactor trip. For cases with offsite power, the RCPs continue to operate unless manually tripped by the operators. The EOPs direct the operators to trip the RCPs within 5 minutes following the Phase B containment isolation (to protect the RCP motors, which are cooled by CCW). For the case to determine time by which the operators need to ensure a pressurizer PORV is available, it is assumed the operators manually trip the RCPs at greater than 90 seconds after FLB initiation, because Phase B containment isolation from high-high containment pressure would not occur before this time. However, for the case analyzed to determine the times by which the operators would need to isolate charging flow and subsequently stop RCP seal injection flow, it was conservatively assumed that the RCPs are manually tripped following reactor

~

15.4.2.4.4 Results The results for Unit 2 were more limiting than those calculated for Unit 1.

With respect to the single failure scenarios, it was found the failure of the TDAFWP is limiting for the calculation of minimum time to pressurizer filling, unless one of the two PG&E Design Class I PORVs is already blocked at the start of the transient. If a PORV is blocked, the failure of the other PG&E Design Class I PORV is limiting for pressurizer filling. The failure of a Class I PORV is also limiting for the calculation of the operator 15.4-42 Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE action times required to ensure that transient mitigation is complete before the maximum number of PORV cycles is reached.

For cases with offsite power available. pressurizer pressure is maintained after the RCP seal injection flow is stopped. since the pressurizer heaters (specifically, the backup heaters. actuated on high pressurizer level deviation) continue to operate. However. as a steam bubble forms again in the pressurizer and the pressurizer water volume begins decreasing, relief flow switches from water to steam. Because there is no longer a concern relative to water relief through the PSVs. transient mitigation is complete. For cases with a loss of offsite power. pressurizer pressure decreases after the RCP seal injection flow is stopped. Because the pressurizer PORV and PSV setpoints are no longer challenged, transient mitigation is complete for these cases.

The results of the FLB analysis for pressurizer filling demonstrate that, if the pressurizer fills. the following TCOAs preclude water relief through the PSVs:

(1) Ensure a pressurizer PORV is available within 8.6 minutes If no pressurizer PORV relief is available at the start of the transient because of a failure of one of the PG&E Design Class I PORVs and the other is isolated by its respective block valve. operator action is required to ensure a PG&E Design Class I PORV is available in time to prevent water relief through the PSVs. The analysis determined that the minimum time to pressurizer filling is 8.3 minutes and the minimum time to subsequently lift the PSVs is 8.6 minutes; therefore. the operators must ensure a PG&E Class I PORV is available within 8.6 minutes of event initiation.

The system response for the limiting case with no pressurizer PORV relief available at the start of the transient is presented in Figures 15.4.2-22 and 15.4.2-23. The calculated sequence of events is listed in Table 15.4-8.

(2) Isolate the faulted SG within 10 minutes Similar to the main feedwater pipe rupture analysis discussed in Section 15.4.2.2. the operators are assumed to isolate the faulted SG within 10 minutes after the low-low SG water level setpoint is reached in accordance with operating procedures. This directs all available AFW flow to the intact SGs.

(3) Isolate charging flow within 25 minutes and (4) Stop RCP seal injection flow within 45 minutes The results of the limiting case determined that in order for transient mitigation to occur before the maximum number of PORV cycles is reached, the operators must isolate charging flow within 25 minutes after the low-low SG water level setpoint is reached and subsequently stop RCP seal injection flow within 45 minutes after the low-low SG water level setpoint is reached. These actions ensure that a steam bubble is formed in the pressurizer and the pressurizer water volume begins to decrease. causing relief flow to 15.4-43 Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE switch from water to steam before the capacity of the backup nitrogen accumulators is depleted. Once this occurs. there is no longer a concern relative to water relief through the PSVs and transient mitigation is complete for these cases.

The system response showing that the maximum number of PORV cycles is not reached is presented in Figures 15.4.2-24 through 15.4.2-27. From these results it can be seen that a steam bubble forms again in the pressurizer. the pressurizer water volume begins decreasing, and relief flow switches from water to steam. This occurs before the maximum number of PORV cycles is reached. The calculated sequence of events is listed in Table 15.4-8.

Summary of TCOAs The TCOAs established for mitigation of the feedwater pipe rupture event are summarized below. All TCOA times are from event initiation.

1. Ensure a PG&E Design Class I pressurizer PORV is available within 8.6 minutes

2. Isolate the faulted SG within 10 minutes

3. Isolate charging flow within 25 minutes

4. Stop RCP seal injection flow within 45 minutes 15.4.2.4.5 Conclusion The results of the FLB analysis for pressurizer filling show that operator actions. when taken in a timely manner. will preclude water relief through the PSVs. Thus. the reactor coolant pressure boundary integrity is maintained.

15.4.3 STEAM GENERATOR TUBE RUPTURE (SGTR) 15.4.3.1 Acceptance Criteria The following limiting criteria are applicable for a SGTR:

(1) The resulting potential exposures to individual members of the public and to the general population shall be lower than the applicable guidelines and limits specified in Section 15.5.20.

(2) There are no regulatory acceptance criteria associated with a SGTR margin-to-overfill transient analysis. However, it will be demonstrated that there is sufficient margin to prevent overfill of the SG during an SGTR event. Overfill of the SG may result in significantly increased offsite dose 15.4-44 Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE

70. RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A (Proprietary), April 1999, and WCAP-15234-A (Non-Proprietary), May 1999.

71. Deleted in Revision 21.

72. PGE-1 0-56, "PG&E Diablo Canyon Units 1 and 2, Steam Generator Tube Rupture Margin to Overfill Analysis (CN-CRA-1 0-45 Rev. 0)," October 18, 2010

73. WCAP-16443-P, Rev. 1, Diablo Canyon Unit 2 ASTRUM BE-LBLOCA Engineering Report, November 2005 15.4-73 Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE CHAPTER15 CONTENTS (Continued)

Section Title 15.3.5 Single Rod Cluster Control Assembly Withdrawal at Full Power 15.3-12 15.3.5.1 Acceptance Criteria 15.3-12 15.3.5.2 Identification of Causes and Accident Description 15.3-12 15.3.5.3 Analysis of Effects and Consequences 15.3-13 15.3.5.4 Results 15.3-13 15.3.5.5 Conclusions 15.3-14 15.3.6 References 15.3-14 15.4 CONDITION IV- LIMITING FAULTS 15.4-1 15.4.1 Major Reactor Coolant System Pipe Ruptures (LOCA) 15.4-2 15.4.1.1 Acceptance Criteria 15.4-2 15.4.1.2 Background of Best Estimate Large Break LOCA 15.4-3 15.4.1.3 WCOBRAITRAC Thermal-hydraulic Computer Code 15.4-4 15.4.1.4 Thermal Analysis 15.4-6 15.4.1.4A Unit 1 Best Estimate Large Break LOCA Evaluation Model 15.4-10 15.4.1.5A Unit 1 Containment Backpressure 15.4-13 15.4.1.6A Unit 1 Reference Transient Description 15.4-13 15.4.1.7A Unit 1 Sensitivity Studies 15.4-14 15.4.1.8A Unit 1Additional Evaluations 15.4-16 15.4.1.9A Unit 1 10 CFR 50.46 Results 15.4-16 15.4.1.10A Unit 1 Plant Operating Range 15.4-17 15.4.1.4B Unit 2 Best Estimate Large Break LOCA Evaluation Model 15.4-18 15.4.1.5B Unit 2 Containment Backpressure 15.4-19 15.4.1.6B Unit 2 Confirmatory Studies 15.4-20 15.4.1.7B Unit 2 Uncertainty Evaluation 15.4-20 15.4.1.8B Unit 2 Limiting PCT Transient Description 15.4-21 15.4.1.9B Unit 2 10 CFR 50.46 Requirements 15.4-21 15.4.1.1 OB Unit 2 Plant Operating Range 15.4-22 15.4.1.11 Conclusions (Common) 15.4-22 15.4.2 Major Secondary System Pipe Rupture 15.4-23 15.4.2.1 Rupture of a Main Steam Line at Hot Zero Power 15.4-24 15.4.2.2 Major Rupture of a Main Feedwater Pipe 15.4-30 15.4.2.3 Rupture of a Main Steam Line at Full Power 15.4-35 15.4.2.4 Major Rupture of a Main Feedwater Pipe for Pressurizer Filling 15.4-39 15.4.3 Steam Generator Tube Rupture (SGTR) 15.4-39 15.4.3.1 Acceptance Criteria 15.4-39 15.4.3.2 Identification of Causes and Accident Description 15.4-39 v Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE CHAPTER15 FIGURES (Continued)

Figure Title 15.4.2A-15 Deleted in Revision 19 15.4.2-15 Main Feedline Rupture without Offsite Power Available- Pressurizer Pressure and Water Volume Transients 15.4.2A-16 Deleted in Revision 19 15.4.2-16 Main Feed line Rupture without Offsite Power Available- Reactor Coolant Temperature Transients for the Faulted and Intact Loops 15.4.2A-17 Deleted in Revision 19 15.4.2-17 Main Feedline Rupture without Offsite Power Available- Steam Generator Pressure and Total Mass Transients 15.4.2A-18 Deleted in Revision 19 15.4.2-18 Main Steam Line Rupture at Full Power, 0.49 ft 2 Break- Nuclear Power and Core Heat Flux Transients 15.4.2-19 Main Steam Line Rupture at Full Power, 0.49 ft 2 Break- Pressurizer Pressure and Water Volume Transients 15.4.2-20 Main Steam Line Rupture at Full Power, 0.49 ft 2 Break- Reactor Vessel Inlet Temperature and Loop Average Temperature Transients 15.4.2-21 Main Steam Line Rupture at Full Power, 0.49 ft 2 Break- Total Steam Flow and Steam Pressure Transients 15.4.2-22 Main Feedline Rupture for Pressurizer Filling (Unblock Pressurizer PORV)- Pressurizer Pressure and Water Volume Transients-15.4.2-23 Main Feedline Rupture for Pressurizer Filling (Unblock Pressurizer PORV) - PSV Relief Flow Rate and Enthalpy Transients 15.4.2-24 Main Feed line Rupture for Pressurizer Filling (Isolate Charging and Stop RCP Seal Injection Flow) - Pressurizer Pressure and Water Volume Transients 15.4.2-25 Main Feedline Rupture for Pressurizer Filling (Isolate Charging and Stop RCP Seal Injection Flow) - PORV and PSV Relief Flow Rate Transients xxxvii Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE CHAPTER15 FIGURES (Continued)

Figure Title 15.4.2-26 Main Feedline Rupture for Pressurizer Filling (Isolate Charging and Stop RCP Seal Injection Flow)- PORV/PSV Relief Flow Enthalpy and Total Number of PORV Cycles Transients 15.4.2-27 Main Feedline Rupture for Pressurizer Filling (Isolate Charging and Stop RCP Seal Injection Flow) - Cold Leg Injection Flow Rate Transient 15.4.3A-1 Deleted in Revision 19 15.4.3-1 Deleted in Revision 20 15.4.3-1A Pressurizer Level- SGTR MTO Analysis 15.4.3-1 8 Pressurizer Level - SGTR Dose Analysis 15.4.3A-2 Deleted in Revision 19 15.4.3-2 Deleted in Revision 20 15.4.3-2A Pressurizer Pressure - SGTR MTO Analysis 15.4.3-28 Pressurizer Pressure- SGTR Dose Analysis 15.4.3A-3 Deleted in Revision 19 15.4.3-3 Deleted in Revision 20 15.4.3-3A Secondary Pressure- SGTR MTO Analysis 15.4.3-38 Secondary Pressure- SGTR Dose Analysis 15.4.3A-4 Deleted in Revision 19 15.4.3-4 Deleted in Revision 20 15.4.3-4A Intact Loop Hot and Cold Leg RCS Temperatures- SGTR MTO Analysis 15.4.3-48 Intact Loop Hot and Cold Leg RCS Temperatures- SGTR Dose Analysis 15.4.3A-5 Deleted in Revision 19 15.4.3-5 Deleted in Revision 20 xxxviii Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE TABLE 15.4-8 Sheet 3 of 4§ Accident Time. sec Total RCS heat generation decreases to 2200 auxiliary feedwater heat removal capability Steam Line Rupture at Power Steam line ruptures 0.0 (0.49 ft2)

Peak core heat flux occurs 53.1 Rupture of a Main Feedwater Feedwater line rupture occurs Pipe for Pressurizer Filling (Unblock Pressurizer PORV) Low-low SG water level reactor trip setpoint (Oo/o NRS) reached in faulted SG Rods begin to drop Turbine trip occurs Steam line check valve closes in loop with faulted SG Reactor coolant pumps begin to coast down (from loss of offsite power)

Low steam *line pressure setpoint reached in loop with faulted SG Safety injection actuation signal generated Safety injection flow initation occurs Steam line isolation occurs on low steam line pressure safety injection signal Main steam safety valve relief begins 36.1 PSV steam relief begins 56.0 AFW flow initiation (390 gpm from a 75.9 motor-driven AFW pump) occurs to intact SGs not connected to the faulted SG Pressurizer reaches a water-solid condition PSV water relief begins (maximum time for operator action to ensure a PORV is available)

Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE TABLE 15.4-8 Sheet 4 of 4§ Accident Time. sec Operator action to isolate faulted SG to direct all available AFW flow to intact SGs AFW flow initiation (195 gpm from the turbine-driven AFW pump and 195 gpm from the other motor-driven AFW pump) occurs intact SG connected to the faulted SG AFW flow addition (390 gpm from the turbine-driven AFW pump) occurs to intact SGs not connected to the faulted SG Rupture of a Main Feedwater Feedline rupture occurs Pipe for Pressurizer Filling (Isolate Charging Flow and Pressurizer backup heater actuation on Stop RCP Seal Injection Flow) level deviation Low-low SG water level reactor trip setpoint (0°/o NRS) reached in faulted SG Rods begin to drop Turbine trip occurs Steam line check valve closes in loop with faulted SG Reactor coolant pumps begin to coast down (from manual trip)

Pressurizer PORV steam relief begins Low steam line pressure setpoint reached in loop with faulted SG Safety injection actuation signal generated Safety injection flow initation occurs Steam line isolation occurs on low steam line pressure safety injection signal Main steam safety valve relief begins AFW flow initiation (390 gpm from a motor-driven AFW pump) occurs to intact SGs not connected to,the faulted SG Pressurizer reaches a water-solid condition Operator action to isolate faulted SG to direct all available AFW flow to intact SGs Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE TABLE 15.4-8 Sheet 5 of 4§ Accident Time. sec AFW flow initiation (195 gpm from the turbine-driven AFW pump and 195 gpm from the other motor-driven AFW pump) occurs to intact SG connected to the faulted SG AFW flow addition (390 gpm from the turbine-driven AFW pump) occurs to intact SGs not connected to the faulted SG Operator action to isolate charging/SI flow 1516.0 Operator action to stop RCP seal injection 2715.9 flow Steam bubble forms again in pressurizer 6723.0 Maximum number of PORV cycles 7137.6 reached (capacity of backup nitrogen accumulators depleted)

Revision 21 September 2013

250o-r----------'-----------------,

2400 Q)

.~ 2300 Q)

Q_----o

v *g_ 2200 N....__...

0 ******* 0 0 0 *** 0 0

• c en

~ 2100 Q_

2000 1900 -t-----'----'--.........__.___.__._............,._ ____,__.....___.____.__.........._._.....,__ __.____,___.__.....__._~

0 1 2 3 10 10 10 10 Time (sec) 2ooo.------------------------,

0 0 o 0 0 0 0 0 0 0 0 I 0 0 0 0 0 I 0 0 0 0 0 0 0 I 0 0 0 I 0 0 0 0 I 0 0 0 I 0 0 I 0 0 1000 -t-----'----'--.........__.____.___._............,._ ____,__.....___.____,__.........._._.....,__ ___.____,____.__.....__._~

0 1 2 3 10 10 10 10 Time (sec)

FSAR UPDATE UNITS 1 AND 2 DIABLO CANYON SITE FIGURE 15.4.2-22 MAIN FEEDLINE RUPTURE FOR PRESSURIZER FILLING (UNBLOCK PRESSURIZER PORV)

PRESSURIZER PRESSURE AND WATER VOLUME TRANSIENTS

300 I-I-

1-1-

250- .... .. ...... ... .. .. . . .. .. .. . . . .... . ....... . .... .

I-

<I) I-

-+-' 1-0 i-0:::: _ _ zoo-~--* * * * * * * * * * * * * * * * * : * * * * * * * * * * * * * . . .. . . ......... . .

3:: u i-0 Q) 1-l...J.._

'"Q:; 'E en 150-r-

~--* . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. .. .. . .. . . .

..= ...0 ~

w-......- ,-

0:::: -

> 100- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

(f) - .

o_  ::::

so-_* * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

• o +----~ ~ ~~~ ~ -~~ ~ ~ ~~ ~

~~~---~~~~~ ~ ~~~~ ~~~~~~~~~

0 1 2 3 10 10 10 10 Time (sec) 1200.---------------------------------------------,

0 1ooo- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

• _c

-+-' -

c:

w-- -

E

S::...o o-l...J.._:::::i sao- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

-+-' -

~e -

<I) 0::::

(f) 6oo- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

• o_

4QQ +----~I~I___,_I_I.__.._IJ....JIIL.....LI.,..-*_ ___...1_ __._1_..............

11~1~1~1...._1,.----~1--~11.__.......1~1~1....._1-'-1 1

0 1 2 3 10 10 10 10 Time (sec)

~------~F=S=A =R=U=P=D=A=T=E------~ ~

UNITS 1 AND 2 DIABLO CANYON SITE FIGURE 15.4.2-23 MAIN FEEDLINE RUPTURE FOR PRESSURIZER FILLING (UNBLOCK PRESSURIZER PORV)

PSV RELIEF FLOW RATE AND ENTHALPY TRANSIENTS

250o.,....------------------------,

2400 Q)

I..,_

J

~ 2300 Q)

I..,_

o._-c;--

a;. g_ 2200 * ** 0 **

N'-'

• c

J en

~ 2100 I..,_

o._

2000 1900 -f-----L..----L......J..-L.....L.LLLr--____.i_----L...l-LJ...J....ULr-----L..---l.........L......J....J....J....L..J...------L...____!__...L......J.._~

0 1 2 3 4 10 10 10 10 10 Time (sec) 2000.,....-------------------------,

Q)

E

J 0

a;

-+-' ...--

1600 On

$:;:)::

I..,_

~

• c 1400

J en en Q)

I..,_

o._ 1200 1- . -_* _ _ _ _--..,

1000 -f-____.1_----L....L....l.....L.LL.Lr-----L..---l.........L......J....J....J....L..J...------L...___..L_....L......J...l...L.l....I..,------L---I....-..I.......J....~

0 1 2 3 4 10 10 10 10 10 Time (sec)

FSAR UPDATE UNITS 1 AND 2 DIABLO CANYON SITE FIGURE 15.4.2-24 MAIN FEEDLINE RUPTURE FOR PRESSURIZER FILLING (ISOLATE CHARGING AND STOP RCP SEAL INJECTION FLOW)

PRESSURIZER PRESSURE AND WATER VOLUME TRANSIENTS

3oo.-----------------------,

Q)

-+-'

0 CY:

s:- 200 0 u

- Q)

LL.cn

~ 'E 150

-_a Q)-

oc-CY: 100 C) o_

o +-~~~~~-~~

0 1 2 3 4 10 10 10 10 10 Time (sec)

I I I I I Ill I I I I I Ill I I I I I II I I I I I I I 1 2 3 4 10 10 10 10 Time (sec)

FSAR UPDATE UNITS 1 AND 2 DIABLO CANYON SITE FIGURE 15.4.2-25 MAIN FEEDLINE RUPTURE FOR PRESSURIZER FILLING (ISOLATE CHARGING AND STOP RCP SEAL INJECTION FLOW)

PORV AND PSV RELIEF FLOW RATE TRANSIENTS

1200 r-

>..., r--

0....

0 r--

_c c 1000-w r-3:,.---... r--

...2E LL.___o r--

~--

• - ::::::s Q)m soo-r--

0::::...__....

r-(/) r-o._

......_ 6oo-0:::: r--

0 r-o._

r-I I I I I Ill. I I I I I Ill

• I I I I I Il l . I I I I I Ill 400 0 1 2 3 +

10 10 10 10 10 Time (sec) 350 en Q) 300 u

(_)

> 250 0::::

0 o._

'"+-

200 0

__o Q) 150 E

s

z: 100 0

0 1- 50 0

0 1 2 3 +

10 10 10 10 10 Time (sec)

FSAR UPDATE UNITS 1 AND 2 DIABLO CANYON SITE FIGURE 15.4.2-26 MAIN FEEDLINE RUPTURE FOR PRESSURIZER FILLING (ISOLATE CHARGING AND STOP RCP SEAL INJECTION FLOW)

PORV/PSV RELIEF FLOW ENTHALPY AND TOTAL NUMBER OF PORV CYCLES TRANSIENTS

14~-------------------------------------,

a +-~~~~~~~~~~~~~~--~~~~

0 1 2 3 4 10 10 10 10 10 Time (sec)

FSAR UPDATE UNITS 1 AND 2 DIABLO CANYON SITE FIGURE 15.4.2-27 MAIN FEEDLINE RUPTURE FOR PRESSURIZER FILLING (ISOLATE CHARGING AND STOP RCP SEAL INJECTION FLOW)

COLD LEG INJECTION FLOW RATE TRANSIENT

DCPP UNITS 1 & 2 FSAR UPDATE A loss of normal feedwater was analyzed in Section 15.2.8 to show that two motor-driven AFW system pumps delivering at least 600 gpm of AFW flow to four steam generators does not result in pressurizer over-filling. Furthermore, the peak RCS pressure remains below the criterion for Condition II transients and no fuel failures occur.

Table 6.5-2 summarizes the assumptions used in the Chapter 15 analysis. All main feedwater flow to the steam generators is terminated at event initiation. Reactor trip is assumed to occur when the water level in any steam generator reaches the low-low level trip setpoint. AFW flow from both motor-driven pumps initiates within 60 seconds after receiving a low-low level signal in any steam generator. The analysis assumes that the plant is initially operating at 102 percent (calorimetric error) of the Nuclear Steam Supply System (NSSS) design rating shown in Table 6.5-2, and includes a conservative assumption in defining decay heat and stored energy in the RCS.

Both the loss of normal feedwater and loss of offsite power analyses demonstrate that there is considerable margin with respect to pressurizer over-filling (refer to Sections 15.2.8 and 15.2.9).

A better-estimate analysis is performed to address the reliability of the AFW system.

This analysis is similar to that described above for the Chapter 15 analysis, but assuming that only a single motor-driven AFW system pump supplies a minimum of 390 gpm to two of the four steam generators. The cases considered in this additional analysis assume better-estimate conditions for several key parameters, including initial power level, decay heat, RCS temperature, pressurizer pressure, and the low-low steam generator water level reactor trip setpoint. The results of this better-estimate analysis demonstrate that there is margin to pressurizer over-filling. While this analysis demonstrates that the AFW system remains highly reliable, the DCPP licensing basis requires that at least two AFW pumps delivering at least 600 gpm to four steam generators is required for this event.

Loss of Offsite Power to the Station Auxiliaries The AFW system is initiated for a loss of offsite power to the station auxiliaries' transient as discussed in Section 15.2.9. The same assumptions discussed above for the loss of normal feedwater transient apply to this analysis, except that power is assumed to be lost to the reactor coolant pumps following reactor trip.

As with all ESF equipment, the ac motor-driven AFW pumps and all valves in the system are automatically and sequentially loaded on the emergency buses on loss of offsite power.

Rupture of Main Feedwater Pipe The double-ended rupture of a main feedwater pipe downstream of the main feedwater line check valve was analyzed (refer to Sections 15.4.2.2 and 15.4.2.4). Table 6.5-2 6.5-16 Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE summarizes the assumptions used in theise analyseis. A reactor trip is assumed to occur when the faulted steam generator reaches the low-low level trip setpoint (adjusted for errors). The initial power rating assumed in the feed line break analysis is 102 percent of the NSSS design rating.

For the analysis in Section 15.4.2.2, Aalthough the AFW system at DCPP Units 1 and 2 would allow delivery of AFW to two intact loops automatically in 1 minute, no AFW flow is assumed until 10 minutes after the break. At this time it is assumed that the operator has isolated the AFW system from the break and flow from one motor-driven AFW pump of 390 gpm (total) to two steam generators commences. As discussed in Section 15.4.2.2, the analysis assumes a single failure of the most limiting component, the turbine-driven AFW pump, and assumes that all flow from the motor-driven AFW pump aligned to the faulted steam generator is lost through the break. The AFW flow is asymmetrically split between two of the three unaffected steam generators. The analysis demonstrates that the reactor coolant remains subcooled, assuring that the core remains covered with water and no bulk boiling occurs in the hot leg.

For the analysis in Section 15.4.2.4, the limiting single failure is the failure of a PG&E Design Class I pressurizer PORV. For this analysis, it is assumed the motor-driven AFW pump that is initially aligned to two intact steam generators delivers 390 gpm total AFW flow to two of the three intact steam generators at 1 minute after the trip. It is also assumed that operator actions are taken within 10 minutes to isolate the faulted steam generator. For this reason, the other motor-driven AFW pump, which is initially aligned to both the third intact steam generator and the faulted steam generator, is assumed to deliver an additional 195 gpm of AFW flow to the third intact steam generator at 10 minutes after the trip. Similarly, the turbine-driven AFW pump, which is initially aligned to all four steam generators, is assumed to deliver an additional 585 gpm of AFW flow to all three intact steam generators at 10 minutes after the trip. The analysis demonstrates that water relief through the pressurizer safety valves is precluded.

Rupture of a Main Steam Pipe Inside Containment Because the result of the steam line break transient is an initial RCS cooldown, the AFW system does not have a requirement to remove heat in the short term. However, addition of AFW to the faulted steam generator will increase the secondary mass available for release to the containment thus maximizing the peak containment pressure following a steam line break inside containment. This transient is performed at four power levels for several break sizes. AFW is assumed to be initiated at the time the Sl setpoint is reached. The AFW flowrate to the faulted SG is maximized based on flow from both motor-driven AFW pumps and the turbine-driven AFW pump where runout protection is not credited. Table 6.5-2 summarizes the assumptions used in this analysis. At 10 minutes after the break, it is assumed that the operator has isolated the AFW system from the faulted steam generator, which subsequently blows down to ambient pressure. This assumption for operator action is also used for temperature profile development for main steam line breaks outside containment. Refer to Section 6.2D.3 for further discussion on a main steam line break inside containment.

6.5-17 Revision 21 September 2013

DCPP UNITS 1 & 2 FSAR UPDATE TABLE 6.5-1 CRITERIA FOR AUXILIARY FEEDWATER SYSTEM DESIGN BASIS CONDITIONS Condition or Transient Classification<a) Criteria(a)(c) Additional Design Criteria

. Loss of Normal Feedwater Condition II (Refer to Section 15.2.8) AFW capable of removing stored and AFW automatically initiated on low-low SG residual heat to prevent pressurizer liquid level.

relief.(b)

Loss of Offsite Power to the Condition II AFW capable of removing stored and AFW automatically initiated on low-low SG Station Auxiliaries residual heat to prevent pressurizer liquid level.

(Refer to Section 15.2.9) relief.

Steamline Rupture (Mass & Condition IV N/A- not an AFW system design AFW flow maximized for mass and energy Energy Release - Refer to requirement. release.

Section 6 .2D.3)

Major Rupture of a Main Condition IV AFW to provide assured source of AFW flow to SGs assumed in 10 minutes Feedwater Pipe feedwater to SGs for decay heat removal. after reactor trip.

(Refer to Section 15.4.2.2)

Major Rupture of a Main Condition IV AFW to provide assured source of AFW flow to SGs assumed in 1 minute after Feedwater Pipe for Pressurizer feedwater to SGs for decay heat removal. reactor trip Filling (Refer to Section 15.4.2.4)

Loss of all ac power N/A AFW to provide assured source of AFW system turbine-driven pump train feedwater to SGs for decay heat removal independent of ac power.

independent of ac power.

Small-Break Loss of Coolant Condition Ill AFW provide 390 gpm.<ct) N/A (Refer to Section 15.3.1)

Natural Circulation Cooldown Same as LONF AFW system provides an assured source of Unit 1 - Hot Standby 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, feedwater to SGs to prevent reactor vessel 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> cooldown @ 25 oF per hour.

head voiding .

Unit 2- Hot Standby 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> cooldown @ 50 oF per hour.

Revision 19 May 2010

DCPP UNITS 1 & 2 FSAR UPDATE (a) Ref: ANS N18.2 (This information provided for those transients analyzed in Chapter 15.)

(b) A better-estimate analysis has also been performed to demonstrate that the pressurizer does not fill with a single motor-driven auxiliary feedwater pump feeding 2 SGs a total of 390 gpm.

(c) Refer to Section 15.5 for 10 CFR 100 acceptance criteria for accident analysis dose consequences.

(d) An AFW flowrate of 97.5 gpm per SG is assumed in NOTRUMP based on 390 gpm divided evenly among 4 SGs since NOTRUMP can riot explicitly model asymmetric flow.

Revision 19 May 2010

DCPP UNITS 1 & 2 FSAR UPDATE Table 6.5-2

SUMMARY

OF ASSUMPTIONS AFW SYSTEM DESIGN VERIFICATION Loss of Normal Feedwater Natural Circulation Major Rupture of a Major Steam Line Small Break Loss of Transient {Loss of Offsite Power} Cool down Main Feedwater Pi(2e Break(b) {Containment} Coolant Accident

a. Max NSSS power 102% of 3425 MWt 102% of 3411 MWt 102% of 3425 MWt 102% of 3425 MWt 102% of 3411 MWt

b. Time delay from (Refer to Table 15.2-1) 2 sec (Refer to Table 15.4-8) Variable 4.7 sec event to Rx trip

c. AFW system Low-low SG level Low-Low SG Level Low-low SG level Assumed immediately Low pressurizer actuation 1 minute 1 minute 10 minutes( Refer to 0 sec (no delay) pressure Sl signal!/ 60 signal/time delay Table 15.4-8) sec for AFW system flow

d. SG water level at Low-low SG level Same as LOOP Low-low SG level N/A N/A time of reactor

• 8% narrow range span 0% NRS trip. (NRS)

e. Decay heat Figure 15.1-7 Figure 15.1-7 Figure 15.1-7 Figure 15.1-7 Figure 15.1-7

f. AFW pump design 1102 psig 1112 psia 1102 psig N/A 1130 psig pressure

g. Min. No. of SGs 4 of4 Same as LONF/LOOP 2 of 4 (Section N/A 4 of 4(c) that must receive 15.4.2.2)

AFWflow 3 of 4 (Section 15.4.2.4)

h. MaximumAFW 100 °F 100 °F 100 °F 100 OF 100° F temperature

i. Operator action None N/A 10 minutes to isolate 10 minutes to isolate None the faulted SG the faulted SG Revision 19 May 2010

DCPP UNITS 1 & 2 FSAR UPDATE Table 6.5-2 Loss of Normal Feedwater Natural Circulation Major Rupture of a Major Steam Line Small Break Loss of Transient {Loss of Offsite Power} Cool down Main Feedwater Pi[2e Break(b) {Containment} Coolant Accident

j. AFW purge 113 te per loop/435° F 113 fe per loop/435°F 113 te per loop/435° F 0.0 tel based on power N/A volume/ (Section 15.4.2.2),

temperature 425°F (Section 15.4.2.4)

k. Normal blowdown None assumed None assumed None assumed None assumed None assumed I. Sensible heat Table 6.5-3 Table 6.5-3 Refer to cool down N/A Refer to cool down

m. Time at 2 hr/4 hr with offsite Unit 1 - 1 hr/8 hr N/A N/A N/A standby/time power available @25 °F to cooldown to (without offsite power RHR available refer to Unit 2- 2 hr/4 hr Natural Circulation @50 OF Cooldown)

n. AFW flowrate 600 gpm (total) Variable based on For Section 15.4.2.2, 569 gpm to 1588 gpm 390 gpm to 4 SGsfc>

constant maintaining SG level at 390 gpm (total) varying due to faulted (minimum requirement) lower NR level tap at constant SG pressure changes SG backpressure (after 10 minutes)(a)

(minimum requirement)

For Section 15.4.2.4, refer to Table 15.4-8 (a) Minimum flow of 175.5/214.5 gpm to each of the two steam generators receiving AFW flow.

(b) A rupture of a main steam pipe inside containment does not impose any performance related requirements on the AFW system. For the accident analysis, AFW flowrates were maximized to increase the mass and energy contributions from the AFW system (Refer to Section 6.20.3).

(c) 390 gpm to four SGs was assumed to be provided by one motor-driven AFW pump. The approved NOTRUMP model cannot model asymmetric flow, therefore the 390 gpm is assumed to be distributed equally among the four SGs.

Revision 19 May 2010

Enclosure Attachment 2 PG&E Letter DCL-15-023 Attachment 2 Technical Specification Bases Markup (For Information Only)

TS 3.4.11 - Pressurizer PORVs

Pressurizer PORVs B 3.4.11 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs)

BASES BACKGROUND The pressurizer is equipped with two types of devices for pressure relief:

pressurizer safety valves and PORVs. The PORVs are air operated valves that are controlled to open when the pressurizer pressure increases above their actuation setpoint and to close when the pressurizer pressure

• decreases. The PORVs may also be manually operated from the control room.

DCPP design includes three air operated pressurizer PORVs. Two of these PORVs have been designated as "Class 1". These two valves provide the reactor vessel low temperature overpressure protection, and mitigate the consequences of_ a spurious operation of the safety injection system at power event and the main feedwater line break event, and provide the means to depressurize the RCS following a steam generator tube rupture (SGTR). These functions must be accomplished under accident analyses assumptions such as loss of offsite power.

Consequently, a Class I nitrogen backup system to the non-safety related air supply is provided for the two Class I PORVs. The identification of Class I is used to make a distinction between these two PORVs that must provide a safety-related function as opposed to the third remaining PORV that is designated as non-Class I. TS 3.4.12 for LTOP applies to the two Class I PORVs but not to the non-Class I PORV.

The non-Class I PORV is associated with plant transients as compared to accident mitigation. Although mitigation is not its primary purpose, the valve may be used for those functions also, although not credited for operation.

The three PORVs are the same design. The PORV that is not designated as Class I may be used, when instrument air is available, to control RCS pressure similarly to the Class I PORVs. However, two Class 1 PORVs satisfy the function, with redundancy, therefore continued operation with the non-Class I PORV unavailable for RCS pressure control is allowed as long as the block valve or PORV can be closed to maintain the RCS pressure boundary. The plant has the capability to sustain a 50% load reduction without a reactor trip with two PORVs available.

Block valves, which are normally open, are located between the pressurizer and the PORVs. The three MOV block valves are the same design. The block valves are used to isolate the PORVs in case of excessive seat leakage or a stuck open PORV. Block valve closure is accomplished manually using controls in the control room. A stuck open PORV is, in effect, a small break loss of coolant accident (LOCA). As such, block valve closure terminates the RCS depressurization and coolant inventory loss.

(continued)

GDIABLO CANYON -UNITS 1 & 2 Rev 8A Page 1 of 105 Tab_B3!4u3r08. DOC

Pressurizer PORVs B 3.4.11 BASES BACKGROUND The PORVs may be manually cycled and are equipped with circuitry for (continued) automatic actuation. The automatic mode is the preferred configuration, as this provides pressure relieving capability without reliance on operator action.

The PORVs and their associated block valves may be used by plant operators to depressurize the RCS to recover from certain transients if normal pressurizer spray is not available. Additionally, the series arrangement of the PORVs and their block valves permits performance of surveillances on the block valves during power operation.

The PORVs may also be used for feed and bleed core cooling in the case of multiple equipment failure events that are not within the design basis, such as a total loss of feedwater.

The PORVs, their block valves, and their controls are powered from the vital buses that normally receive power from offsite power sources, but are also capable of being powered from emergency power sources in the event of a loss of offsite power. The PORV block valves are all powered from separate vital busses.

The plant has three PORVs, each having a relief capacity of 210,000 lb/hr at 2335 psig. The functional design of the PORVs is based on maintaining pressure below the Pressurizer Pressure- High reactor trip setpoint up to and including the design step-load decrease. In addition, the PORVs minimize challenges to the pressurizer safety valves and the two Class I PORVs are used for low temperature overpressure protection (L TOP).

See LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP)

System."

APPLICABLE Plant operators employ the PORVs to depressurize the RCS in response SAFETY to certain plant transients if normal or auxiliary pressurizer spray is not ANALYSES available. For the Steam Generator Tube Rupture (SGTR) event, the safety analysis assumes manual operator actions to mitigate the event. A loss of offsite power is assumed to accompany the event, and thus, normal pressurizer spray is unavailable to reduce RCS pressure. For the SGTR event, the PORVs are assumed to be used for RCS depressurization, which is one of the steps performed to equalize the primary and secondary pressures in order to terminate the primary to secondary break flow and the radioactive releases from the affected steam generator.

For both the spurious operation of the safety injection system at power event (-a Condition II event) and the major rupture of a main feedwater pipe accident (a Condition IV event) , the safety analysis credits operator actions from the main control room to terminate flow from the charging pump(s)lower and control pressurizer water level and to open a PORV block valve (assumed to be initially closed) and assure the availability of at least one PORV for automatic pressure relief. Analysis results indicate that water relief through the pressurizer safety valves, which could result in a Condition II event degrading into a Condition Ill eventloss of reactor coolant pressure boundary integrity if the safety valves do not reseat, is precluded if operator actions are taken within the times assumed in the

.QDIABLO CANYON- UNITS 1 & 2 Rev BA Page 2 of 105 Tab_B3!4u3r08. DOC

Pressurizer PORVs 8 3.4.11 (continued)

BASES APPLICABLE analysis to assure at least one PORV is available for automatic pressure SAFETY relief and to reduce charging pump flmu. The assumed operator action ANALYSES times conservatively bound the times measured during simulator (continued) exercises. Therefore, automatic PORV operation is an assumed safety function in MODES 1, 2, and 3. The PORVs are equipped with automatic actuation circuitry and manual control capability. The PORVs are considered OPERABLE in either the automatic or manual mode, as long as the automatic actuation circuitry is OPERABLE and the PORVs can be made available for automatic pressure relief by timely operator actions to open the associated block valves (if closed) and assure the PORV handswitches are in the automatic position. The automatic mode is the preferred configuration, as this provides the required pressure relieving capability without reliance on operator action.

Pressurizer PORVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The LCO requires the PORVs and their associated block valves to be OPERABLE for manual operation to mitigate the effects associated with an SGTR. This LCO also requires the PORVs and their automatic actuation circuitry to be OPERABLE, in conjunction with the capability to manually open their associated block valves and assure the availability of the PORVs for automatic pressure relief, to mitigate the effects associated with the spurious operation of the safety injection system at power event and the major rupture of a main feedwater pipe accident. The PORVs are considered OPERABLE in the automatic or manual mode, as long as the automatic actuation circuitry is OPERABLE and the PORVs can be made available for automatic pressure relief by timely operator actions to open the associated block valves (if closed) and assure the PORV handswitches are in the automatic position. The automatic mode is the preferred configuration, as this provides the required pressure relieving capability with reliance on operator actions.

By maintaining the PORVs and their associated block valves OPERABLE, the single failure criterion is satisfied. An OPERABLE block valve may be either open and energized, or closed and energized, with the capability to be cycled, since the required safety functions of the block valve are accomplished by manual operation to cycle the block valve. Although typically open to allow PORV operation, the block valve may be OPERABLE when closed to isolate the flow path of an inoperable PORV because of excessive seat leakage. Isolation of an OPERABLE PORV does not render that PORV or block valve inoperable, provided the automatic pressure relief function remains available with timely operator actions to open the associated block valve, if closed, and assure the PORV handswitch is in the automatic position. The block valves are available to isolate the flow path through either a failed open PORV or a PORV with excessive seat leakage. Satisfying the LCO helps minimize challenges to fission product barriers.

(continued)

QDIA8LO CANYON -UNITS 1 & 2 Rev SA Page 3 of 105 Tab _83 !4u3r08. DOC

Pressurizer PORVs B 3.4.11 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, the PORVs are required to be OPERABLE to mitigate a SGTR.L aoo spurious operation of the safety injection system at power event, and a main feedwater line break accident. and the block valves are required to be OPERABLE to limit the potential for a small break LOCA through the flow path. The most likely cause for a PORV small break LOCA is a result of a pressure increase transient that causes the PORV to open. Imbalances in the energy output of the core and heat removal by the secondary system can cause the RCS pressure to increase to the PORV opening setpoint. The most rapid increases will occur at the higher operating power and pressure conditions of MODES 1 and 2.

PORV OPERABILITY in MODES 1, 2, and 3 will also minimize challenges to the pressurizer safety valves.

Pressure increases are less prominent in MODE 3 because the core input energy is reduced, but the RCS pressure is high . Therefore, the LCO is applicable in MODES 1, 2, and 3. OPERABILITY of the PORVs requires them to be capable of both manual and automatic operation. The PORV setpoint is reduced for LTOP in MODES 4, 5, and 6 with the reactor vessel head in place and the reactor vessel head closure bolts not fully de-tensioned. LCO 3.4.12 addresses the PORV requirements in these MODES.

ACTIONS A Note has been added to clarify that all pressurizer PORVs are treated as separate entities, each with separate Completion Times (i.e., the Completion Time is on a component basis).

A.1 PORVs may be inoperable and capable of automatic pressure relief or capable of being manually cycled, (e.g., excessive seat leakage). In this condition, either the PORVs must be restored or the flow path isolated within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The associated block valves is required to be closed but power must be maintained to the associated block valves , since removal of power would render the block valve inoperable. Credit for automatic PORV operation is taken in the safety analysis. However, the PORVs are considered OPERABLE in either the manual or automatic mode, as long as the automatic actuation circuitry is OPERABLE and the PORV can be made available for automatic pressure relief by timely operator actions.

Although a PORV may be designated inoperable, it may be available for automatic pressure relief and capable of being manually opened and closed, and therefore able to perform its required safety functions. PORV inoperability solely due to excessive seat leakage does not prevent automatic and manual use and does not create the possibility for a small break LOCA. For these reasons, the block valve may be closed but the ACTION requires power be maintained to the valve. This Condition is only intended to permit operation of the plant for a limited period of time not to extend beyond the next refueling outage (continued)

G DIABLO CANYON- UNITS 1 & 2 Rev 8A Page 4 of 105 Tab_B3!4u3r08. DOC

Pressurizer PORVs B 3.4.11 BASES ACTIONS A.1 (continued)

(continued)

(MODE 6) so that maintenance can be performed on the PORVs to eliminate the problem condition. Normally, the PORVs should be available for automatic mitigation of overpressure events and should be returned to OPERABLE and automatic actuation status prior to entering startup (MODE 2).

Quick access to the PORV for pressure control can be made when power remains on the closed block valve. The Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is based on plant operating experience that has shown that minor problems can be corrected or closure accomplished in this time period.

B.1, B.2, and B.3 If one PORV is inoperable and not capable of automatic pressure relief or not capable of being manually cycled, it must be either restored or isolated by closing the associated block valve and removing the power to the associated block valve. The Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for Required Actions B.1 and B.2 is reasonable, based on challenges to the PORVs during this time period, and provides the operator adequate time to correct the situation.

If the inoperable PORV cannot be restored to OPERABLE status, it must be isolated within the specified time. Because at least one Class I PORV remains OPERABLE, an additional 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is provided to restore the inoperable PORV to OPERABLE status if it is Class I. If the valve is the non-Class I PORV, there is no required Completion Time. If the Class I PORV cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply as required by Condition D.

C.1, C.2, and C.3 If one PORV block valve is inoperable, then it is necessary to either restore the block valve to OPERABLE status within the Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or place the associated PORV in manual control. The PORV control switch has three positions; open, close, and auto. Placing the PORV in manual control, if required in ACTION C, is accomplished by positioning the switch out of the auto control mode. The prime importance for the capability to close the block valve is to isolate a stuck open PORV.

Therefore, if the block valve cannot be restored to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, the Required Action is to place the associated PORV in manual control.

(continued)

Q DIABLO CANYON- UNITS 1 & 2 Rev 8A Page 5 of 105 Tab_83 !4u3r08. DOC

Pressurizer PORVs 8 3.4.11 BASES ACTIONS C.1. C.2. and C.3 (continued)

(continued)

This action is taken to avoid the potential for a stuck open PORV if the valve were to open under automatic control at a time that the block valve is inoperable. The Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation. If the inoperable block valve is associated with a Class 1 PORV, the operator is permitted a Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to restore the inoperable block valve to OPERABLE status. The time allowed to restore the Class I PORV block valve is based upon the Completion Time for restoring an inoperable Class I PORV in Condition B, since the PORVs are not capable of mitigating a SGTR~--et= spurious operation of the safety injection system at power event.l...

or a main feedwater line break accident when inoperable. If the block valve is restored within the Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the PORV will be transferred to the automatic mode of operation. If the block valve cannot be restored within this additional time, the plant must be brought to a MODE in which the LCO does not apply as required by Condition D.

If the inoperable block valve is associated with the non-Class I PORV, the block valve may be closed and the power removed. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time for closing the block valve is the same applied in Required Action C.2. This recognizes that some restoration work may be required since the block valve is inoperable.

Restoration of the non-class I PORV block valve to OPERABLE status is not required because the non-Class I PORV is not required is not required to be available, although having the valve closed impairs the load rejection design capability. Therefore, once the block valve has been closed per Required Action C.3, Completion Time requirements of Condition D do not apply.

If the block valve can not be placed in the closed position, per Required Action C.3, Condition D applies and the unit must be taken to MODE 4 until the block valve is restored or closed.

The Required Actions are modified by a Note stating that the Required Actions do not apply if the sole reason for the block valve being declared inoperable is as a result of power being removed to comply with other Required Actions. In this event, the Required Actions for inoperable PORV(s) (which require the block valve power to be removed once it is closed) are adequate to address the condition.

(continued)

QDIABLO CANYON- UNITS 1 & 2 Rev 8A Page 6 of 105 Tab_B3!4u3r08. DOC

Pressurizer PORVs B 3.4.11 BASES ACTIONS D.1. D.2. and D.3 (continued)

If the Required Action of Condition A, B, or C is not met, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4, 5, and 6 with the reactor vessel head closure bolts not fully de-tensioned, maintaining Class I PORV OPERABILITY is required by LCO 3.4.12.

E.1, E.2. E.3, E.4. and E.5 If more than one Class I PORV is inoperable for reasons other than excessive seat leakage, it is necessary to either restore at least one valve, within the Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, or isolate the flow path by closing and removing the power to the associated block valves. The Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is reasonable, based on the small potential for challenges to the system during this time and provides the operator time to correct the situation. If one Class I PORV is restored and one Class I PORV remains inoperable, then the plant will be in Condition B with the time clock started at the original declaration of having two Class I PORVs inoperable. If no Class I PORVs are restored within the Completion Time, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4, 5, and 6 with the reactor vessel head closure bolts not fully de-tensioned, maintaining Class I PORV OPERABILITY is required by LCO 3.4.12.

(continued)

Q DIABLO CANYON -UNITS 1 & 2 Rev SA Page 7 of 105 Tab_83 !4u3r08. DOC

Pressurizer PORVs 8 3.4.11 BASES ACTIONS F.1. F.2. F.3. and F.4 (continued)

If more than one PORV block valve is inoperable, it is necessary to either restore the block valves within the Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, or place the associated PORVs in manual control and restore at least one block valve within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and restore the remaining block valve within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The PORV control switch has three positions; open, close and auto. Placing the PORV in manual control, if required in ACTION F, is accomplished by positioning the switch out of the auto control mode. The Completion Times are reasonable, based on the small potential for challenges to the system during this time and provide the operator time to correct the situation.

If the inoperable block valve is associated with the non-Class I PORV, the block valve may be closed and the power removed. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time for closing the block valve is the same time used in Required Action F.3. This recognizes that some restoration work may be required since the block valve is inoperable._ Restoration of the non-class I PORV block valve to OPERABLE status is not required because the non-Class I PORV is not required to be available, although having the valve closed impairs the load rejection design capability. Therefore, once the block valve has been closed per Required Action F .4, Completion Time requirements of Condition G do not apply.

If the block valve can not be placed in the closed position per Required Action F.4, Condition G applies until the block valve is restored or closed.

The required Actions are modified by a Note stating that the Required Actions do not apply if the sole reason for the block valve being declared inoperable is as a result of power being removed to comply with other Required Actions. In this event, the Required Actions for inoperable

• PORV(s) (which require the block valve power to be removed once it is closed) are adequate to address the condition.

(continued)

Q DIABLO CANYON- UNITS 1 & 2 Rev SA Page 8 of 105 Tab_B3!4u3r08.DOC

Pressurizer PORVs 8 3.4.11 BASES ACTIONS G.1, G.2 and G.3 (continued)

If the Required Actions of Condition F are not met, then the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. In MODES 4, 5, and 6 with the reactor vessel head closure bolts not fully de-tensioned, maintaining Class I PORV OPERABILITY is required by LCO 3.4.12.

SURVEILLANCE SR 3.4.11.1 REQUIREMENTS Block valve cycling verifies that the valve(s) can be closed if needed. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

The Note modifies this SR by stating that it is not required to be performed with the block valve closed in accordance with the Required Action of this LCO. Opening the block valve in this condition increases the risk of an unisolable leak from the RCS since the PORV is already inoperable.

SR 3.4.11.2 SR 3.4.11.2 requires a complete cycle of each PORV. Operating a PORV through one complete cycle ensures that the PORV can be manually actuated for mitigation of an SGTR. Operating experience has shown that these valves usually pass the surveillance when performed at the required lnservice Testing Program frequency. The frequency is acceptable form a reliability standpoint.

The Note modifies this SR to allow entry into an operation in MODE 3 prior to performing the SR. This allows the surveillance to be performed in MODE 3 or4.

The Note that modified this SR to allow entry into and operation in MODE 3 prior to performing the SR. This allows the test to be performed in MODE 3 under operating temperature and pressure conditions, prior to entering MODE 1 or 2. In accordance with Reference 4, administrative controls require this test be performed in MODE 3 or 4 to adequately simulate operating temperature and pressure effects on PORV operation.

(continued)

G DIABLO CANYON- UNITS 1 & 2 Rev 8A Page 9 of 105 Tab _83 !4u3r08. DOC

Pressurizer PORVs B 3.4.11 BASES SURVEILLANCE SR 3.4.11.3 REQUIREMENTS Verifying OPERABILITY of the safety related nitrogen supply for the Class (continued)

I PORVs may be accomplished by:

a. Isolating and venting the normal air supply, and

b. Verifying that any leakage of the Class I backup nitrogen system is within its limits, and

c. Operating the Class I PORVs through one complete cycle of full travel.

Operating the solenoid nitrogen control valves and check valves on the nitrogen supply system and operating the Class I PORVs through one complete cycle of full travel ensures the nitrogen backup supply for the Class I PORV operates properly when called upon. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.4.11.4 Performance of a COT is required on each required Class I PORV to verify and, as necessary, adjust its lift setpoint. PORV actuation could depressurize the RCS and is not required.

The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.4.11.5 Performance of a CHANNEL CALIBRATION on each required Class I PORV actuation channel is required to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input.

The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Not Used.

2. FSAR, Section 15.2.

3. ASME, Code for Operation and Maintenance of Nuclear Power Plants, 2001 Edition including 2002 and 2003 Addenda.

4. Generic Letter 90-06, "Resolution of Generic Issue 70, 'Power-Operated Relief Valve and Block Valve Reliability,' and generic issue 94, 'Additional Low-Temperature Overpressure Protection for Light-Water Reactors,' Pursuant to 10 CFR 50.54(f)," June 25, 1990.

G DIABLO CANYON- UNITS 1 & 2 Rev 8A Page 10 of 105 Tab_B3!4u3r08. DOC