SBK-L-13151, Response to Request for Additional Information Regarding License Amendment Request 12-04, Cold Leg Injection Permissive

Response to Request for Additional Information Regarding License Amendment Request 12-04, Cold Leg Injection Permissive

ML13225A398
Person / Time
Site:	Seabrook
Issue date:	08/08/2013
From:	Walsh K NextEra Energy Seabrook
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
SBK-L-13151, LAR 12-004
Download: ML13225A398 (20)

Text

NEXTera ENERG I -

August 8, 2013 10 CFR 50.90 SBK-L-13151 Docket No. 50-443 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001 Seabrook Station Response to Request for Additional Information Regarding License Amendment Request 12-04, Cold Leg Injection Permissive

References:

1. NextEra Energy Seabrook, LLC letter SBK-L- 12179, "License Amendment Request 12-04, License Amendment Request Regarding Cold Leg Injection Permissive,"

March 13, 2013

2. NRC letter "Seabrook Station, Unit No. I - Request for Additional Information for License Amendment Request 12-04, Application Regarding Cold Leg Injection Permissive (TAC No. MF1158)," June 28, 2013 In Reference 1, NextEra Energy Seabrook, LLC (NextEra) submitted a request for an amendment to the Technical Specifications (TS) for Seabrook Station. The proposed amendment modifies the circuitry that initiates high-head safety injection by adding a new permissive, cold leg injection permissive (P-15). This permissive prevents opening of the high-head safety injection valves until reactor coolant system pressure decreases to the P-15 setpoint.

In Reference 2, the NRC staff requested additional information to complete its review of the license amendment request. The Enclosure to this letter contains NextEra's response to the request for additional information. This response does not alter the conclusion in Reference 1 that the change does not present a significant hazards consideration.

Reference 1 requested issuance of a license amendment by March 28, 2014 and implementation of the amendment within 30 days to support planned changes during the spring 2014 refueling outage. However, NextEra has delayed implementation of the cold leg injection permissive NextEra Energy Seabrook, LLC. A 626 Lafayette Rd, Seabrook, NH 03874 A00 QU.,b

United States Nuclear Regudatory Commission SBK-L-13151 /Page 2 (P-15) to the fall 2015 refueling outage. As a result, NextEra requests that upon issuance, the amendment stipulates implementation to occur prior to entering Mode 3 during plant startup from refueling outage 17.

Should you have any questions regarding this letter, please contact Mr. Michael Ossing, Licensing Manager, at (603) 773-7512.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on *iAiX _,2013.

Sincerely, Kevin T. Walsh Site Vice President NextEra Energy Seabrook, LLC Enclosure cc: NRC Region I Administrator NRC Project Manager, Project Directorate 1-2 NRC Senior Resident Inspector Director Homeland Security and Emergency Management New Hampshire Department of Safety Division of Homeland Security and Emergency Management Bureau of Emergency Management 33 Hazen Drive Concord, NH 03305 John Giarrusso, Jr., Nuclear Preparedness Manager The Commonwealth of Massachusetts Emergency Management Agency 400 Worcester Road Framingham, MA 01702-5399

Enclosure Response to Request for Additional Information (RAI)

RAI #1:

Clarify whether the LAR's simplified P-15 cold leg injection permissive (CLIP) logic diagram (ADAMS Accession No. ML13079A122, Attachment 1, Figure 1, Page 5) shows the solid state protection system (SSPS) coincidence logic for only one SSPS train, which is duplicated for the other SSPS train, or does it show the SSPS coincidence logic of both SSPS trains.

Response

The CLIP Logic Diagram (Figure 1 in License Amendment Request 12-04) shows the signals from the four existing pressurizer pressure channels (which are not train-related) providing signals into two 2/4 logic gates. These gates are train-related; only one train is shown on Figure 1 for simplicity. The two 2/4 gates provide the signal to the AND gate, the output of which is the P-15 permissive on a per train basis. Alarms points D8187 & D8188 are common to both trains; the signals from both trains are isolated and input to the computer demultiplexer, which generates these alarms. UL-1-198 is the P-15 permissive status light on the main control board, which receives its input from the control board demultiplexer.

Refer to Attachment 1, which is an overall block diagram for the P- 15 permissive from the pressurizer sensing lines to the slave relays which actuate the high head safety injection (SI) valves, SI-V138 and V139.

RAI #2:

Demonstrate the post-modification allocation of P-I15 functions and S-signal functions among the equipment and components related to the P-15 function (e.g., SSPS components, cabinets, channels, trains, actuated devices and the electrical division/separation group associated with each, etc.).

Response

Refer to Attachment 1, P- 15 Permissive Block Diagram, and Attachment 2, Cold Leg Injection Permissive P-15, which provides additional detail of the implementation of P-15 on train A of the SSPS. The pressurizer pressure transmitters, process protection and SSPS SI components are existing. The components depicted for the P-15 function are new.

1

RAI #3:

Regarding the "two relays with contacts in series with an S-signal relay" (ADAMS Accession No. ML13079A122, Attachment 1, Page 4):

a. Clarify whether these two relays are in series or are in parallel with one another prior to being in series with an S-signal relay;

b. Clarify whether there are two relays (i.e., redundant relays) within each SSPS train, or one-relay in one SSPS train, and another relay in the other SSPS train;

c. Provide the location(s)/cabinets(s) where the series connections between these two relays and the S-signal relay(s) is/are made;

d. Clarify whether each SSPS train affects the S-signal relays for both cold leg injection valves (I-SI-V-138 and 1-SI-V-139), or only a single cold leg injection valve that is associated with one of the two SSPS trains.

Response

3. a) The contacts from the two new master relays associated with the P-i5 function are in series with each other and are in series with the existing contact from the S-signal master relay. See Attachment 2.

b) There are two master relays associated with the P-15 function in each train. See Attachment 2.

c) The electrical connections between these two slave relay contacts and the S-signal relay contact are made in the SSPS output relay cabinet. See Attachment 2.

d) As shown in Attachment 1, each train affects its own associated cold leg injection valve.

Train A only is shown in Attachment 2.

RAI #4:

For the equipment affected by this proposed modification, identify each electrical isolation point between otherwise independent redundant channels (SSPS input cabinets) and trains (SSPS logic cabinets), along with any non-safety equipment, and demonstrate that the electrical isolation is adequate for independence between redundant portions of the safety system, and between safety and non-safety equipment (i.e., demonstrate how the Institute of Electrical and Electronics Engineers (IEEE) Std. 603-1991, "Criteria for Safety Systems for Nuclear Power Generating Stations," Clauses 5.6.1 and 5.6.3, along with General Design Criterion 22, "Protection System Independence," are satisfied). This information should address all monitoring points and indication, including any that the simplified P-15 logic diagram depicts, if applicable (ADAMS Accession No. ML13079A122, Attachment 1, Figure 1, Page 5).

Response

Four existing pressurizer pressure transmitters provide input signals to each of the four existing 7300 process protection cabinets. The CLIPS permissive is generated on an individual channel basis within each of the four existing 7300 process protection cabinets.

2

Within each cabinet, new bistable cards, which receive their input signal from the existing pressurizer pressure channels, will be installed. Outputs from each of the new bistables actuate new SSPS input relays to be installed in the input bays of each SSPS cabinet.

The four instrument channels monitoring pressurizer pressure are physically separated from each other from the sensor to the 7300 process protection cabinets, which provide the signal processing. The process protection cabinets for each instrument channel are physically separate cabinets. The P-15 signal outputs from the process protection cabinets are bistable outputs (one for each channel) which are then input to both trains of the SSPS. The input cabinet of each train of SSPS is divided into four physically separate input relay compartments. The channel identity is maintained through to the SSPS input relay coils, which are channel related. Coil to contact isolation is provided to isolate the channel inputs from the train related logic in the SSPS. The train related contact outputs from the SSPS input relays are input to the train related logic circuits in the SSPS logic cabinet.

Isolation between each train of the SSPS and between each train and the digital computer points is provided by optical isolation boards in the SSPS cabinets. Similarly, isolation is provided between the SSPS trains and the status lights by optical isolation boards in the SSPS cabinets.

The physical separation and electrical isolation discussed above meets the intent of clauses 5.6.1 and 5.6.3 of IEEE-603-1991.

RAI #5:

Identify any deviations from the existing SSPS instrumentation design basis, as documented in the Seabrook Updated Final Safety Analysis Report (UFSAR), Revision 12, that is applicable to this modification (e.g., modifications to the SSPS input cabinets or SSPS logic cabinets).

Response

The existing SSPS instrumentation design basis is provided in UFSAR sections 7.1.2.1 .b, 7.2.2.2.a, 7.3.1.2, and 7.3.2.2. The design of the P-15 permissive, which includes modifications to the SSPS input and logic cabinets, conforms to the SSPS design basis as discussed in these sections. There are no deviations to the design basis of the SSPS for the P-15 modification.

RAI #6:

Identify and describe testing features associated with the proposed modification with respect to the current SSPS instrumentation design basis that solid-state logic testing checks the digital signal path from the input to the logic matrices (as implemented within the SSPS logic cabinets) to the inputs of the slave relays (see Seabrook UFSAR, Chapter 7, Revision 9, Section 7.3, Page 15) (i.e., that demonstrates how IEEE Std 603-1991, Clause 6.5, and the 3

testability portion of General Design Criterion 21, "Protection System Reliability and Testability," are satisfied).

Response

The functionality of the built in testing capability of the SSPS will be utilized for testing of the P- 15 permissive.

The SSPS input relays in protection channels that are tested in bypass during power operation are tested at refueling intervals using the bypass test instrumentation (BTI) switches to toggle the SSPS input relays. For the P-15 permissive, the BTI design includes new connections to the BTI switches to support performance of this testing during refueling shutdowns.

SSPS logic circuitry is tested using the existing permissive logic test switch S505. The P-15 design utilizes spare positions on this switch to support testing of the 2/4 logic circuitry for the P- 15 permissive.

The master relays associated with slave relay K637 (SI/CLIP) will be tested using the existing rotary switch used for master relay testing. As this switch is operated, it actuates various master relays. These master relays close their contacts and allow 15VDC to the appropriate slave relay coil to verify continuity of the associated slave relay coil. For the P-15 permissive, to ensure that slave relay K637 will actuate only when all three master relays have actuated, all of the pair combinations of two of the three master relays will be tested to ensure that K637 cannot be actuated by any of these combinations.

The slave relays are tested utilizing test switches in the safeguards test cabinets. For the P-15 permissive, additional contacts on test switch S801 in the safeguards test cabinet will be utilized to perform BLOCK testing of the slave relays during power operation. The slave relays will be GO tested during refueling shutdowns.

Based on the above discussion, the testing of the P- 15 permissive is consistent with section 7.3 of the UFSAR. This testing satisfies the testability portion of GDC 21 for on-line testing based on the following clarifications that are provided in the UFSAR. In accordance with UFSAR section 7.3, the SSPS input relays for functions tested in bypass during power operation are tested at refueling intervals; the same will apply to the input relays used for the P-15 permissive. In accordance with UFSAR section 7.1.2.5, the opening of the high head safety injection valves cannot be tested during power operation. Therefore, the slave relays for the SI/CLIP function will be BLOCK tested during power operation and GO tested at refueling intervals. This is consistent with the current testing of the slave relays that open the high head safety injection valves. Testing procedures will verify that the slave relay contact is open following testing. Channel checks are performed for the pressurizer pressure channels; these channel checks meet the intent of IEEE-603-1991, clause 6.5.

4

RAI #7:

Regarding the Bypass Test Instrumentation (BTI) signals (ADAMS Accession No. ML13079A122, Attachment 1, Figure 1, Page 5):

a. Clarify whether their use is consistent with Seabrook UFSAR, Chapter 7, Revision 9, Section 7.3, Page 14, which allows testing of a process channel when in bypass via an active high signal, where there is a unique BTI control for each P-15 process channel's bistable. If not, please provide an explanation of the BTI signal used to control the P-15 process channel bistables;

b. Describe whether and how indication of each new bypass will be provided (i.e.,

demonstrate how IEEE Std 603-1991, Clauses 5.8.3, and 6.7, are satisfied).

Response

a. The BTI panels will be used to allow testing of the P-15 interlock, one channel at a time. The use of the BTI panels for the CLIP function is consistent with Section 7.3, page 14 of the UFSAR.

The BTI panels are located in each process protection system (PPS) cabinet. There is a BYPASS ENABLE keylock switch on each bypass panel. All four PPS cabinet keylock switches are keyed the same. The individual bistable bypass switches are inactive unless the BYPASS ENABLE switch on that panel is rotated to the ENABLE position. In this position, the key is held captive in the lock such that another PPS cabinet cannot be bypassed using the same key.

Spare bypass switches (one in each BTI panel) will be connected to the P- 15 circuits and used to provide the bypass of the P- 15 bistable in that channel for testing.

b. Rotating the BYPASS ENABLE switch to the ENABLE position actuates the bypass indication on the control room video alarm system (VAS). This provides continuous bypass/inoperable indication on a protection cabinet basis in accordance with paragraph 4.13 of IEEE-279-1971 and meets the intent of Reg. Guide 1.47 and section 5.8.3 of IEEE-603-1991. The operation of the BYPASS ENABLE switches does not actually create a bypass condition, but it does provide a permissive for bypassing the channels with the individual bistable bypass switches. Each BYPASS ENABLE switch is also provided with an indicating lamp which will be lit any time the panel is enabled (the master bypass enable switch in the ENABLE position).

The capability of a 2/4 protection system to accomplish its safety function when in bypass has been established via WCAP 10271, Supplement 2, Revision 1. This meets the intent of IEEE Std. 603-1991, section 6.7.

5

RAI #8:

Clarify whether any bypass capability is provided for the P-i15 function coincidence logic in addition to that provided for the P- 15 function process channels.

Response

The SSPS coincidence logic is tested one train at a time. During logic testing of one train, the other train can initiate the required engineered safety function actuations. There is no specific bypass for the P-15 coincidence logic; it will be tested as part of the logic testing periodically performed on each train of the SSPS.

The semi-automatic test of each P- 15 circuit will operate in the same way as the test features of the existing logic circuits testing the 2/4 function from the input relay contacts to the master relay coil. The testing of the P-15 circuit will utilize existing permissive logic test switch S505.

RAI #9:

Describe any fail safe behavior of the P-l15 function (e.g., the permissive state under complete loss of offsite power, etc.).

Response

The signal path for CLIP from the sensors to the final actuation device includes the following active components: transmitters, PPS cabinet rack components (power supply boards, bistables), SSPS components (input relays, logic boards, driver boards, master relays, slave relays), and motor operated valves.

Transmitters Transmitters require power to operate and are powered from the associated process rack. Loss of power results in a low signal (channel trip).

Process Protection Racks Power supply boards: require power to operate; loss of power results in a low signal (channel trip). Each process protection rack has a primary and a backup DC power supply.

Bistables: normally energized; de-energized for actuation. Loss of power results in actuation (channel trip).

SSPS Input Relays: de-energized for actuation; loss of power results in actuation of the affected relay (channel trip). Each channel is separately powered.

6

Logic Boards: require power to operate; loss of power prevents an actuation signal output.

There are two redundant 48VDC and two redundant 15VDC power supplies in the logic cabinet providing power to these boards.

Driver Boards: requires power to operate; loss of power prevents an actuation signal output.

There are two redundant 48VDC and two redundant 15VDC power supplies in the logic cabinet providing power to these boards.

Master Relays: energize for actuation; loss of power prevents actuation. Powered from 48VDC bus powered by redundant power supplies.

Slave Relays: energize for actuation; loss of power prevents actuation. Powered from 11 8VAC power source.

High Head Safety Injection Motor Operated Valves (MOV)

The MOVs (SI-V138 and V139) require AC power (480 VAC) to open; loss of power prevents the valves from opening.

RAI #10:

Describe the reliability of the implementation (e.g., circuits and any programmable device) of the P- 15 function that supports the statement, "NextEra concludes that the reliability of the P-15 permissive is commensurate with the safety function performed" (ADAMS Accession No. ML13079A122, Attachment 1, Page 6) (i.e., demonstrate how the P-15 function reliability has been established in accordance with IEEE Std 603-1991, Clause 4.9, and how IEEE Std 603-1991, Clause 5.15 is satisfied).

Response

The protection system is designed for high functional reliability and in-service testability commensurate with the safety functions to be performed. The process rack components used for CLIP include bistables, which are the same model as other bistables used for protection functions. The CLIP bistables have the same quality and reliability as other bistables in the process protection racks. The SSPS components used for CLIP include input relays, universal logic cards, safeguards output cards, master relays, and slave relays. These components are the same model and have the same quality and reliability as the other similar SSPS components used for protection functions.

These additional components increase the complexity of the valve control circuit and thus increase the failure probability of the valves to open. However, the corresponding increases in Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) are not significant. Based on the small change in CDF and LERF, the implementation of the P-15 permissive modification does not have a significant impact on defense-in-depth.

7

Manual capability to open the high head safety injection valves is available should the automatic opening circuit fail. Remote manual capability is provided on the main control board via individual valve control switches. Local manual capability to open the high head safety injection valves is also available. Thus, manual backup defense-in-depth capability is not significantly impacted by this change.

The installation of the P-15 permissive will lessen the challenge of inadvertent safety injection (ISI) events and their CDF contribution. Thus, the benefit of the P-15 permissive is judged to have a very small improvement on CDF.

Therefore, the change in plant risk due to the implementation of the P- 15 permissive is not significant and the impact on defense-in-depth is not significant. This leads to the conclusion that the "reliability of the P- 15 permissive is commensurate with the safety function performed."

Seabrook has not committed to meeting the requirements of IEEE-603 -1991; the reliability commitments for the ECCS are described in UFSAR section 6.3.2.5. The design of the P-15 permissive as discussed above is consistent with the provisions of section 6.3.2.5.

RAI #11:

Clarify whether the design-basis exception of IEEE Std 279-1971, Paragraph 4.11, for "the single failure criterion for one-out-of-two systems during channel bypass where acceptable reliability of operation can be demonstrated, as justified by WCAP-10271, Supplement 2,"

will be applied to any equipment that performs any portion of the P-15 function (see Seabrook UFSAR, Revision 12, Section 7.2, Page 34). If so, the demonstration of "acceptable reliability of operation" should also be provided.

Response

The P-15 permissive uses four channels of pressurizer pressure signals. During analog channel operational tests (ACOTs), the channel under test will be bypassed so that the 2/4 logic becomes 2/3 with one channel providing a control function. As discussed in UFSAR section 7.2.2.2.c(1 1), WCAP-10271, Supplement 2, Revision 1 concluded that the rationale for the single failure exception one-out-of-two systems is equally applicable to two-out-of-four systems which have a control/protection interaction including pressurizer pressure LO-LO safety injection. Thus, this WCAP provides the basis for the statement of "acceptable reliability of operation."

RAI #12:

The NRC staff requests additional information that clarifies whether any of the four reactor coolant pressurizer pressure transmitter channels (I-PB 455 H, II-PB 456 H, III-PB 457 H, IV-8

PB 458 H) are shared by control functions in addition to the P-15 function (i.e., demonstrate that General Design Criterion 24, "Separation of Protection and Control Systems," is satisfied beyond the electrical separation provided by isolators, as discussed in Seabrook UFSAR, Revision 12, Section 7.1.2.2a, Page 14).

Response

Pressurizer pressure channel RC-P-455 provides normal control functions including pressurizer spray valve control, variable heater control, PORV A opening signal, backup heater control, in addition to the P-15 function. Pressurizer pressure channel RC-P-457 can also be selected to provide these control functions in addition to the P-15 function.

Pressurizer pressure channel RC-P-456 provides the following normal control function:

PORV B opening signal. Pressurizer pressure channel RC-P-458 can also be selected to provide this control function in addition to the P- 15 function. Pressurizer pressure channel RC-P-457 provides a PORV B opening interlock and an opening signal to its associated block valve. Pressurizer pressure channel RC-P-458 provides a PORV A opening interlock and an opening signal to its associated block valve. All of the signals providing control functions are isolated from the protection signals.

The design of the instrument sensing lines is discussed in UFSAR section 7.1.2.12. This section indicates that an exception to R.G. 1.151, Instrument Sensing Lines" July, 1983 has been taken for the common instrument taps used for redundant sensors. As discussed in LAR 12-04, the common sensing line has a low probability of failure since the line is designed to ASME III Class 1 or 2. The design of the sensing lines is in conformance with standard Westinghouse design.

Thus, GDC 24 is satisfied since there are no single failures in the pressurizer pressure control system or protection system that would adversely affect the accomplishment of the protection system functions.

RAI #13:

Regarding the evaluation of the P-15 setpoint and its allowable values under increasing and decreasing pressurizer pressure (see marked up TS, Table 3.3-4, FUNCTIONAL UNIT 10.d):

a. Provide a representative calculation of the setpoint methodology used to establish the allowable values of nominal permissive set/reset points for P- 15 and the limiting acceptable values for the as-found and as-left tolerances, as measured during periodic surveillance testing;

b. Identify any related analytical limit or other limiting design value for the P-15 setpoint along with the source of the limit(s);

c. Provide a summary description that addresses each of the following, consistent with Regulatory Issue Summary 2006-17, "NRC Staff Position on the Requirements of 10 CFR 50.36, 'Technical Specifications,' Regarding Limiting Safety System Settings During Periodic Testing and Calibration of Instrument Channels," for the P-15 9

function:

i. the channel performance data that has been used to establish the value of the limiting permissive setpoint (i.e., least conservative as-left value associated with the nominal permissive setpoint);

ii. the channel performance data that has been used to establish the values of the as-found and as-left tolerances;.

iii. representative pressurizer pressure signal conversion and circuit error performance data that has been (or will be) used within the calculation, to demonstrate that the analysis of this data for each P-I15 channel meets the acceptance criteria of 95/95 for the performance of the P-1 5 function (see Regulatory Guide 1.105, "Instrument Setpoints for Safety-Related Systems," Position 1);

iv. how the channel performance data is used to establish the nominal permissive setpoint and its associated as-left and as-found tolerances.

Response

The methodology used to determine instrument uncertainties for the P-I15 setpoint conforms to the methodology previously docketed for the power uprate in Seabrook LAR 04-03, "Application for Stretch Power Uprate," (ML040860307). This methodology was accepted by the NRC in Seabrook License Amendment 101 (ML050140453).

The calculation methodology is a square root of the sum of the squares (SRSS) approach, which is an acceptable approach per ISA S67.04.01. The methodology used to determine Allowable Value (AV) is based on channel performance. The AV is satisfied by verification that the channel "AS FOUND" and "AS LEFT" conditions about the nominal trip setpoint are within the rack calibration accuracy. These criteria are controlled by the Technical Specifications (TS) and implemented by plant procedures. In the TS Sections 2.2.1, parts a and b; and 3.3.2, parts a & b, the requirement is to return the instrumentation to the nominal trip setpoint. Because the AV is based on the rack calibration accuracy (RCA), it follows that the TS requirement is to return the channel to within the calibration accuracy. Therefore, the proposed TS satisfy the requirement to return the channel to within the calibration accuracy, which is consistent with the setpoint methodology.

Allowable Value Determination:

AV = NTS + RCA where NTS= the Nominal Trip Setpoint And RCA=Rack Calibration Accuracy Upper Limit: (AV,)

AV,= 1885 + 4.5 AV, = 1889.5 psig 10

Lower Limit: (AV 2)

AV 2 = 1885 - 4.5 AV 2 = 1880.5 psig The analytical limits were determined by analyses performed by Computer Simulation and Analyses, Inc. (CSA Inc.) and Westinghouse. Best estimate analyses performed by CSA Inc.

were used to determine the minimum pressurizer pressure after a plant trip. The analyses performed by Westinghouse are proprietary and were used to confirm that a P-i15 permissive actuation pressure as low as 1800 psig is acceptable and does not impact the safety analysis conclusions as presented in the UFSAR.

Setpoint Calculation:

The design bases for the CLIP setpoint are as follows:

I. Ensure that the CLIP permissive P-i15 does not actuate when there is an inadvertent ECCS signal, i.e., the plant process conditions do not require an ECCS signal.

2. Ensure that the CLIP permissive P- 15 actuates prior to SI actuation on low pressurizer pressure upon loss of mass from the primary system.

3. Ensure that the CLIP permissive P- 15 actuates on decreasing pressurizer pressure at or above the analysis limit used in the safety analyses for events other than loss of mass from the primary system where SI flow is credited.

Based on the above requirements an upper safety analysis limit (USAL) and a lower safety analysis limit (LSAL) for the CLIP setpoint were established.

The CLIP setpoint value of 1885 psig was selected with input from the Operations Department. The basis for this setpoint is that it must fall in between the USAL and the LSAL including allowances for instrument uncertainty. The purpose of the CLIP setpoint calculation was to demonstrate that this setpoint meets its design bases, i.e., it falls in between the USAL and the LSAL including allowances for instrument uncertainty.

Design Basis #1 The USAL is the minimum value of pressurizer pressure on a normal reactor trip as determined in the RCS pressure sensitivity analysis for CLIP performed by CSA Inc. This analysis used the terms "RCS pressure" and "pressurizer pressure" interchangeably. The analysis determined that the minimum value for pressurizer pressurizer using nominal values for plant parameters at 100% power is 1947.7 psia. Sensitivity studies were then performed using normal variations in selected plant parameters. The result was a minimum pressurizer pressure value of 1920.1 psia. A case was also run at 48% power; the conclusion was that the 100% power case is bounding. Therefore, for conservatism, the minimum value of 1920.1 11

psia was used for the USAL.

An inadvertent ECCS signal generates a reactor trip signal. The CLIP setpoint calculation demonstrated that the CLIP setpoint will not be reached when there is an inadvertent ECCS signal and subsequent reactor trip since the minimum pressurizer pressure remains above the CLIP setpoint including instrument uncertainty.

Margin to USAL:

The USAL is 1920.1 psia as determined above.

Converting to psig: 1920.1 psia -14.7 =1905.4 psig.

With a CLIP setpoint of 1885 psig, the available margin to the USAL is determined as follows:

Margin = USAL - instrument uncertainty - setpoint For instrument uncertainty, the equation for channel statistical accuracy (CSA) includes a term for sensor reference accuracy (SRA). For a decreasing setpoint such as CLIP, the atmospheric pressure allowance (APA) term is not included since an increase in containment pressure yields a conservative signal effect. The equation for CSA is then:

CSA = +/- [ (SCA)2 + (SRA)2 + (SD)2 + (STE)2 + (SMTE)2 + (RCA + RD)2 + (RTE)2 ]0.5 Where SCA=-Sensor Calibration Accuracy SRA-Sensor Reference Accuracy SD=Sensor Drift STE=Sensor Temperature Effect SMTE=Sensor Measuring and Test Equipment Accuracy RCA=Rack Calibration Accuracy RD=Rack Drift RTE=-Rack Temperature Effect Substituting:

= +/- [(0.25%)2 + (0.25%)2 + (0.67%)2 + (0.85%)2 +(0.35%)2 + (0.50% + 1.00 % )2 +

(0.5%)2 ]0.5

= 1.98% (In % of Span)

=+/- 17.8 psi (In process units)

Margin Determination Margin = 1905.4 - 17.8 -1885 = 2.6 psi.

12

Therefore, with positive margin, the CLIP setpoint will not be reached when there is an inadvertent ECCS signal.

Design Basis #2:

The instrument uncertainty for design basis #2 was limited to rack errors only since the bistables that provide the SI actuation and CLIP interlock use the same transmitters for their input signals. The process rack does not experience a harsh environment so the rack error is as follows:

Rack error =+ [(RCA+RD) 2 +(RTE) 2 ] 0.5

=+[(0.5+ 1.0)2 +(0.5)2]0.5

= 1.6% or 14.4 psi Since the rack error applies to both the SI actuation channels and the CLIP channels, the total rack error is 2X the rack error calculated above.

Total Rack Error = 2 X +/- 1.6% = +/- 3.2% or 28.8 psi.

Margin Determination Margin = CLIP setpoint - instrument uncertainty - SI actuation setpoint (where the SI actuation setpoint is 1800 psig)

Margin = 1885 psig- 28.8 psi-1800 psig = 56.2 psi.

Therefore, with positive margin, the CLIP interlock will actuate prior to SI for design basis

1. 2.

Design Basis #3:

Westinghouse analyzed the impact of CLIP on non-LOCA events that model SI. The events considered were hot zero power (HZP) steam line break, feed line break, and inadvertent operation of the ECCS during power operation. Additionally, CVCS malfunctions were analyzed considering the CLIP modification. All other non-LOCA events were not impacted.

The HZP steam line break in containment was the only event that required analysis and this event creates a harsh environment for the pressurizer pressure transmitters. The feed line break was analyzed assuming no SI flow, the inadvertent ECCS operation event assumes SI has already actuated, and CVCS malfunctions do not rely on SI flow for mitigation.

In the analysis for the HZP steam line break, Westinghouse assumed a value of 1790 psia (LSAL) for the CLIP setpoint. SI is initiated on low steam line pressure for this event and the 13

CLIP actuation setpoint is reached after an additional period of time depending on break size.

Since different transmitters are utilized for this event (steam line pressure or containment pressure vs. pressurizer pressure), the analysis considered the full channel uncertainty for pressurizer pressure. The instrument uncertainty calculation included a term for temperature/steam/chemical spray allowance (TEA) due to the harsh environment in containment during steam line breaks. For a decreasing setpoint such as CLIP, the APA term was not included since an increase in containment pressure yields a conservative signal effect relative to actuating prior to reaching the LSAL. The STE term was not included since it is encompassed by the TEA term. The CSA equation then became:

CSA = +/- [ (SCA)2 +(SRA) 2 +(SD) 2 + (SMTE)2 + (RCA + RD)2 + (RTE) 2 ]0.5 +/- TEA Substituting:

CSA = +/- [(0.25%)2 +(0.25%)2 +(0.67%)2 + (0.35%)2 +(0.50% + 1.00 % )2 + (0.5%)2 ]0.5 -

8.83%

= 1.79% +/- 8.83%

+ 10.6% (In Percent of Span)

= + 95.4 psi (In Process Units)

Margin Determination:

LSAL (1790 psia) is the applicable value to use when determining the available margin for this case as discussed above.

Converting from psia to psig:

1790 psia -14.7 = 1775.3 psig Margin = 1885 psig- 95.4 psi -1775.3 psig = 14.3 psi.

Therefore, with positive margin, the CLIP interlock will actuate above the analysis limit as required for Design Basis #3.

Conclusion With positive margin for design bases 1, 2 & 3, the CLIP setpoint was determined to be acceptable.

14

Attachment 1 Diagram P-15 Permissive Block

INPUT RELAYS SSPS TRAIN A'LOGIC MASTER RELAYS SLAVE RELAYS PROCESS PROTECTION PZR CABINETS (I--

- ------- - ,-- SI CHANNEL PRESSURE TRANSMITTERS I BISTABLES I IJ I SPFROM I N i-i SI 2/4 LOGIC - ......- 0 -.......- SI-V-138 OPEN I PT-L*----

-- RELAYS "---0A K637A K527A RC-PT-455 I I I I FROM - . P L Of_ P-15 2/4 LOGIC 0

P-15 INPUT .

's, 0 ----- I P-15 RELAYS KC529A

-PT --- ISTABLES I B1- sl I RC-PT-456 PTGO -- of I I O0 -0K53IA sl I I - III of BISTABLES I III PT -------

RC-PT-457 I--,'

I "T3y -I Of 5=

L----------J SEE FIG.3 FOR FURTHER DETAILS 0 SSPS TRAIN 'A' I IV I INPUT MASTER SLAVE

,I I , s-PT..........

l-,, i_-

I -,-',i RELAYS SSPS TRAIN 'B'LOGIC RELAYS RELAYS L--4L_-_ I -

IV 1 & ------ i "BISTABLES RC-PT-458 Pi!5Q1.' - -- OPEN SI-V-13'l I I FROM (I 1--2/ LOGI --- ---

K837B E0 RELAYS _K527B III sl I 0 t P-IS FROM ¢,::::,;.'_

, ,,._ P-IS 2/4 LOGIC ---00 1' EI-1 PR,,NOM INPUT RELAYS I KIII I NOTES:

I. BTI NOT SHOWN.

0 f P-I 2/A LOGIC

- -- I 2. MPCS ALARMSNOT SHOWN

3. STATUS LIGHTS NOT SHOWN O3~T_ 5318 sl IV X COMMONSENSING LINES FOR CHANNELS [If & IV -

of

• • CHANNEL I SHOWN.

CHANNELSI1. 1iT,IV SIMILAR P15_ f

Attachment 2 Cold Leg Injection Permissive P-15 SSPS Train A

P~ 12 INPUT BAY CABINET -- LOGIC BAY "CABINET [ - - RELAY R -- CCABINET -- T-lV3 TO T- ---

- ToIVI8 To---]OUTfPUT T-F F1.31-V138 1- -V 3 FF I I s js o .. I-F J4 F-F-'-04012-oF 3 -3 T0 0 -7 2 33 I _

0035 I~pe F Ik .... .. ..

o o I F FT Cls l F F 1FFI 133 13..

t. 7 R9 3.4 o- - 13F B

F III H,20 F F----------------j . 1F

,Pa 3a.

E11-

....S 7 347 I J ro53 M07-7-744-W 4--s 1 03 033 .

1 A~

002 Ij0 A 3- - .7-334 F F I7 347405D-A 3-0--334 I F FIF FFa I F "3 p -A, NOTE TO NL 07303 350 ~O3a.

276 Z07 ICL EGIJCINPR ISV TACHRYr SSPS Trami A ZAC35Y NUCLEAR7000731E31G..I3C.' TbG - - j-, ' 9" 073170 NONEIOII