SBK-L-13211, Response to Request for Additional Information Regarding License Amendment Request 12-04, Cold Leg Injection Permissive

Response to Request for Additional Information Regarding License Amendment Request 12-04, Cold Leg Injection Permissive

ML13333A166
Person / Time
Site:	Seabrook
Issue date:	11/22/2013
From:	Walsh K NextEra Energy Seabrook
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
SBK-L-13211
Download: ML13333A166 (29)

Text

NEXTerao ENERGY G November 22, 2013 10 CFR 50.90 SBK-L-13211 Docket No. 50-443 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001 Seabrook Station Response to Request for Additional Information Regarding License Amendment Request 12-04, Cold Leg Injection Permissive

References:

1. NextEra Energy Seabrook, LLC letter SBK-L- 12179, "License Amendment Request 12-04, License Amendment Request Regarding Cold Leg Injection Permissive,"

March 13, 2013.

2. NRC letter "Seabrook Station, Unit No. I - Request for Additional Information for License Amendment Request 12-04, Application Regarding Cold Leg Injection Permissive (TAC No. MF1 158)," September 6, 2013.

In Reference 1, NextEra Energy Seabrook, LLC (NextEra) submitted a request for an amendment to the Technical Specifications (TS) for Seabrook Station. The proposed amendment modifies the circuitry that initiates high-head safety injection by adding a new permissive, cold leg injection permissive (P-I5). This permissive prevents opening of the high-head safety injection valves until reactor coolant system pressure decreases to the P- 15 setpoint.

In Reference 2, the NRC staff requested additional information to complete its review of the license amendment request. The Enclosure to this letter contains NextEra's response to the request for additional information. This response does not alter the conclusion in Reference I that the change does not present a significant hazards consideration.

Should you have any questions regarding this letter, please contact Mr. Michael Ossing, Licensing Manager, at (603) 773-7512.

NextEra Energy Seabrook, LLC PO Box 300, Seabrook, NH 03874

United States Nuclear Regulatory Commission SBK-L-13211 / Page 2 I declare under penalty of perjury that the foregoing is true and correct.

Executed on / 42 ,2013.

Sincerely, Kevin T. Walsh Site Vice President NextEra Energy Seabrook, LLC Enclosure cc: NRC Region I Administrator NRC Project Manager, Project Directorate 1-2 NRC Senior Resident Inspector Director Homeland Security and Emergency Management New Hampshire Department of Safety Division of Homeland Security and Emergency Management Bureau of Emergency Management 33 Hazen Drive Concord, NH 03305 John Giarrusso, Jr., Nuclear Preparedness Manager The Commonwealth of Massachusetts Emergency Management Agency 400 Worcester Road Framingham, MA 01702-5399

Enclosure Response to Request for Additional Information Regarding License Amendment Request 12-04, Cold Leg Injection Permissive

Enclosure Response to Request for Additional Information Regarding License Amendment Request 12-04, Cold Leg Injection Permissive Basis for the Request #1 In its application the licensee stated, for the steam line breaks inside containment, that although an increase in SI delay is considered non-conservative, a sensitivity calculation was specifically performed to evaluate the impact of SI and the results show that mass and energy releases are not impacted by the increased delay time for SI.

Request for Additional Information #1 Describe the sensitivity cases referenced in the application and explain why they were chosen.

In addition, explain how the mass and energy releases are not impacted by the increased delay time for SI as referenced in the application.

NextEra Enermy Response A calculation note was created to address the impact of the P15, cold leg injection permissive (CLIP), on a steamline break (SLB). Because the CLIP has the potential to delay the initiation of emergency core cooling system (ECCS) safety injection, a safety analysis was performed to quantify the change in the mass and energy releases if no safety injection flow is assumed for the duration of the accident transient. It should be noted that the full spectrum of SLB cases analyzed for Seabrook conservatively assumes minimum safety injection consistent with the loss of one train of the ECCS.

The sensitivity case evaluated was a SLB double-ended rupture inside containment initiated from full power, assuming a containment safeguards failure. No credit was taken for the safety injection flow and the associated boron addition to the reactor coolant system (RCS).

Because safety injection flow increases as the RCS pressure decreases, a full power double-ended rupture case was selected because it provides a large RCS pressure decrease due to the cooldown created by the SLB. Therefore, the full power double-ended rupture would provide the greatest change in mass and energy releases when safety injection is not credited.

The documented results show that not taking credit for safety injection flow has an insignificant impact on the associated mass and energy releases. Figure 1 and Figure 2 provide plots of the integrated mass and energy of the sensitivity case not crediting safety injection flow versus crediting safety injection flow. The sensitivity case shows a difference of no more than 0.01% in the integrated mass and energy releases at the end of the transient.

This is due to minimum safety injection flow (one train of the ECCS). By the end of the blowdown, the ECCS has injected minimal amounts of boron into the core. Figure 3 provides a plot of the core boron concentration of the sensitivity case not crediting safety injection flow versus crediting safety injection flow. Combined with the conservative assumption of minimum boron worth, there is an insignificant amount of negative reactivity injected into the core to affect the SLB mass and energy releases. The positive reactivity from the safety 1

injection cold water outweighs the negative reactivity from the assumed minimum boron concentration (and the input boron worth) in the safety injection water. Therefore, the return to power is slightly higher when the cold water (safety injection) is injected as depicted in Figure 4.

2

Seabrook: Steamline Break Inside Containment 100% Power DER, No Single Failure With Safety Injection (AOR)

. .No Safety Injection

--E 200O0D i

150000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I . . . . . . .

0 1100000 0 0O I~ ....

U I 0 50 100 150 200 250 Time (s)

Figure 1: Integrated Break Mass Released Seabrook: Steamline Break Inside Containment 100% Power DER, No Single Failure With Safety Injection (AOR)

--- No Safety Injection

-o a)

(j, 0

a) a)

0' 0)

C Lj~J

-v a) 0 0'

0)

.4-C 0 50 100 150 200 250 Time (s)

Figure 2: Integrated Break Energy Released 3

Seabrook: Steamline Break Inside Containment 100% Power DER, No Single Failure With Safety Injection (AOR)

No Safety Injection C3 a,

0 6 0 0)

. . . . .. . . .. a . . . .a 0.

a a a 9.I l I . .. . l i l

-D 0 50 100 150 200 250 Time (s)

Figure 3: Core Boron Concentration Seabrook: Steamline Break Inside Containment 100% Power DER, No Single Failure With Safety Injection (AOR)

- No Safety Injection 4.

I 038 0.6 0.4-0.2-U 0 5O 100 150 200 250 Time (s)

Figure 4: Fraction of Power 4

Basis for the Request #2 In its application, the licensee stated that the hot zero-power steam line break event remains bounding for operation at the current uprate conditions and that the P-i15 modification does not impact the limiting case for hot zero-power steam line break results because the cold leg injection valves will be fully open before the as-modeled high-head SI flow starts.

Seabrook's updated final safety analysis report (UFSAR), Chapter 15, Section 15.1.5 analyzes the limiting steam line break which is a double-ended rupture of the main steam line at the steam generator nozzle at zero power with offsite power available. In the analysis, it states that after generation of the SI signal the appropriate valves begin to operate and the high head SI pump starts. In 27 seconds, the valves are assumed to be in their final position and the pump is assumed to be at full speed. In addition, the results state that SI will initiate by the low steam line pressure signal. The P-15 modification causes a delay in SI flow, if safety injection initiates on any SI signal other than the low pressurizer pressure signal. Since during the hot zero-power steam line break event, SI is initiated by the low steam line pressure signal there will be an additional delay induced by the P-i 5 modification.

Request for Additional Information #2 Provide a description of the re-analysis of limiting hot zero-power steam line break event; include a timeline for this event that shows the SI flow is delivered by the current analysis of record, 27.55 seconds and shows that it remains bounding for operation at the current uprate conditions, as stated in the application.

NextEra Energy Response To demonstrate that the P-15 cold leg injection permissive (CLIP) logic does not invalidate the current hot zero power steamline break (HZP SLB) analysis of record, the limiting case was modified to delay initiation of Safety Injection (SI) flow until both of the following conditions are met:

• SI system actuation signal is generated due to low steam pressure setpoint plus 27 seconds (delay for safety pumps to start; SI actuation not impacted by the CLIP)

-Pressurizer pressure reaches safety analysis limit P-i15 (CLIP) setpoint (1815 psia) plus 12 seconds (delay for cold leg injection valve to open; New condition)

Table 1 provides an expanded sequence of events up until the time that SI flow is credited.

As indicated in Table 1, the timing of SI flow is determined by the time of the SI signal (0.5 seconds) and its 27 second delay. The added P-15 requirement does not impact the timing of SI injection for this case because the cold leg injection valves are fully opened before the SI flow is credited.

5

Table 1: HZP Steam System piping failure (with offsite power available)

Event Time (seconds) Notes Steam line ruptures 0.0 No change Low steam pressure SI setpoint reached 0.5 No change, results in SI flow available at 27.5 seconds P-15 setpoint reached (in conjunction with 15.2 CLIP setpoint, initiates cold S signal) leg injection valves opening sequence. Valves are fully open at 27.2 seconds.

Cold leg injection valves open. 27.2 P-15 setpoint + delay

(- 15.2 seconds + 12.0 seconds)

SI pumps energized and running at full 27.5 Low steam pressure SI speed (= 0.5 seconds + 27.0 seconds) actuation setpoint + delay SI flow begins 27.55 SI credited by analysis. No change Note: Since timing of SI is not impacted, remaining event times are not impacted.

Since the CLIP modifies the logic for SI injection, multiple additional sensitivities were completed to demonstrate the transient response to smaller break sizes with the revised P-15 logic. Key results are shown in Table 2 and Figures 5 - 8. From this data, the following observations are noted:

• Per Table 2 and Figures 5 - 6, the core return-to-power peaks slightly later in the transient but with a lower peak value as the break size decreases.

• Per Figure 7 (pressurizer pressure), RCS pressure drops more quickly as break size increases.

" Per Figure 8, the core reactivity stabilizes (-zero reactivity) within 300 seconds of the start of the event for all cases.

Based on these results, it is judged that the current limiting HZP SLB analysis (modeling the largest break size) remains bounding of smaller break sizes. Accordingly, the current licensing basis results remain valid for HZP SLB after CLIP implementation.

6

Table 2: HZP-SLB Break Size Sensitivity Results Case Break Area Peak Nuclear Power Peak Core Heat Flux Description (ft2 ) (FON) ) (FON) ()

Base Case (2) 1.388 ft2 0.154 0.154 Sensitivity 1 1.0 ft2 0.134 0.134 Sensitivity 2 0.8 ft2 0.121 0.122 Sensitivity 3 0.6 ft2 0.104 0.104 Sensitivity 4 0.5 ft2 0.095 0.095 Sensitivity 5 0.3 ft2 0.075 0.075 Sensitivity 6 0.1 ft2 0.045 0.047 FON = Fraction of Nominal (2)

Current licensing basis reported in Seabrook UFSAR.

7

Bose 388 sq f Sen s 1.0 sq f Sen s 2 0 8 sq f Sen s 3 0 6 sq f Sen s 4 0 5 sq f Sen s 5 0 3 sq f Sen s 6 0 1 sq f r

0.16-CD 0.14 0.12 0.1E+00 -. - - . .. . . ..-. . . . . . .

0 O08E-01 0.6E-01 . . . . . .............

CD 0.4E-01 .v

.. . . . . . . . . . . . I . ...

0.2E-01 0 I I I 1 I 0 200 400 600 800 1000 1200 time (seconds)

Figure 5: Nuclear Power (FON) Comparison Ba s (1 388 sq ft Sen 1 0 sq ft Sen 2 0 8 sq ft Sen 3 0 6 sq ft Sen 4 0 5 sq ft Sen 5 0 3 sq ft Sen 6 0 1 sq ft 0.16-CD 0.14-0.12-(- 0.1 E+00-0.8E 0.6E-01 .-........... ~ ...-. ,2....

0.4E-01 (D M.E-_01-U I I II 0 200 400 600 800 1000 1200 time (seconds)

Figure 6: Core Heat Flux (FON) Comparison 8

Base 1. 388 sq f Sen s 1.0 sq f Sen s 2 0 8 sq f Sen s 3 0 6 sq f Sen s 4 0 5 sq f Sen s 5 0 3 sq f Sen s 6 0 1 sq f 2500 C3 F 2000 co1500 CL r0 1000 n

500' 1 200 600 800 1000 1200 0 400 time (seconds)

Figure 7: Pressurizer Pressure Comparison Bose (1 388 s q ft Sen s 1 0 S q ft Sen s 2 0 8 q ft Sen s 3 0 6 q ft Sen s 4 0 5 S q ft Sen s 5 0 3 q ft S q Sen s 6 0 1 ft 1*

0.5 0- :_ý. . . . . . . .. .. .. .. .

-0.5-

-1 U.

C) -1.5 (D

0*r -2.5- . . . . . . . . . . . . . . . . . . . .. .. . .. . .

I I I

-_j Z I I 2 I I 0 50 100 150 200 250 300 time (seconds)

Figure 8: Core Reactivity Comparison 9

Basis for the Request #3 In its application, the licensee stated that prior to P-i15 implementation, the Chemical and Volume Control System (CVCS) malfunction event was bounded by the inadvertent Emergency Core Cooling System (ECCS) actuation at power and was not analyzed. With the addition of P-15, the inadvertent ECCS actuation at power is no longer the limiting mass addition event. As part of the P-15 modification effort, the CVCS malfunction described in Section 15.5.2 of the UFSAR has been analyzed with P-15 and the same methodology used for the inadvertent ECCS actuation analysis.

Request for Additional Information #3 Provide the newly performed analysis that NextEra plans to incorporate into the Section 15.5.2 of the UFSAR.

NextEra Energy Response Below is the intended UFSAR change for Section 15.5.2, Chemical and Volume Control System Malfunction that Increases Reactor Coolant System Inventory.

10

SEABROOK ACCIDENT ANALYSES Revision I I STATION STATION' Scin1.

Increase In Reactor Coolant In~entory Section 15.5 UFSAR Page 5 Not in current scope 15.5.1.3 Radiolouical Consequences No radioactivity relcases are anticipated as a direct result of this malfunction. Consequently. no radiological consequences are predicted.

15.5.1.4 Conclusions Results of the analysis of tie inadvertent ECCS initiation at power event demonstrate that there is no hazard to the integrity of the RCS. The approach to terminating this event is consistent I with Option II of Westinghouse NSAL 93-013. 1 RCP seal injection flow For this event, the DNBR is never less than the initial value. Thus. there will be no cladding damage and no release of tission products to the RI'S.

Operator action terminating i:je'iio .;s i;i.e!5, sufficient to preclude a pressurizer water-solid condition and prevent actuation of the pressurizer PORVs and safety valves. By demonstrating that sufficient time is available for the appropriate operator actions to preclude a pressurizer water-solid condition, the pressurizer valve integrity can be maintained for the inadvertent ECCS initiation at power event. No credit for operation of the pressurizer PORVs is assumed. Therefore, the ability to isolate the RCS and maintain the integrity of the RCS pressure boundary confinis that this event does not lead to a more serious plant condition, hence demonstrating acceptability of the Condition II acceptance criteria.

15.5.2 Chemnical and Volume Control System Malfunction that Increases Reactor Coolant Inventory Transients due to CVCS malfunctions that increase thie reactor coolant inventory can be divided into three categories:

Category I CVCS malfunctions that result in the injection of water with a boron concentration greater than the RCS boron concentration.

Category 2 CVCS malfunctions that result in the injection of water with a boron concentration less than the RCS boron concentration.

Category 3 CVCS malfunctions that result in the injection of water with a boron concentration equal to the RCS boron concentration.

There are two possible criteria for evaluating these transients: core integrity and overfilling of the pressurizer. Transients of thie type listed in Category I are bounded by cL 'c.;;i Transients of the type listed in Category 2 are bounded by the CVCS malfunci on that results in a decrease in boron concentration in the reactor coolant" presented in Subsectioj1 15.4.6.

I I transients of the type iisted in Category .31 11

SEABROOK ACCIDENT ANALYSES Revision I I STAT ION Increase In Reactor Coolant Inventory Scin1.

Section 15.5 UFSA R Page 6 CVCS malfunctions of die type described under Category 3 will not result in any significant nuclear power or RCS temperature transient: this type of transient may result in filling the pressurizer. An analysis of the CVCS malfunction that results in injection of water with a boron concentration equal to the RCS boron concentration are presented in this section.

CVCS Malfunctions that Result in the Iniection of Water with a Boron Concentration Equal to the RCS Boron Concentration

a. Identification of Causes and Accident Descrintion The most limiting case would result if charging was in automatic control and the pressurizer level channel being used for charging control failed in a low direction.

This would cause maxinmm charging flow to be delivered to the RCS and letdown flow would be isolated. The worst single failure for this event would be another pressurizer level channel failing in an as is condition or a low condition.

This will defeat the reactor trip on 2 out of 3 high pressurizer level channels. To prevent filling the pressurizer, the operator must be relied upon to terminate charging,* .... .. .. 6-1 --*fie Cr e ,t.... .. ... :....:., ... .,

me eR II P H:  : t ( ;~ ; . ~ z: z r'" ....

..... " " t nsert 5 I

b. Analysis of Eflfects and Consequences The CVCS malfunction is analyzed by employing the detailed digital computer program RETRANt1 ). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief' and safety valves, pressurizer spray, steam generator, steam generator safety valves, and the ECCS. The program computes pertinent plant variables, including temperatures. pressures, and power level.

The assumptions incorporated in the analyses were as follows:

I. Initial Operating Conditions Pressurizer pressure is assumed to be at its minimum value. Pressurizer water level is assumed to be at the high end of the range of the values consistent with its programmed level. The initial reactor power and RCS temperature are at their fill power values with uncertainties.

The impact of the full power RCS T.,,vg window was considered. The upper end of the T,.g window was determined to be more limiting. The higher corresponding pressurizer level turned out to be more limiting than tile benefit gained by tile lower initial mass.

12

Insert 5 The analysis assumes an initial operator action to isolate charging flow injection at 10 minutes. After this point, the injected flow is based on a conservative estimate of the RCP seal injection flow. The analysis continues until the pressurizer fills. The charging flow is assumed to have the same boron concentration as the RCS.

The operator response to a CVCS malfunction is initiated upon the assumed failure of two pressurizer level channels. The operators demonstrate that charging flow can be isolated within the 10 minute operator action time assumed in the analysis. Once charging flow is isolated by closing a motor operated valve in the charging line, operators continue to control mass addition to the reactor coolant system and, if necessary, stop the operating charging pump or isolate seal injection flow to preclude opening the pressurizer power operated relief valves or the pressurizer safety valves.

13

SEABROOK ACCIDENT ANALYSES Revision I I STATION Scin1.

Increase In Reactor Coolant Inventory Section 15.5 UFSAR Page 7 The impact of the feedwater temperature window was also analyzed and the upper end of the feedwater tenperature window was determined to be slightly morc limiting.

2. Reactivity Coefficients Maximum reactivity feedback case The most negative moderator temperature coefficient and a most negative Doppler coefficient.

3. Reactor Control Both manual and autonmatic control have been analyzed.

4. Charging System Maximum charging systeln flow based on RCS back pressure from one centrifugal pump is delivered to the RCS. (

5. Reactor Trips The transient is initiated by the pressurizer level channel which is used for control purpose failing low. As a worst single Ifailure, another pressurizer level channel fails low, defeating the two out of three high pressurizer level trip. No reactor trips are used.

c. Results Figure 15.5-2 shows the transient response due to the charging system malfunction. In all the cases analyzed, core power and RCS average temperature remain relatively unchanged. < Insert 6 The calculated sequence of events is shown in Table 15.5-2.

d. Conclusions The sequence of events presented in Table 15.5-2 shows that the operator has sufficient time to take corrective action.

After an assumed operator action at 10 minutes, the modeled injection flow is reduced to the maximum flow that could be injected via the RCP seals assuming one pump operating with the normal charging path blocked.

14

Insert 6 Following the initial operator action to the CVCS malfunction event at 10 minutes, the pressurizer will reach a water-solid condition at approximately 18 minutes if operator action is not taken to stop the seal injection flow to the RCS. After pressurizer fill, pressurizer sprays maintain pressurizer pressure below the PORV and PSV opening pressure for at least 45 minutes.

Operators demonstrate that the required actions of stopping charging flow and stopping seal injection flow can be completed within the times used in the analysis, with margin.

Table 15.5-2 Time Sequence Of Events Accident Event Time CVCS Malfunction Tivo pressulizer level channels fail low; 0.0 uia\i1.inW chargiing is hcpun; lclduwii is isoluted-low pressurizer level alarmI ih,ta6e proceduVreJ #.eS~o~reS.

Ifigh pressurizer level alarm 69-1.1 Li'- 94 .1 <--VI r:

~~a1t-SP~c -- - '- r-if

• Operators demonstrate that the required actions can be completed within the times used in the analysis, with margin.

15

1 .2 E a-0 W 0.6-0.4-0.2-U II I I I I I I I I I I I I I I I I I I I I 2 I I I I 0 500 1000 1500 2000 2500 3000 Time (seconds) 588

~586-E

'*584-

~582-a)

(n ror%

I I I I I I I I I I I I I I I I I I I I I I I I Jou 0 500 1000 1500 2000 2500 3000 Time (seconds)

SEABROOK STATION Nuclear Power and Vcsscl Avcragc Temperaturc Transients UPDATED FINAL SAFETY for a CVCS Mlalfunction ANALYSIS REPORT I Figure 15.5-2 Sh. I of 2 16

C')

GU)

Q')

0 500 1000 1500 2000 2500 3000 Time (seconds)

C')

(n 0u n.

SEABROOK STATION Prcssurizer Pressure and Pressurizcr Watcr Vohlme Transients UPDATED FINAL SAFETY for a CVCS Malfunction ANALYSIS REPORT I Figu re 15.5-2 Sh. 2 o1 2 17

Basis for the Request #4 The CVCS malfunction event time sequence of events in Table 3 states that the high pressurizer level alarm occurs at 483.1 seconds, that the operator is credited with isolating the normal charging flow path at 600 seconds, and that time to fill the pressurizer if RCP seal injection is not terminated is 1082.1 seconds.

Request for Additional Information #4 The sequence of events presented in Table 3 of the application, allows 1.9 minutes (116.9 seconds) for the operator to respond to the pressurizer high-level alarm reactor trip and isolate the normal charging flow path. This is followed by another 8 minutes (482.1 seconds) for the operator to then isolate RCP seal injection flow and terminate the event.

Considering the above sequence of events explain: (1) how long will it take to fill the pressurizer and open the safety valve without operator action, (2) are there other indications and alarms in the control room that will alert the operator to this postulated event, (3) what actions are the operators expected to take to isolate charging flow and isolate RCP seal injection flow, and how long does it take to complete these actions, (4) what actions are required for a reactor trip and how long does it take to complete these actions, (5) is this event going to be incorporated into training and if so, what type of training and at what frequency, and (6) was this postulated event ran in the simulator with an operating crew as part of this analysis, if so how long did it take the operating crew to terminate the event, if not explain why it was not ran in the simulator as part of this analysis.

NextEra Energy Response The limiting CVCS malfunction involves a malfunction of the controlling pressurizer level channel controlling the CVCS charging make up flow to the reactor coolant system and a second malfunction of the associated backup pressurizer level control channel. This event maximizes the charging pump flow rate to the reactor coolant system and results in the isolation of reactor coolant letdown to the chemical and volume control system. The operator receives multiple alarms for the CVCS malfunction event including low pressurizer level, pressurizer program level deviation-low and high charging flow and enters the appropriate abnormal operating procedure. Operator actions include checking the pressurizer level channels, re-aligning the pressurizer level controlling channel, checking if letdown was isolated and if necessary, re-establishing normal letdown. If these actions do not resolve the CVCS malfunction, the operator is directed to isolate the normal charging flow path by closing one of two motor operated valves in the charging line. If pressurizer level continues to increase, the operators are directed to stop all charging pumps or in the unlikely event that a charging pump does not stop, to close the seal water injection motor operated valves.

The operator action to isolate the charging line by closing one of two motor operated valves corresponds to the analysis assumption of isolating charging flow in 600 seconds (10 minutes) and stopping the charging pump or completing seal injection isolation corresponds to the additional 482 seconds (8 minutes) to stop all mass addition. Operator action response times were determined using methods established in station administrative procedures. The simulator scenarios are identified, the procedure language is validated and then the average operator action response times are determined in a simulator environment for a minimum of 18

three crews in order to provide reasonable assurance that the task can be completed in the required time. Average task completion times within 80% of the required time or analysis limit is an acceptable performance. The average operator action response times for the CVCS malfunction event determined using the above described method is less than 6 minutes to isolate the charging line and an additional 2. 2 minutes to stop all mass addition by stopping a charging pump or closing the seal injection motor operated valves.

The multiple indications of the initial event, use of the validated abnormal operating procedure and operator training ensure that the CVCS malfunction event is terminated well before the pressurizer is filled with water and the possibility of opening the pressurizer power operated relief valves or the pressurizer safety valves. The conservative analysis and the operator action times demonstrate that sufficient time is available to the operator to terminate the event within the analysis assumptions and results.

(1) How long will it take to fill the pressurizer and open the safety valve without operator action?

NextEra Enermy Response As part of the cold leg injection permissive analysis for the CVCS malfunction event, several sensitivity runs were performed to determine the operator action response times required to support the analysis results. The longest time period analyzed with no operator action was 15 minutes for the cases that result in the minimum time to pressurizer fill (i.e. model assumptions used for limiting safety analysis). The results from this time period are summarized below in the following table along with the CLIP base safety analysis case which models the first operator action at 10 minutes. These cases credit pressurizer sprays to maximize CVCS mass addition by minimizing RCS pressure. However, these assumptions also delay the time to PSV or PORV water relief after the pressurizer becomes water-solid.

Sequence of Events: CVCS malfunction for limiting pressurizer fill time cases Event CLIP Design Response Maximum Analyzed Time (seconds) Operator Response Time (seconds)

Modeled time of operator 600.0 900.0 action to isolate charging flow Maximum charging begins 0.05 0.05 Pressurizer level reaches 483.1 483.1 92% span Pressurizer fills (water-solid 1082.1 733.1 1800 ft3)

Pressurizer pressure reaches 2551.6 the nominal PORV setpoint of 2400 psia First Occurrence of PSV 2615.7 opening End of run 2900.0 2900.0 19

From the above results of the limiting pressurizer fill cases for the maximum analyzed operator action response time, the minimum time to fill the pressurizer is 733.1 seconds or 12.2 minutes. For this case, the first operator action to isolate charging flow occurs at 900.0 seconds or 15 minutes and the PSV set pressure is reached in 2615.7 seconds or 43.5 minutes following the initiation of the event.

In addition, sensitivities were completed to determine the minimum time to PORV water relief as noted in the table below. For these cases, pressurizer PORVs are enabled and sprays are not credited. These modeling changes delay the time to pressurizer fill but produce the minimum time to PORV water relief. For this scenario with the maximum analyzed initial operator response time (15 minutes), the minimum time to fill the pressurizer is 989.6 seconds or 16.5 minutes; however, PORV water relief occurs immediately following pressurizer fill.

Sequence of Events: CVCS malfunction for minimum time to PORV water relief cases Event CLIP Design Response Maximum Analyzed Time (seconds) Operator Response Time (seconds)

Modeled time of operator 600.0 900.0 action to isolate charging flow Maximum charging begins 0.05 0.05 First Occurrence of PORV 80.3 80.3 steam relief Pressurizer fills (water- 1644.1 989.6 3

solid) 1800 ft First Occurrence of PORV 1644.1 989.6 water relief End of run 2900.0 2900.0 The operator action response times selected for the CLIP design response times (first operator action at 10 minutes, final operator action at 18 minutes) have been verified in the simulator and preclude pressurizer PORV and PSV water relief.

(2) Are there other indications and alarms in the control room that will alert the operator to this postulated event?

NextEra Enermy Response The CVCS malfunction event results in multiple alarms in the control room based on the low pressurizer level signals resulting from the postulated two level transmitters failing low.

Several of the alarms are given below

• Pressurizer programed level deviation alarm - low

• Pressurizer low level alarm

° High charging flow alarm 20

Other indications of the CVCS malfunction event include letdown line isolation valve indicating lights changing state, no indicated letdown flow, high indicated charging flow, and low indicated pressurizer level on one channel and various computer point alarms.

(3) What actions are the operators expected to take to isolate charging flow and isolate RCP seal injection flow, and how long does it take to complete these actions?

NextEra Enermy Response The limiting CVCS malfunction involves a malfunction of the controlling pressurizer level channel controlling the CVCS charging make up flow to the reactor coolant system and a second malfunction of the associated backup pressurizer level control channel. This event maximizes the charging pump flow rate to the reactor coolant system and results in the isolation of reactor coolant letdown to the chemical and volume control system. The operator receives multiple alarms for the CVCS malfunction event including low pressurizer level, pressurizer program level deviation-low and high charging flow and enters the appropriate abnormal operating procedure. Operator actions include checking the pressurizer level channels, re-aligning the pressurizer level instruments, checking if letdown was isolated and if necessary, re-establishing normal letdown. If these actions do not resolve the CVCS malfunction, the operator is directed to isolate the normal charging flow path by closing one of two motor operated valves in the charging line. If pressurizer level continues to increase, the operators are directed to stop all charging pumps or in the unlikely event that a charging pump does not stop, to close the seal water injection motor operated valves.

The operator action to isolate the charging line by closing one of two motor operated valves corresponds to the analysis assumption of isolating charging flow in 600 seconds (10 minutes) and stopping the charging pump or completing seal injection isolation corresponds to the additional 482 seconds (8 minutes) to stop all mass addition. Operator action response times were determined using methods established in station administrative procedures. The simulator scenarios are identified, the procedure language is validated and then the average operator action response times are determined in a simulator environment for a minimum of three crews in order to provide reasonable assurance that the task can be completed in the required time. Task completion within 80% of the required time or analysis limit is an acceptable performance. The operator action response times for the CVCS malfunction event determined using the above described method is less than 6 minutes to isolate the charging line and an additional 2.2 minutes to stop all mass addition by stopping a charging pump or closing the seal injection motor operated valves.

21

(4) What actions are required for a reactor trip and how long does it take to complete these actions?

NextEra Energy Response The event response does not specifically require a reactor trip. An automatic reactor trip may occur on high pressurizer pressure if during the course of the transient the reactor trip setpoint was reached. The analysis does not credit a high pressurizer level or a high pressurizer pressure reactor trip. Should the reactor trip, Operations enters the reactor trip procedure and completes the immediate actions in approximately two minutes.

(5) Is this event going to be incorporated into training and if so, what type of training and at what frequency?

NextEra Energy Response Prior to implementing the CLIP design change, operator training will be conducted on the affected EOP and abnormal operating procedure changes. Training will also be conducted for the new indications on both the main control board and the main plant computer system video alarm system alarm response screens. Following initial operator training on the procedure changes for the CLIP design, the training frequency will be determined by the operations training program documents and established station procedures for managing time critical operator actions and operator action response times.

(6) Was this postulated event ran in the simulator with an operating crew as part of this analysis, if so how long did it take the operating crew to terminate the event, if not explain why it was not ran in the simulator as part of this analysis?

NextEra Energy Response Operator action response times were determined using methods established in station administrative procedures. The simulator scenarios are identified, the procedure language is validated and then the average operator action response times are determined in a simulator environment for a minimum of three crews in order to provide reasonable assurance that the task can be completed in the required time. Average task completion times within 80% of the required time or analysis limit is an acceptable performance. The average operator action response times for the CVCS malfunction event determined using the above described method is less than 6 minutes to isolate the charging line and an additional 2.2 minutes to stop all mass addition by stopping a charging pump or closing the seal injection motor operated valves.

22

During a call with the NRC to review the above RAI's, the NRC requested clarification on several items in NextEra Energy Seabrook's LAR 12-04 as given below.

(1) Correct Table 3 in the LAR: "Pressurizer Pressure" should be "Pressurizer Level".

(2) Describe how the CVCS malfunction event that was analyzed bounds an operator error that could increase pressurizer level or charging flow.

(3) On Page 3 and 21 of the LAR submittal describe the time to pressurizer safety valves lifting. The NRC noted that the pressurizer PORVs could also open. Provide an explanation of any significance to describing the PSV vs.the PORV.

(4) Revise the discussion concerning the functional limitations of the CLIP design.

(5) Clarify the effect of the failed common sensing line as it relates to the pressurizer pressure control function.

(1) Correct Table 3 in the LAR NextEra Energy Response Table 3 Time Sequence of Events CVCS Malfunction Event EVENT TIME (Sec)

Two pressurizer level channels fail low; maximum charging is 0.0 begun; letdown is isolated; low pressurizer level alarm High pressurizer level alarm 483.1 Operator action to isolate normal charging flow path (after 600.0 this action, charging flow is limited to RCP seal injection path)

Time to pressurizer fill if RCP seal injection flow is not 1082.1 terminated (2) Describe how the CVCS malfunction event that was analyzed bounds an operator error that could increase pressurizer level or charging flow.

NextEra Energy Response The table below compares the analyzed CVCS malfunction event with an operator error that could increase pressurizer level or charging flow.

23

q Analyzed CVCS Malfunction Event Compared To An Operator Error That Increases Pressurizer Level Or Charging Flow Single Operator Error Effect Comparison to CVCS Malfunction Event Isolates letdown by closing a Pressurizer level control For the CVCS malfunction single valve controls charging flow to event, letdown flow is minimum to maintain isolated and charging flow is pressurizer level, maximized by allowing the charging flow control valve to go to the full open position. Seal injection flow to the RCS is maximized.

The CVCS malfunction event is bounding.

Starts a second centrifugal Pressurizer level control For the CVCS malfunction charging pump controls charging flow to event, letdown flow is maintain pressurizer level, isolated and charging flow is Letdown flow continues, maximized by allowing the charging flow control valve to go to the full open position. Seal injection flow to the RCS is maximized.

The CVCS malfunction event is bounding.

Manually opens the charging This is a two-step process to A single operator error does flow control valve, CS-FCV- first take the controller out of not result in an increase in 121 automatic and then to charging flow. The CVCS manually adjust the controller malfunction event is output to open the charging bounding.

flow control valve. This is not a single operator error.

Manually throttles open the Flow to the RCP seals is For the CVCS malfunction seal injection control valve decreased, pressurizer level event, letdown flow is CS-HCV-182 control controls charging isolated and charging flow is flow to maintain pressurizer maximized by allowing the level. Letdown flow charging flow control valve continues, to go to the full open position. Seal injection flow to the RCS is maximized.

The CVCS malfunction event is bounding.

24

4 Single Operator Error Effect Comparison to CVCS Malfunction Event Locally throttles open a seal Pressurizer level control For the CVCS malfunction injection throttle valve, controls charging flow to event, letdown flow is maintain pressurizer level, isolated and charging flow is Letdown flow continues, maximized by allowing the charging flow control valve to go to the full open position. Seal injection flow to the RCS is maximized.

The CVCS malfunction event is bounding.

Starts a positive displacement Procedures require the A single operator error does charging pump positive displacement pump not result in an increase in to be initially started on charging flow. The CVCS recirculation flow requiring malfunction event is several operator actions. bounding.

Pressurizer level control controls charging flow to maintain pressurizer level.

(3) On Page 3 and 21 of the LAR submittal describe the time to pressurizer safety valves lifting. The NRC noted that the pressurizer PORVs could also open.

Provide an explanation of any significance to describing the PSV vs. the PORV.

NextEra Energiv Response The analysis of the inadvertent ECCS operation at power event and the CVCS malfunction event and the available operator response times to perform the required manual actions preclude opening the power operated relief valves and the pressurizer safety valves after pressurizer filling (i.e. water relief). Consistent with standard Westinghouse analysis methodology for the Inadvertent ECCS and CVCS malfunction events, pressurizer PORVs are not credited for the limiting cases which minimize time to pressurizer fill. However, as noted in response to NRC RAI 4, question (1), sensitivities were completed for the CVCS malfunction event to document the minimum time to pressurizer PORV water relief. These cases further validate the standard modeling assumption (with PORV not credited).

(4) Revise the discussion concerning the functional limitations of the CLIP design.

NextEra Energy Response Functional Limitations of the CLIP Design The pressurizer pressure instrumentation has four independent sensors; however, two of those sensors share a common sensing line. It can be postulated that a failure of the common 25

4 sensing line could cause the output of these two pressurizer pressure channels to go low enough to satisfy the CLIP setpoint and to generate a low-low pressurizer pressure S-signal to open the cold leg injection valves without a significant loss of coolant that would require high head SI flow. Thus, the failure of the common sensing line could initiate an inadvertent ECCS actuation event for which CLIP would not provide margin for operator action to mitigate the event. The common sensing line piping and tubing are ASME III Class 1 or Class 2. The common pressurizer instrument tap is the standard Westinghouse design, and is listed in UFSAR subsection 7.1.2.12 (5) as an exception to the guidance of Regulatory Guide 1.151, "Instrument Sensing Lines," July 1983, for the independence of sensing lines.

Millstone Unit 3, which has already received NRC approval of the CLIP modification, also has this sensing line configuration. General design criterion 21 requires that the protection system be designed for high functional reliability commensurate with the safety functions to be performed. Based on the ASME III Class 1 and 2 design of the common sensing line, previous NRC acceptance of the CLIP design at Millstone 3 with the same instrument sensing line configuration, and the existing exception to sensing line independence in the Seabrook current licensing bases, NextEra concludes that excluding this event from the design basis for CLIP is acceptable. NextEra further concludes that the reliability of the CLIP permissive is commensurate with the safety function performed.

(5) Clarify the effect of the failed common sensing line as it relates to the pressurizer pressure control function.

NextEra Energy Response The NRC requested that NextEra Energy document that there are two pressurizer pressure channels that can be selected by the operators as the single input for pressurizer pressure control. The two selectable channels are on separate sensing lines. In the event of the failure of the selected pressure channel the operators would select the second channel via MCB switch. If the second channel is functional then a transient would be prevented. If the second channel was not functional then further procedure steps would be taken to mitigate the pressure transient. Since the two selectable pressure control input channels are not on a common sensing line, given appropriate operator action, a sensing line failure would respond the same as the current Seabrook licensing basis.

26