ML13079A122

License Amendment Request 12-04 Regarding Cold Leg Injection Permissive

ML13079A122
Person / Time
Site:	Seabrook
Issue date:	03/13/2013
From:	Vehec T A NextEra Energy Seabrook
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
SBK-L-12179
Download: ML13079A122 (51)

Text

NExTera ENERGY March 13, 2013 10 CFR 50.90 SBK-L-12179 Docket No. 50-443 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Seabrook Station License Amendment Request 12-04 License Amendment Request Regarding Cold Leg Injection Permissive In accordance with the provisions of Section 50.90 of Title 10 of the Code of Federal Regulations (10 CFR), NextEra Energy Seabrook, LLC (NextEra) is submitting license amendment request (LAR) 12-04 for an amendment to the technical specifications (TS) for Seabrook Station. The proposed change modifies the circuitry that initiates high head safety injection (SI) by adding a new permissive, cold leg injection permissive (CLIP). This permissive prevents opening of the high head SI valves until reactor coolant system pressure decreases to the CLIP set point.Attachment 1 to this letter provides NextEra's evaluation of the proposed change, and Attachment 2 provides a markup of the TS showing the proposed change. New TS pages with the proposed change incorporated will be provided when requested by the NRC Project Manager.As discussed in the evaluation, the proposed change does not involve a significant hazards consideration pursuant to 10 CFR 50.92, and there are no significant environmental impacts associated with the change.No new commitments are made as a result of this change.The station operation review committee has reviewed this LAR. A copy of this LAR has been forwarded to the New Hampshire State Liaison Officer pursuant to 10 CFR 50.91(b).NextEra requests NRC review and approval of LAR 12-04 with issuance of a license amendment by March 28, 2014 to support proposed changes during the next scheduled refueling outage and implementation of the amendment within 30 days.E yPeo NextEra Energy Seabrook, LLC, P.O. Box 300, Lafayette Road, Seabrook, NH 03874 United States Nuclear Regulatory Commission SBK-L- 12 179 / Page 2 Should you have any questions regarding this letter, please contact Mr. Michael O'Keefe, Licensing Manager, at (603) 773-7745.I declare under penalty of perjury that the foregoing is true and correct.Executed on g7 .4 5 Sincerely, Thomas A. Vehec Plant General Manager NextEra Energy Seabrook, LLC Attachments

1. NextEra Energy Seabrook's Evaluation of the Proposed Change 2. Markup of the Technical Specifications cc: NRC Region I Administrator NRC Project Manager NRC Senior Resident Inspector Perry E. Plummer, Acting Director Homeland Security and Emergency Management New Hampshire Department of Safety Division of Homeland Security and Emergency Management Bureau of Emergency Management 33 Hazen Drive Concord, NH 03305 Mr. John Giarrusso, Jr., Nuclear Preparedness Manager The Commonwealth of Massachusetts Emergency Management Agency 400 Worcester Road Framingham, MA 01702-5399 Attachment 1 NextEra Energy Seabrook's Evaluation of the Proposed Change

Subject:

License Amendment Request 12-04 Regarding Cold Leg Injection Permissive 1.0

SUMMARY

DESCRIPTION

2.0 DETAILED

DESCRIPTION

3.0 TECHNICAL

EVALUATION

4.0 REGULATORY EVALUATION

4.1 Applicable

Regulatory Requirements/Criteria

4.2 Precedent

4.3 Significant Hazards Consideration

4.4 Conclusion

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

1 1.0

SUMMARY

DESCRIPTION The proposed change revises the Seabrook Station techmical specifications (TS) by adding a new permissive, cold leg injection permissive (CLIP) to provide additional time for the operator actions to mitigate an inadvertent operation of emergency core cooling system event. CLIP will permit automatic opening of the charging to cold leg injection valves only when required for high head safety injection as indicated by pressurizer pressure being below the CLIP setpoint.

CLIP is classified as an engineered safety features actuation system interlock and will be added to the technical specifications.

2.0 DETAILED

DESCRIPTION The proposed change revises the technical specifications as follows: 1) Revise TS Tables 3.3-3, "Engineered Safety Features Actuation System Instrumentation," 3.3-4, "Engineered Safety Features Actuation System Instrumentation Trip Setpoints," and 4.3-2, "Engineered Safety Features Actuation System Instrumentation Surveillance Requirements," to add Functional Unit 1O.d, "Engineered Safety Features Actuation System Interlock, Cold Leg Injection, P-15." The following additional changes are editorial or intended to provide consistency with the safety analyses.1) Revise TS Table 2.2-1, "Reactor Trip System Instrumentation Trip Setpoints," to add low pressurizer pressure lead/lag time constants as a note.2) Revise TS Table 4.3-1 to add new note for low pressurizer pressure reactor trip lead/lag compensation surveillance requirements.

3) Revise TS Tables 3.3-4 and 4.3-2 to move the surveillance requirement for lead/lag time constants for low steam line pressure from a setpoint note to a surveillance requirement note.4) Editorial correction to the Table 4.3-2, Functional Unit, column heading.Attachment 2 provides the marked TS pages showing the proposed changes.2

3.0 TECHNICAL

EVALUATION

Background

Current Design The charging to cold leg injection valves (l-SI-V-138 and 139) are provided as part of the engineered safety features (ESF) to inject highly borated water from the refueling water storage tank into the four reactor coolant system (RCS) cold legs.Flow is provided by the centrifugal charging pumps (1 -CS-P-2-A and P-2-B). A safety injection, S-signal is provided by the ESF actuation system (ESFAS) to open these valves when required to mitigate design bases events such as loss-of-coolant accidents (LOCAs) and steam line breaks (SLBs).Inadvertent generation of an S-signal will result in a condition II mass addition event when there is no loss of mass from the RCS. If the mass addition is not terminated by operator action, the pressurizer will be filled and the safety valves will open and discharge water (it is assumed that the valves will not reseat) thereby escalating the event to a condition III small break LOCA. Condition II to III event escalation is not permitted by the Seabrook Station commitment to ANSI N 18.2a-1975.

Mitigation of the inadvertent operation of ECCS event during power operation discussed in updated final safety analysis report (UFSAR) Subsection 15.5.1 requires operator action to control the atmospheric steam dump valves (ASDVs) to cool the RCS down to and maintain 557°F and stop both centrifugal charging pumps. These actions have to be accomplished in the time calculated to stop the mass addition prior to a water-solid pressurizer condition; therefore, they are time critical actions. Since the margin between the expected and required performance times is small during this event, operator action requires periodic validation that the task can be completed within the required time.New Design CLIP will be designated ESFAS interlock P-i15 and will perform two nuclear safety-related functions:

1) Prevent the automatic opening of both charging to cold leg injection valves (1-SI-V-138 and 139) when pressurizer pressure is above the CLIP setpoint in the presence of a credible single failure in the CLIP circuitry.

The single failure requirement is met by providing coincidence logic in each solid state protection system (SSPS) train. The CLIP permissive signal consists of four pressurizer pressure instruments and their respective bistables, which provide input to two independent redundant trains of logic circuitry, relays and motor control contacts.The S-signal utilizes the same pressurizer pressure instruments but separate 3 parallel bistables and logic. Logic for both the CLIP and S-signals utilize independent 2-out-of-4 low pressurizer pressure input logic, and CLIP uses 2-out-of-2 actuation logic, such that no single failure in the solid state protection system during an inadvertent safety injection event will result in the presence of a CLIP signal when pressurizer pressure is above the CLIP setpoint.2) Permit the opening of at least one charging to cold leg injection valve when process conditions indicate a condition that requires high head safety injection in the presence of any credible single failure. The single failure requirement is met by the redundant trains of ESF and ESFAS.CLIP functions in each train's SSPS are provided by adding two relays with contacts in series (designated P-15) with an S-signal relay contact in the solid state protection system; the solid state protection system output from this combination is an interlock in the circuitry that opens the charging to cold leg injection valve. The as-designed safety injection (SI) initiation circuits and actuation circuits for other functions will be maintained as is, with no change in design. The proposed modifications are in addition to the as built circuits, and permit the cold leg injection valves to open when actual RCS pressure has degraded to the CLIP setpoint.

Since the CLIP setpoint is higher than the low pressurizer pressure safety injection (LPPSI) setpoint, there will be no delay in the opening of the cold leg injection valves if the S-signal is actuated by LPPSI. There will be a delay in the opening of the cold leg injection valves if the S-signal is actuated by a signal other than LPPSI (i.e. main steam low pressure or containment high pressure).

Testing features are provided to detect credible failures such as the failure of a tested contact to return to an open condition during testing.New main plant computer system (MPCS) inputs and status monitoring lights for P-15 actuation will be provided on the main control board.A simplified logic diagram showing the CLIP P-15 logic derived from the pressurizer pressure transmitters is given in Figure 1.4 FF.E'.. Fi I EF LiI. F.F:E IFE* [ ,,,...1 III. .....I .I FEH /1 E FE"\H/ FE" H /1 E I'I E 1 E E.E;T I* I I I .IT., B-.F.7 \E HTi I.. I .Li "L .F-I7T FEF+IIT riLE LE(: ]H, Figure 1 Cold Leg Injection Permissive, P-15 Logic 5 Evaluation Condition the Proposed Change is Intended to Resolve Mitigation of the inadvertent operation of emergency core cooling system (ECCS)during power operation event requires that operators perform certain time critical actions in the calculated time to terminate water mass addition prior to creating a water-solid pressurizer condition.

Licensed operators are challenged to meet the time critical action time requirement for terminating high head SI flow following inadvertent operation of ECCS during power operation event. The proposed plant modification would significantly increase the available operator time to terminate an inadvertent SI event.Following implementation of CLIP, the mass addition for the inadvertent operation of ECCS during power operation event will be limited to reactor coolant pump seal injection (RCPSI) flow. This will increase the time to approach water-solid pressurizer conditions, which will increase the performance times for the operator actions required to terminate an inadvertent SI event.Functional Limitations of the CLIP Design The pressurizer pressure instrumentation has four independent sensors; however, two of those sensors share a common sensing line. It can be postulated that a failure of the common sensing line could cause the output of these two pressurizer pressure channels to go low enough to satisfy the CLIP setpoint and to generate a low-low pressurizer pressure S-signal to open the cold leg injection valves without a significant loss of coolant that would require high head SI flow. Thus, the failure of the common sensing line could initiate an inadvertent ECCS actuation event for which CLIP would not provide margin for operator action to mitigate the event. The probability of a failure in the common sensing line is low since the piping and tubing are ASME III Class 1 or Class 2. The common pressurizer instrument tap is the standard Westinghouse design, and is listed in UFSAR subsection 7.1.2.12 (5) as an exception to the guidance of Regulatory Guide 1.151, "Instrument Sensing Lines," July 1983, for the independence of sensing lines. Millstone Unit 3, which has already received NRC approval of the CLIP modification, also has this sensing line configuration.

General design criterion 21 requires that the protection system be designed for high functional reliability commensurate with the safety functions to be performed.

Based on the low probability of this failure, previous NRC acceptance of the CLIP design at Millstone 3 with the same instrument sensing line configuration, and the existing exception to sensing line independence in the current licensing bases, NextEra concludes that excluding this event from the design basis for CLIP is acceptable.

NextEra further concludes that the reliability of the CLIP permissive is commensurate with the safety function performed.

6 Impact on Fluid Systems The proposed CLIP modification adds no new unanalyzed events relative to the centrifugal charging pumps' performance or ability to deliver the safety analysis credited flow. Upon initiation of an inadvertent S-signal with pressurizer pressure greater than the CLIP setpoint, the cold..leg injection valves will remain closed. The pumpsý minimum recirculation flow isolation valves will open to provide the required minimum recirculation flow to each pump. In the event of a single active failure of one of the pump's minimum recirculation flow isolation valves to open, the unaffected pump remains capable of delivering the safety analysis credited flow. The consequence of this event is equivalent to any pre-modification event that generates an S-signal and where the RCS subsequently returns to pressure (e.g., a secondary side high energy break) in conjunction with a single active failure to open one of the minimum recirculation flow isolation valves.Design Basis Analyses Affected by CLIP Mass and Energy Releases -Main Steamline Break Evaluation An evaluation was performed to address the impact of the CLIP modification on the steamline break (SLB) mass and energy release stretch power uprate (SPU)analyses, the current analysis of record. For the steamline break mass and energy analyses, the CLIP modification has the potential to delay initiation of ECCS injection by inhibiting auto-open of the cold leg injection valves until both an S-signal and a CLIP signal are present. There are three parts to the evaluation:

part 1 addresses the licensing-basis cases for steamline break mass and energy release inside containment, part 2 addresses the licensing-basis cases for steamline break mass and energy release outside containment, and part 3 addresses steamline breaks smaller than those analyzed for the updated final safety analysis report (UFSAR) for which there may be an S- signal but no signal associated with the CLIP.Steamline break inside containment.

For these breaks, two different break types are analyzed:

double-ended ruptures and split breaks. The double-ended guillotine break assumes that the ends of the ruptured pipe separate to allow unimpeded flow from each end. The split break is a longitudinal crack with an area that ranges from one square foot up to the cross-sectional area of the pipe. All cases from the SPU analysis were reviewed with respect to the timing of SI flow actuation from the analysis of record and when SI flow delivery with CLIP occurs.In the SPU steamline break mass and energy release analysis for double-ended ruptures, the first signal is low steam pressure for all cases. Using the SPU analysis output results, the assumed time of SI flow delivery is compared to the time when SI flow delivery with CLIP occurs. The results are that for all of the double-ended ruptures, SI flow delivery with CLIP is not reached until 7 after the time assumed for SI flow delivery in the SPU analysis.

Although an increase in safety injection delay is considered non-conservative, a sensitivity calculation was specifically performed to evaluate the impact of safety injection and the results show that mass and energy releases are not impacted by the increased delay time for safety injection.

These results were expected as the ECCS injection occurs at relatively low flow rates due to high reactor coolant system pressure, and boron injection occurs long after the return to power has been mitigated by increasing reactor coolant system temperature.

Any delay in initiation of ECCS injection has a negligible effect on core cooling throughout the event and core reactivity during the initial return to power.In the SPU steamline break mass and energy release analysis for split breaks, the first signal is the time of the first high containment pressure setpoint.Using the SPU analysis output results, the assumed time of SI flow delivery is compared to the time when SI flow delivery with CLIP occurs. The results are that for all of the split breaks, SI flow delivery with CLIP is not reached until after the time assumed for SI flow delivery in the SPU analysis.Although an increase in safety injection delay is considered non-conservative, a sensitivity calculation was specifically performed to evaluate the impact of safety injection and the results show that mass and energy releases are not impacted by the increased delay time for Safety Injection.

These results were expected as the ECCS injection occurs at relatively low flow rates due to high reactor coolant system pressure, and boron injection occurs long after the return to power has been mitigated by increasing reactor coolant system temperature.

Any delay in initiation of ECCS injection has a negligible effect on core cooling throughout the event and core reactivity during the initial return to power.Steamline break outside containment.

The SPU analysis for the steamline break mass and energy release outside containment was also evaluated for the CLIP modification.

Each steamline break case actuated ECCS flow on a low-low pressurizer pressure S-signal.

The CLIP modification requires an S-signal and a CLIP signal. The results show that the credited S-signal is much later than the CLIP signal. The results from the SPU analysis remain valid and bounding for the CLIP modification.

8 Smaller Steamline breaks. For the condition involving an S-signal actuation with pressurizer pressure above the CLIP setpoint, sensitivity cases varying the start time for ECCS injection, including no ECCS injection have concluded that the instantaneous and integrated mass and energy releases are insensitive to the injection start time. These results were expected as the ECCS injection occurs at relatively low flow rates due to high reactor coolant system pressure, and boron injection occurs long after the return to power has been mitigated by increasing reactor coolant system temperature.

Any delay in initiation of ECCS injection has a negligible effect on core cooling throughout the event and core reactivity during the initial return to power.The above evaluation shows that the installation of a CLIP would not impact the Seabrook steamline break mass and energy release licensing-basis.

Non-LOCA Analysis The CLIP impacts only non-LOCA events that model high-head SI, including:

hot zero-power steamline break, UFSAR Section 15.1.5; feedline break, UFSAR Section 15.2.8; and inadvertent ECCS, UFSAR Section 15.5.1. Additionally, the chemical and volume control system (CVCS) malfunction in UFSAR section 15.5.2 is indirectly impacted by this modification.

Each of these events has been reanalyzed or evaluated considering the CLIP modification with the same methodologies as those used in the analyses of record. All other non-LOCA events are not impacted.The hot zero-power steamline break event remains bounding for operation at the current uprate conditions.

The CLIP modification does not impact the limiting case for hot zero-power steamline break results because the cold leg injection valves will be fully open before the as-modeled high-head safety injection flow starts. In addition, sensitivity studies confirm that the maximum break size remains bounding for the hot zero-power steamline break event with the CLIP modification.

The feedline break (FLB) has been reanalyzed with the additional conservatism, with respect to the SPU FLB analysis, of assuming no safety injection flow. The results of the analysis show that the emergency feedwater system capacity is adequate to remove decay heat, to prevent over pressurizing the RCS, and to prevent uncovering the reactor core. The maximum hot leg temperature remains below the saturation temperature; therefore, no fuel damage will occur. Table 1 and Figure 1, below, provide a summary of the analysis results for the FLB assuming no safety injection flow. Preventing RCS overpressurization is demonstrated in Figure 2 Sheet 4 of 5 by showing that the pressurizer pressure remains below the RCS design pressure of 2485 psig. The core is demonstrated 9

to remain covered by maintaining level in the pressurizer well above the reactor core level as demonstrated in Figure 2 Sheet 4 of 5. Maintaining the hot leg temperature below the saturation temperature is demonstrated in Figure 2 Sheet 3 of 5 by demonstrating that the RCS hot leg and RCS cold leg temperatures for the loop with the faulted feedline and loops with the intact feedlines remain below the saturation temperature for the prevailing pressure.

The remaining sheets in Figure 2 provide additional information.

Table 1 Time Sequence of Events Feedwater Line Break with CLIP EVENT TIME (Sec)Main feedwater line rupture occurs 0.0 Low-low steam generator water level setpoint reached in broken loop 5.4 Rods begin to drop 7.4 Low Pressurizer Pressure reached for SIS injection 75.6 Safety injection flow is started No credit for SI flow Emergency feedwater flow started 105.4 Low steamline pressure isolation setpoint is reached 113.7 All main steam line isolation valves are closed 119.7 Steam generator safety valves open in steam generators of active loops 721.0 Core decay heat plus pump heat decrease to emergency feedwater heat -4000 removal capacity 10 C ci a C-, a C.)U-ci, 0~C ci-:-5 a C)C C a C)C, U--1~-*ci-)U, C)U)V-4 I I I....K. ......I .I .. .....I I. .I ... -" 4-- 1 -1 1 1 1 1 10 10 10 10 Time (secorn(Is)

I i -L 1-0.8 0.4-0,2-A%.E\i i i i i i i i ..-"... .i ! ..l.-i. t -" ' .I. .. -. -.. ........ ..... .. ... .. ... .Li 10 10 10 3 10 10 Ti rre (seconds)Figure 2 Sh 1 of 5: Nuclear Power and Core Heat Flux Transients for a Feedwater System Pipe Break 11

,U.-0 (---i, 0 I .'.J:~ -0.9 -..... ................

...........................

-.. .. .. .. ....I I I I II I I I 11111 I liii I I I 11111 I 10 I-2 10 irme (seconds)I 3 10 10 CD CD)C--S000-6000-4000 -20.00..................L 114.......~~~~. .............I L 1 11 I I I IIli 10 10 2 Tie secondts)3 10 1 Figure 2 Sh 2 of 5: RCS Flow and FLB Flow Transients for a Feedwater System Pipe Break 12 Hot Lcg tlmperoture C .ool d Le e rTomp er .t u r e.. t u r a t i ' v, -T err-) -o r ji i r v, U -P'. -, IC.-.C)CL)_C., 4 U')6-40 -620-600 -:so -560 -5'10-520-500 7I ................ .... ............................

.............

Faulted Lop; ,.... ....._ -. .....'C -I.. , .. ........... .. .. .... ... ... ..... .... .... ....., " .................... .............

..........I.I.I.I. ...I. ..I. ... .. I, ...................-,: .I 13 2 IC Time (seconds)10 I 10 Hot Lea Temperuture

-. ..Co I d Leg Temperatutire-S t u r a t i on T emrp e r a t u r e Li-3--)07i 0%)b----7100-650-600-550-500 -S .. .. .... .. .. ..-.-..........I .....I I. ."C'C Intact Loops CC I% ....... .............A -,.I I I I111I1I I I I I I I II I I I 2 1 1 11 450-43 10 if 10 Time (seconds)3 10(4'10 Figure 2 Sh 3 of 5: Loop 1 (Faulted) and Loop 2 (Intact) Temperature Transients for a Feedwater System Pipe Break 13 Cs CI-)C-fl C's C-C')5-(.1')Cr)CL)-4-,~.2 Cs Cl-)F 0 5--ci)223 C')ci)C2~4200 t 8100-8 00 -.................................

... ....... .. ......I ....I 1 .I......................./ .7>A'I I 11111 I 0 S0.1'10 Time (sec.onds)'

iA v-I 40 t 0'0 2 3 t 010o Tirnme (sec.onds), Figure 2 Sh 4 of 5: Pressurizer Pressure and Pressurizer Water Volume Transients for a Feedwater System Pipe Break 4 10 14 Loop... ... Loops kFaul1 te d (-1 I n ta," 'V3 r)7.7 CI Q3 i2O 1400 123 0-1000 800-400 200-I I I 11111 S. ..........'". '. .7 7 ..- ..I ..............

.. I -I , I , -, -----I -I ---.t -..0 0 10 2)10 Time " ",ct" " 3 10 4 L a 1; p Loop Loop Loop-i 3 4 F a I t e d Int(ctI , i nt at-)C: 03 C.CL IUUUUU 80000-60000--'N N 100001..........

\K'N.. ........- .......'- -..." " ....." -g. .-- .--". " 20000-I I I I I I I I I I I I I i t I I I I I I I I I1 1 1 1 11 1II11 0 10 2 10 I I 4 10 Time (seconds)Figure 2 Sh 5 of 5: Steam Generator Pressure and Steam Generator Mass Transients for a Feedwater System Pipe Break 15 The inadvertent ECCS event has been reanalyzed with CLIP and there is no hazard to the integrity of the RCS. Following implementation of CLIP, the mass addition for the inadvertent operation of ECCS event during power operation will be limited to the reactor coolant pump seal injection (RCPSI) flow. This will increase the time to approach water-solid pressurizer conditions, which will increase the time allowed to terminate an inadvertent SI event. Table 2 and Figure 3, below, provide a summary of the analysis results for the inadvertent ECCS event with the CLIP. Figure 3 Sheet 2 of 4 shows that the pressurizer fill does not occur until 4000 seconds. The remaining sheets in Figure 3 provide additional information.

Table 2 Time Sequence of Events Inadvertent ECCS Event with CLIP EVENT TIME (See)Spurious SI signal generated; two charging pumps start but 0.0 pressurizer pressure is above P-i15 setpoint; therefore, the cold leg injection valves do not open. Borated water injected into RCS through RCP seal injection only.Terminate all charging flow to avoid pressurizer fill 4200 Time to pressurizer fill if charging flow is not terminated 4271.1 16 1( ......~- Lops -L -2 00 5V,000 4000 Time (.se.onds 5000 9)-Cp-.......516... ...........................................................I I I.................

.................

.................

.................

...............

U 100' 2000 3000 4000 Time (secords)Figure 3 Sh I of 4: Nuclear Power and Vessel Average Temperature Transients for an Inadvertent ECCS Actuation During Power Operation 5 f00 17 CA U')ci)1-4 Q)2258>2261-2240-2220 -2200-2iO@-2!20-2 100 t..........4 .......................................................................... ................................ ..... ... ...... ..........

.. ... .......................7.: I I I I I I I I I i I i I I I I I I I I I I 0 I3 ;nr I I Time (seconds)

.'4000 5f I QT1CI -I -u'su 4---ci).S2 1200 u 1400 El C2k.......................

........~~ ~ ~ .......,........*. .............,A-......................I Unn QULJ I I I I 0 1000 2000 3000 4C,0 Time (seconds)Figure 3 Sh 2 of 4: Pressurizer Pressure and Pressurizer Water Volume Transients for an Inadvertent ECCS Actuation During Power Operation 18 5[00

/U.ul-C Cl)Cr)a El 0~>Cs->I P.KG.400-200-C-,.~II-.. I I I I I I

• I I I I I I I I I I I I-2 00 U i! f'. f %,'t, i J 2000 Time (seCn ds),1000 Loops 1-3..Loop 4 C 03 c-fl F EL cv CL)(I.}I/U 10-60-Xl ..................................................................

I ......................................... .. i ..........

-:-: ..-. ..i- ..... ....... ..... ....I ...................I s-_-20 0 1000 2000 301 Time (seconds I 4000 500(0 Figure 3 Sh 3 of 4: Main Steam Flow and Steam Generator Atmospheric Relief Valve Flow Transients for an Inadvertent ECCS Actuation During Power Operation 19 C--_-, I'U;.. ..(P iL*'.I -....................................................................................................I I III I , I I I I I I U 1003 1 2000 Time s'ecoH I 3000 d s)4000'000 1 -.1 -f-T.3 Z 03 10-V.4 ,-...... ................

... ..... ....... .... ...................I........ .. ...............

.........................................................................................

..................................................................................................................4-L-0 1000 2000 3000 Time (seconds)4000 5000 Figure 3 Sh 4 of 4: Safety Injection Flow and DNBR Transients for an Inadvertent ECCS Actuation During Power Operation 20 For the CVCS malfunction sequence of events, the operator has sufficient time to take corrective action to prevent pressurizer filling. Prior to CLIP implementation, the CVCS malfunction event was bounded by the inadvertent ECCS actuation at power and was not analyzed.

Previously, the inadvertent ECCS actuation at power event required an operator action at 9 minutes to stop a charging pump and an additional 4 minutes to stop all mass addition.

With the addition of CLIP, the inadvertent ECCS actuation at power is no-longer the limiting mass addition event. As part of the CLIP modification effort, the CVCS malfunction described in section 15.5.2 of the UFSAR has been analyzed with CLIP and the same methodology used for the inadvertent ECCS actuation analysis.

In the past, the analysis described in the UFSAR indicated that the operator had sufficient time to take corrective action. In the revised analysis, an assumption is made of an operator action time of 10 minutes (600 sec) to terminate charging.

The result is that pressurizer pressure will remain below the pressurizer safety valve setpoint for at least 45 minutes to provide time for operator action to stop the mass addition from RCPSI flow. Table 3 and Figure 4, below, provide a summary of the analysis results for the CVCS malfunction event, since it is no longer bounded by the inadvertent ECCS actuation at power event. Figure 4 Sheet 2 of 2 shows that the fill time for the pressurizer is up to 1082.1 seconds and the change in the fill rate when one charging pump is stopped.The remaining sheets in Figure 4 provide additional information.

Table 3 Time Sequence of Events CVCS Malfunction Event EVENT TIME (See)Two pressurizer pressure channels fail low; maximum 0.0 charging is begun; letdown is isolated; low pressurizer level alarm High pressurizer level alarm 483.1 Operator action to isolate normal charging flow path (after 600.0 this action, charging flow is limited to RCP seal injection path)Time to pressurizer fill if RCP seal injection flow is not 1082.1 terminated 21

'.9'.9 C)C)C-C)-i 1-0.4..............................I~ ~~ ................0 0 50 I 1000 I 1500 lime (seconds)2000 2500 3000 U-C)C)a'CD 5~ 88-ci)=1~o 386 CD El Cl)581 C)cm C CD ct ~ci)c-c: Cr CI)...............................................................................I I I I I I I I I I I I I I I I I I I I I I I JCL.J 0 0 500 I 1 COD I i 500 Time (seconds)200 2500 30,00 Figure 4 Sh 1 of 2: Nuclear Power and Vessel Average Temperature Transients for a CVCS Malfunction 22 221z z" ..- ..". .............. ;. ......... ;. ......... ;. ...................cJ) ....2.2 2.z0......._ ....................... ..2 1 ........\ ..............................................'..... ..... ......... ...> ,. "_ , " -- I -' -i I I I I I I I III I I I I.~0 500 100,0, 1500 2000 25-0 3000 Tim- (seconds)1 800 .,7CL o -O ............,+-.I. O~bu //'L.) .,/ ._- -i 0 0 ........ ./ ' .................................................... .................................................K /--- 1400-.i.. //,0.I ~ .,/U) /d ) 12 0 0 -/ ... ...........................t1 0 I I I I , I I I I , I I I II I 11 00 I ,* I I I I , I I I I 00 0 500 1000 1500 2000 000 Time (seconds)Figure 4 Sh 2 of 2: Pressurizer Pressure and Pressurizer Water Volume Transients for a CVCS Malfunction 23 Other related issues Dynamic Compensation of Low Pressurizer Pressure Reactor Trip Since this feature is currently credited in the Seabrook design basis analysis, the lead/lag time constants for the dynamic compensation are added to the technical specifications.

Adding the lead/lag time constants for dynamic compensation of the low pressurizer pressure reactor trip maintains consistency within the technical specifications.

Conclusion The CLIP installation does not impact the licensing-basis for steamline break mass and energy releases.

The analysis of record for the hot zero-power steamline break event remains bounding for operation at the current uprate conditions.

For the feedline break, assuming no safety injection flow, the emergency feedwater system capacity is adequate to remove decay heat, to prevent overpressurizing the RCS, and to prevent uncovering the core. For the inadvertent ECCS event, there is no hazard to the integrity of the RCS. Following implementation of CLIP, the mass addition for the inadvertent operation of ECCS event during power operation will be limited to RCPSI flow. This will increase the time to approach water-solid pressurizer conditions, which will increase the time allowed to terminate an inadvertent SI event.For the CVCS malfunction sequence of events, the operator has sufficient time to take corrective action to prevent pressurizer filling.

4.0 REGULATORY EVALUATION

4.1 Applicable

Regulatory Requirements/Criteria

• 10 CFR 50.36, Technical Specifications, states (c) Technical specifications will include items in the following categories:

(1) Safety limits, limiting safety system settings, and limiting control settings. (i)(A) Safety limits for nuclear reactors are limits upon important process variables that are found to be necessary to reasonably protect the integrity of certain of the physical barriers that guard against the uncontrolled release of radioactivity.

If any safety limit is exceeded, the reactor must be shut down. The licensee shall notify the Commission, review the matter, and record the results of the review, including the cause of the condition and the basis for corrective action taken to preclude recurrence.

Operation must not be resumed until authorized by the Commission.

The licensee shall retain the record of the results of each review until the Commission terminates the license for the reactor, except 24 for nuclear power reactors licensed under § 50.2 1(b) or § 50.22 of this part. For these reactors, the licensee shall notify the Commission as required by § 50.72 and submit a Licensee Event Report to the Commission as required by § 50.73. Licensees in these cases shall retain the records of the review for a period of three years following issuance of a Licensee Event Report.General Design Criterion 13-Instrumentation and control.Instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems. Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges.The CLIP is designed to enhance the protection for the reactor coolant pressure boundary by limiting a potential challenge to the pressurizer safety valves. For the case of the inadvertent ECCS actuation at power event, the CLIP extends the time for operators to terminate a mass addition that could ultimately lift the pressurizer safety valves and cause water relief through the safety valves. The CLIP has an insignificant effect on the containment and its associated systems. This was demonstrated by showing that the ECCS response to a steam line break with the CLIP in place did not affect the steam line break mass and energy release into the containment.

The feedline break (FLB) has been reanalyzed with the additional conservatism, with respect to the SPU FLB analysis, of assuming no safety injection flow. The results of the analysis show that the emergency feedwater system capacity is adequate to remove decay heat, to prevent overpressurizing the RCS, and to prevent uncovering the reactor core. The maximum hot leg temperature remains below the saturation temperature; therefore, no fuel damage will occur.The analyses associated with the CLIP design change demonstrate that appropriate controls are provided to maintain these variables and systems within prescribed operating ranges.General Design Criterion 15-Reactor coolant system design. The reactor coolant system and associated auxiliary, control, and protection systems shall be designed with sufficient margin to assure that the design conditions of the reactor coolant pressure boundary are not exceeded during any condition of normal operation, including anticipated operational occurrences.

The CLIP design setpoint is below the normal reactor coolant system operating pressure and above the low pressurizer pressure reactor trip 25 setpoint.

These values are well below the RCS pressure boundary design pressure of 2485 psig. The CLIP design provides additional response time to the plant operators to terminate an inadvertent safety injection and avoid the possibility of lifting the pressurizer safety valves due to the resultant mass addition from an inadvertent safety injection at power.* General Design Criterion 20-Protection system functions.

The protection system shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety.The existing functions of the reactor trip and reactor protection system are preserved with the CLIP design. The CLIP is designed to suppress high pressure safety injection when it is not needed due to an inadvertent ECCS operation at power event and to automatically allow high pressure safety injection for a valid ECCS demand signal based on low pressurizer pressure.

Analyses have demonstrated that the CLIP has no effect on the steam line break mass and energy release into the containment or outside containment.

For the feedline break, the analysis shows that the emergency feedwater system capacity is adequate to remove decay heat to prevent overpressurizing the reactor coolant system and to prevent uncovering the core with no credit for high pressure safety injection.

For the feedline break, the maximum hot leg temperature remains below the saturation temperature; therefore, no fuel damage will occur.General Design Criterion 21-Protection system reliability and testability.

The protection system shall be designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

Redundancy and independence designed into the protection system shall be sufficient to assure that (1) no single failure results in loss of the protection function and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

The protection system shall be designed to permit periodic testing of its functioning when the reactor is in operation, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.The CLIP function is derived from four independent pressurizer pressure transmitters.

Two of the transmitters sensing lines share the sensing taps into the pressurizer shell. The four Class 1E transmitters provide input signals to four independent bistables which provide input to two independent redundant trains of logic circuitry, relays and motor control contacts.

The S-signal utilizes the same pressurizer pressure instruments 26 but separate parallel bistables and logic. Logic for both the CLIP and S-signals utilize independent 2-out-of-4 low pressurizer pressure input logic, and CLIP uses 2-out-of-2 actuation logic, such that no single failure in the solid state protection system during an inadvertent safety injection event will result in the presence of a CLIP signal when pressurizer pressure is above the CLIP setpoint.

A single failure of the CLIP will not result in the loss of the protection function of the redundant train. CLIP testability is consistent wit the design of the protection system. The common sensing line has a low probability of failure since the line is designed to ASME III Class 1 or 2 and use of the common sensing line for two of the pressurizer pressure transmitters is consistent with the Seabrook current licensing basis.* General Design Criterion 22-Protection system independence.

The protection system shall be designed to assure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function, or shall be demonstrated to be acceptable on some other defined basis. Design techniques, such as functional diversity or diversity in component design and principles of operation, shall be used to the extent practical to prevent loss of the protection function.The CLIP design utilizes existing Class I E qualified instrumentation and relay components that are located in existing qualified signal processing and relay cabinets as part of the reactor protection system and the engineered safety features actuation system. The CLIP design includes physical and electrical separation as well as seismic qualification.

General Design Criterion 23-Protection system failure modes. The protection system shall be designed to fail into a safe state or into a state demonstrated to be acceptable on some other defined basis if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments (e.g., extreme heat or cold, fire, pressure, steam, water, and radiation) are experienced.

The CLIP design utilizes the same protection system components as the other, currently existing protection system functions.

The CLIP design provides an interlock with valves actuated by the ESFAS; it does not affect the existing failure modes of the ESFAS. The failure of a protection train function to actuate is still postulated; however, the actuation of the opposite train provides the required function.

The protection system equipment for CLIP that is located in areas that potentially could have a harsh environment is components already installed in the station and qualified for that environment.

General Design Criterion 24-Separation of protection and control systems. The protection system shall be separated from control systems to 27 the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems shall be limited so as to assure that safety is not significantly impaired.The CLIP function is derived from four independent pressurizer pressure transmitters.

Two of the transmitters sensing lines share the sensing taps into the pressurizer shell. The four Class I E transmitters provide input signals to four independent bistables which provide input to two independent redundant trains of logic circuitry, relays and motor control contacts.

The S-signal utilizes the same pressurizer pressure instruments but separate parallel bistables and logic. Logic for both the CLIP and S-signals utilize independent 2-out-of-4 low pressurizer pressure input logic, and CLIP uses 2-out-of-2 actuation logic, such that no single failure in the solid state protection system during an inadvertent safety injection event will result in the presence of a CLIP signal when pressurizer pressure is above the CLIP setpoint.

A single failure of the CLIP will not result in the loss of the protection function of the redundant train. The common sensing line has a low probability of failure since the line is designed to ASME III Class 1 or 2 and use of the common sensing line for two of the pressurizer pressure transmitters is consistent with the Seabrook current licensing basis. The CLIP function is designed to protection system requirements; it utilizes Class lE components and is separated from control and non Class I E functions using qualified isolation devices consistent with the design of the protection system.The changes proposed in this request will continue to meet the above regulatory requirements as described.

4.2 Precedent

The NRC staff has approved a similar license amendment for a cold leg injection permissive design for the Millstone 3 Power Station.* Safety Evaluation By The Office Of Nuclear Reactor Regulation Related To Amendment No. 242 To Renewed Facility Operating License No.NPF-49 Dominion Nuclear Connecticut, Incorporated Millstone Power Station, Unit 3 Docket No. 50-423 (August 12, 2008; Adams Accession No. ML081640535)

[Reference 2]28

4.3 Significant

Hazards Consideration No Significant Hazards Consideration The proposed change modifies the circuitry that initiates high head safety injection (SI) by adding a new permissive, cold leg injection permissive (CLIP). This permissive prevents automatic opening of the high head SI valves until reactor coolant system pressure decreases to the CLIP setpoint.In accordance with 10 CFR 50.92, NextEra has concluded that the proposed change does not involve a significant hazards consideration (SHC). The basis for the conclusion that the proposed change does not involve a SHC is as follows: 1. The proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

The proposed change adds an additional permissive before high head safety injection is initiated to assist the operators in mitigating the consequences of an inadvertent initiation of the emergency core cooling system (ECCS). This change in the ECCS actuation circuitry does not increase the probability of any accident previously evaluated because:* there is no effect on any of the systems, structures, or components that are used for normal operation of the plant,* there is no effect on any of the fission product barriers,* this change will not affect the normal operating procedures, The revised circuitry will delay the initiation of high head SI until reactor coolant pressure is below the CLIP setpoint; however, the proposed change does not significantly increase the consequences of accidents previously evaluated.

The proposed change does not alter ECCS flow.The delayed opening of the high head SI valves has been evaluated for the effect on the consequences of the following:

• Mass and energy release for steam line break accidents,* Steam line break -UFSAR section 15.1.5 (specifically hot zero-power conditions)

• Feedwater line break -UFSAR section 15.2.8 Inadvertent operation of emergency core cooling system during power operation

-UFSAR section 15.5.1 Chemical and volume control system malfunction that increases reactor coolant inventory

-UFSAR section 15.5.2 29 For all of the above evaluated accidents, the analysis results continue to meet all the safety limits. For the inadvertent initiation of ECCS event, the proposed change assists the operators in mitigating the event by significantly extending the time for the pressurizer to fill. Additional evaluations of small break LOCA, best estimate large break LOCA, long term cooling, LOCA forces, cold overpressure mitigation/low temperature over pressure protection, steam generator tube rupture, and LOCA mass and energy release were performed and it was concluded that they were not affected by this change.In addition evaluations were performed for the centrifugal charging pumps and reactor vessel internals; and for the NSSS design transients to determine if the change in the timing of the high head injection would have an effect and it was concluded that these components and transients are not adversely affected.Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. The proposed change does not create the possibility of a new or different kind of accidentfrom any previously evaluated The proposed change adds new components to the process protection racks and solid state protection system similar to the components and configurations that are already installed.

The sequence of operation of equipment used to mitigate the consequences of an accident is changed;however, it does not add any different types of equipment.

The proposed change is a change to the protection circuitry for the plant and not to the system or equipment used for normal operation of the plant. It does not alter any fluid flow paths or fission product barriers and does not change the method of control of any plant systems used for normal operations.

The proposed change does not alter or prevent the ability of the ECCS to perform its specified function to mitigate the consequences of an initiating event within assumed acceptance limits. The evaluation of the centrifugal charging pumps, reactor internals, control systems and NSSS design transients confirmed that new failure modes were not created.Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. The proposed changes do not involve a significant reduction in the margin of safety.Margin of safety is associated with confidence in the ability of the fission product barriers (i.e., fuel cladding, reactor coolant system pressure boundary, and containment structure) to limit the level of radiation dose to 30 the public. The proposed changes will not relax any criteria used to establish safety limits and will not relax any safety system settings.

The safety analysis acceptance criteria are not affected by this change. The proposed change will not result in plant operation in a configuration outside the design basis.The proposed change does involve a change in the timing of the mitigation of inadvertent ECCS actuation and steam line break.This change provides additional time for mitigating the inadvertent operation of emergency core cooling system during power operation event prior to filling the pressurizer water solid, by preventing the injection of high head safety injection when it is not required.This change delays the injection of high head safety injection on a steam line break. The delay has no effect on the steamline break mass and energy releases and the limiting analysis of record hot zero power steam line break as discussed below.An evaluation was performed to address the impact of the CLIP modification on the steamline break (SLB) mass and energy release stretch power uprate (SPU) analyses, the current analysis of record. For the steamline break mass and energy analyses, the CLIP modification has the potential to delay initiation of ECCS injection by inhibiting auto-open of the cold leg injection valves until both an S-signal and a CLIP signal are present. There are three parts to the evaluation:

part 1 addresses the licensing-basis cases for steamline break mass and energy release inside containment, part 2 addresses the licensing-basis cases for steamline break mass and energy release outside containment, and part 3 addresses steamline break s smaller than those analyzed for the updated final safety analysis report (UFSAR) for which there may be an S- signal but no signal associated with the CLIP.Steamline break inside containment.

For these breaks, two different break types are analyzed:

double-ended ruptures and split breaks. All cases from the SPU analysis were reviewed with respect to the timing of SI flow actuation from the analysis of record and when SI flow delivery with CLIP occurs.In the SPU steamline break mass and energy release analysis for double-ended ruptures, the first signal is low steam pressure for all cases. Using the SPU analysis output results, the assumed time of SI flow delivery is compared to the time when SI flow delivery with CLIP occurs. The results are that for all of the double-ended ruptures, SI flow delivery with CLIP is not reached until after the time assumed for SI flow delivery in the SPU analysis.

Although an increase in safety injection delay is considered non-conservative, a sensitivity calculation was specifically performed to evaluate the impact of safety injection and the results show that mass and 31 energy releases are not impacted by the increased delay time for safety injection.

These results were expected as the ECCS injection occurs at relatively low flow rates due to high reactor coolant system pressure, and boron injection occurs long after the return to power has been mitigated by increasing reactor coolant system temperature.

Any delay in initiation of ECCS injection has a negligible effect on core cooling throughout the.event and core reactivity during the initial return to power.In the SPU steamline break mass and energy release analysis for split breaks, the first signal is the time of the first high containment pressure setpoint.

Using the SPU analysis output results, the assumed time of SI flow delivery is compared to the time when SI flow delivery with CLIP occurs. The results are that for all of the split breaks, SI flow delivery with CLIP is not reached until after the time assumed for SI flow delivery in the SPU analysis.

Although an increase in safety injection delay is considered non-conservative, a sensitivity calculation was specifically performed to evaluate the impact of safety injection and the results show that mass and energy releases are not impacted by the increased delay time for Safety Injection.

These results were expected as the ECCS injection occurs at relatively low flow rates due to high reactor coolant system pressure, and boron injection occurs long after the return to power has been mitigated by increasing reactor coolant system temperature.

Any delay in initiation of ECCS injection has a negligible effect on core cooling throughout the event and core reactivity during the initial return to power.Steamline break outside containment.

The SPU analysis for the steamline break mass and energy release outside containment was also evaluated for the CLIP modification.

Each steamline break case actuated ECCS flow on a low-low pressurizer pressure S-signal.

The CLIP modification requires an S-signal and a CLIP signal. The results show that the credited S-signal is much later than the CLIP signal. The results from the SPU analysis remain valid and bounding for the CLIP modification.

32 Smaller Steamline breaks. For the condition involving an S-signal actuation with pressurizer pressure above the CLIP setpoint, sensitivity cases varying the start time for ECCS injection, including no ECCS injection have concluded that the instantaneous and integrated mass and energy releases are insensitive to the injection start time. These results were expected as the ECCS injection occurs at relatively low flow rates due to high reactor coolant system pressure, and boron injection occurs long after the return to power has been mitigated by increasing reactor coolant system temperature.

Any delay in initiation of ECCS injection has a negligible effect on core cooling throughout the event and core reactivity during the initial return to power.The hot zero-power steamline break event remains bounding for operation at the current uprate conditions.

The CLIP modification does not impact the limiting case for hot zero-power steamline break results because the cold leg injection valves will be fully open before the as-modeled high-head safety injection flow starts. In addition, sensitivity studies confirm that the maximum break size remains bounding for the hot zero-power steamline break event with the CLIP modification.

The above evaluation shows that the installation of a CLIP would not impact the Seabrook steamline break mass and energy release licensing-basis or the hot zero-power steam line break results.The feedline break (FLB) has been reanalyzed with the additional conservatism, with respect to the SPU FLB analysis, of assuming no safety injection flow. The results of the analysis show that all the safety limits continue to be met even with the additional conservatism of no safety injection assumed. The assumption that operator action is required to mitigate the consequences of a chemical and volume control malfunction is not changed by this modification.

Before CLIP, the event was bounded by the inadvertent ECCS actuation event and its associated operator action. With CLIP, the event requires operator action to terminate charging and seal injection flows. As discussed above the consequences of the other accidents evaluated remain bounded by the analyses of record. The results of analyses and evaluations supporting the proposed change demonstrate acceptance criteria continue to be met.Therefore, these proposed changes do not involve a significant reduction in a margin of safety.33 Based on the above, NextEra concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(b), and, accordingly, a finding of"no significant hazards consideration" is justified.

4.4 Conclusions

Based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.34

5.0 ENVIRONMENTAL

CONSIDERATION NextEra has evaluated the proposed amendment for environmental considerations.

The review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement.

However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment needs to be prepared in connection with the proposed amendment.

6.0 REFERENCES

1. Seabrook Station UFSAR, Revision 14, sections 7.1.2.12, 15.1.5, 15.2.5, 15.2.8, 15.5.1, 15.5.2 2. NRC letter Safety Evaluation By The Office Of Nuclear Reactor Regulation Related To Amendment No. 242 To Renewed Facility Operating License No.NPF-49 Dominion Nuclear Connecticut Incorporated Millstone Power Station, Unit 3 Docket No. 50-423 (August 12, 2008; Adams Accession No.ML081640535) 35 Attachment 2 Mark-up of the Technical Specifications (TS)The attached markup reflects the currently issued version of the TS and facility operating license. At the time of submittal, the facility operating license was revised through Amendment No. 132.Listed below are the license amendment requests that are awaiting NRC approval and may impact the currently issued version of the facility operating license affected by this LAR.LAR Title NextEra Energy Date Seabrook Letter Submitted LAR 10-02 Application for Change to the Technical SBK-L-10074 05/14/2010 Specifications for the Containment Enclosure Emergency Air Cleanup System LAR 11-04 Changes to the Technical Specifications SBK-L-11245 01/30/2012 for New and Spent Fuel Storage LAR 11-06 Application to Revise the Applicability SBK-L- 11186 11/17/2011 of the Reactor Coolant System Pressure-Temperature Limits and the Cold Overpressure Protection Setpoints LAR 12-06 Application for Technical Specification SBK-L-12235 12/20/2012 Improvement to Extend the Inspection Interval for Reactor Coolant Pump Flywheels Using the Consolidated Line Item Improvement Process The following TS pages are included in the attached lnarkup: Technical Title Page Specification

2.2.1 Table

2.2-1, Reactor Trip System Instrumentation Trip 2-4 Setpoints 2-10 3/4.3.1 Table 4.3-1, Reactor Trip System Instrumentation 3/4 3-9 Surveillance Requirements 3/4 3-13 3/4.3.2 Table 3.3-3, Engineered Safety Features Actuation 3/4 3-21 System Instrumentation 3/4.3.2 Table 3.3-4, Engineered Safety Features Actuation 3/4 3-28 System Instrumentation Trip Setpoints 3/4 3-29 3/4.3.2 Table 4.3-2, Engineered Safety Features Actuation 3/4 3-31 System Instrumentation Surveillance Requirements 3/4 3-32 3/4 3-33 3/4 3-34 3/4 3-35 TABLE 2,2-1 REACTOR TRIP SYSTEM INSTRUMENTATION TRIP SETPOINTS SENSOR TOTAL ERROR ALLOWANCE.(TA)

Z (S) TRIP SETPOINT N.A. N.A. N.A. N.A.FUNCTIONAL UNIT 1. Manual Reactor Trip 2. Power Range, Neutron F a. High Setpoint b. Low Setpoint 3. Power Range, Neutron F High Positive Rate lux lux, 7.5 8.3 1.6 4.56 4.56 0.5 1.42 1.42 0 4.5.6.7.8.9.10.(NOT USED)Intermediate Range, Neutron Flux Source Range, Neutron Flux Overtemperature AT Overpower AT Pressurizer Pressure -Low Pressurizer Pressure -High 17.0 17.0 N.A.N.A.N.A.N.A.8.41 0<109% of RTP*<25% of RTP*<5% of RTP* with a time constant>2 seconds<25% of RTP*!100 cps See Note 1 See Note 3>_1945 psig<2385 psig 10.01 N.A.N.A.N.A.N.A.ALLOWABLE VALUE N.A.<111.1% of RTP*27.1% of RTP*6.3% of RTP* with a time constant>_2 seconds_<31.1% of RTP*0 N.A.N.A.N.A.N.A.1.6 x 10, cps See Note 2 See Note 4_1,933 psig2,397 psig$~*RTP = RATED THERMAL POWER SEABROOK-UNIT 1 2-4 Amendment No. 4-2, 1 TABLE 2.2-1 (Continued)

TABLE NOTATIONS (Continued)

NOTE 3: (Continued)

K 6 = Value specified in COLR, T = As defined in Note 1,= Indicated Ta,,g at RATED THERMAL POWER, 'F, (Calibration temperature for AT instrumentation, value specified in the COLR), S = As defined in Note 1, and f 2= A function of the indicated difference between the top and bottom detectors of the power-range neutron ion chambers as specified in the COLR.NOTE 4: Cycle dependent values for the channel's Allowable Value are specified in the COLR.SEABROOK -UNIT 1 2-10 Amendment No. 3, 76, REACT FUNCTIONAL UNIT 1. Manual Reactor Trip 2. Power Range, Neutron Flux a. High Setpoint b. Low Setpoint 3. Power Range, Neutron Flux, High Positive Rate 4. (NOT USED)5. Intermediate Range, Neutron Flux 6. Source Range, Neutron Flux 7. Overtemperature AT 8. Overpower AT 9. Pressurizer Pressure-Low

10. Pressurizer Pressure-High

11. Pressurizer Water Level--High

12. Reactor Coolant Flow--Low SEABROOK-UNIT 1 TABLE 4.3-1 OR TRIP SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS TRIP ANALOG ACTUATING CHANNEL DEVICE CHANNEL CHANNEL OPERATIONAL OPERATIONAL A CHECK CALIBRATION TEST TEST L N.A. N.A. N.A. R(13) N*CTUATION OGIC TEST l.A.MODES FOR WHICH SURVEILLANCE IS REQUIRED 1,2,3*,4*,5*

S S N.A.S S S S S S S S D(2, 4), M(3, 4), Q(4, 6), R(4, 5)R(4)R(4)R(4, 5)R(4, 5)R R R (1.R R R Q S/U(1)Q S/U(1)S/U(8),Q(9)

Q Q Q Q Q Q N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.1,2 1***, 2 1,2 1"**, 2 2**, 3, 4, 5 1,2 1,2 1 1,2 1 1 Amendment No. 36 3/4 3-9 TABLE 4.3-1 (Continued)

TABLE NOTATIONS (Continued)

(12) Number not used.(13) The TRIP ACTUATING DEVICE OPERATIONAL TEST shall independently verify the OPERABILITY of the undervoltage and shunt trip circuits for the Manual Reactor Trip Function.

The test shall also verify the OPERABILITY of the Bypass Breaker trip circuit(s).

(14) Local manual shunt trip prior to placing breaker in service.(15) Automatic undervoltage trip 10~ COA4ANJEL CAI-11A-TIOA

~L\ ~X~SEABROOK -UNIT 1 3/4 3-13 Amendment No9 TABLE 3.3-3 (Continued)

ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION TOTAL NO.OF CHANNELS CHANNELS TO TRIP MINIMUM CHANNELS OPERABLE APPLICABLE MODES FUNCTIONAL UNIT ACTION b. RWST Level-Low-Low 4 2 3 1,2,3,4 15 Coincident With: Safety Injection See Item 1. above for all Safety Injection initiating functions and requirements.

9. Loss of Power (Start Emergency Feedwater)

a. 4.16 kV Bus E5 and E6-Loss of Voltage b. 4.16 kV Bus E5 and ES-Degraded Voltage Coincident with SI 2/bus 2/bus I/bus 1,2,3,4 14 2/bus 2/bus 1/bus 1,2,3,4 14 See Item 1. above for all and requirements.

Safety Injection initiating functions 10. Engineered Safety Features Actuation System Interlocks

a. Pressurizer Pressure, P-11 b. Reactor Trip, P-4 c. Steam Generator Water Level, P-14 SEABROOK -UNIT 1~ cM~ kC, 3 2 2 2 2 2 1,2,3 1,2,3 1,2,3 19 21 18 4/stm. gen.2/stm. gen. 3/stm. gen.3/4 3-21 Amendment Nco 3 19 TABLE 3.3-4 (Continued)

ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION TRIP SETPOINTS SENSOR TOTAL ERROR L UNIT ALLOWANCE (TA) Z L TRIP SETPOINT ALLOW FUNCTIONAl ABLE VALUE 9. Loss of Power (Start Emergency Feedwater)

a. 4.16 kV Bus E6 and E6 Loss of Voltage N.A.N.A. N.A._> 2975 volts with a 1.20 second time delay.> 3933 volts with a < 10 second time delay._> 2908 volts with a !5 1.315 second time delay.> 3902 volts with a 10.96 second time delay.b. 4.16 kV Bus E5 and E6 Degraded Voltage N.A.N.A. N.A.Coincident with: Safety Injection See Item 1. above for all Safety Injection Trip Setpoints and Allowable Values.10. Engineered Safety Features Actuation System Interlocks

a. Pressurizer Pressure, P-i 1 N.A.N.A.N.A. N.A.N.A. N.A.< 1950 psig< 1962 psig b. Reactor Trip, P-4 N.A.N.A.c. Steam Generator Water Level, P-14 SEABROOK-UNIT 1 P-/See Item 5. above for all Steam Generator Water Level Trip Setpoints and Allowable Values.3/4 3-28 Amendment Nol NA K. P, N.A.NSF' N~ N.. ~j~%.ws-~4*

TABLE 3.3-4 (Continued)

TABLE NOTATIONS Time constants utilized in the lead-lag controller for Steam Line Pressure-Low are TCscnsadT: 5ecns. ;le**The time constant utilized in the rate-lag controller for Steam Line Press ure- Negative R5a~t eJ-1i~qjreater than or equal to 5(

that this tim e ' --T- ---._ -"'I***Value specified applies when "as measured" Trip Setpoint is greater than the specified Trip Setpoint.****Value specified applies when "as measured" Trip Setpoint is less than the specified Trip Setpoint.SEABROOK -UNIT 1 3/4 3-29 Amendment No.l TABLE 4.3-2 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS FUNCTIONAL UNIT ANALOG CHANNEL OPERATIONAL TEST TRIP ACTUATING DEVICE OPERATIONAL TEST CHANNEL CHANNEL CHECK CALIBRATION ACTUATION LOGIC TEST MASTER RELAY TEST SLAVE RELAY TEST MODES FOR WHICH SURVEILLANCE IS REQUIRED 1.Safety Injection (Reactor Trip, Feedwater Isolation, Start Diesel Generator, Phase "A" Isolation, Containment Ventilation Isolation, and Emergency Feedwater, Service Water to Secondary Component Cooling Water Isolation, CBA Emergency Fan/Filter Actuation, and Latching Relay).a. Manual Initiation

b. Automatic Actuation Logic and Actuation Relays c. Containment Pressure-Hi-1 d. Pressurizer Pressure Low e. Steam Line Pressure-Low

2. Containment Spray a. Manual Initiation

b. Automatic Actuation Logic and Actuation Relays C, Containment Pressure-Hi-3 SEABROOK-UNIT 1 N.A.N.A.S N.A.N.A.R S S R R (A6 N.A.N.A.Q Q Q N.A.N.A.Q R N.A.N.A.N.A.N.A.R N.A.N.A.N.A, M(1)N.A.N.A.N.A.N.A.M(1)N.A.NA. N.A. 1,2,3,4 M(1) Q 1,2,3,4 N.A. N.A, 1,2,3 N.A. N.A. 1,2,3 N.A. N.A. 1,2,3 N.A. N.A. 1,2,3,4 M(1) Q 1,2,3,4 N.A. N.A. 1,2,3 I N.A.N.A.N.A.N.A.S R 3/4 3-31 Amendment Nos)

ENGINEERED.CHANNEl FUNCTIONAL UNIT CHECK 3. Containment Isolation a. Phase "A" Isolation 1) Manual Initiation N.A.2) Automatic Actuation N.A.Logic and Actuation Relays 3) Safety Injection See Item b. Phase "B" Isolation 1) Manual Initiation N.A.2) Automatic Actuation N.A.Logic Actuation Relays 3) Containment S Pressure-Hi-3

c. Containment Ventilation Isolation 1) Manual Initiation N.A.2) Automatic Actuation N.A.Logic and Actuation Relays 3) Safety Injection See Item 4) Containment On Line S Purge Radioactivity-High TABLE 4.3-2 (Continued)

SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS TRIP ANALOG ACTUATING CHANNEL DEVICE MASTER L CHANNEL OPERATIONAL OPERATIONAL ACTUATION RELAY CALIBRATION TEST TEST LOGIC TEST TEST SLAVE RELAY TEST MODES FOR WHICH SURVEILLANCE IS REQUIRED N.A.N.A.N.A.N.A.R N.A.N.A.M(1)N.A.M(1)N.A. 1,2,3,4 Q 1,2,3,4 1. above for all Safety Injection Surveillance Requirements.

N.A.N.A.N.A.N.A.R Q R N.A.N.A.R N.A.N.A.M(1)N.A.N.A.M(1)N.A.M(1)N.A.N.A.M(1)N.A.N.A. 1,2,3,4 Q 1,2,3,4 N.A. 1,2,3 N.A. 1,2,3,4 Q 1,2,3,4 N.A. 1,2,3,4 N.A.N.A.N.A.N.A.1. above for all Safety Injection Surveillance Requirements.

R Q(2) N.A. N.A.SEABROOK-UNIT 1 3/4 3-32 Amendment NIRý TABLE 4.3-2 (Continued)

ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS FUNCT ANIT 4. Steam Line Isolation ANALOG CHANNEL OPERATIONAL TEST TRIP ACTUATING DEVICE MASTER SLAVE MODES FOR WHICH CHANNEL CHANNEL CHECK CALIBRATION OPERATIONAL ACTUATION RELAY TEST LOGIC TEST TEST RELAY SURVEILLANCE TEST IS REQUIRED a. Manual Initiation N, (System)b. Automatic Actuation N.Logic and Actuation Relays c. Containment Pressure-S Hi-2 d. Steam Line S Pressure-Low

e. Steam Line Pressure-S Negative Rate-High A.A.N.A.N.A.N.A.N.A.R R V'C)R C5)0 Q Q R N.A.N.A.N.A.N.A.N.A.N.A.N.A.N.A.M(1)N.A.N.A.N.A.M(1)N.A.N.A.M(1) Q 1,2,3 N.A.N.A.N.A.N.A.N.A. 1,2,3 N.A. 1,2,3 N.A. 3 N.A. 1,2,3 5. Turbine Trip a. Automatic Actuation N.A.Logic and Actuation Relays b. Steam Generator Water S Level-High-High (P-14)6. Feedwater Isolation N.A, N.A.M(1) Q 1,2 R R Q Q N.A.N.A.N.A. 1,2 N.A. 1,2 a. Steam Generator Water S Level--High-High (P-14)b. Safety Injection S ee Item 1. above for all Safety Injection Surveillance Requirements.

7. Emergency Feedwater a. Manual Initiation

1) Motor-driven pump N.A.2) Turbine-driven pump N.A.N.A.N.A.NA.N.A.R R N.A.N.A.N.A.N.A.N.A. 1,2,3 N.A. 1,2,3 SEABROOK-UNIT 1 3/4 3-33 Amendment Noa TABLE 4.3-2 (Continued)

ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS CHANNEL CHANNEL FUNCT IONAL NIT CHECK CALIBRATION

7. Emergency Feedwater (Continued)

ANALOG CHANNEL OPERATIONAL TEST TRIP ACTUATING DEVICE MASTER OPERATIONAL ACTUATION RELAY TEST LOGIC TEST TEST SLAVE RELAY TEST MODES FOR WHICH SURVEILLANCE IS REQUIRED b. Automatic Actuation and Actuation Relays c. Steam Generator Water Level-Low-Low, Start Motor-Driven Pump and Turbine-Driven Pump d. Safety Injection, Start Motor-Driven Pump and Turbine-Driven Pump e. Loss-of-Offsite Power Start Motor-Driven Pump and Turbine-Driven Pump 8. Automatic Switchover to Containment Sump a. Automatic Actuation Logic and Actuation Relays b. RWST Level Low-Low Coincident With Safety Injection N.A.N.A.N.A.N.A, N.A.M(1)N.A.M(1) Q 1,2,3 NA, N.A. 1,2,3 S R Q See Item 1. above for all Safety Injection Surveillance Requirements.

See Item 9. for all Loss-of-Offsite Power Surveillance Requirements, N.A.N.A.N.A.N.A.N.A.Q(3)M(1)NA.M(1) Q 1,2,3,4 N.A. N.A. 1,2,3,4 R Q See Item 1. above for all Safety Injection Surveillance Requirements.

SEABROOK -UNIT 1 3/4 3-34 Amendment N4R5 TABLE 4.3-2 (Continued)

ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS TRIP ANALOG ACTUATING CHANNEL DEVICE MASTER SLA\CHANNEL CHANNEL OPERATIONAL OPERATIONAL ACTUATION RELAY RELI FUNCTIONAL UNIT CHECK CALIBRATION TEST TEST LOGIC TEST TEST TESI 9. Loss of Power (Start)Emergency Feedwater)

a. 4.16 kV Bus E5 and N.A. R N.A. M N.A. N.A. N.A.E6 Loss of Voltage b. 4.16 kV Bus E5 and N.A. R N.A. M N.A. N.A. N.A.E6 Degraded Voltage Coincident With Safety Injection See Item 1. above for all Safety Injection Surveillance Requirements 10.Engineered Safety Features Actuation System Interlocks

a. Pressurizer N.A. R Q N.A. N.A. N.A. N.A.Pressure, P-11 b. Reactor Trip, P-4 N.A. N.A. N.A. N.A. R N.A, N.A.c. Steam Generator S R Q N.A. M(1) M(1) Q Water Level, P-14 C.C. \ T-S.4,.- _I K TABLE NOTATION (1) Each train shall be tested at least every 62 days on a STAGGERED TEST BASIS.(2) A DIGITAL CHANNEL OPERATIONAL TEST will be performed on this instrumentation.

(3) Setpoint verification is not applicable.

LI~~ ~ ~ ~ '\C1AYA4 Cu6grj(t3

.(E ,Y MODES FOR WHICH SURVEILLANCE IS REQUIRED 1,2,3,4 1,2,3,4 1,2,3 I 1,2,3 1,2,3 I'1 SEABROOK -UNIT 1 3/4 3-35 J Amendment I ý