ML14029A445

Issuance of Amendment Regarding License Amendment Request 12-04, Application Regarding Cold Leg Injection Permissive

ML14029A445
Person / Time
Site:	Seabrook
Issue date:	03/06/2014
From:	John Lamb Plant Licensing Branch 1
To:	Ossing M, Walsh K NextEra Energy Seabrook
Lamb J
References
TAC MF1158
Download: ML14029A445 (47)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 March 6, 2014 Mr. Kevin Walsh, Site Vice President c/o Michael Ossing Seabrook Station NextEra Energy Seabrook, LLC P.O. Box 300 Seabrook, NH 03874

SUBJECT:

SEABROOK STATION, UNIT NO.1 -ISSUANCE OF AMENDMENT REGARDING LICENSE AMENDMENT REQUEST 12-04, APPLICATION REGARDING COLD LEG INJECTION PERMISSIVE (TAC NO. MF1158)

Dear Mr. Walsh:

The Commission has issued the enclosed Amendment No. 140 to Facility Operating License No. NPF-86 for the Seabrook Station, Unit No. 1. This amendment consists of changes to the facility technical specifications in response to your application dated March 13, 2013, as supplemented by letters dated August 8, 2013, and November 22, 2013.

The amendment modifies the circuitry that initiates high-head safety injection by adding a new permissive, cold leg injection permissive (P-15). This permissive prevents opening of the high-head safety injection valves until reactor coolant system pressure decreases to the P-15 set point.

A copy of our safety evaluation is also enclosed. Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Joh . Lamb, Senior Project Manager Pia Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-443

Enclosures:

1. Amendment No. 140 to NPF-86

2. Safety Evaluation cc w/encls: Distribution via Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 NEXTERA ENERGY SEABROOK, LLC, ET AL.*

DOCKET NO. 50-443 SEABROOK STATION, UNIT NO. 1 AMENDMENT TO FACILITY OPERATING LICENSE Amendment No. 140 License No. NPF-86 1 The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment filed by NextEra Energy Seabrook, LLC, et al.,

(the licensee) dated March 13, 2013, as supplemented August 8, 2013, and November 22, 2013, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance: (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations:

D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

• NextEra Energy Seabrook, LLC is authorized to act as agent for the: Hudson Light & Power Department, Massachusetts Municipal Wholesale Electric Company, and Taunton Municipal Light Plant and has exclusive responsibility and cortrol ':lver the physical construction, operation and maintenance of the facility.

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 2.C.(2) of Facility Operating License No. NPF-86 is hereby amended to read as follows:

(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 140, and the Environmental Protection Plan contained in Appendix B are incorporated into the Facility License No. NPF-86.

NextEra Energy Seabrook, LLC shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

3. This license amendment is effective as of its date of issuance and shall be implemented within 615 days.

FOR THE NUCLEAR REGULATORY COMMISSION

~V-~~

Meena Khanna, Chief Plant Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the License and Technical Specifications Date of Issuance: March 6, 2014

ATTACHMENT TO LICENSE AMENDMENT NO. 140 FACILITY OPERATING LICENSE NO. NPF-86 DOCKET NO. 50-443 Replace the following page of Facility Operating License No. NPF-86 with the attached revised page. The revised page is identified by amendment number and contains a marginal line indicating the area of change.

Remove 3 3 Replace the following pages of Appendix A, Technical Specifications, with the attached revised pages as indicated. The revised pages are identified by amendment number and contain marginal lines indicating the area of change.

Remove Insert 2-4 2-4 2-10 2-10 3/4 3-9 3/4 3-9 3/4 3-13 3/4 3-13 3/4 3-21 3/4 3-21 3/4 3-28 3/4 3-28 3/4 3-29 3/4 3-29 3/4 3-31 3/4 3-31 3/4 3-32 3/4 3-32 3/4 3-33 3/4 3-33 3/4 3-34 3/4 3-34 3/4 3-35 3/4 3-35

(4) NextEra Energy Seabrook, LLC, pursuant to the Act and 10 CFR 30, 40, and 70, to receive, possess, and use at any time any byproduct, source, and special nuclear material as sealed neutron sources for reactor startup, sealed sources for reactor instrumentation and radiation monitoring equipment calibration, and as fission detectors in amounts as required; (5) NextEra Energy Seabrook, LLC, pursuant to the Act and 10 CFR 30, 40, and 70, to receive, possess, and use in amounts as required any byproduct, source, or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; (6) NextEra Energy Seabrook, LLC, pursuant to the Act and 10 CFR 30, 40, and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility authorized herein; and (7) DELETED C. This license shall be deemed to contain and is subject to the conditions specified in the Commission's regulations set forth in 10 CFR Chapter I and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; is subject to the additional conditions specified or incorporated below:

(1) Maximum Power Level NextEra Energy Seabrook, LLC, is authorized to operate the facility at reactor core power levels not in excess of 3648 megawatts thermal (100% of rated power).

(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 140*, and the Environmental Protection Plan contained in Appendix Bare incorporated into the Facility License No. NPF-86. NextEra Energy Seabrook, LLC shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

(3) License Transfer to FPL Energy Seabrook, LLC**

a. On the closing date(s) of the transfer of any ownership interests in Seabrook Station covered by the Order approving the transfer, FPL Energy Seabrook, LLC**, shall obtain from each respective transferring owner all of the accumulated decommissioning trust funds for the facility, and ensure the deposit of such funds and additional funds, if necessary, into a decommissioning trust or trusts for Seabrook Station established by FPL Energy Seabrook, LLC**, such that the amount of such funds deposited meets or exceeds the amount required under 10 CFR 50.75 with respect to the interest in Seabrook Station FPL Energy Seabrook, LLC**,

acquires on such dates(s).

• Implemented

• • On April16, 2009, the name "FPL Energy Seabrook, LLC" was changed to "NextEra Energy Seabrook, LLC".

AMENDMENT NO. 140

TABLE 2.2-1 REACTOR TRIP SYSTEM INSTRUMENTATION TRIP SETPOINTS SENSOR TOTAL ERROR FUNCTIONAL UNIT ALLOWANCE (TA) ~ .@_ TRIP SETPOINT ALLOWABLE VALUE

1. Manual Reactor Trip N.A. N.A. N.A. N.A. N.A.

2. Power Range, Neutron Flux

a. High Setpoint 7.5 4.56 1.42 ~1 09% of RTP* ~111.1% of RTP*

b. Low Setpoint 8.3 4.56 1.42 ~25% of RTP* ~27.1% of RTP*

3. Power Range, Neutron Flux, 1.6 0.5 0 ~5% of RTP* with ~6.3% of RTP* with High Positive Rate a time constant a time constant 22 seconds 22 seconds

4. (NOT USED)

5. Intermediate Range, 17.0 8.41 0 ~25% of RTP* ~31.1% of RTP*

Neutron Flux

~10 cps 5

6. Source Range, Neutron Flux 17.0 10.01 0 ~1.6 x 105 cps

7. Overtemperature 11T N.A. N.A. N.A. See Note 1 See Note 2

8. Overpower !1T N.A. N.A. N.A. See Note 3 See Note 4

9. Pressurizer Pressure- Low N.A. N.A. N.A. 21945 psig 21 ,933 psig, See Note 5

10. Pressurizer Pressure - High N.A. N.A. N.A. ~2385 psig ~2.397 psig

• RTP = RATED THERMAL POWER SEABROOK- UNIT 1 2-4 Amendment No. 12, 33, 91, 140

TABLE 2.2-1 (Continued)

TABLE NOTATIONS (Continued)

NOTE 3: (Continued)

Ks = Value specified in COLR, T = As defined in Note 1, T" = Indicated Tavg at RATED THERMAL POWER, °F, (Calibration temperature for ~T instrumentation, value specified in the COLR),

S = As defined in Note 1, and fz(~l) = A function of the indicated difference between the top and bottom detectors of the power-range neutron ion chambers as specified in the COLR.

NOTE4: Cycle dependent values for the channel's Allowable Value are specified in the COLR.

NOTE 5: Time constants utilized in the lead-lag controller for Pressurizer-Low are -r 1 :2: 10 seconds and

-r2 ~ 1 second.

SEABROOK- UNIT 1 2-10 Amendment No. 33. 76. 101, 140

TABLE 4.3-1 REACTOR TRIP SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS TRIP ANALOG ACTUATING MODES FOR CHANNEL DEVICE WHICH CHANNEL CHANNEL OPERATIONAL OPERATIONAL ACTUATION SURVEILLANCE FUNCTIONAL UNIT CHECK CALIBRATION TEST TEST LOGIC TEST IS REQUIRED

1. Manual Reactor Trip N.A. N.A. N.A. R(13) N.A. 1,2,3*,4*,5*

2. Power Range, Neutron Flux

a. High Setpoint s D(2, 4), Q N.A. N.A. 1, 2 M(3, 4),

0(4, 6),

R(4, 5)

b. Low Setpoint s R(4) S/U(1) N.A. N.A. 1***, 2

3. Power Range, Neutron Flux, N.A. R(4) Q N.A. N.A. 1, 2 High Positive Rate

4. NOT USED

5. Intermediate Range, s R(4, 5) S/U(1) N.A. N.A. 1***, 2 Neutron Flux

6. Source Range, Neutron Flux s R(4, 5) S/U(8),Q(9) N.A. N.A. 2**, 3, 4, 5

7. Overtemperature /1T s R Q N.A. N.A. 1, 2

8. Overpower /1T s R Q N.A. N.A. 1, 2

9. Pressurizer Pressure--Low s R(16) Q N.A. N.A. 1

10. Pressurizer Pressure--High s R Q N.A. N.A. 1, 2

11. Pressurizer Water Level--High s R Q N.A. N.A. 1

12. Reactor Coolant Flow--Low s R Q N.A. N.A. 1 SEABROOK- UNIT 1 3/4 3-9 Amendment No. 36, 91,140

TABLE 4.3-1 (Continued)

TABLE NOTATIONS (Continued)

(12) Number not used.

(13) The TRIP ACTUATING DEVICE OPERATIONAL TEST shall independently verify the OPERABILITY of the undervoltage and shunt trip circuits for the Manual Reactor Trip Function. The test shall also verify the OPERABILITY of the Bypass Breaker trip circuit(s).

(14) Local manual shunt trip prior to placing breaker in service.

(15) Automatic undervoltage trip.

(16) CHANNEL CALIBRATION shall include verification that the time constants are adjusted to the prescribed values.

SEABROOK - UNIT 1 3/4 3-13 Amendment No. ae, 140

TABLE 3.3-3 (Continued)

ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION

b. RWST Level--Low-Low 4 2 3 1,2,3,4 15 Coincident With:

Safety Injection See Item 1. above for all Safety Injection initiating functions and requirements.

9. Loss of Power (Start Emergency Feedwater)

a. 4.16 kV Bus E5 and E6- 2/bus 2/bus 1/bus 1,2,3,4 14 Loss of Voltage

b. 4.16 kV Bus E5 and E6-Degraded Voltage 2/bus 2/bus 1/bus 1,2,3,4 14 Coincident with Sl See Item 1. above for all Safety Injection initiating functions and requirements.

10. Engineered Safety Features Actuation System Interlocks

a. Pressurizer Pressure, P-11 3 2 2 1' 2, 3 19

b. Reactor Trip, P-4 2 2 2 1' 2, 3 21

c. Steam Generator Water 4/stm. gen. 2/stm. gen. 3/stm. gen. 1' 2, 3 18 Level, P-14

d. Cold Leg Injection, P-15 4 2 3 1,2,3 18 SEABROOK- UNIT 1 3/4 3-21 Amendment No. 47, 140

TABLE 3.3-4 {Continued}

ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION TRIP SETPOINTS SENSOR TOTAL ERROR FUNCTIONAL UNIT ALLOWANCE {T A} ~ __(§.}_ TRIP SETPOINT ALLOWABLE VALUE

9. Loss of Power (Start Emergency Feedwater)

a. 4.16 kV Bus E5 and E6 N.A. N.A. N.A. ~ 2975 volts ~ 2908 volts Loss of Voltage with a~ 1.20 with a~ 1.315 second time second time delay. delay.

b. 4.16 kV Bus E5 and E6 N.A. N.A. N.A. ~ 3933 volts ~ 3902 volts Degraded Voltage with a~ 10 with a~ 10.96 second time second time delay. delay.

Coincident with:

Safety Injection See Item 1. above for all Safety Injection Trip Setpoints and Allowable Values.

10. Engineered Safety Features Actuation System Interlocks

a. Pressurizer Pressure, P-11 N.A. N.A. N.A.  :::; 1950 psig  :::; 1962 psig

b. Reactor Trip, P-4 N.A. N.A. N.A. N.A. N.A.

c. Steam Generator Water Level, See Item 5. above for all Steam Generator Water Level Trip P-14 Setpoints and Allowable Values.

d. Cold Leg Injection, P-15 N.A. N.A. N.A. 1885 psig ~ 1880.5 psig****

~ 1889.5 psig***

SEABROOK - UNIT 1 3/4 3-28 Amendment No. 33. 60,140

TABLE 3.3-4 (Continued)

TABLE NOTATIONS

• Time constants utilized in the lead-lag controller for Steam Line Pressure-Low are

't1 ~ 50 seconds and 't2 ~ 5 seconds.

• • The time constant utilized in the rate-lag controller for Steam Line Pressure-Negative Rate-High is greater than or equal to 50 seconds.

• • • Value specified applies when "as measured" Trip Setpoint is greater than the specified Trip Setpoint.

• • • • Value specified applies when "as measured" Trip Setpoint is less than the specified Trip Setpoint.

SEABROOK- UNIT 1 3/4 3-29 Amendment No. W, 140

TABLE 4.3-2 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS TRIP ANALOG ACTUATING MODES CHANNEL DEVICE MASTER SLAVE FOR WHICH CHANNEL CHANNEL OPERATIONAL OPERATIONAL ACTUATION RELAY RELAY SURVEILLANCE FUNCTIONAL UNIT CHECK CALIBRATION TEST TEST LOGIC TEST TEST TEST IS REQUIRED

1. Safety Injection (Reactor Trip, Feedwater Isolation, Start Diesel Generator, Phase "A" Isolation, Containment Ventilation Isolation, and Emergency Feedwater, Service Water to Secondary Component Cooling Water Isolation, CBA Emergency Fan/Filter Actuation, and Latching Relay).

a. Manuallnitiation N.A. N.A. N.A. R N.A. N.A. N.A. 1, 2, 3, 4

b. Automatic Actuation N.A. N.A. N.A. N.A. M(1) M(1) Q 1, 2, 3, 4 Logic and Actuation Relays

c. Containment Pressure- s R Q N.A. N.A. N.A. N.A. 1, 2, 3 Hi-1

d. Pressurizer Pressure s R Q N.A. N.A. N.A. N.A. 1, 2, 3 Low

e. Steam Line s R(4) Q N.A. N.A. N.A. N.A. 1, 2, 3 Pressure-Low

2. Containment Spray

a. Manual Initiation N.A. N.A. N.A. R N.A. N.A. N.A. 1, 2, 3, 4

b. Automatic Actuation N.A. N.A. N.A. N.A. M(1) M(1) Q 1, 2, 3, 4 Logic and Actuation Relays C. Containment Pressure- s R Q N.A. N.A. N.A. N.A. 1, 2, 3 Hi-3 SEABROOK - UNIT 1 3/4 3-31 Amendment No. 26, 140

TABLE 4.3-2 (Continued)

ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS TRIP ANALOG ACTUATING MODES CHANNEL DEVICE MASTER SLAVE FOR WHICH CHANNEL CHANNEL OPERATIONAL OPERATIONAL ACTUATION RELAY RELAY SURVEILLANCE FUNCTIONAL UNIT CHECK CALIBRATION TEST TEST LOGIC TESTTEST TEST IS REQUIRED

3. Containment Isolation

a. Phase "A" Isolation

1) Manual Initiation N.A. N.A. N.A. R N.A. N.A. N.A. 1,2,3,4

2) Automatic Actuation N.A. N.A. N.A. N.A. M(1) M(1) Q 1,2,3,4 Logic and Actuation Relays

3) Safety Injection See Item 1. above for all Safety Injection Surveillance Requirements.

b. Phase "B" Isolation

1) Manual Initiation N.A. N.A. N.A. R N.A. N.A. N.A. 1, 2, 3,4

2) Automatic Actuation N.A. N.A. N.A. N.A. M(1) M(1) Q 1,2, 3,4 Logic Actuation Relays

3) Containment s R Q N.A. N.A. N.A. N.A. 1, 2, 3 Pressure-Hi-3

c. Containment Ventilation Isolation

1) Manual Initiation N.A. N.A. N.A. R N.A. N.A. N.A. 1,2,3,4

2) Automatic Actuation N.A. N.A. N.A. N.A. M(1) M(1) Q 1,2,3,4 Logic and Actuation Relays

3) Safety Injection See Item 1. above for all Safety Injection Surveillance Requirements.

4) Containment On Line S R 0(2) N.A. N.A. N.A. N.A. 1, 2, 3, 4 Purge Radioactivity- High SEABROOK - UNIT 1 3/4 3-32 Amendment No. ae, 140

TABLE 4.3-2 (Continued)

ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS TRIP ANALOG ACTUATING MODES CHANNEL DEVICE MASTER SLAVE FOR WHICH CHANNEL CHANNEL OPERATIONAL OPERATIONAL ACTUATION RELAY RELAY SURVEILLANCE FUNCTIONAL UNIT CHECK CALIBRATION TEST TEST LOGIC TEST TEST TEST IS REQUIRED

4. Steam Line Isolation

a. Manual Initiation N.A. N.A. N.A. R N.A. N.A. N.A. 1' 2, 3 (System)

b. Automatic Actuation N.A. N.A. N.A. *N.A. M(1) M(1) Q 1,2,3 Logic and Actuation Relays

c. Containment Pressure- s R Q N.A. N.A. N.A. N.A. 1, 2, 3 Hi-2

d. Steam Line s R(4) Q N.A. N.A. N.A. N.A. 1' 2, 3 Pressure-Low

e. Steam Line Pressure- s R(4) Q N.A. N.A. N.A. N.A. 3 Negative Rate-High

5. Turbine Trip

a. Automatic Actuation N.A. N.A. N.A. N.A. M(1) M(1) Q 1, 2 Logic and Actuation Relays

b. Steam Generator Water S R Q N.A. N.A. N.A. N.A. 1' 2 Level-High-High (P-14)

6. Feedwater Isolation

a. Steam Generator Water S R Q N.A. N.A. N.A. N.A. 1' 2 Level--High-High (P-14)

b. Safety Injection See Item 1. above for all Safety Injection Surveillance Requirements.

7. Emergency Feedwater

a. Manuallnitiation

1) Motor-driven pump N.A. N.A. N.A. R N.A. N.A. N.A. 1, 2, 3

2) Turbine-driven pump N.A. N.A. N.A. R N.A. N.A. N.A. 1' 2, 3 SEABROOK - UNIT 1 3/4 3-33 Amendment No. 46, 140

TABLE 4.3-2 (Continued)

ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS TRIP ANALOG ACTUATING MODES CHANNEL DEVICE MASTER SLAVE FOR WHICH CHANNEL CHANNEL OPERATIONAL OPERATIONAL ACTUATION RELAY RELAY SURVEILLANCE FUNCTIONAL UNIT CHECK CALIBRATION TEST TEST LOGIC TEST TEST TEST IS REQUIRED

7. Emergency Feedwater (Continued)

b. Automatic Actuation N.A. N.A. N.A. N.A. M(1) M(1) Q 1, 2, 3 and Actuation Relays

c. Steam Generator Water S R Q N.A. N.A. N.A. N.A. 1, 2, 3 Level-Low-Low, Start Motor-Driven Pump and Turbine-Driven Pump

d. Safety Injection, Start See Item 1. above for all Safety Injection Surveillance Requirements.

Motor-Driven Pump and Turbine-Driven Pump

e. Loss-of-Offsite Power See Item 9. for all Loss-of-Offsite Power Surveillance Requirements.

Start Motor-Driven Pump and Turbine-Driven Pump

8. Automatic Switchover to Containment Sump

a. Automatic Actuation N.A. N.A. N.A. N.A. M(1) M(1) Q 1,2, 3,4 Logic and Actuation Relays

b. RWST Level Low-Low N.A. R Q 0(3) N.A. N.A. N.A. 1, 2, 3, 4 Coincident With Safety Injection See Item 1. above for all Safety Injection Surveillance Requirements.

SEABROOK - UNIT 1 3/4 3-34 Amendment No. 36, 140

TABLE 4.3-2 (Continued)

ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REQUIREMENTS TRIP ANALOG ACTUATING MODES CHANNEL DEVICE MASTER SLAVE FOR WHICH CHANNEL CHANNEL OPERATIONAL OPERATIONAL ACTUATION RELAY RELAY SURVEILLANCE FUNCTIONAL UNIT CHECK CALIBRATION TEST TEST LOGIC TEST TEST TEST IS REQUIRED

9. Loss of Power (Start)

Emergency Feedwater)

a. 4.16 kV Bus E5 and N.A. R N.A. M N.A. N.A. N.A. 1,2,3,4 E6 Loss of Voltage

b. 4.16 kV Bus E5 and N.A. R N.A. M N.A. N.A. N.A. 1, 2, 3, 4 E6 Degraded Voltage Coincident With Safety Injection See Item 1. above for all Safety Injection Surveillance Requirements.

10. Engineered Safety Features Actuation System Interlocks

a. Pressurizer N.A. R Q N.A. N.A. N.A. N.A. 1, 2, 3 Pressure, P-11

b. Reactor Trip, P-4 N.A. N.A. N.A. N.A. R N.A. N.A. 1' 2, 3

c. Steam Generator s R Q N.A. M(1} M(1} Q 1' 2, 3 Water Level, P-14

d. Cold Leg Injection, P-15 S R Q N.A. M(1} M(1) Q 1, 2, 3 TABLE NOTATION (1) Each train shall be tested at least every 62 days on a STAGGERED TEST BASIS.

(2} A DIGITAL CHANNEL OPERATIONAL TEST will be performed on this instrumentation.

(3} Setpoint verification is not applicable.

(4) CHANNEL CALIBRATION shall include verification that the time constants are adjusted to the prescribed values.

SEABROOK - UNIT 1 3/4 3-35 Amendment No. 36, 140

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 140 TO FACILITY OPERATING LICENSE NO. NPF-86 NEXTERA ENERGY SEABROOK. LLC SEABROOK STATION. UNIT NO. 1 DOCKET NO. 50-443

1.0 INTRODUCTION

By application dated March 13, 2013 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML13079A122), as supplemented by letters dated August 8, 2013 (ADAMS Accession No. ML13225A398), and November 22, 2013 (ADAMS Accession No. ML13333A166), NextEra Energy Seabrook, LLC (NextEra or the licensee) requested changes to the technical specifications (TSs) for Seabrook Station, Unit 1 (Seabrook). The supplements dated August 8, 2013, and November 22, 2013, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the staff's original proposed no significant hazards consideration determination as published in the Federal Register on April 30, 2013 (78 FR 25315).

The amendment modifies the circuitry that initiates high-head safety injection (SI) by adding a new permissive, cold leg injection permissive (P-15). This permissive prevents opening of the high-head Sl valves until reactor coolant system (RCS) pressure decreases to the P-15 set point. The new P-15 permissive is intended to reduce or eliminate the incidence of unnecessary operation of the emergency core cooling system (ECCS) due to spurious actuation signals or operator errors. Inadvertent operation of the ECCS at power is an anticipated operational occurrence (AOO), or American Nuclear Society (ANS) Condition II event that could develop into a more serious Condition Ill or IV event.

2.0 BACKGROUND

The modification adds the P-15 function to the solid-state protection system (SSPS) of the licensee's reactor trip system. This modification affects the conditions to automatically open two valves associated with high-head Sl. The permissive, P-15, prevents the opening of the high-head Sl valves until the RCS pressure is sufficiently low. Opening the high-head Sl valves is an engineered safety features actuation system (ESFAS) function, and the P-15 permissive is an ESFAS interlock. Opening the charging-to-cold leg injection valves allows highly borated Enclosure

water to flow from the refueling water storage tank (RWST) into the four RCS cold legs to mitigate certain design bases events (e.g., loss-of-coolant accidents, steam line breaks, etc.).

The licensee proposed the P-15 function to help prevent a failure that causes an inadvertent engineered safety features (ESF) actuation from resulting in a small break loss-of-coolant accident (SBLOCA). A mass addition of highly borated water could result from an inadvertent ESF actuation. If an inadvertent ESF actuation, which Seabrook has defined to be an event of moderate frequency (Condition II), is not successfully terminated, then the resultant mass addition could result in a SBLOCA, which Seabrook has defined to be an infrequent event (Condition Ill). Manual operator actions provide mitigation against the inadvertent mass addition of highly borated water. The safety benefit derived from P-15 is additional time for operators to mitigate an inadvertent operation of the ECCS under most circumstances. This additional time can help prevent a Condition II incident from escalating to a Condition Ill incident.

The licensee proposed two P-15 safety functions to remain operable and meet the single-failure criterion. First, the P-15 function shall prevent both charging-to-cold leg injection valves from automatically opening under process conditions not requiring high-head Sl. Second, the P-15 function shall allow automatic opening of at least one charging-to-cold leg injection valve under process conditions requiring high-head Sl. The P-15 function combines pressurizer pressure measurement comparisons against a TS-controlled setpoint and implements logic to control whether charging-to-cold leg injection valves may automatically open.

The licensee proposed to implement the P-15 function consistent with the licensee's existing safety instrumentation architecture. The proposed implementation uses existing equipment and components that meet the currently applicable Seabrook licensing bases for its SSPS, ESF and ESFAS instrumentation. The existing equipment and components include the pressurizer pressure transmitters, plant protection cabinets, SSPS cabinets, and main control board (MCB).

The licensee proposed revisions to the TSs establishing limiting conditions for operations (LCOs) for the P-15 function. These TS revisions provide surveillance requirements (SR) for each P-15 instrument channel's setpoint and all P-15 logic circuits.

The modification also includes automatic and manual monitoring capabilities for P-15. For automatic monitoring, the modification adds P-15 signals from the SSPS to the main plant computer system. For manual monitoring, the modification adds status indications on the MCB along with signals from the SSPS to the MCB to control these indications.

3.0 REGULATORY EVALUATION

The following regulations apply to the evaluation of this license amendment request (LAR):

• Title 10 of the Code of Federal Regulations (10 CFR), Section 50.34(f)(2)(v)

• 10 CFR 50.36 (c)(2)(i)

• 10 CFR 50.36 (c)(3)

• 10CFR50.55a(a)(1)

• 10 CFR 50.55a {h}(2)

Chapter 7, Section 7.3.2.2, of the Seabrook Updated Final Safety Analysis Report (UFSAR),

Revision 15, dated April 26, 2013, discusses compliance with the General Design Criteria (GDC) specified in Appendix A to 10 CFR Part 50 that apply to ESFAS. The following GDCs apply to this evaluation of the LAR.

• GDC 1 - Quality standards and records

• GDC 10 - Reactor design

• GDC 13- Instrumentation and control

• GDC 15 - Reactor coolant system design

• GDC 20 - Protection system functions

• GDC 21 -Protection system reliability and testability

• GDC 22 - Protection system independence

• GDC 23- Protection system failure modes

• GDC 24- Separation of protection and control systems

• GDC 26 - Reactivity control system redundancy and capability

• GDC 27- Combined reactivity control systems capability

• GDC 28 - Reactivity limits

• GDC 31 -Fracture prevention of reactor coolant pressure boundary

• GDC 35 - Emergency core cooling The U.S. Nuclear Regulatory Commission (NRC) staff's review also relied upon relevant guidance that is available in NUREG-0800, "Standard Review Plan for the Review of Safety Analysis for Nuclear Power Plants," (SRP). Specifically, SRP Chapters 15.1.5, 15.2.8, and 15.5.1-2 were consulted.

SRP Chapter 15.1.5, "Steam System Piping Failures Inside and Outside of Containment (PWR)," discusses that the steam release resulting from a rupture of a main steam pipe will result in an increase in steam flow, a reduction of coolant temperature and pressure, and an increase in core reactivity. The core reactivity increase may cause a power level increase and a decrease in shutdown margin. ECCS is actuated to mitigate the event.

SRP Chapter 15.2.8, "Feedwater System Pipe Break Inside and Outside of Containment (PWR)," states, in part, that "depending upon the size and location of the break and the plant operating conditions at the time of the break, the break could cause either an RCS cooldown (by excessive energy discharge through the break) or an RCS heatup (by reducing feedwater flow to the affected SG [steam generator])." In this case, the event is evaluated as an RCS heatup, since the cooldown is addressed by the steam line break.

SRP Chapters 15.5.1 and 15.5.2, "Inadvertent Operation of ECCS and Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory," indicates that equipment malfunctions, operator errors, and abnormal occurrences could cause unplanned increases in reactor coolant inventory. In this case, the boron concentration and temperature of the injected water are the same as the water in the RCS.

The NRC staff considered the following Regulatory Guides (RGs) in this evaluation of the LAR, in accordance with the guidance established within NUREG-0800, Chapter 7, "Instrumentation and Controls," per 10 CFR 50.34(h)(3):

• Regulatory Guide 1.22, "Periodic Testing of Protection System Actuation Functions"

• Regulatory Guide 1.47, "Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems"

• Regulatory Guide 1.53, "Application of the Single-Failure Criterion to Safety Systems"

• Regulatory Guide 1.62, "Manual Initiation of Protective Actions"

• Regulatory Guide 1. 75, "Criteria for Independence of Electrical Safety Systems"

• Regulatory Guide 1.1 05, "Setpoints for Safety-related Instrumentations"

• Regulatory Guide 1.118, "Periodic Testing of Electric Power and Protection Systems"

• Regulatory Guide 1.151, "Instrument Sensing Lines"

• Regulatory Guide 1.153, "Criteria for Safety Systems" The NRC staff also considered the following Branch Technical Positions in this evaluation of the LAR, in accordance with the guidance established within NUREG-0800, Chapter 7, "Instrumentation and Controls," per 10 CFR 50.34(h)(3):

• Branch Technical Position 7-8, "Guidance for Application of Regulatory Guide 1.22"

• Branch Technical Position 7-11, "Guidance on Application and Qualification of Isolation Devices"

• Branch Technical Position 7-12, "Guidance on Establishing and Maintaining Instrument Setpoints"

• Branch Technical Position 7-17, "Guidance on Self-test and Surveillance Test Provisions" Section 182a of the Atomic Energy Act requires applicants for nuclear power plant operating licenses to include TSs as part of the license. The NRC's regulatory requirements related to the content of the TSs are contained in 10 CFR 50.36, "Technical Specifications." The TS requirements in 10 CFR 50.36 include the following categories: (1) safety limits, limiting safety systems settings and control settings, (2) LCOs, (3) SRs, (4) design features, (5) administrative controls, (6) decommissioning, (7) initial notification, and (8) written reports.

4.0 TECHNICAL EVALUATION

Specifically, the proposed change revises the Seabrook TS as follows:

• Add functional unit 1O.d, "Engineered Safety Features Actuation System Interlocks, Cold Leg Injection, P-15," to:

TS Table 3.3-3, "Engineered Safety Features Actuation System Instrumentation,"

TS Table 3.3-4, "Engineered Safety Features Actuation System Instrumentation Trip Setpoints," and TS Table 4.3-2, "Engineered Safety Features Actuation System Instrumentation Surveillance Requirements"

• Add low pressurizer pressure lead/lag time constants, as a note, toTS Table 2.2-1, "Reactor Trip System Instrumentation Trip Setpoints"

• Add a new note for low pressurizer pressure reactor trip lead/lag compensation surveillance requirements toTS Table 4.3-1

• Move the surveillance requirement for lead/lag time constants for low steam line pressure from a setpoint note to a surveillance requirement note in TS Tables 3.3-4 and 4.3-2

• Make an editorial correction to the functional unit column heading in Table 4.3-2.

4.1 Instrumentation and Controls Based on the Seabrook construction permit issuance, dated July 7, 1976, 10 CFR 50.55a(h)(2),

"Protection systems," requires protection systems meet either the Institute of Electrical and Electronics Engineers (IEEE) Standard (Std.) 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations," or IEEE Std. 603-1991, "Criteria for Safety Systems for Nuclear Power Generating Stations," and the correction sheet dated January 30, 1995.

NRC RG 1.153, "Criteria for Safety Systems," Revision 1, provides a method acceptable to the NRC staff for satisfying the Commission's regulations with respect to the design, reliability, qualification, and testability of the power, instrumentation, and control portions of the safety systems of nuclear power plants through an endorsement of IEEE Std. 603-1991. However, RG 1.153 post-dates the Seabrook design basis.

Within the Seabrook UFSAR and the licensee's response to Request for Additional Information (RAI) 10, dated August 8, 2013, the licensee identified IEEE Std. 279-1971 as its design basis rather than IEEE Std. 603-1991. Although the RAI 10 response stated, in part, that "Seabrook has not committed to meeting the requirements of IEEE-603-1991," other individual RAI responses describe how the licensee's approach meets the intent of corresponding IEEE Std. 603-1991 clauses. Therefore, the NRC staff's technical evaluation was performed using the licensee's current design basis of IEEE Std. 279-1971 with further consideration of IEEE Std. 603-1991 and the current regulatory evaluation criteria identified through the 10 CFR 50.34(h)(3) reference to NUREG-0800, Chapter 7, "Instrumentation and Controls."

The remaining subsections describe the proposed instrumentation and control modification and evaluate the modification against the regulatory evaluation criteria identified in Section 3.0.

Section 4.1.1 provides a description of the proposed instrumentation and controls. Each remaining subsection provides a technical evaluation of a specific topic against its applicable regulatory evaluation criteria.

4.1.1 Description The P-15 function is implemented using analog signals and logic components that do not embed software or programmable devices. The P-15 function is implemented using components that have been previously qualified as suitable for use at Seabrook. The P-15 function is implemented in a manner consistent with the licensee's existing safety instrumentation architecture. The licensee's implementation of the P-15 function conforms to the SSPS design basis and does not deviate from the SSPS design basis, as documented in the Seabrook UFSAR Sections 7.1.2.1 b, 7.2.2.2a, 7.3.1.2, and 7.3.2.2 (see responses to RAis 5, 6, 11, and 13). This design basis includes a justification, which is based upon WCAP-1 0271, Supplement 2, Revision 1, "Evaluation of Surveillance Frequencies and Out of Service Times

for the Reactor Protection Instrumentation System," for the single failure criterion for one-out-of-two systems during channel bypass and for two-out-of-four systems that have a control/protection interaction.

Figure 3.1-1 depicts the P-15 function, as performed by the associated equipment within the Seabrook's safety instrumentation architecture. As shown in Figure 3.1-1, the modification for the P-15 function is consistent with the licensee's existing instrumentation architecture for Sl.

This architecture includes four channels (I through IV) of pressurizer pressure transmitters, where each provides an input to one of four electrically isolated and physically separated process protection cabinets and pressurizer pressure transmitters. Channel numbers Ill and IV share a common sensing line. This architecture also includes two electrically isolated and physically separated trains of SSPS (A and B), where each train controls one and only one charging-to-cold-leg injection valve (1-SI-V-138 or 1-SI-V-139, respectively).

The modification adds a P-151ow pressurizer pressure bistable channel with bypass test capability to each of four process protection cabinets. Each process protection cabinet provides its P-15 low pressurizer pressure bistable as a two-state analog signal to two SSPS input cabinets. Each SSPS input cabinet is part of a separate and redundant instrumentation and control train of the SSPS.

The modification adds four P-15low pressurizer pressure bistable inputs to each SSPS input cabinet. Consistent with the licensee's existing safety instrumentation architecture, each low pressurizer pressure bistable signal input to the SSPS input cabinets provides an automatic monitoring point and a manual indication, which is not shown for simplicity. SSPS cabinets provide an optically isolated interface with the equipment used for automatic monitoring and manual indication to preserve electrical separation of the SSPS trains. Also, consistent with the licensee's existing safety instrumentation architecture, physically separate circuitry within each SSPS input cabinet maintains electrical isolation via relay coils for the four P-15 low pressurizer pressure bistable signals it receives. The relay coils preserve bistable channel identity and provide coil to contact isolation between individual P-15 low pressurizer pressure bistable signals and the SSPS train's logic. The SSPS input cabinet within each SSPS train provides the post-isolated P-15 low pressurizer pressure bistable signals to two-out-of-four voting logic within its train in a manner consistent with the licensee's existing safety instrumentation architecture and the generation of the train's ESFAS high-head Sl signal (S-signal).

The modification implements P-15 two-out-of-four voting logic in each SSPS train's logic cabinet in a manner consistent with the licensee's existing safety instrumentation architecture.

However, for P-15, the two-out-of-four voting logic is additionally implemented redundantly within each SSPS train. The modification uses spare SSPS logic matrices of existing components within each SSPS logic cabinet to perform two-out-of-four voting on the four P-15 low pressurizer pressure bistable signals in a manner consistent with generation of the train's S-signal. Each of the redundant two-out-of-four voting circuits for P-15 produces its own relay control signal. For each SSPS train, its two P-15 relay control signals drive corresponding relays in a manner consistent with the licensee's existing safety instrumentation architecture and the generation of the train's S-signal.

Each SSPS logic cabinet provides the result of both P-15 two-out-of-four voting decisions to the SSPS train's output relay cabinet in a manner consistent with the licensee's existing safety

instrumentation architecture and the train's S-signal. Each two-out-of-four voting result is provided with an automatic monitoring point, which is not shown for simplicity. The SSPS cabinets provide optically isolated interfaces with the equipment used for this automatic monitoring to preserve electrical separation of the SSPS trains.

Channel,-based I ll ill N

~ Separation Pr~~eJ o:>zr>

i Groups Pressc.te {Press)

{'

{

Process Sensing

.1::: ~~nets~-

P-15 (Low Pzr Press)

Bis1able P-15 (Low Pzr Press)

Bistable P-15 (Low Pzr Press)

Bis1able P-15 (Low Pzr Press)

Bis1able

~............................................................... ....................... ..............................................................

Analog Bistable Connections between Protection Process and r.................................................................t......t.......1............

Solid-State Protection System

~~*{ I IT ill IV Solid-State 2/4 2/4 2/4 2/4 ProtectiOn P-15 P-15 P-15 P-15 System (SSPS) Logic Bay B, Gabinet A, ~ B2 lnstrtmeiltaliori

~~==--!==ts~~*goo~ '-;:r;:=._!=~S-S~ignals

,----(existing} (existing}

Otiput Relay

. Train-based Cabinet

&islillf1AdwlioiJS/gn81

.i t;~;~~::. .;~~;.~. ~.i~~:t~~-~~. . .A............................~.:~.~~~---Jl..........................J Figure 3.1-1 Simplified Functional Block Diagram for P-15 Modification The modification implements P-15 relay control circuitry in each SSPS train's output relay cabinet. The redundant P-15 relays are connected in series to form a two-out-of-two logic combination, which is further in series with the S-signal, to control actuation of a charging-to-cold leg injection valve. These modified relay controls create the P-15 permissive that prevents charging-to-cold leg injection valves from automatically opening or that allows it to open. The output of each two-out-of-two combination of the redundant P-15 two-out-of-four voting results is provided with a manual indication, which is not shown for simplicity. These manual indications reflect the state of the P-15 function for each SSPS train. The SSPS cabinets provide optically isolated interfaces with the equipment used for these manual indications to preserve electrical separation of the SSPS trains.

Each train controls one of the redundant charging-to-cold leg injection valves (1-SI-V138 or 1-SI-V139). The configuration does not alter the existing connections between the output relay cabinets and the charging-to-cold leg injection valves, because the connections among the pair of P-15 relay control signals and the S-signal are made within each train's output relay cabinet.

As a result of this modification, each SSPS train of the P-15 functionality will prevent automatic opening of its charging-to-cold leg injection valve until both portions of the train's redundant voting logic determines two-out-of-four low pressurizer pressure signals have decreased to the P-15 setpoint and remain below the P-15 reset point. Conversely, each SSPS train of the P-15 functionality will allow automatic opening of its charging-to-cold leg injection valve whenever at least one portion of the train's redundant voting logic determines 3-out-of-4 low pressurizer pressure signals have not decreased to the P-15 setpoint or have since increased above the P-15 reset point.

The arrangement of redundancies between the process protection channels and SSPS trains, the selection of the P-15 setpoint value, and the interfaces between plant protection cabinets and SSPS cabinets prevent both charging-to-cold leg injection valves from automatically opening under process conditions not requiring high-head Sl. These factors also permit at least one charging-to-cold leg injection valve to automatically open under process conditions requiring high-head Sl.

4.1.2 Description Independence Between Redundant Protective Functions IEEE Std. 279-1971, Clause 4.6, "Channel Independence," requires, in part, independence between channels providing signals for the same protective function. The independence is required, in part, to decouple the effects of unsafe environmental factors and electric transients, and to reduce the likelihood of interactions between channels during maintenance operations or in the event of channel malfunction.

GDC 21, Protection system reliability and testability, states, in part, that:

The protection system be designed for high functional reliability and in service testability commensurate with the safety functions to be performed. Redundancy and independence designed into the protection system shall be sufficient to assure that: (1) no single failure results in loss of the protection function, and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated. The protection system shall be designed to permit periodic testing of its functioning when the reactor is in operation, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.

Seabrook UFSAR Sections 3.1.3.2, 7.1.2.1e, 7.3.1.1, and 7.3.2.2 identify applicability of GDC 21 to this LAR.

GDC 22, Protection system independence, states, in part, that:

The protection system be designed to assure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function, or shall be demonstrated to be acceptable on some other defined basis.

Design techniques, such as functional diversity or diversity in component design and principles of operation, shall be used to the extent practical to prevent loss of the protection function.

Seabrook UFSAR Sections 3.1.3.3, 7.1.2.1 e, 7.1.2.2, 7.3.1.1, and 7.3.2.2 identify applicability of GDC 22 to this LAR.

The licensee provided its evaluation against GDC 21 and GDC 22 in Section 4.1 of the LAR, dated March 13, 2013.

In addition to IEEE Std. 279-1971, and consistent with its UFSAR design basis, the licensee concluded that the rationale within WCAP-1 0271, Supplement 2, Revision 1 for the single failure exception for one-out-of-two systems also applies to two-out-of-three and two-out-of-four systems, where acceptable reliability of operation can be demonstrated. The licensee justified its conclusion based on the continued applicability of WCAP-1 0271 to P-15. The existing Seabrook design basis applies the WCAP-1 0271 exception to low pressurizer pressure for Sl.

The licensee indicated in its response to RAI 11 that this exception similarly applies to the P-15 function in the letter dated August 8, 2013.

The pressurizer pressure transmitters and process protection cabinets are redundant components that support the P-15 function. Consistent with the current Seabrook licensing basis and instrumentation, the P-15 function maintains channel independence between process protection channels I through IV. One of four pressurizer pressure transmitters supplies process input to one of four process protection cabinets to form four separate instrument channels to independently monitor pressurizer pressure and generate a P-15 bistable. These four instrument channels maintain electrical independence from one another from the sensor through the process protection cabinets. Each process protection cabinet uses a power source that is independent from the others. No signals required for the P-15 function are shared among process protection cabinets. The design of the instrument channels allows each to be independently maintained and tested.

Similarly, each train of SSPS cabinets and the charging-to-cold-leg injection valves are redundant components that support the P-15 function. Consistent with the current Seabrook licensing basis and instrumentation, the P-15 function maintains independence between SSPS train A and B. These two trains maintain electrical independence between one another from the input cabinet to charging-to-cold-leg injection valve. Additionally, each SSPS input cabinet provides input relay coils to preserve instrumentation channel identity and coil to contact isolation to isolate the channel inputs from SSPS logic. Each SSPS train uses a power source that is independent from the other. No signals required for the P-15 function are shared between SSPS trains. The design of the SSPS trains allows each to be independently maintained and tested.

By letter dated August 8, 2013, the licensee's response to RAis 1, 2, 3 and 4 clarified the modification's consistency with Seabrook's existing safety instrumentation architecture to maintain the Seabrook design basis for independence between redundant protective functions.

In part, the licensee's response stated the physical separation and electrical isolation meet the intent of Clauses 5.6.1 and 5.6.3 of IEEE Std. 603-1991. Additionally, the licensee's response to RAI 5 stated, in part, that "there are no deviations to the design basis of the SSPS for the P-15 modification." As such, the design of the P-15 function and the associated modifications conform to the SSPS design basis in the Seabrook UFSAR for functional and electrical independence.

The NRC staff reviewed the LAR, as supplemented by RAI responses, for conformance to the regulatory acceptance criteria applicable to Seabrook for independence between redundant components that provide the P-15 function.

The NRC staff determined the P-15 modification meets the regulatory acceptance criteria applicable to Seabrook for independence between redundant components that perform the P-15 function. This determination is based on the modification's implementation of the P-15 function in redundant components that maintain independence consistent with the Seabrook design basis.

4.1.3 Separation between Redundant Equipment IEEE Std. 279-1971, Clause 4.6, "Channel Independence," requires, in part, separation between channels providing signals for the same protective function. The separation is required to decouple of the effects of unsafe environmental factors and physical accident consequences documented in the design basis.

Regulatory Guide 1.75, "Criteria for Independence of Electrical Safety Systems," Revision 3, describes a method acceptable to the NRC staff for meeting physical independence of the circuits and electrical equipment that comprise or are associated with safety systems.

Seabrook UFSAR Section 7.1.2.2 identifies the licensee's conformance to an earlier revision of Regulatory Guide 1.75. Regardless, Section 7.1.2.2 discusses independence of redundant sensing lines, installation of electrical cables and the routing of redundant signals, and physical separation of redundant safety components.

The pressurizer pressure transmitters and process protection cabinets are redundant safety components that support the P-15 function. Consistent with the current Seabrook licensing basis and instrumentation, four instrument channels maintain physical separation from one another from sensor through the process protection cabinet for the P-15 function. Physical separation of pressurizer pressure channel Ill and IV sensing lines is not included in the current Seabrook licensing basis to the same degree that physical separation exists among channels I, II, and III/IV. Nevertheless, limited physical separation exists between the pressurizer pressure transmitters Ill and IV, and cable routing further maintains physical separation from the sensor outputs to the physically separate instrumentation channels.

Similarly, each train of SSPS cabinets and the charging-to-cold-leg injection valves are redundant safety components that support the P-15 function. Consistent with the current

Seabrook licensing basis and instrumentation, SSPS train A and B maintain physical separation between one another from input cabinet to charging-to-cold-leg injection valve for the P-15 function.

By letter dated August 8, 2013, the licensee's response to RAis 2, 3 and 4 clarified the modification's consistency with Seabrook's existing safety instrumentation architecture to maintain the Seabrook design basis for separation between redundant equipment that performs a protective function. In part, the licensee's response stated the physical separation meets the intent of Clause 5.6.1 of IEEE Std. 603-1991. Additionally, the licensee's response to RAI 5 stated, in part, that "there are no deviations to the design basis of the SSPS for the P-15 modification." As such, the design of the P-15 function and the associated modifications conform to the SSPS design basis in the Seabrook UFSAR for physical separation.

The NRC staff reviewed the LAR, as supplemented by RAI responses, for conformance to the regulatory acceptance criteria applicable to Seabrook for separation between redundant safety components that provide the P-15 function.

The NRC staff determined the P-15 modification meets the regulatory acceptance criteria applicable to Seabrook for separation between redundant components that perform the P-15 function.

This determination is based on the modification's implementation of the P-15 function in redundant safety components that maintain physical separation consistent with the Seabrook design basis.

4.1.4 Independence from Nonsafety Equipment IEEE Std. 279-1971, Clause 4.7.2, "Isolation Devices," states, in part, that the transmission of signals from protection system equipment for control system shall be through isolation devices, which are classified as part of the protection system and meet all the requirements of the standard. No credible failure at the output of an isolation device shall prevent the associated protection system channel from meeting the minimum performance requirements specified in the design bases.

NRC Branch Technical Position 7-11, "Guidance on Application and Qualification of Isolation Devices," provides guidelines for reviewing the use of electrical isolation devices to allow connections between redundant portions of safety systems or between safety and non-safety systems. However, this branch technical position post-dates the Seabrook design basis.

Regardless, Seabrook UFSAR Sections 7.1.2.2b and 7.2.1.1 h identify the use of qualified isolators (isolation amplifiers), which are part of the protection system, for outputs of the process instrumentation for nonprotective functions. The outputs for nonprotective functions include signals used for control, remote process indication, and computer monitoring. Furthermore, the isolators were qualified by type test. Additionally, UFSAR Section 7.2.2.2c states, in part, that

"[t]he isolation amplifiers are designed so that a short circuit, open circuit, or the application of credible fault voltages from within the cabinets on the isolated output portion of the circuit (i.e.,

the non protective side of the circuit) will not affect the input (protective) side of the circuit."

By letter dated August 8, 2013, the licensee's response to RAI 4 clarified the modification's consistency with Seabrook's existing safety instrumentation architecture to maintain the Seabrook design basis for independence from nonsafety equipment. In part, the licensee's response stated the electrical isolation meets the intent of clause 5.6.3 of IEEE Std. 603-1991.

Additionally, the licensee's response to RAI 5 stated, in part, that "there are no deviations to the design basis of the SSPS for the P-15 modification." As such, the design of the P-15 function and the associated modifications conform to the SSPS design basis in the Seabrook UFSAR for the use of qualified isolators.

The NRC staff reviewed the LAR, as supplemented by RAI responses, for conformance to the regulatory acceptance criteria applicable to Seabrook for independence of the components that provide the P-15 function from nonsafety equipment.

The NRC staff determined the P-15 modification meets the regulatory acceptance criteria applicable to Seabrook for independence of the components that provide the P-15 function from nonsafety equipment. This determination is based on the modification's protection of the P-15 functions from nonsafety equipment failures through the use of qualified isolators that are classified as part of the safety system.

4.1.5 Separation of Protection and Control IEEE Std. 279-1971, Clause 4.7.3, "Single Random Failure," states, in part, that "[w]here a single random failure can cause a control system action that results in a generating station condition requiring protective action and can also prevent proper action of a protection system channel designed to protect against the condition, the remaining redundant protection channels shall be capable of providing the protective action even when degraded by a second random failure." Furthermore, IEEE Std. 279-1971, Clause 4.7.3 goes on to state, in part, that

"[p]rovisions shall be included so that this requirement can still be met if a channel is bypassed or removed from service for test or maintenance purposes."

GDC 24, Separation of protection and control systems, states, in part, that:

The protection system be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel that is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the protection system. Interconnection of the protection and control systems shall be limited so as to assure that safety is not significantly impaired.

Seabrook UFSAR Sections 3.1.3.5, 7.2.2.2c, 7.3.1.1, and 7.3.2.2 identify applicability of GDC 24 to this LAR. Seabrook UFSAR Section 7.2.2.2c discusses control and protection system interaction. As discussed in Section 4.1.3 of this evaluation, Section 7.2.2.2c provides qualified isolation amplifiers for interfaces between protection and control.

Seabrook UFSAR Section 7.2.2.3 discusses specific control and protection interactions including the use of the pressurizer pressure protection channel signals for control of pressurizer spray, pressurizer heater, and power-operated relief valve control. These signals

are provided through qualified isolation amplifiers. The qualified isolation amplifiers ensure a failure in the control circuitry does not adversely affect a protection channel.

By letter dated March 13, 2013, the licensee provided its evaluation against GDC 24 in Section 4.1 of the LAR.

By letter dated August 8, 2013, the licensee's response to RAI 12 clarified the modification's consistency with Seabrook's existing safety instrumentation architecture to maintain the Seabrook design basis for the separation of protection and control. The response identifies the pressurizer pressure instruments that are used for control functions in addition to P-15, including the ability to select between a pressurizer pressure instrument channel normally used for control to a backup pressurizer pressure channel, and isolation of all signals providing control functions from the protection signals. The licensee's response relied on the low probability of a common sensing line failure, for which Seabrook UFSAR Section 7.1.2.12 provides an exception to RG 1.151, "Instrument Sensing Lines," for pressurizer pressure. As such, the licensee stated that GDC 24 is satisfied, because there are no single failures in the pressurizer pressure control system or protection system that would adversely affect the accomplishment of the protection system functions. Additionally, the licensee's response to RAI 5 stated, in part, that "there are no deviations to the design basis of the SSPS for the P-15 modification." As such, the design of the P-15 function and the associated modifications conform to the SSPS design basis for separation of protection and control documented in the Seabrook UFSAR.

The NRC staff reviewed the LAR, as supplemented by RAI responses, for conformance to the regulatory acceptance criteria applicable to Seabrook for separation of protection and control for the P-15 function.

The NRC staff determined the P-15 modification meets the regulatory acceptance criteria applicable to Seabrook for separation of protection and control for the P-15 function based on the modification's adherence to the Seabrook design basis for separation between protection and control.

4.1.6 Setpoint Methodology and Calculation GDC 15, Reactor coolant system design, requires the RCS and associated auxiliary, control, and protection systems to be designed with sufficient margin to assure the design conditions of the reactor coolant pressure boundary are not exceeded during any condition of normal operation, including anticipated operational occurrences.

Seabrook UFSAR Sections 3.1.2.6 and 7.2.2.2 identify applicability of GDC 15 to this LAR.

RG 1.105, "Setpoints for Safety-Related Instrumentation," Revision 3, describes a method acceptable to the NRC staff for complying with the NRC's regulations for ensuring instrumentation setpoints are initially within and remain within the TS limits. This RG endorses Part I of ISA-S67.04-1994, "Setpoints for Nuclear Safety-Related Instrumentation," subject to NRC staff clarifications. Seabrook UFSAR Section 7.1.2.1 i identifies the licensee's conformance to an earlier revision of RG 1.1 05. Section 7 .1.2.1 i states the methodology applied to determine safety-related setpoints comply with the methodology outlined in RG 1.105 (Rev 1), as supplemented by the information presented in ISA Standard S67.04 (Draft F).

Branch Technical Position 7-12, "Guidance on Establishing and Maintaining Instrument Setpoints," provides guidelines for reviewing the process an applicanUiicensee follows to establish and maintain instrument setpoints. However, this branch technical position post-dates the Seabrook design basis. Regardless, Seabrook UFSAR Section 7.1.2.1 i states that the bistable trip setpoints assist the ESFAS in mitigating the consequences of accidents.

Furthermore, Seabrook UFSAR Section 7.1.2.1 i states that the methodology to derive the nominal trip setpoints is based upon the statistical combination of all uncertainties in the channels and applying this total uncertainty with margin in the conservative direction.

By letter dated March 13, 2013, the licensee provided its evaluation against GDC 15 in Section 4.1 of the LAR.

By letter dated August 8, 2013, the licensee's response to RAI 13 clarified the modification's consistency with Seabrook's existing setpoint methodology and calculation method to produce conservative setpoints with margin. The response identifies the NRC staff's prior acceptance of this methodology for use in Seabrook License Amendment 101. The licensee's response demonstrated its use of a square root of the sum of the squares of error terms per ISA S67.04.01. Furthermore, the calculations demonstrated the suitability of the nominal value and allowable value range for the P-15 setpoint in consideration of design basis limits and error terms. The resulting nominal value and allowable value range match those proposed for the P-15 function in TS Table 3.3-4. Additionally, the licensee's response to RAI 5 stated, in part, that "there are no deviations to the design basis of the SSPS for the P-15 modification." As such, the design of the P-15 function and the associated modifications conform to the SSPS design basis in the Seabrook UFSAR for bistable trip setpoints.

The NRC staff reviewed the LAR, as supplemented by RAI responses, for conformance to the regulatory acceptance criteria applicable to Seabrook for the P-15 function setpoint.

The NRC staff determined the P-15 modification meets the regulatory acceptance criteria applicable to Seabrook for the P-15 setpoint. This determination is based on the modification's adherence to the Seabrook design basis for bistable trip setpoints including Seabrook's previously reviewed and approved setpoint determination method.

4. 1. 7 Safety Function Reliability IEEE Std. 279-1971, Clause 4.1, "General Functional Requirement," states, in part, that "[t]he nuclear power generating station protection system shall, with precision and reliability, automatically initiate appropriate protective action whenever a condition monitored by the system reaches a preset level."

GDC 21 requires, in part, that:

The protection system to be designed for high functional reliability commensurate with the safety functions to be performed. Redundancy and independence designed into the protection system shall be sufficient to assure that (1) no single failure results in loss of the protection function and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated ...

Seabrook UFSAR Sections 3.1.3.2, 7.1.2.1 e, 7.3.1.1, and 7.3.2.2 identify applicability of GDC 21 to this LAR.

By letter dated March 13, 2013, the licensee provided its evaluation against GDC 21 in Section 4.1 of the LAR.

By letter dated August 8, 2013, the licensee's response to RAis 9, 10, 11, and 13 clarified the modification's consistency with Seabrook's existing safety instrumentation architecture to maintain the Seabrook design basis for safety function reliability. The licensee's response to RAI 9 describes the behavior of components that implement the P-15 function in response to losses of power.

The licensee's response to RAI 10 describes the implementation of the P-15 function using components, which are the same as those currently used in the process protection cabinets and SSPS cabinets at Seabrook, and have been designed for high functional reliability and in-service testability. In its RAI 10 response, the licensee concluded no significant increase in Core Damage Frequency (CDF) or Large Early Release Frequency (LERF) results from the inclusion of additional components in the success path to automatically open the charging-to-cold leg injection valves. The licensee stated that the inclusion of the P-15 function will provide the benefit of a small improvement to CDF and further concluded the reliability of the P-15 function is commensurate with its safety significance. Lastly, the licensee stated that reliability commitments for the ECCS remain as described in the Seabrook UFSAR Section 6.3.2.5. The licensee also confirmed that the manual capability to open the charging-to-cold leg injection valves is not altered by inclusion of the P-15 function.

The licensee's response to RAI 11 function confirmed the exception for two-out-of-four systems that have a control/protection applied to low pressurizer pressure for safety injection. This response stated the WCAP-1 0271 , Supplement 2, Revision 1 provides the basis for the statement of "acceptable reliability of operation."

The licensee's response to RAI 13 demonstrated the P-15 function will automatically initiate, with precision and reliability, whenever a condition monitored by the system reaches a preset level.

Additionally, the licensee's response to RAI 5 stated, in part, that "there are no deviations to the design basis of the SSPS for the P-15 modification." As such, the design of the P-15 function and the associated modifications conform to the SSPS design basis for safety function reliability documented in the Seabrook UFSAR.

The NRC staff reviewed the LAR, as supplemented by RAI responses, for conformance to the regulatory acceptance criteria applicable to Seabrook for P-15 functional reliability.

The NRC staff determined the P-15 modification meets the regulatory acceptance criteria applicable to Seabrook for the P-15 functional reliability. This determination is based on the modification's adherence to the Seabrook design basis including the Seabrook's previously reviewed and approved safety instrumentation architecture, exceptions, and setpoint determination method.

4.1.8 Bypass Capability The regulations in 10 CFR 50.34 (f)(2)(v) require automatic indication of the bypassed and operable status of safety systems.

IEEE Std. 279-1971, Clause 4.11, "Channel Bypass or Removal from Operation," states, in part that "[t]he system shall be designed to permit any one channel to be maintained, and when required, tested or calibrated during power operation without initiating a protective action at the systems level. During such operation the active parts of the system shall of themselves continue to meet the single failure criterion." Clause 4.11 also identifies an exception based on the reliability of operation, and the time interval and duration required to perform a test, calibration, or maintenance operation on a bypassed channel. Clause 4.13, "Indication of Bypass," requires continuous indication of portions of a system that perform a protective action that have been bypassed or deliberately rendered inoperable. Clause 4.14, "Access to Means for Bypassing," provides for administrative control of the means for manually bypassing a channel or protective function.

GDC 21 requires, in part, the protection system to be designed for in service testability commensurate with the safety functions to be performed. Bypass capability supports satisfying GDC 21, because it facilitates in service testability of a redundant and independent portion of a system that performs a protective action.

Seabrook UFSAR Sections 3.1.3.2, 7.1.2.1e, 7.3.1.1, and 7.3.2.2 identify applicability of GDC 21 to this LAR.

RG 1.47, "Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems,"

Revision 1, describes a method acceptable to the NRC staff for complying with IEEE Std. 603-1991 for bypassed and inoperable status indication for nuclear power plant safety systems.

Seabrook UFSAR Sections 7 .1.2.6 and 7.5.3 identify the licensee's conformance to an earlier revision of RG 1.47. Regardless, Section 7.1.2.6 states system level bypassed and inoperable status indication applies to Sl. Furthermore, Section 7.5.3 states indications are provided to monitor valve position, actuated equipment status and emergency power availability for cold leg injection. Section 7.5.3 also states the bypassed/inoperable condition of safety systems and ESF actuation signals are displayed on the MCB for each train.

By letter dated March 13, 2013, the licensee provided its evaluation against GDC 21 in Section 4.1 of the LAR.

By letter dated August 8, 2013, the licensee's response to RAis 7 and 8 clarified the modification's consistency with Seabrook's existing safety instrumentation architecture to maintain the Seabrook design basis for bypass capability and indication of the P-15 function.

The licensee's response to RAI 7 described the use of the Bypass Test Instrumentation signals, which are enabled under administrative control of a keylock and allow testing P-15 bistable channels one at a time. The licensee's response to RAI 7 described the indication provided to operators that a process protection cabinet has been enabled for BYPASS. The licensee's response to RAI 7 also stated that when one channel is in bypass, the P-15 logic in the SSPS will temporarily perform two-out-of-three voting, rather than the normal two-out-of-four voting to meet the intent of IEEE Std. 603-1991, Clause 6.7.

The licensee's response to RAI 8 confirmed that no specific bypass exists for the P-151ogic within the SSPS cabinets and that semi-automatic testing of each P-15 circuit will be performed in the same manner as the other SSPS two-out-of-four logic testing. The two trains of SSPS logic are tested one train at a time, and during the logic testing of one train, the other train can initiate any ESFAS function required by plant conditions.

Additionally, the licensee's response to RAI 5 stated, in part, that "there are no deviations to the design basis of the SSPS for the P-15 modification." As such, the design of the P-15 function and the associated modifications conform to the SSPS design basis in the Seabrook UFSAR for bypass capability and indication.

The NRC staff reviewed the LAR, as supplemented by RAI responses, for conformance to the regulatory acceptance criteria applicable to Seabrook for P-15 bypass capability.

The NRC staff determined the P-15 modification meets the regulatory acceptance criteria applicable to Seabrook for the P-15 bypass and indication. This determination is based on the modification's adherence to the Seabrook design basis, which includes the bypass capability with indication for Sl, using Seabrook's previously reviewed and approved safety instrumentation architecture.

4.1.9 Calibration and Test Capability IEEE Std. 279-1971, Clause 4.1 0, "Capability for Test and Calibration," states, in part, that:

Capability shall be provided for testing and calibrating channels and the devices used to derive the final system output signal from the various channel signals.

For those parts of the system where the required interval between testing will be less than the normal time interval between generating station shutdowns, there shall be capability for testing during power operation.

GDC 21 requires, in part, the protection system to be designed for in service testability commensurate with the safety functions to be performed. The protection system shall be designed to permit periodic testing of its functions when the reactor is in operation, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.

Seabrook UFSAR Sections 3.1.3.2, 7.1.2.1e, 7.3.1.1, and 7.3.2.2 identify applicability of GDC 21 to this LAR.

RG 1.22, "Periodic Testing of Protection System Actuation Functions," Revision 0, describes a method acceptable to the NRC staff for inclusion of actuation devices in the periodic tests of the protection system during reactor operation.

Seabrook UFSAR Sections 7.1.2.5 and 7.3.2.2 identify the licensee's conformance to this revision of RG 1.22. Specifically, Section 7.3.2.2 states:

During online operation of the reactor, all of the Engineered Safety Features Actuation System monitoring and logic circuitry will be fully tested. All active components will be tested at the operational test frequency. A lower testing frequency may be justified if adequate reliability is assured. Passive components will be tested at the operational test frequency where practicable. All components will be tested at the channel calibration frequency. In addition, essentially all of the Engineered Safety Features actuated equipment, with the exceptions listed in Section 7.1.2.5, will be fully tested. The remaining actuated equipment whose operation is not compatible with continued online plant operation will be checked by means of continuity check of associated testable actuation devices or overlapping testing.

Branch Technical Position 7-8, "Guidance for Application of Regulatory Guide 1.22," allows an applicant/licensee with a construction permit issued between January 1, 1971, and May 13, 1999, to elect to comply with the requirements stated in IEEE Std. 279-1971.

Seabrook UFSAR Table 7.1-1 identifies an earlier version of Branch Technical Position 7-8, as "BTP EICSB 22," and references Section 7.1.2.5 for the conformance discussion.

RG 1.118, "Periodic Testing of Electric Power and Protection Systems," Revision 3, describes a method acceptable to the NRC staff for complying with the Commission's regulations as they apply to the periodic testing of electric power and protection systems.

Seabrook UFSAR Section 7.3.2.3d identifies the licensee's conformance to an earlier revision of RG 1.118 for ESFAS. Regardless, Section 7.3.2.3d states the design conforms to the guidance of RG 1.118, as supported by the capability to perform the surveillance tests specified in the TSs "without interfering with normal plant operation or the use of jury-rigs or lifted leads."

Branch Technical Position 7-17, "Guidance on Self-Test and Surveillance Test Provisions,"

provides guidelines for reviewing the design of the self-test and surveillance test provisions.

However, this branch technical position post-dates the Seabrook design basis and largely assumes digital computer-based components that provide an automatic self-test capability.

Branch Technical Position 7-17 is not used in this evaluation, because it only created new acceptance criteria for digital computer-based instrumentation and controls systems to include self-test features while the modification does not introduce digital computer-based components.

Seabrook UFSAR Section 7.1.2.11 discusses conformance to IEEE Std. 338-1975 for the periodic testing of the Reactor Trip System and the ESFAS. In part, Seabrook UFSAR Section 7.1.2.11 states, in part, that:

The surveillance requirements of the Technical Specifications for the protection system ensure that the system functional operability is maintained comparable to the original design standards. Periodic tests at frequent intervals, or as determined by probabilistic risk/reliability evaluations, demonstrate this capability.

The periodic time interval discussed in IEEE Standard 338-1975, and specified in the plant Technical Specifications, is conservatively selected to ensure that equipment associated with protection functions has not drifted beyond its minimum performance requirements. If any protection channel appears to be marginal, or requires more frequent adjustments due to plant condition changes, the time interval will be decreased to accommodate the situation until the marginal performance is resolved.

The test interval discussed in IEEE Standard 338-1975 is developed primarily on past operating experience and modified, if necessary, to assure that system and subsystem protection is reliably provided. Analytic methods for determining reliability are not used to determine test interval.

By letter dated March 13, 2013, the licensee provided its evaluation against GDC 21 in Section 4. 1 of the LAR.

The licensee stated in the LAR that testing features are provided to detect credible failures during testing, such as the failure of a tested contact to return to an open condition.

By letter dated August 8, 2013, the licensee's response to RAis 6, 7 and 8 clarified the modification's consistency with Seabrook's existing safety instrumentation architecture to provide a calibration and test capability for the P-15 function.

The licensee's response to RAI 6 described the overall test capabilities that support the P-15 function with signal overlap. This description discusses the test methods and intervals. The description relies on pressurizer pressure "Channel Checks" to confirm calibration of the P-15 setpoint. The licensee's response concluded that testing of the P-15 permissive is consistent with Section 7.3 of the UFSAR and satisfies the testability portion of GDC 21 for testing during power operations, as clarified within in the UFSAR. Part of the clarification that applies to the P-15 function states the slave relays for the P-15 "BLOCK" function will be tested during power operations, but the slave relays for the P-15 "GO" function will be tested at refueling intervals.

Section 4.1.8 of this evaluation discusses the licensee's response to RAis 7 and 8.

Additionally, the licensee's response to RAI 5 stated, in part, that "there are no deviations to the design basis of the SSPS for the P-15 modification." As such, the design of the P-15 function and the associated modifications conform to the SSPS design basis in the Seabrook UFSAR for calibration and test capability.

The NRC staff reviewed the LAR, as supplemented by RAI responses, for conformance to the regulatory acceptance criteria applicable to Seabrook for P-15 calibration and test capability.

The NRC staff determined the P-15 modification meets the regulatory acceptance criteria applicable to Seabrook for the P-15 calibration and test capability. This determination is based on the modification's adherence to the Seabrook design basis, which includes the calibration and test capability, using Seabrook's previously reviewed and approved safety instrumentation architecture. This calibration and test capability allows testing of the P-15 function path with signal overlap without interfering with normal plant operation or the use of temporary jumpers or lifted leads.

4.2 Reactor Systems Charging flow, through the cold leg Sl valves, is provided as part of the plant's ESF, to inject borated water from the RWST into the four RCS cold legs. Seabrook's current design causes these valves to open when an Sl signal is received from the ESFAS. The licensee proposes to add a cold leg injection permissive to the ESFAS, and designate it as interlock P-15. The new ESFAS interlock P-15 will block the automatic opening of the cold leg Sl valves whenever the pressurizer pressure is greater than the P-15 setpoint. In the modified ESFAS, the cold leg Sl valves will open only when there is an Sl signal present and pressurizer pressure is lower than the P-15 setpoint. Since the proposed P-15 pressure setpoint is higher than the low pressurizer pressure Sl setpoint, there could be a delay in opening of the cold leg Sl valves if the Sl signal is derived from conditions that could be produced before the P-15 pressure setpoint is reached (e.g., high containment pressure or low steam line pressure).

The licensee evaluated four events, all of which model ECCS actuation, in support of its proposal to add the P-15 interlock, or cold leg injection permissive, to the ECCS actuation logic:

(1) steam system piping failure, (2) feedwater system pipe break, (3) inadvertent operation of ECCS during power operation, and (4) eves malfunction that increases reactor coolant inventory.

The first two events tend to rely upon Sl signals that are obtained from conditions other than low-low pressurizer pressure. ECCS delivery, during these events, could be delayed.

The third event could be directly affected by the presence of the P-15 interlock. It is expected that the fourth event would not be affected by the presence of the P-15 interlock.

The licensee used an NRC-approved computer code, RETRAN, and NRC-accepted methodologies for each accident and transient analysis.

4.2.1 Steam System Piping Failure The steam release resulting from a rupture of a main steam (MS) pipe will result in an increase in steam flow, a reduction of coolant temperature and pressure, and an increase in core reactivity. The increase in core reactivity may cause an increase in power level, or, if the core is subcritical, a decrease in shutdown margin. Analyses of steam system piping failures are

performed to evaluate changes in core reactivity, and to calculate mass and energy release rates for containment pressure response analyses and environmental qualification of safety-related equipment. The licensee considered three steam system piping failure cases of the latter, mass and energy release, variety:

(1) major steam line break that produces mass and energy releases inside containment, (2) major steam line break that produces mass and energy releases outside containment, and (3) minor steam line breaks (smaller than those cases that are analyzed for the UFSAR) that cause a safety signal to be generated; but does not release the P-15 interlock.

Hence, no Sl flow is delivered.

The licensee used the NRC-approved RETRAN computer code to calculate the core heat flux and the RCS temperature and pressure resulting from the cooldown.

Steam Line Break Inside Containment Two types of steam line breaks inside containment were analyzed: double-ended guillotine breaks and split breaks. The double-ended guillotine breaks completely sever the steam line, which results in unimpeded break flow from each pipe end. The split break is a longitudinal crack with an area that ranges from one square foot up to the cross-sectional area of the pipe.

For purposes of this P-15 evaluation, the Sl signal is derived from low steam line pressure when a double-ended guillotine break occurs, and from high containment pressure when a split break occurs. In both cases, delivery of Sl flow cannot commence until the P-15 interlock pressure is reached. The analyses were performed to determine the effect of delaying the Sl flow due to the requirement that the P-15 permissive must be present in order to open the cold leg Sl valves.

Steam Line Break Outside Containment Several steam line break mass and energy release cases, outside containment, were also re-evaluated by the licensee. Each of these steam line break case analyses predicted that ECCS flow would be actuated by the low-low pressurizer pressure signal. The P-15 signal is received prior to the Sl low-low pressurizer pressure signal. Therefore, ECCS flow delivery is not delayed and the current analyses of record would remain valid after the P-15 addition is made.

Smaller Steam Line Break Sizes The licensee has also evaluated smaller steam line break sizes, in which an Sl actuation signal is received while the pressurizer pressure is higher than the P-15 setpoint (i.e., no ECCS flow is immediately delivered to the RCS cold legs). Sensitivity cases, in which the start time for ECCS injection is varied, including a case with no ECCS injection, indicate that the resulting mass and energy releases are not sensitive to the ECCS delivery start times. The licensee stated that the results were expected because the ECCS injection occurs at relatively low flow rates due to high RCS pressure, and boron injection occurs long after increasing RCS temperature has mitigated the return to power. The NRC staff agrees.

Hot Zero-Power Steam Line Break The licensee concluded that hot zero-power steam line break (i.e., the core reactivity response case) is still the limiting steam line break case. Sensitivity studies, in which the break size was varied, up to and including the flow area of the steam nozzle venturi, confirm that the maximum break size (i.e., the flow area of the venturi) remains the limiting break size for the hot zero-power steam line break after the P-15 addition is implemented. This is concluded from the results of analyses that show the P-15 permissive is reached in time to fully open the cold leg Sl valves before the ECCS flow becomes available. The NRC staff agrees.

Summary and

Conclusion:

Steam Line Break The steam line break is analyzed, by means of several case studies, to calculate mass and energy releases, and to show that a possible return to criticality will not result in unacceptable fuel clad damage. ECCS can be actuated as a result of the steam line break.

Major steam line breaks, especially those that occur inside containment, cause ECCS to be actuated by the low steam line pressure signal or by containment high pressure signal. Since these signals are generated before the P-15 permissive, there could be a delay in ECCS delivery of flow to the RCS cold legs. The delay has been shown to be insignificant, since the boron content of the ECCS flow has little or no effect upon core reactivity or power level. The steam line break is effectively ended when the faulted steam generator empties, thus ending the cool down.

For smaller steam line breaks, including those that occur outside containment, it is assumed that ECCS is actuated by the low-low pressurizer pressure signal. There is no delay in ECCS flow delivery, since the P-15 interlock is released (at a higher pressurizer pressure) before the low-low pressurizer pressure Sl actuation setpoint is reached. The addition of the P-15 permissive to the ECCS actuation logic would have no effect upon these steam line breaks.

The NRC staff has reviewed the licensee's analyses of steam system piping failure events and concludes that the licensee's analyses have adequately accounted for the effect of the proposed modification. The NRC staff further concludes that the licensee has demonstrated that the reactor protection and safety systems will continue to ensure that the ability to insert control rods is maintained, the RCPB pressure limits will not be exceeded, the RCPB will behave in a non brittle manner, the probability of a propagating fracture of the RCPB is minimized, and abundant core cooling will be provided. Based on this, the NRC staff concludes that the plant will continue to meet the requirements of GDCs 10, 15, 26, 27, 28, 31, and 35 following implementation of the proposed P-15 modification. Therefore, the NRC staff finds the proposed P-15 modification acceptable with respect to steam system piping failures.

4.2.2 Feedwater System Pipe Break A major feedwater (FW) line rupture is defined as a break in a FW line large enough to prevent the addition of sufficient FW to the SGs to maintain shell-side fluid inventory. Depending upon the size and location of the break and the plant operating conditions at the time of the break, the break could cause either an RCS cooldown (by excessive discharge of steam through the break) or an RCS heatup. Cases that can cause an RCS cooldown are covered by the analysis

of the steam line break event. Therefore, FW line rupture is evaluated as one of the events that can cause an RCS heatup.

Analysis of this event demonstrates the ability of the emergency FW system to remove core decay heat and thereby ensure that the core remains in a coolable geometry. It is inferred that the core remains covered with water (and coolable) by showing that the hot and cold leg temperatures remain subcooled until the emergency FW heat removal rate exceeds the RCS heat generation rate (mainly from decay heat). The analysis also demonstrates that the primary and secondary system pressures remain within 11 0-percent of their design pressures.

The FW line rupture event is classified as an ANS Condition IV event, a postulated accident or limiting fault, as defined by the ANS. Guidelines for the NRC staff's review of the FW line rupture event are provided in Section 15.2.8 of the SRP.

The RETRAN computer code was used to calculate the power transient and the associated temperatures of the reactor coolant various locations in the RCS. These are compared to the saturation temperature, which is based upon the RCS pressure. Demonstration that the hot and cold leg temperatures remain below the saturation temperature implies that the core remains covered throughout the transient. The major assumptions of the analysis are selected to conservatively maximize the RCS fluid temperatures and minimize the saturation temperature.

The licensee has reanalyzed the FW line rupture, with the additional conservatism of assuming no Sl flow. The results of the reanalysis show that the emergency FW system capacity is adequate to remove decay heat, to prevent overpressurizing the RCS, and to prevent uncovering the reactor core. The maximum hot leg temperature remains below the saturation temperature and therefore no fuel damage occurs. The pressurizer pressure remains below the RCS design pressure of 2485 pounds per square inch guage, thereby preventing RCS overpressurization. The RCS water level remains above the reactor core, and therefore, the core is kept covered. Since the maximum hot and cold leg temperatures remain below the saturation temperature throughout the transient, it is demonstrated that the core remains covered and coolable.

Summary and

Conclusion:

Feedwater System Pipe Break In the FW line rupture analysis, the Sl signal is derived from the low-low pressurizer pressure Sl signal. Therefore, the delivery of ECCS flow to the cold legs would not be affected by the implementation of the P-15 permissive.

The NRC staff has reviewed the licensee's analyses of FW system pipe breaks and concludes that the licensee's analyses have adequately accounted for operation of the plant after implementation of the proposed P-15 permissive. The NRC staff further concludes that the licensee has demonstrated that the reactor protection and safety systems will continue to meet the requirements of GDCs 10, 15, 26, 27, 28, 31, and 35 following implementation of the proposed P-15 modification. Therefore, the NRC staff finds the proposed P-15 modification acceptable with respect to FW system pipe breaks.

4.2.3 Inadvertent Operation of ECCS at Power An inadvertent actuation of the ECCS at power is a Condition II event that could be caused by operator error or by a spurious actuation signal. All the charging pumps are started, and they are used, by the ECCS, to pump borated water from the RWST into the RCS cold legs. The Sl pumps are also started; but they do not have the head to deliver flow into the RCS when the RCS is at nominal pressure.

The inadvertent ECCS actuation at power event will continue to add water to the RCS until the operator shuts off the ECCS. This event could develop into a more serious event (e.g., an SBLOCA), if the pressurizer fills, a pressurizer relief or safety valve opens, relieves water, and, since it is not qualified to relieve water, fails to reseat. The open valve would create an SBLOCA. This would be a violation of the ANS design requirement that prohibits escalation of a Condition II event to a Condition Ill or IV event, without the independent occurrence of another fault.

A simple way to demonstrate satisfaction of this ANS design requirement is to show that there is enough time for the operator to shut off the ECCS charging pump flow before the pressurizer can become water-solid. The possibility that a pressurizer relief or safety valve fails to reseat is thereby eliminated, since it will not relieve anything but steam (i.e., it will operate within its design parameters).

The licensee proposed to add a new permissive (P-15) to the RPS and ESFAS logic. The P-15 permissive would be set to a pressure value that is higher than the existing low-low pressurizer pressure safety injection signal setpoint. The P-15 permissive would permit the cold leg Sl valves to open automatically upon receiving the Sl signal, provided that the pressurizer pressure is below the P-15 setpoint. The proposed logic, therefore, would require the P-15 permissive, in addition to the Sl signal, to open the cold leg Sl valves, and allow delivery of ECCS charging pump flow into the RCS cold legs.

With the P-15 permissive in place, an Sl signal (whether valid or spurious) would not cause the ECCS to supply any charging flow to the RCS cold legs unless the pressurizer pressure is below the P-15 setpoint. Charging flow would continue to be delivered to the RCP seals, for cooling. RCP seal cooling flow would eventually fill the pressurizer and pressurize the RCS to pressure levels that can lift the pressurizer power-operated relief valves (PORVs) or pressurizer safety valves (PSVs). However, accident analysis results, submitted by the licensee, indicate that this would take more than an hour to occur. The NRC staff considers this time period to be sufficiently long for corrective operator action.

The inadvertent ECCS at power event is analyzed using the NRC-approved RETRAN computer code. The RETRAN computer code is used to simulate transient behavior in light-water reactor systems. The code includes a one-dimensional homogeneous equilibrium mixture thermal-hydraulic model, an ECCS model, and a non-equilibrium pressurizer model. The code computes pertinent plant variables including temperatures, pressures and power level.

Summary and

Conclusion:

Inadvertent Operation of ECCS at Power The NRC staff agrees that the licensee's proposed addition of the P-15 permissive would be effective in providing the Seabrook operators with sufficient time to deal with an inadvertent ECCS at power event.

The NRC staff has reviewed the licensee's analyses of the inadvertent operation of ECCS event and concludes that the licensee's analyses have adequately accounted for the effect of the P-15 permissive, and that these analyses were performed using acceptable analytical models. The NRC staff further concludes that the licensee has demonstrated that the reactor protection and safety systems will continue to ensure that the specified acceptable fuel design limits and the RCPB pressure limits will not be exceeded as a result of this event. Based on this, the NRC staff concludes that the plant will continue to meet the requirements of GDCs 10, 15, and 26 following the addition of the proposed P-15 permissive. Therefore, the NRC staff finds the proposed addition of the P-15 permissive to be acceptable with respect to the inadvertent operation of ECCS event.

4.2.4 Chemical Volume Control System Malfunction that Increases RCS Inventory The Chemical Volume Control System (CVCS) malfunction that increases RCS inventory is an ANS Condition II event that could be caused by operator error or a spurious actuating signal. In this case, if the charging system were under automatic control, and the pressurizer level channel that is used for charging control were to fail in the low direction, then: (1) the maximum amount of charging flow to be delivered to the RCS, and (2) letdown flow would be isolated.

Unlike the inadvertent operation of ECCS at power event, there is no immediate reactor trip signal. The automatic reactor trip signal could be obtained from conditions that result from the eves malfunction event.

The CVCS malfunction that increases RCS inventory event is analyzed using the NRC-approved RETRAN computer code. The RETRAN computer code is used to simulate transient behavior in light-water reactor systems. The code includes a one-dimensional homogeneous equilibrium mixture thermal-hydraulic model, an ECCS model, and a non-equilibrium pressurizer model. The code computes pertinent plant variables including temperatures, pressures and power level.

In many Westinghouse reactor protection system designs, there are channels in which control and protection functions are shared. The Westinghouse high pressurizer water level reactor trip logic consists of three channels, two of which must register high in order to demand an automatic reactor trip on high water level. One of these channels can be manually selected to also monitor pressurizer water level, and route the level measurement to the water level control system, which modulates charging and letdown flow rates to maintain the required pressurizer water level. If this level sensor fails in the low direction, then charging flow will increase, and initiate a Condition II eves malfunction event. Since the sensor is shared with a safety system, its failure could also prevent proper action of a portion of the safety system designed to protect against this event. An IEEE standard 1 requires the remaining portions of the safety system to 1 Where a single random failure in a nonsafety system can result in a design basis event, and also prevent proper action of a portion of the safety system designed to protect against that event, the remaining portions of the safety system shall be capable of

be capable of providing the safety function even when degraded by a separate single failure. In this case, another sensor failure (e.g., in a low or in an as-is state) would render the safety system with only one working level sensor. Two are required to generate the reactor trip signal.

Under these circumstances, the remaining sensor could not produce a pressurizer high water level reactor trip signal. If there is a reactor trip signal, then it would be obtained from another part of the automatic reactor protection system logic.

In this event, makeup water, of a boron concentration that is equal to the boron concentration in the RCS, is added until the operator ends the flow. If the charging flow is ended (or reduced to the rate of seal injection flow) before the pressurizer becomes water-solid, then the possibility of a pressurizer PORV opening, discharging water, and failing to reseat becomes insignificant.

The proposed P-15 permissive, which has been shown to be useful in preventing or mitigating the inadvertent ECCS at power event, has no effect upon the CVCS malfunction event, since the ECCS is not actuated (i.e., there is no Sl signal). The licensee has provided the results of a CVCS malfunction analysis, in which one charging pump is conservatively assumed to be started and set to operate at maximum capacity. The reactor is not tripped, since the pressurizer high water level reactor trip logic is not assumed to be completed.

The CVCS malfunction analysis results show that there is sufficient time available for the operators to end the event (e.g., by switching control of letdown and charging to an operable channel). The results indicate that the pressurizer is not predicted to become water-solid (due to continued seal injection cooling flow) until about 18 minutes after initiation of the event.

There are several alarms available, such as the charging pump high flow alarm, to alert the operators of the effects of excessive charging flow. Although the alarms are not classified as safety-grade, they originate from safety-related instrumentation, and they monitor several different parameters. The CVCS malfunction analysis results show that the high pressurizer water level alarm would occur about 8 minutes after initiation of the event. The CVCS malfunction is among the licensee's simulator training exercises for initial operator qualification and requalification. The operators are expected to take manual control of the charging pump flow, and stop filling the pressurizer before the reactor would trip. If the reactor is to be tripped on high pressurizer water level, and the high pressurizer water level alarm occurs at about 8 minutes, and the operators complete their required actions before 10 minutes, then the 10-minute operator action time, which is assumed in the analysis, is verified. 2 Experience from the simulator exercises shows that the operators will routinely meet this expectation.

Summary and

Conclusion:

CVCS Malfunction that Increases RCS Inventory The NRC staff reviewed the licensee's evaluation of the eves malfunction event and agrees with the licensee's assumptions, methods and conclusions. The NRC staff agrees, too, that the providing the safety function even when degraded by any separate single failure. See IEEE Std 603-1998, (Revision of IEEE Std 603-1991) IEEE Standard Criteria for Safety Systems for Nuclear Power Generating Stations, July 1, 1998. This requirement is also in IEEE Std 279-1971 (withdrawn), IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations 2 The CVCS malfunction analysis results show that the pressurizer would not fill until18 minutes after initiation of the event, if the operators throttle back the charging flow, at 10 minutes, to the level needed to supply seal injection cooling (and do nothing else)*-.

operator has sufficient time to prevent this event from escalating into a more serious event. The NRC staff concludes that the plant will continue to meet the regulatory requirements following implementation of the proposed addition of the P-15 permissive with respect to the CVCS malfunction event.

4.2.5 Inadvertent Opening of a PORV The inadvertent opening of a PORV is not among the events that are evaluated, in the LAR, to support addition of the P-15 permissive. It is included in this review to indicate that this event, like the inadvertent operation of ECCS, will eventually cause an increase in RCS inventory, and could develop into a more serious event if the operator does not take timely action.

The inadvertent opening of a PORV or PSV is listed in RG 1. 70 as an event that decreases RCS inventory. It is evaluated, in UFSAR Chapter 15.6.1, to show that it would not lead to fuel clad damage (i.e., the minimum departure from nucleate boiling ratio will not fall below its safety limit value). The evaluation is most effective when it shows that the automatic reactor trip is demanded by the portion of the reactor protection system that is designed to protect against fuel clad damage (e.g., overtemperature ~T trip, or variable low pressure trip). Since the reactor trip ends the degradation of thermal margin, licensing basis accident analyses of this event do not extend much past the time of reactor trip.

The Seabrook UFSAR analysis of the inadvertent opening of a PORV shows that no fuel clad damage would be incurred. The analysis is not extended, however, to show that the inadvertent opening of a PORV can be accommodated with, at most, a shutdown of the reactor with the plant capable of returning to operation after corrective action, and that it cannot generate a more serious incident of the Condition Ill or IV type. Although the reactor trip prevents clad damage, it does not end the RCS depressurization. Manual action must be taken to close the inadvertently opened PORV, or else close its block valve. If the PORV is not closed or isolated, then the continuing depressurization will lead to actuation of the ECCS, and possibly to a water-solid pressurizer, water relief through the PORVs, and eventually to an SBLOCA.

The P-15 permissive will not prevent or delay delivery of ECCS water to the RCS, in this scenario, since the ECCS actuation signal is derived from a low-low pressurizer pressure condition. If the ECCS is actuated, then the RCS depressurization, due to the open PORV, would allow a greater rate of ECCS flow delivery, which could cause the pressurizer to be filled faster than would an inadvertent actuation of the ECCS at power event. Therefore, it is important for the operators to close the inadvertently opened PORV, or else close its block valve, before this can happen.

4.2.6 Conclusion The proposed P-15 modification blocks the delivery of ECCS flow to the RCS cold legs unless the pressurizer pressure is below the P-15 pressure setpoint. An ECCS actuation signal would no longer be sufficient to cause delivery of ECCS flow to the RCS. A low pressurizer pressure condition would also be required. Since the proposed P-15 pressure setpoint is higher than the low-low pressurizer pressure ECCS actuation setpoint, the P-15 would have no effect upon ECCS actuations that are derived from a low-low pressurizer pressure condition (e.g., LOCA).

However, if the ECCS is actuated from conditions that do not necessarily produce a reduction in pressurizer pressure (e.g., high containment pressure or low steam line pressure), then delivery of ECCS flow to the RCS would not begin until pressurizer pressure drops below the P-15 pressure setpoint. The resultant delay in the delivery of ECCS flow has been shown, by the licensee, to be acceptable.

The licensee's evaluation of events that involve ECCS actuation, and excessive charging system flow, show that the proposed addition of the P-15 permissive is acceptable, since it would little or no effect upon the delivery of ECCS flow.

The NRC staff has reviewed the licensee's analyses of the effects of the proposed P-15 modification and concludes that the licensee's analyses have adequately accounted for operation of the plant with the P-15 permissive in place. The NRC staff further concludes that the licensee has demonstrated that the reactor protection and safety systems will continue to meet the requirements of GDCs 10, 15, 26, 27, 28, 31 and 35 following implementation of the proposed P-15 modification. Therefore, the NRC staff finds the proposed P-15 modification acceptable.

5. 0 STATE CONSULTATION In accordance with the Commission's regulations, the New Hampshire and Massachusetts State officials were notified of the proposed issuance of the amendment. The State officials provided no comments.

6.0 ENVIRONMENTAL CONSIDERATION

The amendment changes a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendment involves no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendment involves no significant hazards consideration, and there has been no public comment on such finding (78 FR 25315, April 30, 2013). Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need to be prepared in connection with the issuance of the amendment.

7.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors: B. Dittman, K. Bucholtz, and S. Miranda Date: March 6, 2014

March 6, 2014 Mr. Kevin Walsh, Site Vice President c/o Michael Ossing Seabrook Station NextEra Energy Seabrook, LLC P.O. Box 300 Seabrook, NH 03874

SUBJECT:

SEABROOK STATION, UNIT NO. 1 -ISSUANCE OF AMENDMENT REGARDING LICENSE AMENDMENT REQUEST 12-04, APPLICATION REGARDING COLD LEG INJECTION PERMISSIVE (TAC NO. MF1158)

Dear Mr. Walsh:

The Commission has issued the enclosed Amendment No. 140 to Facility Operating License No. NPF-86 for the Seabrook Station, Unit No. 1. This amendment consists of changes to the facility technical specifications in response to your application dated March 13, 2013, as supplemented by letters dated August 8, 2013, and November 22, 2013.

The amendment modifies the circuitry that initiates high-head safety injection by adding a new permissive, cold leg injection permissive (P-15). This permissive prevents opening of the high-head safety injection valves until reactor coolant system pressure decreases to the P-15 set point.

A copy of our safety evaluation is also enclosed. Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Sincerely, IRA/

John G. Lamb, Senior Project Manager Plant Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-443

Enclosures:

1. Amendment No. 140 to NPF-86

2. Safety Evaluation cc w/encls: Distribution via Listserv DISTRIBUTION:

PUBLIC LPLI-2 R/F RidsAcrsAcnw_MaiiCTR Resource RidsNrrDoriDpr Resource RidsNrrDorllpl1-2 Resource RidsRgn1 MaiiCenter Resource RidsNrrDeEicb Resource RidsNrrPMSeabrook Resource RidsNrrLAABaxter Resource RidsNrrDssSrxb Resource ADAMS Accession No ..* ML14029A445 **via memo OFFICE LPL 1-2/PM LPL 1-2/LA EICB/BC** SRXB/BC** OGC- NLO LPL 1-2/BC NAME Jlamb A Baxter JThorp CJackson DRoth MKhanna DATE 01/29/2014 02/24/2014 12/10/2013 01/28/2014 03/04/2014 03/06/2014 Off1c1al Record Copy