L-PI-19-025, Request to Approve Site-Specific Probabilistic Risk Assessment (PRA) Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant (PINGP)

Request to Approve Site-Specific Probabilistic Risk Assessment (PRA) Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant (PINGP)

ML19239A420
Person / Time
Site:	Prairie Island
Issue date:	08/27/2019
From:	Sharp S Northern States Power Company, Minnesota, Xcel Energy
To:	Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML19239A419	List: L-PI-19-025, Request to Approve Site-Specific Probabilistic Risk Assessment (PRA) Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant (PINGP)
References
L-PI-19-025
Download: ML19239A420 (63)

Text

ENCLOSURE 4 CONTAINS PROPRIETARY INFORMATION WITHHOLD FROM PUBLIC DISCLOSURE IN ACCORDANCE WITH 10 CFR 2.390 1717 Wakonade Drive Welch, MN 55089 August 27, 2019 L-PI-19-025 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Prairie Island Nuclear Generating Plant, Units 1 and 2 Docket Nos. 50-282 and 50-306 Renewed Facility Operating License Nos. DPR-42 and DPR-60 Request to Approve Site-Specific Probabilistic Risk Assessment (PRA) Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant (PINGP)

With this letter Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), submits Flowserve Corporation report, PRA Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant and requests NRC approval of the reactor coolant pump (RCP) seal model for use in the PINGP internal events and fire PRAs. The report supplements the approved generic topical report WCAP-16175-P-A, Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants. contains background and information related to the proposed RCP abeyance seal PRA model. Enclosure 2 contains a non-proprietary version of the report that provides a PRA model for the abeyance seals. Enclosure 3 provides a Flowserve application for withholding from public disclosure the proprietary version of the report contained in Enclosure 4 and a supporting affidavit. Enclosure 4 provides the proprietary version of the report that provides a PRA model for the abeyance seals.

NSPM requests approval of the proposed PRA model by September 21, 2020. This date supports final NFPA 805 implementation concurrent with completion of the final NFPA 805 modifications.

Summary of Commitments This letter makes no new commitments and no revisions to existing commitments.

Document Control Desk Page 2 If you have any questions regarding this submittal or if additional information is needed, please contact Mr. Jeff Kivi, (612) 330-5788.

~:ff?

Site Vice President, Prairie Island Nuclear Generating Plant Northern States Power Company - Minnesota

Enclosures:

1. Background and Information Related to Proposed RCP Abeyance Seal PRA Model

2. Flowserve Corporation PRA Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant, Revision 0, May 20, 2019. [NON-PROPRIETARY]

3. Flowserve Letter and Affidavit, Application for Withholding Proprietary Information From Public Disclosure.

4. Flowserve Corporation PRA Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant, Revision 0, May 20, 2019.

[PROPRIETARY]

cc: Project Manager, Prairie Island Nuclear Generating Plant, USNRC Resident Inspector, Prairie Island Nuclear Generating Plant, USNRC

ENCLOSURE 1 Background and Information Related to Proposed Reactor Coolant Pump (RCP)

Abeyance Seal Probabilistic Risk Assessment (PRA) Model 1.0 REQUESTED ACTION Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), hereby submits Flowserve report, PRA Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant and requests NRC approval of the RCP seal model for use in the PINGP internal events and fire PRAs. The purpose of the Flowserve report includes two analyses that support PRA modeling of Flowserve N-Seal RCP seal failure:

1. One analysis in the report is used to develop a model to estimate the probability of failure for the Flowserve N-Seal package Abeyance Seal (see Figure 1) given failure of the other three sealing stages. This failure probability model will be used in the PINGP PRA models calculation of risk of a RCP seal Abeyance loss of coolant accident (LOCA) given a loss of seal cooling (LOSC) event.

2. Another analysis in the report evaluates rd 3 Stage data from dynamic testing of the N-seal package 1st, 2nd, and 3rd stages (see nd 2 Stage Figure 1) without seal cooling and provides a basis for the time that the N-seal can operate without seal cooling.

As discussed in more detail below, NRC approval of the enclosed RCP seal model st 1 Stage for use in the PINGP internal events and fire PRAs supports closure of PINGP Fact and Observation (F&O) Finding # SY-A17-01 that resulted from a peer review of the Prairie Island PRA seal model. Approval also supports ongoing implementation of the Figure 1 NFPA 805 license amendment and future Flowserve N-Seal with Abeyance Seal implementation of the pending 10 CFR 50.69 amendment, currently under NRC review.

Page 1 of 8

L-PI-19-025 NSPM 2.0 INFORMATION ON FLOWSERVE N-SEALS 2.1 N-Seal Package Description The N-seal design (see Figure 1) includes three redundant face type sealing stages and a diverse abeyance seal that has the ability to preclude larger seal leakage rates during loss of seal cooling scenarios. The critical parts of each seal stage are the rotating face ring, stationary face ring, and secondary seals. During normal operation, each seal stage will be subjected to a differential pressure of approximately one-third of reactor coolant system (RCS) pressure. Each of the three individual sealing stages is designed to withstand full RCS pressure for an extended period of time with the RCP idle and for a limited period of time with the pump running at a nominal speed of 1200 rpm. Although three seal stages are provided for redundancy, only one stage must function to prevent excessive leakage from the RCS to the containment atmosphere when the pump is running.

The N-Seal package has demonstrated through design, testing, and field operation to be very robust. When operated within the specified limits, N-Seal packages have been installed and operated for up to 17 years.

The N-Seal is equipped with an Abeyance Seal, a diverse sealing mechanism, which provides defense in depth to mitigate the effects caused by failure of all three mechanical-face seals. The Abeyance Seal is a passive, self-actuated device and does not rely on any additional complex sub-assemblies. The Abeyance Seal remains inert until a significant leak from the primary seals occurs, at which time it automatically actuates from the pressure generated by the leakage flow across it, forming a near-zero leakage backup seal provided that the RCP is stopped.

The Abeyance Seal is located on the containment atmosphere side and downstream of the N-Seal cartridge. The location is critical for the Abeyance Seal as it is only needed if all three of the redundant N-Seal stages of the seal cartridge fail. Only after all the redundant seal stages have failed and the seal leakage flow exceeds a specific rate does the Abeyance Seal actuate. Being on the atmosphere side, it will only actuate once there is sufficient flow of steam due to the phase change that would occur in the area. Lastly, being downstream of the seal cartridge, the Abeyance Seal is not influenced by RCS debris that may affect the ability for it to function.

Page 2 of 8

L-PI-19-025 NSPM 2.2 Abeyance Seal Principles of Operation The Abeyance Seal has no mechanical parts and actuation involves only a small displacement of the actuation and metal sealing rings (see Figure 2). Once actuated, the Abeyance Seal is designed to prevent leakage from the third stage seal for an indefinite period. The Abeyance Seal uses a metallic sealing ring as the main sealing device. This is supplemented with an actuation ring made from poly-ether ether ketone (PEEK), a high performance engineering thermoplastic material designed specifically for high temperature applications.

RCP shaft Sealing ring Actuation ring Seal injection or RCS Normal Operation Initialization Full Deployment Figure 2 Abeyance Seal Actuation Sequence The actuation ring provides initial sealing and develops enough pressure loading to plastically collapse the metal sealing ring onto the shaft sleeve. After collapse of the metal sealing ring, the actuation ring ensures that the Abeyance Seal is leak tight. The collapse of the metal sealing ring eliminates any finite gap and provides support across the entire actuation ring, enabling the device to withstand high pressures and temperatures for long periods of time. If near complete depressurization occurs and the actuation ring elastically returns to its original, non-contacting position, the metal sealing ring remains plastically collapsed against the shaft sleeve, limiting leakage.

2.3 Abeyance Seal Design Features Beside the actuation ring and the sealing ring, there are no other mechanically moving parts in the Abeyance Seal. During normal RCP operation, the Abeyance Seal is non contacting and suffers no wear or degradation. PEEK will maintain sealing properties at full RCS conditions for an extended period of time after the Abeyance Seal has actuated. PEEK has high resistance to both thermal and radiation exposure, there are no known aging mechanisms which could impede the function within the expected maintenance periods of less than 20 years. The Abeyance Seal does not rely on elastomers, because the Abeyance Seal is designed to maintain a leak-tight seal for an extended time at high temperatures.

Page 3 of 8

L-PI-19-025 NSPM Dynamic testing of the N-Seal single stage to full temperature for more than one hour demonstrates there is no credible mechanism for inadvertent actuation of the Abeyance Seal, even from scenarios which could result in RCP operation under LOSC. The Abeyance Seal has been tested repeatedly across a range of severe conditions, including shaft offset, adherent crud coatings, up to 2500 psi and 580 °F, for durations up to 388 hours0.00449 days <br />0.108 hours <br />6.415344e-4 weeks <br />1.47634e-4 months <br />. 1 Throughout these tests, the Abeyance Seal has demonstrated the ability to actuate reliably at both low and high temperatures, and remain leak-tight as long as pressure remains.

2.4 Prairie Island Specific Installation NSPM changed the PINGP RCP seals to Flowserve N-Seal RCP seals in both RCPs in both units (Unit 1 in the fall 2014 refueling outage; Unit 2 in the fall 2013 refueling outage).

Specifically, the PINGP RCP seal were changed to Flowserve N-9000 seals. 2 Minor variants in face design go into the packages which are customized to fit each pump application. Seal face designs are the slotted carbon face, Mayer groove face, and Precision Face Topography designs. At PINGP, one RCP in each unit uses slotted carbon faces and one RCP in each unit uses Mayer groove faces.

3.0 INFORMATION ON PRA MODELING OF N-SEALS 3.1 Impact of Flowserve N-Seal RCP Seals on PINGP PRA After installing the N-Seals on Unit 2, NSPM updated the PRA models to reflect the as-built, as-operated plant. In the PINGP PRA models, the three sealing stages of the N-Seal were modeled in accordance with WCAP-16175-P-A, Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants (Reference 2). This includes conditions and limitations provided in the NRC Safety Evaluation for WCAP-16175-P-A (Reference 9). The Flowserve report of Reference 1 includes data that supports additional time (beyond the 20 minutes allowed for in WCAP-16175-P-A) to trip the RCPs on loss of cooling. However, this additional time to trip RCPs is not currently incorporated in the PINGP PRA models. 3 In the PINGP PRA models, the abeyance seal is modeled in accordance with the Flowserve report (References 1 and 3).

NSPM had a focused scope PRA peer review conducted in 2014. This review resulted in four findings, one of which was fact and observation (F&O) finding # SY-A17-01:

1 The maximum RCS cold leg temperature (Tcold) is 547 °F at 0% power.

2 Several variations of the N-Seal have been developed for different RCP shaft sizes, one of which is the N-9000 seal used on the PINGP RCPs.

3 The testing that underlies the analysis in the report was conducted on sealing stages with slotted carbon faces.

One RCP in each PINGP unit has a seal package outfitted with Mayer groove faces. As such, the testing does not match the as-installed pumps, so the increase in time to trip RCPs that is supported by the Flowserve report is not credited in the current PINGP PRA models.

Page 4 of 8

L-PI-19-025 NSPM Subsection 1.8.1 of AC System notebook, PRA-PI-SY-AC, Rev. 2.1a indicates safeguards 4kV buses do not result in RCP trip. Failure in both 4Kv buses (bus 15 and

16) which is a cause of 1AC requires RCP trip to prevent RCP seal failure, but 1N9-SBO gate does not include the operator action.

Cause(s) of loss of 1AC which do not result in RCP trip requires RCP trip within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to prevent RCP LOCA. 4 NSPM took actions to resolve the F&O findings. For SY-A17-01, NSPM completed a sensitivity analysis for failure to trip RCPs on a loss of a 4kV safeguards bus. NSPM conducted an F&O finding closure review in 2017. A team of four independent PRA experts reviewed the proposed closure of the F&O findings in accordance with NEI 05-04, Process for Performing PRA Peer Reviews Using the ASME PRA Standard (Internal Events), Appendix X.

The team concluded that, while the actions to disposition the finding were acceptable, SY-A17-01 results from the implementation of a Reactor Coolant Pump Seal leakage model that has not yet been approved by the NRC. As a result, F&O finding # SY-A17-01 remained open.

3.2 Related Risk-Informed Licensing Actions for PINGP The modeling of the RCP abeyance seal within the PINGP PRA models has been previously addressed in the following PINGP risk-informed licensing actions:

• NFPA 805, Performance-Based Standard for Fire Protection for Light Water Reactors

• TSTF-425, Relocate Surveillance Frequencies to Licensee Control - Risk Informed Technical Specifications Task Force (RITSTF) Initiative 5b

• 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors 3.2.1 NFPA 805 In Reference 4, NSPM Letter L-PI-12-089 to NRC, License Amendment Request to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactors, dated September 28, 2012, Attachment S, Table S-2, Plant Modifications Committed, NSPM committed under Item 18 to install new RCP seals that would not be subject to excessive leakage if all seal cooling is lost.

In response to an NRC request for additional information associated with this license amendment, Reference 5, NSPM noted that transition to NFPA-805 will be achieved with the current implementation items in accordance with Reference 4, Table S-3 including Implementation Item 66, as follows:

4 The two hours noted comes from Reference 3. The time within which RCPs must be stopped is one hour under the analysis in Reference 1.

Page 5 of 8

L-PI-19-025 NSPM The PINGP Fire PRA model shall be reviewed using an NRC approved RCP seal model, as well as any exceptions/clarifications included in the NRC approval, to determine if the internal events and Fire PRA require a revision. The Prairie Island internal events and Fire PRA will be updated, if applicable, with the latest RCP seal information. If the updates result in a risk increase greater than RG 1.174, NSPM will take action to reduce the risk results. Compensatory measures established prior to the RCP seal replacement shall remain in place until the calculated risk increase is within RG 1.174 limits.

In the issued amendment, Reference 6, the NRC stated:

In its response to PRA RAI 17 , the licensee indicated that a Flowserve RCP seal PRA model (i.e., logic structure and basic event values) was developed for the Flowserve RCP seal package that will be installed as is identified in LAR Attachment S, Tables S-1 and S-2 and credited in the FPRA. Additionally, in its response to PRA RAI 15 , the licensee indicated that it revised LAR Attachment S, Table S-3 to include Implementation Item 66, which replaces the current RCP seal PRA model with a final, NRC-approved PRA model, if applicable, and requires PINGP to take action should RG 1.174 risk acceptance guidelines be exceeded. The NRC staff concludes that the licensee's response to PRA RAI 17 is acceptable because the licensee used the best available applicable information, (i.e., the Flowserve RCP seal PRA model, based on current technical evaluations), to estimate the associated change-in-risk and will take action if replacing the current model with a final, NRC-approved PRA model increases risk beyond risk acceptance guidelines.

NRC approval of the RCP seal model for use in the PINGP internal events and fire PRAs permits completion of the PRA model review and PRA updates of Implementation Item 66.

3.2.2 TSTF-425 In Reference 7, NRC letter to NSPM, Prairie Island Nuclear Generating Plant, Units 1 and 2 -

Issuance of Amendments re: Adoption of TSTF-425, Revision 3, Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 58, dated April 16, 2019, the NRC noted:

Finding SY-A17-01 indicates that the closure review team determined that this F&O should remain open until NRC approves the Flowserve N-9000 reactor coolant pump (RCP) seal model. The licensee performed a sensitivity study that removed credit for the abeyance seals in the current PRA model of record. This sensitivity study showed no more than a 5.7 percent increase in the internal events CDF and no more than a 2.7 percent increase in the Fire CDF. The combined fire and internal events CDF increases no more than three percent. Based on the results of the sensitivity study, the NRC staff concludes that the Flowserve N-9000 RCP seal model does not have significant impact on the SFCP [Surveillance Frequency Control Program].

NRC approval of the RCP seal model does not impact implementation of TSTF-425.

Page 6 of 8

L-PI-19-025 NSPM 3.2.3 10 CFR 50.69 In Reference 8, NSPM Letter L-PI-19-029 to NRC, Supplement to Response to Request for Additional Information: Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (EPID L-2018-LLA-0196), dated August 25, 2019, NSPM responded to NRC RAIs associated with the LAR to implement 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors. In particular, RAI 8.iii requested that NSPM propose a mechanism that ensures an NRC approved abeyance RCP seal model is available before incorporation of an abeyance seal into the PRA models of record. In response NSPM noted the mechanism would be part of a proposed implementation item that NSPM PRA model used for SSC categorization will only credit the abeyance RCP seal after the NRC has approved the modeling approach for the abeyance seal. Prior to modeling approach approval, the PRA model used for categorization will not credit the abeyance seal.

NRC approval of the RCP seal model for use in the PINGP internal events and fire PRAs supports NSPMs preferred approach for implementation of 10 CFR 50.69 and more accurately reflects the as-built, as-operated plant.

4.0 REFERENCES

1. Flowserve Report, PRA Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant, Revision 0, May 20, 2019.

[Non-proprietary version included as Enclosure 2 and proprietary version included as Enclosure 4.]

2. WCAP-16175-P-A, Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants.

3. Flowserve Report, PRA Model for Flowserve 3 Stage N-Seals with Abeyance Seal, Revision 0, December 20, 2013

4. NSPM Letter L-PI-12-089 to NRC, License Amendment Request to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactors, dated September 28, 2012 (ADAMS Accession No. ML12278A405)

5. NSPM Letter L-PI-16-090 to NRC, License Amendment Request to Adopt NFPA 805 Performance-Based Standard for Fire Protection for Light Water Reactors - Response to Request for Additional Information, dated December 14, 2016 (ADAMS Accession No. ML16350A105)

6. NRC letter to NSPM, Prairie Island Nuclear Generating Plant, Units 1 and 2 - Issuance of Amendments re: Transition to NFPA-805 Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants", dated August 8, 2017 (ADAMS Accession No. ML17163A027)

Page 7 of 8

L-PI-19-025 NSPM

7. NRC letter to NSPM, Prairie Island Nuclear Generating Plant, Units 1 and 2 - Issuance of Amendments re: Adoption of TSTF-425, Revision 3, Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 58, dated April 16, 2019 (ADAMS Accession No. ML19045A480)

8. NSPM Letter L-PI-19-029 to NRC, Supplement to Response to Request for Additional Information: Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (EPID L-2018-LLA-0196), dated August 5, 2019 (ADAMS Accession No. ML19217A333).

9. NRC letter to Westinghouse Owners Group, Final Safety Evaluation for Pressurized Water Reactor Owners Group (PWROG) Topical Report WCAP-16175-P, Revision 0, (CE NPSD-1199, Revision 1) Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants, (TAC No. MB5803) dated February 12, 2007 (ADAMS Accession No. ML070240429)

Page 8 of 8

ENCLOSURE 2 Flowserve Corporation PRA Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant Revision 0, May 20, 2019

[NON-PROPRIETARY]

46 pages follow

Flowserve Corporation PRA Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant Revision 0 ENERCON Services, Inc.

May 20, 2019 ENERCON Services, Inc.

DOCUMENT APPROVALS Responsibility Signature Date Prepared: Steven Phillippi Digitally signed by Raymond Dremel Reviewed: Raymond Dremel Raymond Dremel DN: cn=Raymond Dremel, o=ENERCON Services, Inc.,

ou, email=rdremel@enercon.com, c=US Date: 2019.05.24 07:44:41 -05'00' Digitally signed by David Zagres Approved: David Zagres David Zagres DN: cn=David Zagres, ou=PBG Date: 2019.05.24 09:08:32 -04'00' REVISION HISTORY Rev. Description Date 0 Initial Issue May 2019 ENERCON Services, Inc. page i

Table of Contents Section Page 1.0 Introduction.......................................................................................................................... 1 1.1 Purpose ............................................................................................................................. 1 1.3 Background ...................................................................................................................... 1 2.0 Technical Description of Flowserve N-Seal Package.......................................................... 3 2.1 Seal Package Description and Principles of Operation .................................................... 3 2.1.1 Three-Stage N-Seal................................................................................................... 3 2.1.2 Abeyance Seal........................................................................................................... 5 3.0 Seal Failure Mechanisms ................................................................................................... 10 3.1 Mechanical Seal Failure Symptoms ............................................................................... 10 3.2 Mechanical Seal Failure Modes ..................................................................................... 11 3.3 Abeyance Seal Failure Modes........................................................................................ 12 4.0 Operational Considerations Affecting N-Seal Performance.............................................. 14 4.1 Seal Injection.................................................................................................................. 14 4.2 Component Cooling Water ............................................................................................ 15 4.3 CVCS Seal Return (CBO) Flow .................................................................................... 15 4.4 Restoration of Seal Injection .......................................................................................... 15 4.5 Loss of Both Seal Injection and Thermal Barrier Heat Exchanger Cooling .................. 15 5.0 Pump Seal Tests and Results ............................................................................................. 17 5.1 N-Seal Dynamic Operation Test .................................................................................... 17 5.2 Abeyance Seal Tests....................................................................................................... 19 5.2.1 Abeyance Seal Low-Pressure Actuation Test.............................................................. 19 5.2.2 Abeyance Seal Low-Pressure Actuation Test at Elevated Temperature ..................... 19 5.2.3 Abeyance Seal Non-Actuation Test on Seal Leakage ................................................. 20 5.2.4 Abeyance Seal Full-Pressure Seal Test........................................................................ 20 5.2.5 Abeyance Seal Steam Actuation Test .......................................................................... 20 5.2.6 Abeyance Seal Steam Actuation and Full-Pressure Seal Test ..................................... 21 5.2.7 Abeyance Seal Steam Actuation and Extended Seal Test ........................................... 21 5.2.8 Abeyance Seal Minimum Actuation Flow Test........................................................... 21 5.2.9 Two-Week Hold Test................................................................................................... 22 5.2.10 Abeyance Seal Final Qualification Tests ................................................................... 22 5.3 Test Failure Data Analysis ............................................................................................. 24 6.0 N-Seal Experience at Operating Plants.............................................................................. 25 ENERCON Services, Inc. page ii

Table of Contents (continued)

Section Page 7.0 RCP Seal Failure Model for the Abeyance Seal of the N-Seal Package ........................... 34 8.0 Summary and Conclusions ................................................................................................ 35 9.0 References.......................................................................................................................... 36 Appendix A. Abeyance Seal Test Data........................................................................................ 37 ENERCON Services, Inc. page iii

Disclosure and Legal Notice This report was prepared by Flowserve, Inc. for Xcel Energy, Inc. Neither Flowserve, Inc, the sponsoring company, nor the contractors makes any warranty or representation, express or implied including the warranties of fitness for a particular purpose or merchantability, with respect to the accuracy, completeness, or usefulness of the information contained in this report, or that the use of any information, or process discussed in this report may not infringe privately owned rights. The person using this report assumes any liabilities with respect to the use of, or for damages resulting from the use of, any information, method, or process disclosed in this report.

ENERCON Services, Inc. page iv

1.0 Introduction 1.1 Purpose The purpose of this analysis is to develop a model to estimate the probability of failure for the Flowserve N-Seal package Abeyance Seal given failure of the N-seal package for the Prairie Island Nuclear Generating Plant (PINGP). This model is intended to be used in the PINGP probabilistic risk assessment (PRA) models to quantify the risk of a reactor coolant pump (RCP) seal loss of coolant accident (LOCA) given a loss of seal cooling (LOSC) event. Additionally, this analysis evaluates data from dynamic testing of the N-seal package without seal cooling and provides a basis for the time that the N-seal can operate without seal cooling.

1.2 Background Development of the N-Seal package began in 1983 and focused on improving the reliability of RCP seals on pumps with shaft sizes greater than 7-inches. Several variations of the N-Seal have been developed for different RCP shaft sizes. These variations are known as the N-7500, N-9000, and NX seal packages. This document will refer to all thre -

minor variants in face design go into the packages which are customized to fit each pump application. Seal face designs are the slotted carbon face, Mayer groove face, and Precision Face Topography designs. For static sealing, the critical characteristics for resistance to loss of seal cooling (the sizes of elastomer sealed clearances, how those clearances are influenced by pressure and temperature, and the elastomer materials used to seal them) remain constant across the product family. Operation and design of the different model seals is substantially identical.

In the United States, the N-Seal package has been installed in the RCPs of some Babcock and Wilcox (B&W) and Combustion Engineering (CE) plants since 1988. A model for estimating the probability of failure of an N-Seal RCP seal given loss of all cooling to the RCP seal was developed by the Pressurized Water Reactor Owners Group (PWROG). These analyses are documented in Reference 1 and the safety evaluation by the Nuclear Regulatory Commission (NRC) staff found that WCAP-16175 (Reference 1) is acceptable for referencing in licensing applications for CE designed pressurized water reactors to the extent specified and under the limitations identified. The model documented in Reference 1 does not consider the Abeyance seal.

Since the Safety Evaluation Report (SER) was issued for the models presented in WCAP-16175, Flowserve has conducted a series of tests to explore the ability of the N-Seal RCP seal package to withstand dynamic (pump running) operation under LOSC conditions. In a LOSC, cooling to the pump seal is interrupted and the normal flow of cool water from the RCP seal into the reactor coolant system (RCS) reverses. This flow reversal causes the cool water around the barrier heat exchanger and in the RCP seal package to be replaced by hot water from the RCS. The increased temperatures that occur can challenge the integrity of the RCP seals.

Past tests (Reference 4) demonstrated that the existing, standard N-Seal design for CE, Westinghouse (W), and B&W plants is capable of providing an extended coping time (an 8-hour minimum by design) under LOSC scenarios with the pump stopped. This seal design has been installed and operated at plants such as Surry, Oconee, Prairie Island, and Crystal River 3.

ENERCON Services, Inc. page 1

To extend the capability of the N-Seals to ensure minimum leakage from the RCS, Flowserve has developed and tested the Abeyance Seal, a supplemental and diverse shutdown seal that complements the capabilities of the standard mechanical face N-Seal package when added to the seal cartridge.

ENERCON Services, Inc. page 2

2.0 Technical Description of Flowserve N-Seal Package This section provides a description of the sealing system for the operation of a RCP with a three-stage N-Seal cartridge installed, such as would be used in B&W or W plants.

2.1 Seal Package Description and Principles of Operation The N-Seal RCP shaft sealing system design consists of three mechanical face-type sealing stages. The sealing system normally is assembled in a controlled work area outside containment.

The seal package typically is assembled as a single cartridge unit if it is to be installed in the RCP with the motor removed. If the RCP motor is not being removed, [

]a,b,c. In neither situation however, are any delicate seal parts handled or assembled in the containment environment as would be the case for component-type seals. The N-Seal is designed to be retrofit on Westinghouse RCPs without any field modifications to the pump shaft or cover.

The critical parts of each seal stage are the rotating face ring, stationary face ring, and secondary seals. During normal operation, each seal stage will be subjected to a differential pressure of approximately one-third of reactor coolant system (RCS) pressure. Each of the three individual sealing stages is designed to withstand full RCS pressure for an extended period of time with the RCP idle and for a limited period of time with the pump running at a nominal speed of 1200 rpm (the seal is capable of running at 125% of the nominal 1200 RPM operating speed without incident).

2.1.1 Three-Stage N-Seal The N-Seal is a mechanical face seal package and was developed in the mid-1980s to resolve operational and regulatory concerns with RCP seals developed in the 1960s and provided during initial construction and operation of nuclear plants. The N-Seal initially was designed and tested to be able to cope with a static 8-hour LOSC event, such as station blackout (SBO), with minimal leakage. The test results and design information developed for the N-seal were provided by Flowserve for use in the PRA evaluations of RCP seals documented in WCAP-16175 (Reference 1), (originally prepared as CEOG-1199). Applicable references and test results that were provided by Flowserve for the WCAP-16175 evaluations are discussed in this paper as to how these tests provide insight to the response of the N-Seal while operating under LOSC conditions.

The N-Seal cartridge for Westinghouse or B&W RCPs uses three identical seal stages that function based on hydrodynamic operating principles. Although three seal stages are provided for redundancy, only one stage must function to prevent excessive leakage from the RCS to the atmosphere. The optimized deflection control of the N-Seal design results in repeatable and predictable behavior with significant operating margin to tolerate transients.

The N-Seal package has demonstrated through design, testing, and field operation to be very robust. When operated within the specified limits, N-Seal packages have been installed and operated for up to 17 years.

ENERCON Services, Inc. page 3

With the sealing system functioning normally, a pressure drop of approximately one-third of RCS pressure occurs across each stage. The pressure drop is caused by tubular seal staging flow resistance coils. The seal staging flow provides the means to reduce the pressure from RCS operating pressure to atmospheric pressure across the three-stage seal cartridge. The flow is normally designated the controlled bleed-off (CBO). From the reactor coolant system this flow exits the RCP through lines to the Chemical and Volume Control System (CVCS) seal return.

The seal staging flow coil is part of a subassembly that is designated the pressure breakdown device (PBD). There is a separate staging coil for each sealing stage and the coil is located in the pressure retaining housing for that stage.

Normal CBO flow ranges for PINGP are from 0.7 to 3.0 gpm with a target nominal value determined in Figure 2-2 (Reference 10) and is much larger than the very small leakage (<0.1 gpm) across the faces of each seal stage. For B&W plants with BJ or Bingham RCPs, the three stage N-seal cartridges are very similar in functional configuration to N-Seals used in Westinghouse RCPs. The only significant differences are that the normal CBO flow used is only 1.5 gpm rather than the higher 2.5 gpm used in Westinghouse applications (Reference 9) [

]a,b,c.

The RCP seal system flow schematic in Figure 2-1 provides a diagram of flows through the N-Seal package. Figure 2-2 presents the flow versus pressure relationship for a single coil (Reference 9). A second function of the PBD flow is to provide cooling flow through the sealing system to carry away frictional heat generated by the rotating seal parts.

In addition to the flow around the seal through the PBD, flow also passes across the seal stage.

Normal flow across the seal face nominally is less than [ ]a,b,c. The leakage flow across a given seal stage is in parallel with the staging coil for that stage so the pressure differential across the PBD and the seal stage must be equal. Therefore, variations in seal leakage can affect seal stage pressures, but since the normal leakage is two orders of magnitude smaller than the CBO flow, only significant changes in seal leakage will cause large changes in differential pressure. Since the flow resistance of the PBD is fixed, an increase in leakage across one seal will cause the pressure differential across that stage to decrease. Because the total pressure drop across the three stages is constant (equal to RCS pressure), pressure differential across each of the other two non-leaking seals will increase. The total pressure differential increase across the two seals will be equal to the decrease in pressure differential across the leaking seal stage.

Ideally, the differential pressure increase for each of the two non-leaking seals would be one-half the pressure decrease across the leaking seal. For the three-stage packages, leakage across the third stage seal face always flows directly to the reactor coolant drain tank (RCDT)

(Reference 11).

Primary reactor loop water is normally greater than 550°F while the desired seal cartridge temperature is below 200°F. Maintaining stable seal temperatures is important to limit thermal gradients during transient conditions. The cooling systems used at PINGP are both thermal barrier cooling and CVCS seal injection. These systems are redundant with respect to RCP seal ENERCON Services, Inc. page 4

cooling so that operation of either one of these two systems provides the necessary cooling to the N-Seal cartridge.

2.1.2 Abeyance Seal As discussed in Section 2.1.1, any one of the three redundant, mechanical-face stages is capable of providing the required sealing function with the RCP operating and seal cooling provided.

Failure of seal cooling from both CVCS injection and thermal barrier cooling presents a common challenge to the proper functioning of the mechanical-face seals and could result in their failure.

To mitigate the effects caused by failure of all three mechanical-face seals, all new N-Seal applications will be equipped with an Abeyance Seal, a diverse sealing mechanism. The Abeyance Seal (shutdown seal) is a passive, self-actuated device and does not rely on any additional complex sub-assemblies with small springs, pistons, etc. The Abeyance Seal remains inert until a significant leak from the primary seals occurs, at which time it automatically actuates from the pressure generated by the leakage flow across it, forming a near-zero leakage backup seal provided that the RCP has tripped.

During normal RCP operation, the Abeyance Seal is non contacting and suffers no wear or degradation. Dynamic testing of the N-Seal single stage to full temperature for more than one hour demonstrates there is no credible mechanism for inadvertent actuation of the Abeyance Seal, even from scenarios which could result in RCP operation under LOSC.

The Abeyance Seal is located above the top stage of all N-Seal packages as shown in Figure 2-3.

The location is critical for the Abeyance Seal as it is only needed once all three of the redundant N-Seal stages fail. Only after all the redundant seal stages have failed and the seal leakage flow exceeds a specific rate does the Abeyance Seal actuate. Another advantage of the placement of the Abeyance Seal is that it is located on the atmospheric side of the seal cartridge as a last defense when needed. Being on the atmosphere side, it will only actuate once there is sufficient flow of steam due to the phase change that would occur in the area. Lastly, being downstream of the seal cartridge, it is not influenced by RCS debris that may affect the ability for the Abeyance Seal to function.

The Abeyance Seal is designed to seal against a sleeve that is mounted to the pump shaft when the flow rate from the mechanical-face seals is in excess of [

]a,b,c. With the RCP tripped, the Abeyance Seal is designed to stop leakage from the upper, third-stage, seal and RCP seal leakage will be limited to flow through the CVCS seal return CBO line. During normal operation, there is a relatively large running clearance between the Abeyance Seal and the shaft sleeve so there is no effect from normal seal leakage on the Abeyance Seal. However, if the Abeyance Seal is exposed to high velocity leakage, then the Abeyance Seal actuates by deflection to close down the small [ ]a,c gap between the seal and the shaft sleeve. Closing this gap will stop leakage from the top seal to containment.

High velocity leakage at the Abeyance Seal can occur only after major failure of all the mechanical seal stages, an event that is expected only after an extended loss of all normal seal cooling. Under these conditions, the increased temperatures would result in the leakage being steam, which results in increased flow velocity through the failed seals due to the high specific volume of the mass being released.

ENERCON Services, Inc. page 5

Once actuated, the Abeyance Seal is designed to prevent leakage from the third stage seal for an indefinite period. The Abeyance Seal does not rely on elastomers, because the Abeyance Seal is designed to maintain a leak-tight seal for an extended time at high temperatures. In general, elastomers (even the high-temperature Ethylene Propylene compounds tested and used in the N-Seal) are not capable of remaining intact for extended times at temperatures approaching full RCS conditions. The Abeyance Seal uses a metallic sealing ring as the main sealing device. This is supplemented with an actuation ring made from poly-ether ether ketone (PEEK), a high performance engineering thermoplastic material designed specifically for high temperature applications. PEEK has a melting point of 649 °F and a glass transition temperature of 289 °F.

However, since PEEK has a semi-crystalline structure, some degree of the mechanical properties is retained even close to the melting point. These properties give PEEK the ability to maintain effective sealing function at far higher temperatures than any elastomer. These properties also are maintained for much longer periods than elastomers at normal RCP seal operating temperatures during normal plant operation without decay while the Abeyance Seal is in standby.

Furthermore, PEEK will maintain sealing properties at full RCS conditions for an extended period of time after the Abeyance Seal has been demanded. As described above, the Abeyance Seal has no mechanical parts and actuation involves only a small displacement of the actuation and metal sealing rings. Since there are no other mechanically moving parts in the Abeyance Seal, and since PEEK has high resistance to both thermal and radiation exposure, there are no known aging mechanisms which could impede the function within the expected maintenance periods of less than 20 years.

The actuation ring provides initial sealing, and develops enough pressure loading [

]a,b,c to plastically collapse the metal sealing ring onto the shaft sleeve. After collapse of the metal sealing ring, the actuation ring ensures that the Abeyance Seal is leak tight. The collapse of the metal sealing ring eliminates any finite gap and provides support across the entire actuation ring, enabling the device to withstand high pressures and temperatures for long periods.

The Abeyance Seal has been tested repeatedly across a range of severe conditions, including shaft offset, adherent crud coatings, up to 2500 psi and 580 °F, for durations up to 388 hours0.00449 days <br />0.108 hours <br />6.415344e-4 weeks <br />1.47634e-4 months <br />.

Throughout these tests, the Abeyance Seal has demonstrated the ability to actuate reliably at both low and high temperatures, and remain leak-tight as long as pressure remains greater than [

]a,b,c. Even if near complete depressurization occurs and the actuation ring elastically returns to its original, non-contacting position, the metal sealing ring remains plastically collapsed against the shaft sleeve, limiting leakage to [ ]a,b,c.

ENERCON Services, Inc. page 6

Figure 2-1. Reactor Coolant Pump Seal Flow Schematic ENERCON Services, Inc. page 7

Figure 2-2. Characteristics of the Pressure Breakdown Device ENERCON Services, Inc. page 8

Abeyance seal Figure 2-3. Abeyance Seal in 3-Stage N-Seal Package ENERCON Services, Inc. page 9

3.0 Seal Failure Mechanisms This section discusses the failure mechanisms applicable to the N-Seals and how the failure mechanisms influence the associated failure models. Included in the discussions are failures of the N-Seal mechanical seals as well as failures of the Abeyance Seal.

As discussed previously, degradation or failure of one or both of the first two seal stages does not necessarily preclude operation of the pump as any single seal stage is designed to operate at full pressure. Operation of a seal stage with elevated differential pressures has a negative impact on the operating life of the affected seal, but presents no short-term challenge to maintaining the integrity of the remaining seals. That is, operation with one failed seal stage could continue for several months without impacting the seal failure probability under LOSC conditions. However, it is expected that a plant would investigate the cause and shut down to repair the package if warranted. Operation of the pump with one or more degraded seal stages will cause CVCS seal return (CBO) flow to increase.

Because the Abeyance Seal is not demanded until after all three mechanical seal stages fail, failure of the Abeyance Seal could only occur during normal plant operation (with no initiating event) due to installation errors.

Further discussion of seal failures is provided below.

3.1 Mechanical Seal Failure Symptoms There are numerous symptoms that would indicate that a mechanical seal stage has failed (Reference 8). Discussed below are the symptoms of the various seal failures that could occur for the various failure modes. The conditions delineated below may indicate degradation or failure of a seal stage.

a. With operation of seal injection flow or thermal barrier cooling and RCS pressure above 1500 psig, seal cartridge delta-temperature (seal return temperature minus lower radial bearing outlet temperature) in excess of 50°F.

b. Seal stage pressure > 1490 psid with the seal return isolation valve open.

c. Seal stage pressure is fluctuating with the seal return isolation valve open.

d. Seal leakoff to RCDT in excess of 2.5 gpm recommended operating limit. This indicates that all three of the individual seal stages are leaking at a high rate.

e. Excessive pump vibration. This may be caused by a problem in the pump, motor, or seal cartridge.

f. Seal failure of 20 to 200 gpm may be indicated by additional symptoms such as decreasing pressurizer level, decreasing RCS pressure, and accumulation of RCS inventory in the containment building sump.

ENERCON Services, Inc. page 10

g. Under seal failure circumstances, the seal cartridge temperature will rise rapidly toward RCS cold leg temperature. In addition, it is possible that P2 and P3 may return to near normal staging values with the seal return flow valve OPEN OR CLOSED. This condition is caused by the parts within each of the three seal stages acting as a high flow orifice such that the RCS pressure is broken into three equal parts in a manner similar to the low flow staging coils. Finally, the #3 seal leakoff (as indicated by RCDT level trend), may be zero or near zero. This is due to the problem that the leakoff flow is in the form of steam exiting the seal cartridge.

Given the myriad indications that show incipient or actual failure of a mechanical seal stage, it is considered unlikely that an RCP would operate for a significant time unnoticed with a degraded seal.

3.2 Mechanical Seal Failure Modes Failure modes for the mechanical seals in the N-Seal package are discussed in Section 4 of Reference 1. These failure modes include elastomer extrusion, hydraulic instability, and operational-related failure mechanisms. The latter category consists of two failure modes, random failures and pre-existing failures. Regardless of the failure mode, the effect on the N-Seal package evaluated in Reference 1 was the same. That is, failure of all three seals for any reason was considered failure of the N-Seal package.

The specific failure mode for each seal stage can affect total flow from a failed seal package. As discussed in Section 2.1.2, a flow rate in excess of [

]a,b,c past the third stage mechanical seal is needed to actuate the Abeyance Seal. Failure modes that result in lower flow rates will not actuate the Abeyance seal.

The flow rates that result from the various failure modes of the three stages of mechanical seals vary and could result in flows that are not high enough to actuate the Abeyance Seal. The testing documented in Reference 4 shows that failure of an elastomer would result in [ ]a,b,c flow past the failed seal. That flow rate is about the same as flow past the PBD and results in pressure across the failed seal equalizing. Once pressure equalizes, stresses on the elastomer are eliminated and no further degradation is expected.

- in high flow rates past the failed seal. The N-Seal specific data show that, although operational problems have resulted in seal degradation, no gross failures of seal stages have occurred. When initial degradation of a seal stage was detected, the plants were taken offline and the seals replaced. However, the potential exists that a degraded seal stage could progress to a failed seal stage. For this analysis, it is assumed that a seal stage failure due to a pre-existing or random stage failure will result in high flows past the failed seal stage.

Given the flows discussed above, a nominal flow through a PBD of 2.5 gpm, and the flow paths shown in Figure 2-1, flow rates expected from the various combinations of seal failures are shown in Table 3-1 for Westinghouse pump installations based on cool water flowing from the seal. Flow rates are calculated using ratios based on flow being proportional to the square root of the pressure differential across the failed seal. For large seal failures, there would be a negligible ENERCON Services, Inc. page 11

pressure differential across the seal. The flows shown are the bounding initial conditions for the seal failure events. After the initial heat-up, two-phase flow will occur and the volumetric flow rates will change with overall mass flow rates decreasing.

[

]a,b,c 3.3 Abeyance Seal Failure Modes As discussed in above, a flow rate in excess of [ ]a,b,c past the third stage mechanical seal is needed to actuate the Abeyance Seal. Failure combinations that do not result in flow rates large enough to actuate the Abeyance Seal are described in Section 3.2. Because the Abeyance Seal is not demanded until after failure of all three mechanical seal stages have failed, potential failure modes for the Abeyance have been examined.

The Abeyance Seal, if actuated, is designed to provide a leak-tight seal between the RCP shaft and the atmosphere given that the RCP has been tripped. Failure mechanisms for the Abeyance Seal could prevent a complete seal from forming or could result in complete failure of the seal.

Failure modes for the Abeyance Seal could be caused by maintenance or installation practices or by mechanical failures of the seal. Causes of failures could include:

Foreign material entering the seal package during assembly or installation Use of incorrect or improper parts during assembly or installation Pre-existing flaws in parts Improper assembly or installation Damage to components during assembly or installation The Abeyance Seal is produced as a safety-related component under a 10CFR50 Appendix B Quality Program. The Quality Assurance (QA) and Quality Control (QC) processes should detect ENERCON Services, Inc. page 12

and prevent the vast majority of these issues from occurring in the final installed seal package.

In addition, many of the potential failure modes are expected to result in only partial failure of the Abeyance Seal. That is, the failure would result in a small flow rate past the Abeyance Seal to atmosphere. However, because the flow rate for each failure mode cannot be calculated, this analysis will conservatively assume that any failure of the Abeyance Seal is a complete failure of the Abeyance Seal to actuate.

ENERCON Services, Inc. page 13

4.0 Operational Considerations Affecting N-Seal Performance Major parameters which can have a negative impact on seal life include abnormal axial and radial shaft motions, abnormal radial shaft vibrations, elevated temperature, elevated pressure, oxidizing water chemistry, the presence of particulates, and an unusually high number of pump start/stop cycles. While these factors have an impact on seal life, they do not have an immediate impact on seal integrity. The major factor that influences integrity of the N-Seals is availability of seal cooling which is provided by two redundant and diverse methods. At PINGP, primary seal cooling occurs through charging flow injection from the CVCS. The second is cooling of the thermal barrier heat exchanger by component cooling water (CCW). The effects of these systems on N-Seal integrity are described below.

4.1 Seal Injection The preferred method for cooling for the RCP seal package is CVCS seal injection flow. CVCS seal injection flow serves two purposes. The first is seal cooling. The second is to keep small particles and debris that may be present in the RCS from entering the RCP seals.

Cooling of the N-Seals is provided by the flow of cool injection water from the CVCS preventing the hot reactor coolant from entering the seals. Seal injection flow normally is supplied between six (6) and ten (10) gpm per pump and is typically at a temperature of 100°F to 145°F (Reference 9). As shown in Figure 2-1, the injection flow piping is connected to the pump thermal barrier flange and flow is directed to the bottom of the seal cartridge. With an assumed normal staging flow of 0.7 to 3.0 gpm with a target nominal value determined in Figure 2-2 (Reference 10), or approximately 2.5 gpm, and leakage nominally less than 0.1 gpm, most of the seal injection fluid will flow downward through the pump internals and into the RCS. In other words, of the 6-gpm minimum seal injection flow into the pump seal, approximately 3.5 gpm will flow into the RCS while the remaining 2.5 gpm will flow upward through the seal cartridge to the CVCS seal return (CBO) line to maintain proper seal staging. A small amount of normal seal leakage will flow out the third stage to the containment at atmospheric pressure.

Since most of the seal injection flow is directed downward into the RCS under normal conditions, flow of reactor coolant upward from the RCS into the seal is minimized. Thus, seal injection flow prevents debris that might be in the RCS from entering the seal cartridge. The seal faces normally operate with a nominal thin fluid film gap of less than [ ]a,b,c.

Preventing debris in the RCS from entering the seal cartridge minimizes the amount of small particles that could score the seal faces or increase seal face wear.

Although it is desirable to operate the RCP seal cartridge with CVCS injection, the seal cartridge is designed to operate continuously without seal injection flow as long as CCW to the thermal barrier heat exchanger is available. If seal injection is lost, then flow will originate from RCS and flow up through the seals. As long as the thermal barrier heat exchanger is operating to cool the backflow of reactor coolant, temperatures in the seal cartridge will be maintained in the normal range and no immediate challenge to seal integrity will occur. Extended periods, e.g.,

many days, of operation without seal injection may result in particulates from the RCS causing premature seal face wear which can shorten seal life and increase personnel exposure associated ENERCON Services, Inc. page 14

with seal maintenance, but these are operational and economic considerations and do not affect seal integrity.

4.2 Component Cooling Water CCW to the thermal barrier heat exchanger is the second source of cooling for the pump seal.

The N-Seal cartridge is designed to operate for an indefinite period of time with only cooling to the thermal barrier heat exchanger as long as seal temperatures are maintained within recommended operating limits. However, because small particles and debris may be in the reactor coolant that flows past the seals, extended operation, e.g., days, with only CCW cooling can result in premature wear of the seals and may result in the seals not operating to their design life.

4.3 CVCS Seal Return (CBO) Flow As stated in Section 2.1, the seal is designed to operate with each of the three stages carrying one-third of RCS pressure. If the CVCS seal return (CBO) flow path is closed, the seal typically would be exposed to nearly the entire system pressure across the third or upper seal stage with no staging flow. Test data has shown that a leakage rate of approximately [ ]a,b,c can be expected from the N-Seal under this abnormal condition when the RCS is at full pressure and the pump is running. Operation with the CVCS seal return (CBO) flow path isolated restricts cooling flow to a seal stage that is operating with a differential pressure above recommended operating limits. If a functioning relief valve is present upstream of the isolation point on the CVCS seal return (CBO) line, then the relief valve can be considered adequate for maintaining flow under this scenario. The CBO is merely redirected into the containment instead of back to CVCS. At PINGP, the seal return isolation valves are air operated and may not close if instrument air is not available to containment. In that case, the CVCS return line relief valve will open and direct CBO to the PRT. While operating with the CVCS seal return (CBO) flow path isolated will not result in seal failure, the condition is undesirable and can shorten seal life. For maximum seal life, the pump should not be operated with the CVCS seal return (CBO) flow path closed.

4.4 Restoration of Seal Injection If all seal cooling is lost, seal integrity can be challenged; therefore seal cooling should be recovered as quickly as possible. In restoring seal injection flow to the RCPs, the primary objective is to restore the flow gradually to minimize the thermal transient to the seal cartridge and the pump internals so as to maximize seal operating life. However, the N-Seal is highly resistant to thermal transients and no damage is expected if seal injection is restored suddenly.

4.5 Loss of Both Seal Injection and Thermal Barrier Heat Exchanger Cooling After a loss of seal injection and thermal barrier heat exchanger cooling, seal cartridge temperatures will begin to rise and will exceed alarm and recommended operating limit set points after the cold water around the seal package is purged.

Plant operating procedures (References 6, 7, and 8) were developed using the guidance in N-9000 Seal Technical Manual (Reference 9) as a basis for protecting the seal. The technical manual establishes setpoints and directs operators for what to do in the case of a loss of seal cooling event. That is, the procedures (Reference 6, 7, and 8) direct that all RCPs be secured ENERCON Services, Inc. page 15

following a Loss of Seal Cooling event. This meets the requirement to trip the pump within 20 minutes as stated in the WCAP. This guidance is consistent with that which was evaluated in WCAP-16175. No challenge to seal integrity will occur for short periods of operation without seal cooling. As described below (Section 5.1), no challenge to integrity of the primary N-Seals is expected if the affected RCP is tripped within the [ ]a,b,c time from dynamic testing plus the time needed to purge cool water from the RCP seal package.

ENERCON Services, Inc. page 16

5.0 Pump Seal Tests and Results This section summarizes the testing that Flowserve has performed on the Abeyance Seal and dynamic testing of the N-Seals following a LOSC (Reference 5). The addition of the Abeyance Seal extends static LOSC coping time for an indefinite period. The Abeyance Seal is qualified for 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> of operation under the most extreme operating parameters and has been tested for 388 hours0.00449 days <br />0.108 hours <br />6.415344e-4 weeks <br />1.47634e-4 months <br />. The Abeyance Seal works in concert with the capabilities of the standard N-Seal which was designed to cope with an eight-hour LOSC under static (SBO) conditions. In addition, testing and the dynamic LOSC operation demonstrated the ability of the N-Seal to operate at normal RCS temperatures and pressure for well over one hour. The Abeyance Seal extends these times even further while virtually eliminating all seal leakage in many scenarios.

The Flowserve dynamic LOSC tests demonstrate that the mechanical seal package with slotted carbon faces can remain intact for over [ ]a,b,c with the seals at the full RCS temperature and pressure of 560°F and 2250 psig while the pump is operating (Section 5.1).

After the pump has stopped rotating, the static performance characteristics described above apply. Finally, the Abeyance Seal provides assurance that after degradation to the mechanical seal package occurs and leakage increases above [ ]a,b,c (Section 5.2.8), the static coping time is extended indefinitely with negligible leakage from the Abeyance Seal and total RCP seal leakage limited to flow only from CBO (Section 5.2.7). Even under the strenuous qualification program performed, the Abeyance Seal is fully qualified for 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> of operation under the most extreme operating parameters (Section 5.2.9).

5.1 N-Seal Dynamic Operation Test Flowserve conducted tests that evaluated the ability of the N-Seal to withstand the effects of operation without seal cooling (Reference 5). The first was a dynamic operation test of the N-Seal with slotted carbon faces at the staging pressure [ ]a,b,c and inlet temperature of 560°F to demonstrate that the N-Seal is capable of operating in a LOSC scenario until operator action to secure the pumps can be expected. A target of one hour at full RCS temperature was selected as the test objective as that was considered a reasonable time for successful action to respond to alarms and trip RCPs. The test takes no credit for any operating service from the 3rd stage seal, since at full temperature it will have steam at its inlet. Also, the time to heat up the remaining water in the RCP heat exchanger is not considered.

Based on Reference 12, the volume of cold water in the PINGP RCPs that would be purged is 23 gallons in each pump. This volume will be purged in 9 minutes given nominal seal leakage. For the N-Seal package, flow from the RCS through the RCP seals is nominally 2.5 gpm. If the RCP is tripped before the cold water in the N-Seal package is purged, then there is no challenge to seal integrity. The SER for Reference 1 acknowledges that no damage to the seals is expected if the pumps are tripped within 20 minutes of the loss of seal cooling. However, Reference 1 evaluated pumps with a smaller volume of cold water around the thermal barrier heat exchanger than Westinghouse pumps. Therefore, the additional time available to purge the cold water from Westinghouse pumps is consistent with the analyses in Reference 1.

ENERCON Services, Inc. page 17

This time would add to the time available to trip the RCPs. System pressure was rapidly increased from 750 psig to 1250 psig as this is the staging pressure of the N-Seal with a failed third stage.

Figure 5-1 shows the operating conditions of the first dynamic seal test for the N-9000 seal package. The test demonstrates that the first and second stage seals, operating by themselves, can run for more than [ ]a,b,c. No measurable change in seal leakage occurred during this elevated temperature operation. Post-test examination showed that the condition of the seal faces was good following the testing, with no pitting, chipping or cracking, and no excessive wear. Given the good condition of the components noted from this testing, it would be expected that many additional hours of static operation under LOSC could be withstood by the standard N-Seal without gross leakage after the pumps were secured.

[

]a,b,c In addition, several N-Seals, including both slotted carbon and Mayer groove face configurations, that were installed and operated in plants for 10 to 17 years were removed and examined. These seals showed no unusual wear or other effects from operation. Since no significant wear or degradation was seen on these seals, the previously-described test of a new seal is valid for seals that have operated for the expected life cycle. Based on the test and examination of the previously-operated seals, it is concluded that slotted carbon N-9000 seals can operate for ninety minutes after fluid in the seal cartridge reaches normal ENERCON Services, Inc. page 18

reactor operating temperature and pressure (which may take more than 20 minutes to be reached), as discussed above. In addition, operating for that period will not affect the likelihood of subsequent static failure.

5.2 Abeyance Seal Tests Development of the Abeyance Seal included a number of tests throughout the design process.

The tests (summarized in Reference 5) were used to identify potential failure modes and to ensure that the design functioned as expected. Each time the Abeyance Seal design was modified, it was tested and, if the test indicated a potential failure mode, the seal was re-designed to eliminate the failure mode and the seal tested again. The Abeyance Seal testing, described below, provides evidence of the ability of the seal to reliably actuate at the desired leakage rate, without premature actuation, and the ability of the seal to hold for an extended duration with zero leakage, even under extreme operating conditions.

The test data, presented in Appendix A, can be used to estimate the probability of an Abeyance Seal failure to actuate or failure to hold a seal. The data in Appendix A presents a series of tests for the evolving Abeyance Seal design (described by the columns Seal Design, Actuation Ring Configuration, and Static Ring Configuration). When a seal failure occurred during a test, a seal re-design was performed to eliminate that failure mode. Therefore, the failures that were experienced by earlier Abeyance Seal designs are evaluated to determine if the failures are applicable to the final design.

Details of specific tests are summarized below.

5.2.1 Abeyance Seal Low-Pressure Actuation Test The purpose of this test was to simulate low pressure actuation of the Abeyance Seal on minimal gas flow as a functional test of the seal actuation initiator ring. Shop air was used to actuate the Abeyance Seal by slowly increasing shop air flow from [

]a,b,c and observing actuation point. The air was then released from the cavity and the test repeated varying the rate of air flow increase.

The Abeyance Seal actuated each of the six times that it was tested, with no issue and held shop air with no signs of leakage. Air actuation was consistently between [ ]a,b,c on shop air. The variability in the rate of opening was due to the speed of the supply valve to open, ranging from [ ]a,b,c.

5.2.2 Abeyance Seal Low-Pressure Actuation Test at Elevated Temperature The purpose of this test was to simulate low pressure actuation of the Abeyance Seal on minimal gas flow as a functional test of the seal actuation initiator ring at an elevated temperature of 225°F. This is near the expected inlet temperature of steam mixtures to the Abeyance Seal under most accident scenarios. Abeyance Seal temperature was increased to 225°F by flow of pressurized water through the system using a circulation pump and heaters; the circulation pump was then isolated. Shop air was used to actuate the Abeyance Seal by slowly increasing shop air flow from [ ]a,b,c and observing actuation point. The air was then released from the cavity and the test repeated varying the rate of air flow increase.

ENERCON Services, Inc. page 19

The Abeyance Seal actuated repeatedly, with no issue and held shop air with no signs of leakage.

a,b,c Air actuation was consistently between [ on shop air. The variability in the rate of opening was due to the speed of the supply valve to open, ranging from [

]a,b,c.

5.2.3 Abeyance Seal Non-Actuation Test on Seal Leakage The purpose of this test was to demonstrate the Abeyance Seal does not actuate on normal or upset seal leakage up to 200°F flow. This condition was chosen to establish that the Abeyance Seal would not prematurely actuate on seal leakage under normal or upset seal leakage temperatures. First, unheated water was passed through the Abeyance Seal. The flow was gradually increased to determine if the Abeyance Seal would actuate. Then the water in the test loop was heated to 200°F using the circulation pump and heaters. The heated water was passed through the Abeyance Seal and the flow gradually increased.

The Abeyance Seal did not actuate at up to [ ]a,b,c of ambient or 200°F water flow through the seal. [ ]a,b,c was the upper limit of test flow rate due to limitations in the circulation loop. Comparing test data for the generated pressure at the Abeyance Seal on air actuation allowed the extrapolation of the data to determine that actuation would occur near [ ]a,b,c water flow at ambient and elevated temperatures. As long as cooling is provided to the RCP so that leakage is water and not steam, no actuation will occur up to approximately [ ]a,b,c.

5.2.4 Abeyance Seal Full-Pressure Seal Test The purpose of this test was to demonstrate the Abeyance Seal is capable of sealing at full pressure for one hour. The Abeyance Seal was actuated using shop air. After actuation, air was bled off the seal and the system flooded with water. The test loop was then pressurized to 2500 psig and held for one hour.

The Abeyance Seal actuated and held 2500 psig for one hour, with no signs of leakage during the test.

5.2.5 Abeyance Seal Steam Actuation Test The purpose of this test was to demonstrate the Abeyance Seal successfully actuates on steam.

The test loop was pressurized to 1150 psig and heated to 400°F using pumps and heaters. The hot pressurized water was then passed [ ]a,b,c to the Abeyance Seal to create steam for actuation.

The Abeyance Seal actuated immediately when the block valve [

]a,b,c. Accumulated leakage before actuation was minimal. After actuation there were no signs of degradation or leakage during a half hour hold period. This test also demonstrates that the higher velocity of flow for steam reduces the actuation point from approximately [

]a,b,c. Further tests (see section 5.2.8) were performed to determine the minimum-flow actuation point of [ ]a,b,c for the Abeyance Seal.

ENERCON Services, Inc. page 20

5.2.6 Abeyance Seal Steam Actuation and Full-Pressure Seal Test The purpose of this test was to demonstrate the Abeyance Seal successfully actuates and holds on full-pressure steam. The test loop was pressurized to 2250 psig and heated to 400°F using pumps and heaters. The hot pressurized water was then passed [ ]a,b,c to the Abeyance Seal to create steam for actuation.

The Abeyance Seal actuated immediately when the block valve [

]a,b,c. After actuation there were no signs of degradation or leakage during a half hour hold period. Further tests (see section 5.2.8) were performed to determine the minimum-flow actuation point of at least [

]a,b,c for the Abeyance Seal.

5.2.7 Abeyance Seal Steam Actuation and Extended Seal Test The purpose of this test was to demonstrate the Abeyance Seal successfully actuates and holds on full-pressure steam for an extended period. The test loop was pressurized to 2250 psig and heated to 400°F using pumps and heaters. The hot pressurized water was then passed [

]a,b,c to the Abeyance Seal to create steam for actuation. Following actuation temperature and pressure will steadily increase to full test conditions of 2500 psig and 580°F After 264 hours0.00306 days <br />0.0733 hours <br />4.365079e-4 weeks <br />1.00452e-4 months <br /> at full temperature and pressure a cool-down period began. After an additional 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, pressure was removed from the seal to evaluate performance. During the 288 hour0.00333 days <br />0.08 hours <br />4.761905e-4 weeks <br />1.09584e-4 months <br /> test, no signs of leakage were present and the seal successfully handled the extended coping time.

5.2.8 Abeyance Seal Minimum Actuation Flow Test The purpose of this test was to determine the minimum flow actuation point for the Abeyance Seal on steam (at least [

]a,b,c). The Abeyance Seal was connected to a leg on the test loop. [Various orifice arrangements also were connected to the leg to change the flow rate to the Abeyance Seal. The test loop was pressurized to 2250 psig and heated to 580°F using the test loop pumps and heaters. Beginning with the smallest diameter orifice, the associated block valve was opened and the seal observed to determine if it actuated. If actuation did not occur, the orifice was changed to next larger size and the test repeated.

The Abeyance Seal did not actuate on flow rates below [

]a,b,c. No actuation occurred at these flow rates using the same Abeyance Seal. Upon increasing [

]a,b,c, the Abeyance Seal did actuate. [

ENERCON Services, Inc. page 21

]a,b,c. After the pump is shut-down, the N-Seal cartridge has been demonstrated to handle over 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of SBO conditions (Reference 4). After potential degradation of elastomers, and increased leakage from the seal package the Abeyance Seal is then able to actuate and reduce leakage to zero for an extended time.

5.2.9 Two-Week Hold Test The purpose of this test was to demonstrate the ability of the Abeyance Seal to function for an extended period of time at full RCS temperature and pressure. For this test, the goal was to maintain 2500 psig and 580°F for a minimum of 336 hours0.00389 days <br />0.0933 hours <br />5.555556e-4 weeks <br />1.27848e-4 months <br />. The Abeyance Seal was actuated on steam, and once actuated; hot pressurized water at 580°F and 2500 psig was circulated through the seal for a total of 388 hours0.00449 days <br />0.108 hours <br />6.415344e-4 weeks <br />1.47634e-4 months <br />. At hour 52, a test fitting failed, depressurizing the system. The fitting was repaired without disturbing the test article, and the tester repressurized at temperature, which re-actuated the Abeyance Seal. The 580°F and 2500 psig conditions were held for an additional 336 hours0.00389 days <br />0.0933 hours <br />5.555556e-4 weeks <br />1.27848e-4 months <br />.

There was no measurable leakage throughout the 388 hour0.00449 days <br />0.108 hours <br />6.415344e-4 weeks <br />1.47634e-4 months <br /> test when pressurized. At no time during the test was there any visible steam from the Abeyance Seal under pressure. Test data indicated the pressure and temperature remained stable at 2500 psig and 580°F inlet temperature, with zero leakage. The test exceeded the original goal of 336 hours0.00389 days <br />0.0933 hours <br />5.555556e-4 weeks <br />1.27848e-4 months <br />.

5.2.10 Abeyance Seal Final Qualification Tests The final qualification program consisted of additional tests, including beyond design basis tests intended to investigate the boundaries of the design. The qualification tests were to verify the capability of the Abeyance Seal in installed conditions which may include eccentric sealing surfaces and/or CRUD coated parts (the shaft sleeve and Abeyance Seal sealing surface). The qualification tests also demonstrated the ability to withstand depressurization from 2500 psig to 200 psig. These tests verified the full functionality of the Abeyance Seal, as it successfully performed a zero leakage seal under all design basis operating conditions.

The final tests were comprised of the following conditions: (1) an eccentric CRUD-coated shaft sleeve and CRUD-coated Abeyance Seal, and (2) an eccentric CRUD-coated shaft sleeve and CRUD-coated Abeyance Seal with controlled depressurization, and (3) a beyond design basis scratched, eccentric, CRUD-coated shaft sleeve and CRUD-coated Abeyance Seal. The CRUD substance used in the tests is a simulation of chemicals found in RCS leakage and is believed to be more adhesive than additional chemicals commonly found. All tests used steam actuation to begin the test, followed by various hold periods.

5.2.10.1 Eccentric CRUD-coated Shaft Sleeve and CRUD-coated Abeyance Seal 96-Hour Hold Qualification Test The purpose of this test was to demonstrate the ability of the Abeyance Seal to resist eccentricity on the seal surface, with the parts being covered with CRUD, and maintaining 2500 psig for a minimum of 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />. The Abeyance Seal was actuated on steam, and once actuated; hot pressurized water at 580°F and 2500 psig was circulated through the seal for at least 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />.

ENERCON Services, Inc. page 22

There was no measurable leakage throughout the 106-hour test. At no time during the test was there any visible steam from the Abeyance Seal. Test data indicated the pressure and temperature remained stable at 2500 psig and 580°F inlet temperature, with zero leakage. The test exceeded the original goal of 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />.

5.2.10.2 Eccentric CRUD-coated Shaft Sleeve and CRUD-coated Abeyance Seal Controlled Depressurization Qualification Test The purpose of this test was to demonstrate the ability of the Abeyance Seal to withstand depressurization and cooling following an extended coping period. Parts were covered with CRUD, and the test held at 2500 psig and 580°F for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, followed by depressurization and cooldown to 200 psig and ambient temperature. The Abeyance Seal was actuated on steam, and once actuated; hot pressurized water at 580°F and 2500 psig was circulated through the seal for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The system was then cooled and depressurized to ambient temperature and 200 psig.

The Abeyance Seal actuated normally and held full pressure and temperature with zero visible leakage for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. During the depressurization, there was zero leakage until the seal cavity pressure reached [

]a,b,c.

5.2.10.3 Scratched Eccentric CRUD-coated Shaft Sleeve and CRUD-coated Abeyance Seal Test The purpose of this test was to determine the ability of the Abeyance Seal to function with large axial scratches across the sealing surface of the Abeyance Seal on an eccentric surface, with realistic RCS CRUD coating, at 2500 psig and 580°F. For this test, four large axial scratches

[ ]a,b,c were created across the sealing surface. The test was designed to demonstrate that the Abeyance Seal will actuate and hold pressure for greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, even with surface damage beyond procedural acceptance values. The Abeyance Seal was actuated on steam, and once actuated; hot pressurized water at 580°F and 2500 psig was circulated through the seal until leakage exceeded test system capacity.

Measurable seal leakage began within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of the test commencing as was expected given the size and geometry of the scratches that were placed on the shaft as part of the test setup. The leakage gradually increased from zero to approximately [

]a,b,c at full temperature and pressure. At that point, the leakage increased beyond the test system capability to maintain full temperature [ ]a,b,c.

Without being able to maintain full temperature the test was terminated. This beyond design condition test demonstrated the Abeyance Seal will still function over an extended time with compromised sealing surfaces.

ENERCON Services, Inc. page 23

5.3 Test Failure Data Analysis The last five rows in the Appendix A table give the test data that are applicable to the final Abeyance Seal design. While tests of earlier designs experienced failures of the Abeyance Seal to hold after actuation, these failures involved failure mechanisms that design changes eliminated from the final design. Therefore, failures that occurred during previous tests are not applicable.

For the final design there are zero entries for the last five rows in the Seal Failure column for failure of the seal to hold.

The total Test Duration for these final five tests is calculated to be 775.64 hours7.407407e-4 days <br />0.0178 hours <br />1.058201e-4 weeks <br />2.4352e-5 months <br /> by summing the entries in column Test Duration Actual (hrs) for the last five rows. This gives a probability of

[ ]a,b,c for Abeyance Seal failure to hold a seal.

All the tests shown in Appendix A are applicable for determining actuation failure probability.

Although the final design changed features that improved the ability of the Abeyance Seal to hold at pressure after actuation, e.g., the length of the lip, the design changes did not significantly affect the ability of the seal to actuate. Therefore, demand failures from all development tests are included to maximize the amount of data available.

The total number of actuation demands is calculated to be [ ] by summing the entries in the column Actual Demands for the table. For these same rows, there are zero demand failures.

This gives a probability of [ ]a,b,c for Abeyance Seal failure to actuate.

ENERCON Services, Inc. page 24

6.0 N-Seal Experience at Operating Plants In order to develop the probabilistic failure model for the Abeyance Seal of N-Seal RCP seal package, industry installation and event data was collected for the N-Seal package. The collected data included the numbers of seals and seal stages installed at a given plant, an estimate of the operating time for each seal, any events that indicate failure or incipient failure of a seal, and a description of the event.

Raw data was collected from a total of 11 units, and is reproduced in Table 6-1. This table shows the date that an N-Seal was first installed on each pump of each plant and the date that each seal was replaced. The raw data was compiled and analyzed to determine the total numbers of seals installed, the total operating time for those installations, the total numbers of failures that occurred, and whether the seal failure was caused during installation or occurred as a result of operation. The data compilation is presented in Tables 6-1 through 6-3. Based on the industry data compilation provided in these tables, estimates of N-Seal failure probabilities can be developed.

From Table 6-3, the total number of failures occurring due to installation errors is [

]a,b,c.

Also from Table 6-3, the total number of operating failures or incipient failures is [

]a,b,c.

ENERCON Services, Inc. page 25

[

ENERCON Services, Inc. page 26

ENERCON Services, Inc. page 27 ENERCON Services, Inc. page 28 ENERCON Services, Inc. page 29 ENERCON Services, Inc. page 30

(

]a,b,c ENERCON Services, Inc. page 31

[

ENERCON Services, Inc. page 32

]a,b,c ENERCON Services, Inc. page 33

7.0 RCP Seal Failure Model for the Abeyance Seal of the N-Seal Package A model for failure of the Abeyance Seal of the N-Seal package was developed for the N-seal package. This model is intended to be used in the PINGP PRA models. Application of the model for other purposes must be performed with caution. This failure model for the N-Seal package Abeyance seal addresses the probability of failure for the Abeyance Seal.

Failure of the Abeyance Seal considers three failure modes: failure caused by an installation error, failure of the Abeyance Seal to actuate, and failure of the Abeyance Seal to hold once actuated. Any one of the three failure modes will result in failure of the Abeyance seal.

Therefore, the failure probability of the Abeyance Seal is the sum of the three failure probability values.

Failure values for failure to actuate and failure to hold are developed in Section 5 using proprietary operating, test, and failure data. The probability of an installation error resulting in failure of an N-Seal is developed in Section 6. Because the Abeyance Seal is an integral part of the N-seal package, the probability of an installation error causing failure of an Abeyance Seal is taken to be the same as an installation error causing failure of an N-Seal.

Installation and actuation failures are demand based failures while failure-to-hold is time-based.

Therefore, the failure probability of the Abeyance Seal must consider the length of time that the Abeyance Seal is required to maintain the RCS pressure boundary. Results of evaluation of the model are presented in Table 7-1.

[

]a,b,c ENERCON Services, Inc. page 34

8.0 Summary and Conclusions The analyses presented in this paper document the development of a failure model for the Flowserve N-Seal Abeyance Seal package, including failure data, for failure of the Abeyance Seal. In addition, this paper evaluates dynamic testing of the N-Seal under LOSC conditions to determine the time that a slotted carbon N-9000 can operate without cooling prior to failure.

The model for failure of the Abeyance Seal is based on data obtained during the extensive testing performed during development of the Abeyance Seal along with N-Seal-specific operating experience accumulated during the many years that the N-Seal packages have been used at US nuclear plants.

The results of these analyses additionally provide a model for failure of the N-Seal Abeyance Seal package that can be used in the PINGP PRA model to estimate the likelihood of failure given that conditions demand actuation of the Abeyance Seal. That is, failure of all stages of the N-Seal package have occurred and the RCP has been tripped.

The time that an N-seal can operate after a loss of all seal cooling is estimated based on data obtained from dynamic tests performed on slotted carbon N-9000 seal packages. This testing includes data obtained after the publication of Reference 1.

ENERCON Services, Inc. page 35

9.0 References

1. WCAP-16175-NP-A, Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants, Revision 0.

2. WCAP-16141 (Non-Proprietary), RCP Seal Leakage PRA Model Implementation Guidelines for Westinghouse PWRs, August 2003.

3. WCAP-16396 (Non-Proprietary), Westinghouse Owners Group Reactor Coolant Pump Seal Performance for Appendix R Assessments, January 2005.

4. Test Report RDR-0010, Loss of Seal Cooling Water Test N-9000 Advanced Reactor Coolant Pump Mechanical Seal Cartridge Flowserve Corporation, Byron Jackson Project No. DG-871.015.80, April 1988.

5. Internal Project: 1342-963, 1342-985 & 1343-017, N-Seal Appendix R Spurious Operation and Abeyance Seal Development Project, Revision C, Flowserve Corporation, December 2014.

6.

7.

8. 1C3 AOP3 [2C

9. NX-236888, N-9000 Seal Technical Manual

10. PRA Input Transmittal (QF0939): PIT No. PI-19

11. PINGP Updated Safety Analysis Report, Section 4, page 4.3-7.

12. LTR-PMO-07-104 Rev.0, Prairie Island Units 1 & 2 Model 93A Reactor Coolant Pump Seal Water Volume Related To Safe Shutdown Analysis Validation ENERCON Services, Inc. page 36

Appendix A. Abeyance Seal Test Data[

ENERCON Services, Inc. page 37

Appendix A. Abeyance Seal Test Data (continued)

ENERCON Services, Inc. page 38

Appendix A. Abeyance Seal Test Data (continued)

ENERCON Services, Inc. page 39

Appendix A. Abeyance Seal Test Data (continued)

ENERCON Services, Inc. page 40

Appendix A. Abeyance Seal Test Data (continued)

]a,b,c ENERCON Services, Inc. page 41

ENCLOSURE 3 Flowserve Letter and Affidavit Application for Withholding Proprietary Information From Public Disclosure 5 pages follow

~ Flowserve Corporation FLOWSERVE Engineered Products Division

~ Nuclear Products Operations 2300 E. Vernon Ave.

Vernon, CA 90058 U.S. Nuclear Regulatory Commission Date: 6/3/2019 Document Control Desk 11555 Rockville Pike Document: FLS-WOP-190602A Rockville, MD 20852 APPLICATION FOR WITHHOLDING PROPRIETARY INFORMATION FROM PUBLIC DISCLOSURE

Subject:

PRA Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant, Revision 0, Dated May 20, 2019 (Proprietary)

The Application for Withholding Proprietary Information from Public Disclosure is submitted by Flowserve Corporation, pursuant to the provisions of paragraph (b)(l) of Section 2.390 of the U.S. Nuclear Regulatory Commission's regulations. It contains commercial strategic information proprietary to Flowserve which is customarily held in confidence.

The proprietary material for which withholding is being requested is identified in the proprietary version of the subject report and presentation. In conformance with 10 CFR Section 2.390, Affidavit FLS-WOP-190602B accompanies this application for withholding, setting forth the basis on which the identified proprietary information may be withheld from public disclosure. The Document is considered proprietary in its entirety. A separate, redacted non-proprietary version is also provided.

Accordingly, it is respectfully requested that the subject information which is proprietary to Flowserve be withheld from public disclosure in accordance with 10 CFR Section 2.390 of the Commission's regulations.

Correspondence with respect to the proprietary aspects of the Application for Withholding (FLS-WOP-190602A) or the accompanying Affidavit (FLS-WOP-l 90602B) should reference the applicable document and addressed as follows:

Main Contact Regulatory Compliance Proprietary Reviewer Mr. James M. Cook Mr. David P. Zagres Flowserve Director Nuclear Sales Principal Engineer, Nuclear Products Operations Phone (Office): 952-443-0682 Phone: 908-859-7371 E-Mail: jcook@flowserve.com E-Mail: dzagres@flowserve.com Address: Flowserve Corporation 1480 Valley Center Pkwy.

Bethlehem, PA 18017 Sincerely,

/A~l 77--

David Zagres

Document: FLS-WOP-190602B AFFIDAVIT COMMONMWEALTH OF PENNSYLVANIA:

COUNTY OF NORTHAMPTON:

Before me, the undersigned authority, personally appeared David Paul Zagres, who, being by me duly sworn according to law, deposes and says that he is authorized to execute this Affidavit on behalf of Flowserve Corporation, and that the averments of fact set forth in this Affidavit are true and correct to the best of his knowledge, information, and belief:

,_ A/\,_/ ~-

- b___,}~ ~ ]_ ______

David Paul Zagres Regulatory Compliance Proprietary Reviewer Sworn to and subscribed before me this _5_ day of June 2019 Ut~1-i1.~1:

Notary Public Commonwealth of Pennsylvania

• Notary Seal MICHEL£ CHRISTIN£ FONTANEZ, Notary N>llc Nofthan1>ton County My Commtsston Expires February 13, 2022 Commission ~ 1324591

Document: FLS-WOP- l 90602B (1) I am Manager, Regulatory Compliance for Nuclear Products Operations, Flowserve Corporation, and as such, I have been specifically delegated the function of reviewing the proprietary information sought to be withheld from public disclosure in connection with nuclear power plant licensing and rule making proceedings, and am authorized to apply for its withholding on behalf of Flowserve.

(2) I am making this Affidavit in conformance with the provisions of 10 CFR Section 2.390 of the Commission's regulations and in conjunction with the Flowserve Application for Withholding Proprietary Information from Public Disclosure accompanying this Affidavit.

(3) I have personal knowledge of the criteria and procedures utilized by Flowserve in designating information as a trade secret, privileged or as confidential commercial or financial information.

(4) Pursuant to the provisions of paragraph (b)( 4) of Section 2.390 of the Commission's regulations, the following is furnished for consideration by the Commission in determining whether the information sought to be withheld from public disclosure should be withheld.

a. The information sought to be withheld from public disclosure is owned and has been held in confidence by Flowserve.

b. The information is of a type customarily held in confidence by Flowserve and not customarily disclosed to the public. Flowserve has a rational basis for determining the types of information customarily held in confidence by it and, in that connection, utilizes a system to determine when and whether to hold certain types of information in confidence. The application of that system and the substance of that system constitute Flowserve policy and provide the rational basis required.

Under that system, information is held in confidence if it falls in one or more of several types, the release or which might result in the loss of an existing or potential competitive advantage, as follows:

1. The information reveals the distinguishing aspects of a process (or component, structure, tool, method, etc.) where prevention of its use by any of Flowserve's competitors without license from Flowserve constitutes a competitive economic advantage over other companies.

ii. It consists of supporting data, including test data, relative to a process (or component, structure, tool, method, etc.), the application of which data secures a competitive economic advantage, e.g., by optimization or improved marketability.

iii. Its use by a competitor would reduce his expenditure of resources or improve his competitive position in the design, manufacture, shipment, installation, assurance of quality, or licensing a similar product.

2

Document: FLS-WOP-190602B iv. It reveals cost or price information, production capacities, budget levels, or commercial strategies of Flowserve, its customers or suppliers.

v. It reveals aspects of past, present, or future Flowserve or customer funded development plans and programs of potential commercial value to Flowserve.

v1. It contains patentable ideas, for which patent protection may be desirable.

There are sound policy reasons behind the Flowserve system which include the following:

1. The use of such information by Flowserve gives Flowserve a competitive advantage over its competitors. It is, therefore, withheld from disclosure to protect the Flowserve competitive position.

11. It is information that is marketable in many ways. The extent to which such information is available to competitors diminishes the Flowserve ability to sell products and services involving the use of the information.

m. Use by our competitor would put Flowserve at a competitive disadvantage by reducing his expenditure of resources at our expense.

1v. Each component of proprietary information pertinent to a particular competitive advantage is potentially as valuable as the total competitive advantage. If competitors acquire components of proprietary information, anyone component may be the key to the entire puzzle, thereby depriving Flowserve of a competitive advantage.

v. Unrestricted disclosure would jeopardize the position of prominence of Flowserve in the world market, and thereby give a market advantage to the competition of those countries.

v1. The Flowserve capacity to invest corporate assets in research and development depends upon the success in obtaining and maintaining a competitive advantage.

c. The information is being transmitted to the Commission in confidence and, under the provisions of 10 CFR Section 2.390, it is to be received in confidence by the Commission.

d. The information sought to be protected is not available in public sources or available information has not been previously employed in the same original manner or method to the best of our knowledge and belief.

3

Document: FLS-WOP-190602B

e. The proprietary information sought to be withheld in this submittal is that which is appropriately marked in PRA Model for Flowserve N-Seal Abeyance Seal and Dynamic Testing for the Prairie Island Nuclear Generating Plant, Revision 0, Dated May 20, 2019 (Proprietary) being transmitted by Xcel Energy letter L-PI-19-025 along with Application for Withholding Proprietary Information from Public Disclosure (FLS-WOP-190602A), to the Document Control Desk. The proprietary information as submitted is applicable in response to certain NRC requirements for justification of the responses to Probabilistic Risk Assessment (PRA) of the response of the N-Seal as described by Flowserve, and may be used only for that purpose.

Public disclosure of this proprietary information is likely to cause substantial harm to the competitive position of Flowserve because it would enhance the ability of competitors to provide similar product, calculational models and licensing defense services for commercial power reactors without commensurate expenses. Also, public disclosure of the information would enable others to use the information to address NRC requirements for licensing documentation without purchasing the right to use the information.

The development of the technology described in part by the information is the result of applying the results of many years of experience in an intensive Flowserve effort and the expenditure of a considerable sum of money.

In order for competitors of Flowserve to duplicate this information, similar technical programs would have to be performed and a significant manpower effort, having the requisite talent and experience, would have to be expended.

Further the deponent sayeth not.

PROPRIETARY INFORMATION NOTICE Transmitted herewith is the proprietary version of a document furnished to the NRC in connection with requests for informational use only. The document is to be considered proprietary in its entirety.

COPYRIGHT NOTICE The report transmitted herewith bears a Flowserve copyright notice. The NRC is permitted to make the number of copies of the information contained in this report which is necessary for its internal use in connection with generic and plant-specific reviews as well as the issuance, denial, amendment, transfer, renewal, modification. Suspension, revocation, or violation of a license, permit, order, or regulation subject to the requirements of 10 CFR 2.390 regarding restrictions on public disclosure to the extent such information has been identified by Flowserve, copyright protection withstanding.

Copies made by the NRC must include the copyright notice in all instances and the proprietary notice if the original was identified as proprietary.

4