ML021640255

License Amendments Authorizing Changes to the Updated Final Safety Analysis Report

ML021640255
Person / Time
Site:	Oconee
Issue date:	06/11/2002
From:	Olshan L NRC/NRR/DLPM
To:	Mccollum W Duke Energy Corp
Olshan L N, NRR/DLPM, 415-1419
References
TAC MA9294, TAC MA9295, TAC MA9296
Download: ML021640255 (29)

Text

June 11, 2002 Mr. William R. McCollum, Jr.

Vice President, Oconee Site Duke Energy Corporation 7800 Rochester Highway Seneca, SC 29672

SUBJECT:

OCONEE NUCLEAR STATION, UNITS 1, 2 AND 3 RE: ISSUANCE OF AMENDMENTS (TAC NOS. MA9294, MA9295, AND MA9296)

Dear Mr. McCollum:

The Nuclear Regulatory Commission has issued the enclosed Amendment Nos. 325, 325, and 326 to Renewed Facility Operating Licenses DPR-38, DPR-47, and DPR-55, respectively, for the Oconee Nuclear Station, Units 1, 2, and 3. The amendments authorize changes to the Updated Final Safety Analysis Report (UFSAR) in response to your application dated June 21, 2000, as supplemented by letters dated April 30 and May 20, 2002. The April 30 and May 20, 2002, letters provided clarifying information that did not change the scope of the June 21, 2000, application nor the initial proposed no significant hazards consideration determination.

These amendments revise the UFSAR Section 10.4.7, Emergency Feedwater System.

A copy of the related Safety Evaluation is also enclosed. A Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Sincerely, Leonard N. Olshan, Senior Project Manager, Section 1 Project Directorate II Division of Licensing Project Management Office of Nuclear Reactor Regulation Docket Nos. 50-269, 50-270, and 50-287

Enclosures:

1. Amendment No. 325 to DPR-38

2. Amendment No. 325 to DPR-47

3. Amendment No. 326 to DPR-55

4. Safety Evaluation cc w/encls: See next page

June 11, 2002 Mr. William R. McCollum, Jr.

DISTRIBUTION:

OGC Vice President, Oconee Site PUBLIC ACRS T-6 E26 Duke Energy Corporation PDII-1 R/F GHill(6)

P. O. Box 1439 WBeckner RHaag,RII Seneca, SC 29679

SUBJECT:

OCONEE NUCLEAR STATION, UNITS 1, 2 AND 3 RE: ISSUANCE OF AMENDMENTS (TAC NOS. MA9294, MA9295, AND MA9296)

Dear Mr. McCollum:

The Nuclear Regulatory Commission has issued the enclosed Amendment Nos. 325, 325, and 326 to Renewed Facility Operating Licenses DPR-38, DPR-47, and DPR-55, respectively, for the Oconee Nuclear Station, Units 1, 2, and 3. The amendments authorize changes to the Updated Final Safety Analysis Report (UFSAR) in response to your application dated June 21, 2000, as supplemented by letters dated April 30 and May 20, 2002. The April 30 and May 20, 2002, letters provided clarifying information that did not change the scope of the June 21, 2000, application nor the initial proposed no significant hazards consideration determination.

These amendments revise the UFSAR Section 10.4.7, Emergency Feedwater System.

A copy of the related Safety Evaluation is also enclosed. A Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Sincerely,

/RA/

Leonard N. Olshan, Senior Project Manager, Section 1 Project Directorate II Division of Licensing Project Management Office of Nuclear Reactor Regulation Docket Nos. 50-269, 50-270, and 50-287

Enclosures:

1. Amendment No. 325 to DPR-38

2. Amendment No. 325 to DPR-47

3. Amendment No. 326 to DPR-55

4. Safety Evaluation cc w/encls: See next page DOCUMENT NAME: C:\\ORPCheckout\\FileNET\\ML021640255.wpd

• No major changes to SE Accession Number: ML021640255

• • See previous concurrence OFFICE PDII-1/PM PDII-1/LA OGC**

IOLB/SC*

SPSB/SC*

PDII-1/SC NAME LOlshan CHawes RHoefling DTrimble SWeerakkody JNakoski DATE 6/10/02 6/10/02 6/6/01 09/16/01 05/21/02 06/11/02 OFFICIAL RECORD COPY

DUKE ENERGY CORPORATION DOCKET NO. 50-269 OCONEE NUCLEAR STATION, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 325 Renewed License No. DPR-38

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment to the Oconee Nuclear Station, Unit 1 (the facility)

Renewed Facility Operating License No. DPR-38 filed by the Duke Energy Corporation (the licensee) dated June 21, 2000, as supplemented by letters dated April 30 and May 20, 2002, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations as set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commissions regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commissions regulations and all applicable requirements have been satisfied.

2. Accordingly, the license is amended to authorize revision to the Updated Final Safety Analysis Report Section 10.4.7, Emergency Feedwater System, as set forth in the application for amendment by the licensee dated June 21, 2000, as supplemented by letters dated April 30 and May 20, 2002.

3. This license amendment is effective as of its date of issuance and shall be implemented within 30 days of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

John A. Nakoski, Chief, Section 1 Project Directorate II Division of Licensing Project Management Office of Nuclear Reactor Regulation Date of Issuance: June 11, 2002

DUKE ENERGY CORPORATION DOCKET NO. 50-270 OCONEE NUCLEAR STATION, UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 325 Renewed License No. DPR-47

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment to the Oconee Nuclear Station, Unit 2 (the facility)

Renewed Facility Operating License No. DPR-47 filed by the Duke Energy Corporation (the licensee) dated June 21, 2000, as supplemented by letters dated April 30 and May 20, 2002, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations as set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commissions regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commissions regulations and all applicable requirements have been satisfied.

2. Accordingly, the license is amended to authorize revision to the Updated Final Safety Analysis Report Section 10.4.7, Emergency Feedwater System, as set forth in the application for amendment by the licensee dated June 21, 2000, as supplemented by letters dated April 30 and May 20, 2002.

3. This license amendment is effective as of its date of issuance and shall be implemented within 30 days of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

John A. Nakoski, Chief, Section 1 Project Directorate II Division of Licensing Project Management Office of Nuclear Reactor Regulation Date of Issuance: June 11, 2002

DUKE ENERGY CORPORATION DOCKET NO. 50-287 OCONEE NUCLEAR STATION, UNIT 3 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 326 Renewed License No. DPR-55

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment to the Oconee Nuclear Station, Unit 3 (the facility)

Renewed Facility Operating License No. DPR-55 filed by the Duke Energy Corporation (the licensee) dated June 21, 2000, as supplemented by letters dated April 30 and May 20, 2002, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations as set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commissions regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commissions regulations and all applicable requirements have been satisfied.

2. Accordingly, the license is amended to authorize revision to the Updated Final Safety Analysis Report Section 10.4.7, Emergency Feedwater System, as set forth in the application for amendment by the licensee dated June 21, 2000, as supplemented by letters April 30 and May 20, 2002.

3. This license amendment is effective as of its date of issuance and shall be implemented within 30 days of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

John A. Nakoski, Chief, Section 1 Project Directorate II Division of Licensing Project Management Office of Nuclear Reactor Regulation Date of Issuance: June 11, 2002

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 325 TO RENEWED FACILITY OPERATING LICENSE DPR-38 AMENDMENT NO. 325 TO RENEWED FACILITY OPERATING LICENSE DPR-47 AND AMENDMENT NO. 326 TO RENEWED FACILITY OPERATING LICENSE DPR-55 DUKE ENERGY CORPORATION OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3 DOCKET NOS. 50-269, 50-270, AND 50-287

1.0 INTRODUCTION

By letter dated June 21, 2000, as supplemented by letters dated April 30 and May 20, 2002, Duke Energy Corporation (the licensee) submitted a request for changes to the Oconee Nuclear Station, Units 1, 2, and 3, Updated Final Safety Analysis Report (UFSAR). The requested changes would revise UFSAR Section 10.4.7, Emergency Feedwater System. The supplements dated April 30 and May 20, 2002, provided clarifying information that did not change the scope of the June 21, 2000, application nor the initial proposed no significant hazards consideration determination.

2.0 BACKGROUND

As described in the Oconee UFSAR, the Oconee units have many means available for satisfying decay heat removal requirements, and a complete loss of decay heat removal is very unlikely. However, as a result of inspections that have been conducted recently, the staff has questioned the accuracy of statements contained in the current UFSAR about the ability of the Emergency Feedwater (EFW) System to remove decay heat following postulated accident conditions. Each of the three Oconee units has a separate EFW system that has been modified over time in order to resolve generic requirements that have been imposed by the staff, such as the post-Three Mile Island (TMI) Action Plan requirements. While the UFSAR description of the EFW system has been revised to reflect the changes that have been made, the licensee and the staff have determined that the existing UFSAR description contains ambiguities and is subject to misinterpretation. This has been the subject of numerous discussions and a predecisional enforcement conference between the licensee and the staff.

During portions of 1998 and 1999, the staff identified EFW vulnerabilites, as described in Inspection Reports 50-269/99-10, 50-270/99-10, and 50-287/99-10. EFW vulnerabilities are defined as sets of plant conditions, within prescribed limits (i.e., single active, loss of offsite power, secondary pipe breaks) for which the EFW system may not automatically ensure overall plant safety. For these conditions, operator actions are required to ensure overall safety.

As stated in the licensees cover letter dated June 21, 2000, the licensee is committed to resolving the lack of clarity associated with the EFW licensing basis, and the proposed UFSAR revision is intended to resolve this problem.

3.0 EVALUATION For newer pressurized-water reactor plant designs, the EFW system is relied upon as the assured, safety-related means for removing reactor decay heat following postulated accidents and upset conditions that result in a loss of steam generator (SG) feedwater. The staff review criteria that was applied to newer plants with respect to the EFW system is contained in Standard Review Plan 10.4.9, "Auxiliary Feedwater System (PWR)." The Oconee units were constructed and began commercial operation before these criteria were implemented, and consequently, vulnerabilities and limitations exist in the Oconee EFW system design that would not exist in newer reactor plant designs. The staff review of the proposed UFSAR revision focused on those areas that were found to be in need of clarification, including the system design-basis, system vulnerabilities and limitations, and alternate means of decay heat removal that are credited for addressing the vulnerabilities and limitations that exist.

The revised description of the EFW system design basis augments the previous description by including the following salient corrections and clarifications:

EFW inventory requirements are based on maintaining hot standby conditions for 1-hour, followed by a 50 °F per hour cooldown to decay heat removal entry conditions.

However, plant cooldown is a manually controlled function and it is recognized that while the minimum required EFW system capacity is sufficient to support a 50 °F per cooldown rate, this rate is not achievable during certain events, such as natural circulation cooldown.

It is recognized that in some instances (as addressed in revised Section 10.4.7.3 of the UFSAR) alternate capability and operator actions are credited for performing the EFW function to compensate for specific single failures and system vulnerabilities that have been identified.

The water inventory that is immediately available to the turbine-driven EFW pump is sufficient to supply feedwater to the SGs for at least 40 minutes following a loss of all AC power, assuming automatic steam generator level control and no reliance on operator action.

The staff considers the description of the EFW system design-basis to be an accurate representation of the system and its capabilities, and it is consistent with the staffs expectations given the vintage of the Oconee units.

The post-TMI Action Plan criteria for the turbine-driven EFW pump included the ability to provide water to the SGs without reliance on operator actions for at least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following a loss of all AC power (station blackout). Based on more current analyses, the licensee has determined that the turbine-driven EFW pump only has sufficient assured inventory for at least 40 minutes. However, as discussed in revised Section 10.4.7.3.7 of the UFSAR, alternate

means are available for coping with station blackout situations. The 40 minutes afforded by the turbine-driven EFW pump provides additional capability for unforseen circumstances.

Therefore, the staff consider this to be acceptable.

The revised EFW system description provides information that is similar to what is in the current UFSAR, but a more complete and clear description is provided in those areas where this information is currently lacking. One change in particular that is noteworthy is the discussion in revised Section 10.4.7.2 associated with the water inventory that is necessary for performing a plant cooldown. The licensee has revised the inventory requirements to assure that sufficient inventory is available for loss of offsite power conditions, consistent with design basis assumptions. Assuming a maximum inventory temperature of 130 °F (consistent with plant parameters), the licensee determined that 155,000 gallons of inventory is needed in order to complete a plant cooldown to decay heat removal switchover without relying on recirculation via the Turbine Bypass system. As discussed in the letter dated April 30, 2002, the licensee will submit a proposed change to Technical Specification 3.7.6 to reflect the revised inventory requirement. The staff considers this change to be appropriate and acceptable.

Another change in the revised EFW system description that is noteworthy is the discussion of the EFW pump suction source in the revised UFSAR Section 10.4.7.2.3. The revised section more clearly outlines the requisite steps for shifting EFW pump suction from the upper surge tank to the non-safety related condenser hotwell. Also, vulnerabilities associated with the condenser hotwell are discussed along with alternate actions that are credited for addressing these vulnerabilities. The revised system description is an improvement and the staff considers it to be acceptable.

Much of the confusion and controversy associated with the Oconee EFW system design basis deals with how the decay heat removal function is assured given the various vulnerabilities that exist. Section 10.4.7.3 of the revised UFSAR discusses the response of the EFW system for the event scenarios of interest and addresses the system vulnerabilities that exist. The licensee has indicated that none of the existing vulnerabilities are risk significant, and it is the staffs understanding that any risk significant vulnerabilities that are identified in the future will be corrected in accordance with regulatory policies.

Alternate means of decay heat removal that are credited in lieu of the EFW system include the Standby Shutdown Facility (SSF) Auxiliary Service Water (ASW) system, the Station Auxiliary Service Water system, and High Pressure Injection forced cooling. While use of these alternate means was alluded to in the current EFW UFSAR description and related licensing correspondence, it was not clear to what extent these alternate means were credited from a design basis perspective. In essence, more reliance is being placed on the SSF ASW system than previously recognized by the staff. The letter dated April 30, 2002, includes additional supporting information concerning testing and controls associated with the SSF that provides assurance of its ability to perform the decay heat removal function when required. Additionally, UFSAR Section 10.4.7.3.8 is being added to include a brief description of the alternate means of decay heat removal that are credited for accident mitigation purposes. Apart from this, the staff recognizes that additional decay heat removal capability exists (both safety-related and non-safety related) that provides further assurance that the decay heat removal function will be performed when required.

1The validity of the specific numerical requirements have NOT been validated. These values have been assumed to be correct, in order to evaluate operator actions.

The use of alternate means for accomplishing the decay heat removal function, as specifically described in revised UFSAR Section 10.4.7.3, is consistent with past NRC practices and policies that were applied to older vintage reactor plants. Therefore, the staff considers the proposed change to UFSAR Section 10.4.7.3 to be appropriate and acceptable.

Based on the staffs review, as discussed above in this evaluation, the staff considers the proposed revision of Oconee UFSAR Section 10.4.7 to be a substantial improvement over the existing UFSAR section. The proposed revision eliminates existing ambiguities and provides a clear description of the EFW system design basis; alternate means that are credited for performing the decay heat removal function are specifically identified for the various EFW vulnerabilities that exist; and bounding inventory requirements consistent with the EFW system design basis are specified. The proposed revision of UFSAR Section 10.4.7 is consistent with past NRC practices and policies for older vintage reactor plants, and the staff finds the revised UFSAR section to be an accurate representation of the Oconee EFW system.

The staff understands that the licensee is currently involved in licensing actions that may require future updates of the EFW UFSAR section. These licensing actions are related to postulated high energy line breaks and the effects of tornados, as well as the installation of an Automatic Feedwater Isolation System. This evaluation does not encompass these ongoing licensing actions, and we recognize that future updates of UFSAR Section 10.4.7 may be required to reflect the outcome of these licensing actions.

The staff also reviewed the capabilities of the EFW system and associated operator actions, as presented in Section 10.4.7 of the proposed Oconee UFSAR revision. The staffs evaluation sought to answer the following fundamental question:

Given the numerous EFW system vulnerabilities, is it reasonable to assume that mitigating actions by plant operators will be performed in a timely fashion, such that overall plant safety is maintained?

In order to answer this fundamental question, the following evaluation will examine the details of the EFW system vulnerabilities and the procedurally directed mitigating operator actions.

Assuming a loss of normal main feedwater (MFW) and subsequent reactor trip, any alternate feedwater system or combination of systems must be capable of performing the following two basic objectives to ensure overall plant safety:

3.1 Remove decay heat A loss of normal MFW will result in a loss of the heat sink for the reactor. Any alternate feedwater system or combination of systems must be capable of removing reactor decay heat to prevent core damage.

For Oconee1, adequate decay heat removal and plant stabilization is assured if a minimum of 375 gallons per minute (gpm) of feedwater is restored and maintained to at least one SG within:

2The validity of the specific time requirements have NOT been validated. These values have been assumed to be correct, in order to evaluate operator actions.

(a) 20 minutes following the loss of MFW, if reactor coolant pumps (RCPs) are running; OR (b) 30 minutes following the loss of MFW, if RCPs are not running.

This requirement can be satisfied by a minimum of one EFW pump delivering feedwater to one SG, or by alternate feed sources.

Although any EFW system should also be capable of performing plant cooldown, cooldown is not as time-constrained as the above 20- or 30-minute feedwater restoration and plant stabilization requirement. Once the plant is stabilized, operators have ample time to align a feedwater source to support plant cooldown.

3.2 Terminate EFW flow to a faulted or ruptured SG During steam line breaks (a faulted SG) it is imperative to terminate all sources of feedwater to the affected SG, including EFW. Terminating feed flow during a steam line break is important to overall plant safety, because it:

(a)

Limits reactor coolant system overcooling, thus limiting positive reactivity addition. This prevents reactor restart and possible fuel damage due to departure from nucleate boiling conditions.

(b)

Limits the possible runout and trip of the EFW pumps that can lead to a subsequent loss of decay heat removal to the intact SG.

(c)

Limits containment pressure increase, thus preventing increased containment leakage and containment damage for steam line breaks inside containment.

(d)

Limits SG tube stresses, thus preventing SG tube failures.

Currently, for steam line break events, Oconee2 relies on operator action to terminate EFW flow to the affected SG within 10 minutes of break initiation. Termination of normal MFW flow is currently accomplished automatically by the main steam line break detection and feedwater isolation system.

For steam generator tube rupture (SGTR) events concurrent with a loss of MFW, terminating EFW flow to the ruptured SG is also imperative. However, terminating EFW flow to the ruptured SG at Oconee is not particularly time-constrained. For Oconee2, during SGTR events, operator action to complete the isolation of the affected SG is credited at 68.5 minutes following operator identification of a ruptured SG. Since more time is available during a SGTR, terminating EFW flow during a steam line break is the limiting case.

Terminate EFW flow to a faulted/ruptured SG As previously discussed, the limiting requirement for this objective is to:

Terminate EFW flow to the affected SG within 10 minutes of the initiation of a steam line break.

During a steam line break at Oconee, the main steam line break detection and feedwater isolation system automatically terminates MFW flow and prevents auto start/trips the turbine-driven emergency feedwater pump (TDEFWP). As a result, during a steam line break both motor-driven emergency feedwater pumps (MDEFWPs) are running, with each MDEFWP feeding its associated SG via an EFW flow control valve (EFWFCV). Currently, Oconee credits operator action to terminate EFW flow to the affected SG by either securing the MDEFWP to the affected SG or closing the EFWFCV to the affected SG.

In regards to mitigating a steam line break, the EFW vulnerabilities of interest are: (1) a failed open EFWFCV to the depressurizing SG, and (2) the failure of the MDEFWP associated with the depressurizing SG to stop on demand. Even though these failures, taken individually, are within the allowed scenarios (i.e., single active failure concurrent with a secondary pipe break),

the staff has concluded that it is reasonable to assume that operators will terminate EFW flow to the affected SG within 10 minutes. This conclusion is based on the following:

1.

There is not a common cause that would fail both an EFWFCV open and fail a MDEFWP to stop on demand. Failing both the EFWFCV and the MDEFWP concurrently is beyond the scope of a single active failure.

2.

There are multiple plant indications (SG pressures, reactor coolant temperatures, etc.)

that allow a trained operator to rapidly and accurately identify a steam break and the affected SG. It is reasonable to assume that licensed operators at Oconee will identify a steam break and the affected SG within a few minutes of break initiation.

3.

As soon as the break is identified, the Oconee emergency operating procedure calls for securing the applicable MDEFWP and closing the applicable EFWFCV. These two control manipulations are straightforward, require one control room operator, and can be performed in less than one minute. Even with a failed EFWFCV or failed MDEFWP, this results in terminating feed flow to the affected SG (while maintaining adequate decay heat removal via the intact SG).

4.

Historically, the staff has accepted Oconees mitigation strategy for steam line breaks.

This acceptance has been documented in:

A post-Three Mile Island EFW safety evaluation report (8/25/81 TMI SER), dated August 25, 1981.

A high energy line break safety evaluation, dated July 6, 1973.

Conclusions - Terminating EFW flow to a faulted/ruptured SG The staff concludes that during a steam line break, it is reasonable to assume that operators will terminate EFW flow to the affected SG within 10 minutes of break initiation. Since more time is available to terminate EFW flow during a SGTR, the staff also concludes that EFW flow will be terminated in a timely fashion during a SGTR. With regards to operator actions to terminate feed flow to a faulted or ruptured SG, the staff finds the current EFW design and the proposed EFW license amendment acceptable as it relates to human performance.

Remove Decay Heat - EFW Vulnerabilities and an Overview of Operator Actions Based on past staff inspections and licensee investigations, it has been determined that the EFW system, on its own, may not always be capable of supplying and maintaining adequate feedwater under the allowed scenarios (i.e., single active failure, secondary pipe break, loss of offsite power (LOOP)). Vulnerabilities in the EFW suction sources, pumps, and flow control valves can all lead to a loss of adequate cooling, and require compensatory operator actions to ensure overall pant safety.

Oconees basic strategy for coping with EFW vulnerabilities is to (1) attempt to correct the problem with the EFW system, and (2) if the EFW problem cannot be corrected (i.e., a total loss of EFW), align alternate systems for decay heat removal. This strategy and the associated operator actions are directed by the Oconee emergency operating procedure and by other plant procedures.

EFW Suction Source Vulnerabilities

1.

The normally aligned primary water supply for EFW, the upper surge tank (UST),

contains a limited water supply. As the UST empties, operators are directed to replenish the UST from the demineralized water system, the condensate storage tank (CST), or the condenser hotwell.

2.

The systems that replenish the UST rely on non-safety power. If the UST becomes unavailable, operators are directed to align the EFW suction to the condenser hotwell.

3.

During a condensate/feed line break, condenser hotwell inventory will empty out the break and the hotwell will not be available as an EFW suction source. Also, a large condensate/feed line break concurrent with a failed open UST-to-hotwell makeup valve (single active failure of valve C-187) will rapidly deplete both the UST and the condenser hotwell, resulting in a loss of all EFW. Should EFW be lost, operators are directed to use alternate methods for decay heat removal: cross-tie EFW from another unit, initiate high pressure injection (HPI) feed and bleed, initiate SSF ASW, or initiate station auxiliary service water (SASW).

EFW Pump Vulnerabilities

1.

Although much of the EFW system is seismically qualified, the EFW pumps, due to their location in the turbine building basement, are subject to complete failure as a result of seismic-induced flooding. Should EFW be lost, operators are directed to use alternate

methods for decay heat removal: cross-tie EFW from another unit (if available, also vulnerable to flooding), initiate HPI feed and bleed, initiate SSF ASW, or initiate SASW.

2.

The EFW pumps could trip due to pump runout (overfeeding) and result in the loss of all EFW flow. Pump runout concerns are exacerbated by steam line breaks, feedwater line breaks, and failed open or malfunctioning EFWFCVs. To prevent EFW pump runout, operators at Oconee are trained to throttle EFW flow to within limits, and terminate EFW flow to a faulted SG. Should an EFWFCV malfunction or fail open, an in-plant operator can take local manual control.

3.

A LOOP with a feedwater or steam line break in the vicinity of vital switchgear can cause a loss of electrical power to the MDEFWPs, and a loss of auto start and control room manual start for the TDEFWP. For this scenario, operators are directed to locally start the TDEFWP.

4.

A LOOP with a feedwater or steam line break in the vicinity of vital switchgear concurrent with a single active failure of the TDEFWP will result in no MFW and no EFW flow to either SG. This is similar to item 3 above; however, in this case the TDEFWP cannot be locally started, and EFW flow is lost. For this scenario, operators are directed to use alternate methods for decay heat removal: cross-tie EFW from another unit, initiate HPI feed and bleed, initiate SSF ASW, or initiate SASW.

5.

A steam line break concurrent with a single failure of the MDEFWP to the intact SG will result in no MFW and no EFW flow to the intact SG. For this scenario, there are two procedurally-directed ways to restore feedwater to the intact SG: manually start the TDEFWP using the control room switch; or align the available MDEFWP, via locally operated cross connect valves, to the intact SG.

EFWFCV Vulnerability

1.

A feed line or steam line break concurrent with an EFWFCV failed closed to the intact SG will result in no MFW and no EFW flow to the intact SG. Oconees strategy and actions for coping with EFWFCV failures is to:

a.

Take manual control of the affected EFWFCV from the control room.

b.

If manual control from the control room is unsuccessful, take local manual control of the EFWFCV. Note, however, that a failed closed EFWFCV cannot be opened locally.

c.

If both control room and local manual control are unsuccessful, bypass the failed EFWFCV via the MFW startup pathway. However, establishing the MFW startup flow path may not be possible during a LOOP.

d.

If all of the above methods fail (i.e., failed closed EFWFCV to the intact SG during a LOOP), Oconee relies on alternate methods for decay heat removal -

HPI feed and bleed, SSF ASW, and SASW. Note that cross-tying to another units EFW with a failed closed EFWFCV will not be effective.

Other Vulnerabilities

1.

Portions of the EFW system are vulnerable to tornado-generated missiles. All EFW flow could be lost.

2.

The EFW system has not been designed to withstand the effects of internally generated missiles. All EFW flow could be lost.

If all EFW flow is lost Oconee relies on alternate systems to remove decay heat - cross-tie EFW from another unit (if available), HPI feed and bleed, SSF ASW, and SASW.

3.

Station blackout. Although the TDEFWP should be available, Oconee relies on the capabilities of the safe shutdown facility during a station blackout.

Remove Decay Heat - Prior NRC Approval, Operator Action Details, and Timeliness The previous section presented an overview of EFW vulnerabilities, and the procedurally directed operator actions. This section will demonstrate that these actions, in most cases, have been implicitly or explicitly approved by the NRC in the past, and that these actions can be performed in a timely fashion (less than 20 minutes).

Concerning past NRC approval, four NRC letters (with attached safety evaluations) are of interest:

Letter to William O. Parker, Vice President - Steam Production, Duke Power Company, documenting the completion of a post-TMI EFW review, dated August 25, 1981 (8/25/81 TMI SER).

Letter to Hal B. Tucker, Vice President - Nuclear Production, Duke Power Company, Seismic Qualification of the Emergency Feedwater System, dated January 14, 1987 (1/14/87 seismic SER).

Letter to Hal B. Tucker, Vice President - Nuclear Production, Duke Power Company, documenting the closeout of findings from a safety system functional inspection, dated April 30, 1987 (4/30/87 SSFI).

Letter to H. B. Tucker, Vice President - Nuclear Production, Duke Power Company, Safety Evaluation Report on Effect of Tornado Missiles on Oconee Emergency Feedwater System, dated July 28, 1989 (7/28/89 tornado SER).

With regards to timeliness, recall that plant safety is ensured if a minimum of 375 gpm of feedwater is restored and maintained to at least one SG within:

(1) 20 minutes following the loss of MFW, if RCPs are running; or (2) 30 minutes following the loss of MFW, if RCPs are not running (e.g., LOOP).

I. Suction Source Vulnerabilities - Operator actions, time to perform, and past NRC approval Circumstances Action Description

1. of Operators Time to perform Past NRC approval Comments UST inventory depletes Replenish UST from demin. water and CST - operate demin. water flow controller, start CST pumps.

1 control room 1 minute 4/30/87 SSFI C.1 UST inventory depletes Replenish UST from condenser hotwell - valve and pump manipulations from control room; operate one local valve.

1 control room 1 in-plant 5 minutes 4/30/87 SSFI C.2 UST empties (e.g., LOOP)

Align EFW suction to hotwell. Locally operate atmospheric dump valves, stop MDEFWPs, locally open condenser vacuum breaker, locally close one valve, restart MDEFWPs.

1 control room 4 in-plant 10 minutes 8/25/81 TMI SER C.3 Hotwell unavailable, UST empties Align alternate sources: EFW from another unit, HPI, SSF ASW, SASW.

see follow-on discussion in IV below see follow-on discussion in IV below 8/25/81 TMI SER C.4 C.1 Rate of replenishing > normal EFW usage rate. The demineralized water and CST pumps require non-safety electrical power.

C.2 Rate of replenishing > normal EFW usage rate. The hotwell pumps require non-safety power. The hotwell may be unavailable during certain events (condensate/feed break, failed open turbine bypass valve).

C.3 If problems exist on only one unit, up to six in-plant operators are available. The hotwell may be unavailable during certain events (condensate/feed break, failed open turbine bypass valve).

C.4 A large condensate/feed break with a failed open hotwell makeup valve will empty both the hotwell and the UST in ~ 5 minutes.

II. EFW Pump Vulnerabilities - Operator actions, time to perform, and past NRC approval Circumstances Action Description

1. of Operators Time to perform Past NRC approval Comments Seismic-induced flooding of EFW pumps Align alternate sources: HPI, SSF ASW, SASW.

see follow-on discussion in IV below see follow-on discussion in IV below 1/14/87 seismic SER C.1 EFW pump runout Throttle EFW flow: take manual control of EFWFCVs.

1 control room 1 in-plant 1 minute 5 minutes 4/30/87 SSFI C.2 LOOP, feed/steam break in vicinity of vital switchgear Locally start TDEFWP: reset trips, lift hand start lever.

1 in-plant 5 minutes Not specifically approved.

LOOP, feed/steam break in vicinity of vital switchgear, TDEFWP single failure Align alternate sources: EFW from another unit, HPI, SSF ASW, SASW.

see follow-on discussion in IV below see follow-on discussion in IV below Not specifically approved.

Generic use of alternate sources approved in 8/25/81 TMI SER.

Steam break, MDEFWP fails to intact SG Manually start TDEFWP: take hand switch to run.

1 control room 1 minute 8/25/81TMI SER Steam break, MDEFWP fails to intact SG Cross connect running MDEFWP to intact SG:

operate EFWFCVs, open two local valves.

1 control room 2 in-plant 15 minutes Not specifically approved.

C.1 EFW from another unit also susceptible to seismic-induced flooding.

C.2 Manual control from control room requires one control room operator and takes 1 minute. If manual control from control room is ineffective, take local manual control. Local manual control requires one in-plant operator and takes 5 minutes.

III. EFWFCV and Other Vulnerabilities - Operator actions, time to perform, and past NRC approval Circumstances Action Description

1. of Operators Time to perform Past NRC approval Comments Feed/steam break with EFWFCV failed closed to intact SG Take manual control of EFWFCV from control room.

1 control room 1 minute 8/25/81TMI SER

- manual control from control room ineffective Take local manual control of EFWFCV.

1 in-plant 5 minutes 8/25/81TMI SER C.1

- local manual control ineffective Bypass EFWFCV using MFW startup flow path: multiple (>12) valve manipulations, stop and restart MDEFWP, operate startup flow controller.

1 control room 10 minutes 8/25/81TMI SER C.2

- all of the above plus MFW startup path unavailable (LOOP)

Align alternate sources: HPI, SSF ASW, SASW.

see follow-on discussion in IV below see follow-on discussion in IV below 8/25/81TMI SER C.3 Tornado or internal missiles Use EFW if available, otherwise align alternate sources: EFW from another unit, SSF ASW, SASW see follow-on discussion in IV below see follow-on discussion in IV below 7/28/89 tornado SER C.4 C.1 A failed closed EFWFCV cannot be opened locally.

C.2 MFW startup flow path may not be available during a LOOP.

C.3 EFW from another unit must pass through the same failed closed EFWFCV and is therefore unavailable.

C.4 The staff found tornado missile protection acceptable, based on the low probability of EFW, SASW and SSF ASW all failing.

IV. Alternate sources - Operator actions and time to perform There are several scenarios where all of EFW is lost, and Oconee relies on alternate sources. These scenarios include:

Condenser hotwell unavailable and UST empties - loss of suction source.

Seismic induced flooding of EFW pumps.

LOOP, feed/steam break in vicinity of vital switchgear, TDEFWP single failure - loss of all EFW pumps.

LOOP, feed/steam break, EFWFCV failed closed to intact SG.

Tornado or internal missiles.

The alternate sources cited in the proposed UFSAR revision and the associated operator actions are:

Alternate Source Action Description

1. of Operators Time to perform Comments Cross tie to another units EFW system Open local valves, contact other unit to manually close their EFWFCVs and start their EFW pumps.

2 control room 2 in-plant 15 minutes C.1 HPI feed and bleed HPI valve lineup (5 valves), start HPI pumps, open pressurizer PORV and block valve, de-energize pressurizer heaters.

1 control room 5 minutes SG feed from SSFASW Trip RCPs, start SSF diesel generator (1 pushbutton), align 4 breakers, start SSF ASW pump, open 3 valves from SSF control panel.

1 control room 1 SSF operator 15 minutes SG feed from SASW Rack in SASW pump breaker, fill and vent SASW pump, lower SG pressure to atmospheric, align power to SASW pump, start SASW pump, locally throttle two valves 1 control room 5 in-plant 20 minutes C.2 C.1 EFW from another unit not available via a failed closed EFWFCV; other units EFW systems also susceptible to seismic-induced flooding.

C.2 SASW pump discharge pressure ~125 psig. 5 in-plant operators required if atmospheric dump valves are used to depressurize the SGs. If turbine bypass valves are available, only 3 in-plant operators are required.

This requirement can by satisfied by a minimum of one EFW pump delivering feedwater to one SG or by alternate feed sources (unit cross-tie, SSF ASW, SASW). Based on a review of plant procedures, discussions with the licensee, and a site visit (including a visit to the plant-referenced simulator), the staff has determined time estimates for the various actions.

The following tables summarize the operator actions, timeliness, and past NRC approval. As can be seen from these tables, most of the actions have been previously approved by the NRC, and all of the actions can be completed in less than (or in one case equal to) 20 minutes.

Conclusions - Remove Decay Heat The staff concludes that during a loss of normal decay heat removal (i.e., MFW), it is reasonable to assume that plant operators will restore and maintain an adequate alternate means of decay heat removal within the allowed time. Although numerous EFW vulnerabilities have been identified, plant operators are capable of either restoring the EFW system or aligning alternate sources for decay heat removal in a timely fashion. This conclusion was based on four findings: (1) actions that address EFW operation and vulnerabilities are directed by plant procedures, (2) the licensee has stated that validation exercises confirm that these actions can be performed in a timely fashion, (3) an independent staff review of plant procedures and operator actions also shows that these actions can be performed in a timely fashion, and (4) in the past, the NRC has accepted most of these actions, including the use of diverse (i.e., non-EFW) decay heat removal sources.

Conclusions - EFW Vulnerabilities, Operator Actions, and Overall Plant Safety The staff concludes that even though there are numerous vulnerabilities in the EFW system, plant operators can take timely compensatory actions, such that overall plant safety is reasonably assured. This conclusion was based on a detailed review of applicable plant procedures and procedure-directed operator actions, and past NRC acceptance of diverse decay heat removal sources and operator actions. With respect to EFW-related operator actions, the staff therefore finds the proposed EFW license amendment acceptable.

4.0 STATE CONSULTATION

In accordance with the Commissions regulations, the South Carolina State official was notified of the proposed issuance of the amendments. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendments change requirements with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts and no significant change in the types of any effluents that may be released offsite and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding (65 FR 46008). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor: J. Tatum D. Muller Date: June 11, 2002