ML030380340

Proposed License Amendment Request to Fully Credit the Standby Shutdown Facility and to Eliminate Crediting the Spent Fuel Pool to High Pressure Injection System Flow Path for Tornado Mitigation

ML030380340
Person / Time
Site:	Oconee
Issue date:	01/29/2003
From:	Rosalyn Jones Duke Power Co
To:	Document Control Desk, Office of Nuclear Security and Incident Response
References
Download: ML030380340 (28)

Text

TREAT AS SENtilTiVE INFORMATION

SDuke R. A.

JONES EPower Vice President A Duke Energy Company Duke Power 29672 / Oconee Nuclear Site 7800 Rochester Highway Seneca, SC 29672 864 885 3158 January 29, 2003 864 885 3564 fax U. S. Nuclear Regulatory Commission Document Control Desk Washington, DC 20555

Subject:

Oconee Nuclear Station Docket Nos. 50-269, -270, -287 Proposed License Amendment Request to Fully Credit the Standby Shutdown Facility and to Eliminate Crediting the Spent Fuel Pool to High Pressure Injection System Flow Path for Tornado Mitigation, License Amendment Request No. 2001-012 In a letter dated June 7, 2002, Duke Energy Corporation (Duke) submitted a risk informed License Amendment Request (LAR) for Oconee Nuclear Station (ONS) Units 1, 2, and 3, related to the station's tornado licensing and design basis. The proposed LAR revises the Updated Final Safety Analysis Report to eliminate credit for the Spent Fuel Pool to High Pressure Injection pump flow path as one of the sources of primary system makeup following a tornado event. In addition, the submittal credits the Standby Shutdown Facility as the assured means of achieving safe shutdown for all Oconee Units following a tornado. On September 16, 2002, and again on September 19, 2002, the NRC informally requested additional information related to the LAR.

A December 10, 2002 meeting was held at NRC headquarters to discuss the responses to the initial questions as well as other details related to the LAR submittal. The enclosure to this letter provides Duke's written responses to all of the Staff's questions received to date.

If there any questions regarding this submittal, please contact Stephen Newman of the ONS Regulatory Compliance Group at 864-885-4388.

Ve I yours, R.

es, Vice President Oconee Nuclear Site

Enclosure:

Responses to Request for Additional Information www. duke-energy. corn

Page 2 U. S. Nuclear Regulatory Commission January 29, 2003 cc:

Mr. L. N. Olshan, Project Manager Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Mr. L. A. Reyes, Regional Administrator U. S. Nuclear Regulatory Commission - Region II Atlanta Federal Center 61 Forsyth St., SW, Suite 23T85 Atlanta, Georgia 30303 Mr. M. C. Shannon Senior Resident Inspector Oconee Nuclear Station Mr. Virgil R. Autry, Director Division of Radioactive Waste Management Bureau of Land and Waste Management Department of Health & Environmental Control 2600 Bull Street Columbia, SC 29201

U. S. Nuclear Regulatory Commission Page January 29, 2003 R. A. Jones, being duly sworn, states that he is Vice President, Oconee Nuclear Site, Duke Energy Corporation, that he is authorized on the part of said Company to sign and file with the U. S. Nuclear Regulatory Commission this revision to the Facility Operating License Nos. DPR 38, DPR-47, and DPR-55, for Oconee Units 1, 2, and 3 respectively; and that all the statements and matters set forth herein are true and correct to the best of his knowledge.

R. A. J n ice President Oconee Nuclear Site Subscribed and sworn to before me this,:T day oA1 V..J 2003 Notary Public My Commission Expires:

/, //r

/2 If 3

SEAL

ENCLOSURE DUKE RESPONSES TO RAI CONCERNING PROPOSED LICENSE AMENDMENT REQUEST TO FULLY CREDIT THE STANDBY SHUTDOWN FACILITY AND TO ELIMINATE CREDITING THE SPENT FUEL POOL TO HIGH PRESSURE INJECTION SYSTEM FLOW PATH FOR TORNADO MITIGATION, OCONEE NUCLEAR STATION, UNITS 1, 2 AND 3 Question 1:

The submittal is risk informed but proposes to establish a deterministic success path. A probabilistic treatment of tornado wind loading appears inconsistent with regulatory guidance (meeting current regulations) Standard Review Plan 3.3.2, 3.5.1.4, 3.5.2, RG 1.117, 1.176 and GDC-2 and 4. Although risk insights are referenced, it is not clear that the proposed or current tornado license bases change meets NRC regulations or guidance for tornado wind loads or that RG 1.174 criterion that states the proposed change meets current regulations is met. For example:

" UFSAR 3.3 states all class 1 structures, except those not exposed to wind are designed to withstand the effects of wind and tornado loadings.

UFSAR 3.5.1.3 states that tornado generated missiles neither penetrate the reactor building wall nor endanger the structural integrity of the reactor building or any components of the reactor coolant system.

UFSAR 3.1.2 states that systems or components which are essential to the prevention of accidents which could effect the public health and safety or the mitigation of their consequences shall be designed, fabricated and erected to performance standards that will enable the facility to withstand, without loss of capability to protect the public, additional forces that might be imposed by natural phenomena (including tornadoes). The designs are based upon the most severe natural phenomena recorded for the vicinity of the site. Among the essential components listed are:

"o Reactor coolant system "o Engineered safeguard system "o Electric emergency power sources

"* UFSAR 9.6 notes that the SSF is a backup to existing safety systems; therefore the single failure criterion is not required. However, the proposed amendment states that the SSF is the assured deterministic path for tornado mitigation not a backup system.

The NRC SER on tornado missiles, dated July 28, 1989, states acceptance criteria that the probability of a loss of secondary heat removal capability by the EFW system due to tornado missiles not exceed 1E-6. For the proposed Oconee design, what is the probability of a loss of secondary decay heat removal capability due to tornado missiles?

Responses to Request for Additional Information Enclosure January 29, 2003 Page 2

Response

The License Amendment Request (LAR) does not include a request to revise either the original design criteria or methods of acceptance by the Atomic Energy Commission (ABC) for the Oconee Nuclear Station (ONS). Specifically, the principal design criteria for Oconee Units 1, 2, and 3 were developed in consideration of the 70 General Design Criteria (GDC) for Nuclear Power Plant Construction Permits proposed by the AEC in a proposed rule-making published for 10 CFR Part 50 in the Federal Register of July 11, 1967. These 70 general design criteria are described in Section 3.1 of the Oconee Updated Final Safety Analysis Report (UFSAR).

Criterion 2, "Performance Standards," states that components, which are essential to the prevention of accidents that could affect the public health and safety or the mitigation of their consequences, shall be designed, fabricated, and erected to performance standards that will enable the facility to withstand, without loss of capability to protect the public, the additional forces that might be imposed by natural phenomena (including tornadoes). The original licensing of the ONS relied upon the Station Auxiliary Service Water (ASW) system to meet this design criterion for tornadoes. The principles supporting the original tornado design basis were protection or physical separation. This is evident in that the original FSAR refers to physically separated station ASW lines (one in the East Penetration Room and one in the West Penetration Room) as well as six sources of electric power. The AEC accepted this design philosophy for meeting Criterion 2.

The proposed LAR improves upon the original design basis by protecting all portions of the Standby Shutdown Facility (SSF) from tornadoes. This approach eliminates the reliance for station ASW separation as a means of tornado protection. Section 3.1.2 of the UFSAR refers to the tornado design basis given in Section 3.2.2. Thus, the proposed LAR change meets design criterion 2 of the Oconee UFSAR and NRC regulations as applied to Oconee. The ONS design basis remains that Class 1 structures, except those not exposed to wind are designed to withstand the effects of wind and tornado loadings. No change is proposed with respect to UFSAR Section 3.5.1.3 in that missiles will not penetrate the Reactor Building nor endanger the structural integrity of the Reactor Building or any components of the Reactor Coolant System, which are located in the Reactor Building.

Duke agrees that the SSF was originally licensed as a backup to existing safety systems. The proposed LAR request replaces the station ASW system with the SSF as the primary means for satisfying Criterion 2 given in Section 3.1.2 of the UFSAR. Since the design basis of the SSF exceeds that of the station ASW system, this change is considered an overall improvement in plant safety. Pending approval of this LAR, this revised role will be documented in the UFSAR.

The remote possibility of losing all secondary side decay heat removal due to tornado-generated missiles will be eliminated with the final installation of the proposed missile barriers (See

Responses to Request for Additional Information Enclosure January 29, 2003 Page 3 response #4 given below). These modifications will ensure that a tornado missile cannot damage the SSF ASW system and its vital support systems.

Ouestion 2:

Provide the bases as to why single failures need not be considered/postulated for the Oconee tornado-licensing basis? Provide background information and references for the proposed change to the Oconee design basis such that the postulation of a single failure for a tornado event to the UFSAR is not required.

Response

This LAR does not request a change relative to the ONS requirements for postulating a single failure. The ONS licensing basis (LB) at the time of the issuance of operating licenses is documented in the original FSAR and NRC Safety Evaluation Report (SER) for the facility. No single failure was postulated as part of the original tornado LB as evidenced by the reliance on one station ASW pump powered from the single ASW switchgear located in the basement of the Auxiliary Building.

Post TMI correspondence with the Staff did not alter the original single failure requirements in that it was acknowledged that EFW was not tornado protected. In addition, Recommendation GL-4 established a requirement to either fully protect the SSF or analyze the use of Station ASW; neither of which are single failure proof (Reference NRC SER dated February 9, 1982). As with the original LB, the current LB does not postulate a single failure with a tornado.

Ouestion 3:

The Rev. 3 tornado analysis assumes the BWST is capable of withstanding tornado design basis wind loads. Describe the differences in the Rev. 3 analysis, vendor information or assumptions with respect to previous tornado analyses that assumed failure of the BWST due to tornado wind loading. Previous analyses assumed failure of structures due to wind loading were the dominant failure modes and as such, tornado missiles were not specifically modeled in the Oconee PRA.

Discuss the analysis, data and the impact (delta CDF), including failure frequency, with the respect to BWST failure due to tornado wind loads and missiles as revised by the Rev. 3 tornado analysis.

Response

The original assumption that the BWST would fail at F-3 or higher intensity tornado winds, was based on a 1982 scoping calculation performed for the NSAC/60 study. Thus, in Oconee PRA studies prior to Rev. 2 or the IPEEE, the tornado logic assumed that any F-3 or higher intensity

Responses to Request for Additional Information Enclosure January 29, 2003 Page 4 tornado striking the plant would cause failure of the BWST. During the IPEEE review, it was recognized that F-3+ intensity winds represent only a fraction of the total damage area used to calculate the plant strike frequency. To remedy this apparent conservatism, a damage area ratio methodology was developed and applied to BWST failure logic to produce a more accurate estimate of the wind damage frequency. This approach was then carried forward to the Oconee PRA Rev. 2.

The original BWST wind capacity evaluation was revised during the Rev. 3 analysis update. A safety-related engineering calculation was completed that documents the BWST can withstand the wind and differential pressure loads from a 300 mph design basis tornado. With this information, it became readily apparent that the dominant failure mechanism was missile related instead of wind related and that the BWST modeling changes implemented in the IPEEE and Rev. 2 had failed to properly consider the frequency of missile damage.

Rev. 3 uses missile damage probabilities based on a 1993 update to the original tornado missile risk studies conducted in the 1980s to support Duke's Post-TMI review of Oconee EFW missile protection. The 1993 update made only a few small changes and did not affect the estimated BWST damage probabilities. A summary description of the tornado missile analysis is contained in Section 5.1.2.3 of the Oconee IPEEE Submittal Report and Section 3.4.2.3 of the Oconee IPE Submittal Report.

Table 1 presents a comparison of the BWST damage frequencies (per year) for the different assumptions used in Rev. 2 and Rev. 3 of the tornado analysis. This comparison shows that the estimated BWST failure frequency nearly doubled.

Table 1 - Oconee BWST Failure Frequency BWST BWST Conditional Failure Damage Frequency Probability F-Strike Rev. 2 Rev. 3 Rev. 2 Rev. 3 Scale Freq.

(based on (based on (based on (based on Increa WIND)

MISSILES)

WIND)

MISSILES) se F-2 5.37E-05 0.071 3.81E-06 32.4%

F-3 4.12E-05 0.13 0.166 5.36E-06 6.84E-06 12.6%

F-4 3.59E-05 0.17 0.316 6.10E-06 1.13E-05 44.6%

F-5 1.71E1-06 0.17 0.439 2.91E-07 7.51E-07 3.9%

1.17E-05 2.27E-05 93.6%

Totals

Responses to Request for Additional Information Enclosure January 29, 2003 Page 5 Additional discussion of the assumptions and analysis of the BWST are provided in SAAG #673, "Oconee PRA Rev. 3 Tornado Analysis Update," in the following sections:

"* Appendix A - Section A.2.9

"* Appendix B - Sections B7 and B8 Ouestion 4:

Describe the modifications proposed for hardening the west penetration room and cask wash down areas against tornado wind loads and missile strikes.

Response

A steel barrier system is to be constructed and installed on the west sides of the West Penetration Rooms and Cask Decontamination Rooms of the Units 1, 2 & 3 Auxiliary Buildings. Steel panels will be added to the exterior of the West Penetration and Cask Decontamination Room walls. The SSF trench will be modified to provide additional protection from scabbing, SSF doors and the diesel fuel oil storage tank vent lines will also be protected.

This barrier system is designed to protect these areas of the Auxiliary Building from pressure differential, wind pressure and missiles generated as a result of a design basis tornado. Since the goal is to protect the SSF ASW piping and associated components from the effects of a design basis tornado, the design criteria of section 9.6 of the UFSAR is used as input to this calculation to qualify the system. The design tornado used is in conformance with Regulatory Guide 1.76, except as noted in UFSAR Section 9.6.3.1.

Ouestion 5:

The SSF is stated to be able to provide reactor coolant makeup and seal water for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Is the SSF RCS makeup flow and supply adequate with RCP seal failures present?

Response

The SSF RC makeup pump is capable of providing 29 GPM to the RC pump seals. Seal injection flow is established within 20 minutes after a loss of HPI and CC. Since seal injection flow is established within 20 minutes after a loss of HPI seal injection flow and CC, seal degradation or failure will not occur and flow rates associated with a seal LOCA will not occur.

Seal return flow is isolated when the SSF is activated so inventory lost due to seal leakage will be less than what is lost during normal operation. The SSF RC makeup system is not sized or required to mitigate a seal LOCA or other LOCA event. SSF RC makeup inventory is adequate for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of operation at a 29 GPM flow rate.

Responses to Request for Additional Information Enclosure January 29, 2003 Page 6 Ouestion 6:

The submittal states that the SSF is monitored through the maintenance rule program. Provide a scope of SSF systems that are included in the performance monitoring and surveillance requirements. Systems discussed should include those SSF systems required for tornado mitigation including HVAC, diesel fuel system, diesel cooling, batteries, charger, instrumentation, etc.

Response

The SSF Super System was created to cover all the SSF functions required for the SSF to perform its design basis mission. For performance monitoring, the SSF Super System is divided into the following parts:

"* SSF ASW System-Includes system and components required to deliver auxiliary feedwater to the SGs.

"* SSF RC Makeup System-Includes system and components required to provide seal injection flow to the RCS via the RC pump seals. Also includes RCS letdown capability.

"* SSF Support System-Includes all other functions required for the SSF to perform its design basis mission (SSF diesel & support systems, RCS & other required SSF instrumentation, PRZ heaters, boundary valves required for RCS isolation, & SSF HVAC function)

The SSF Super System for each Unit shall meet the following Maintenance Rule Criteria to be considered A2:

Maintenance Preventable Functional Failures (MPFFs) per fuel cycle - 4 Distribution of MPFFs not to exceed:

- SSF Support System - 3 MPFFs

- SSF RC Makeup System - 1 MPFF

- SSF ASW System -1 MPFF No MPFFs on the SSF Submersible Pump or the Breaker Transfer Mechanism.

No Repetitive MPFFs without a Run to Failure Analysis.

SSF Super System Unavailability per Cycle is 5 % (5 % limit may be increased for a cycle if Maintenance Rule Expert Panel reviews impact on overall risk and agrees increase is warranted.

This is typically done to allow for major diesel maintenance or a modification to improve SSF reliability.)

Responses to Request for Additional Information Enclosure January 29, 2003 Page 7 If the SSF Super System is declared Al, a cause determination and A(1) evaluation are performed.

Question 7:

What SSF components are controlled through the Oconee TS?

Response

In addition to the ONS In-Service Testing and Generic Letter 89-10 programs, the following sections from the Technical Specifications (TS) and Selected Licensee Commitment (SLC)

Manuals provide controls for SSF components to ensure that system reliability and performance is fully monitored. SSF components found to not be in compliance with any of these controls would be addressed via Duke's corrective action program.

1. TS 3.10.1 provides controls and testing requirements for the SSF, specifically:

"* SSF ASW system

"* Portable Pumping system

"* Reactor Coolant Makeup system

"* Power (& Instrumentation) system.

2. TS 3.10.2 provides controls and testing requirements for the SSF Battery Cell Parameters

3. TS 5.5.14 describes the requirement for the SSF fuel oil testing program

4. SLC 16.7.12 provides controls for the SSF diesel generator air start pressure instrumentation;

5. SLC 16.7.13 provides controls for SSF instrumentation; and

6. SLC 16.9.14 provides criteria for inspection of the SSF diesel generator.

Question 8:

Provide the frequency of occurrence for tornadoes F-I through F-5 assumed in the current Oconee PRA Rev. 3.

Responses to Request for Additional Information Enclosure January 29, 2003 Page 8

Response

Strike F-Scale Freq.

F-2 5.37E-05 F-3 4.12E-05 F-4 3.59E-05 F-5 1.7 1E-06 F1 tornados would result in only a loss of offsite power with no damage to plant structures or equipment. Therefore, it is assumed that F1 tornados are included in the weather related LOOP initiator frequency. Oconee tornado strike frequency information is also found in Section 5.1.2.1 of the Oconee IPEEE Submittal Report.

Ouestion 9:

Provide a discussion on the vulnerability of instrumentation/control systems/ displays for equipment required to mitigate the effects of a tornado strike. Discussion should include cables, sensors (level, pressure), process equipment, power supplies including batteries and displays vulnerable to a tornado strike.

Response

The areas of vulnerability for the instrumentation and control equipment for the tornado mitigation systems are the West Penetration Room (WPR), East Penetration Room (EPR), and Control Battery Room.

The WPR contains power, control, and instrumentation cables for the SSF systems as well as instrumentation and controls for the other plant systems associated with the "B" steam generators and the "B" RCS Loops. Additional discussion of the vulnerability of the WPR is provided in SAAG Report #673, Appendix A - Section A.2.6.

The EPR contains instrumentation and control cables for the normal plant mitigation systems (EFW/HPI/ASW/etc.) associated primarily with the "A" steam generators and the "A" RCS Loops. Most other indications and controls not directly associated with a specific loop ("A" or "B") utilize penetrations and cabling in the EPR. For example, the instrumentation and control cables for the Pressurizer PORV pass through the EPR.

It is important to note that the cable shaft is at the back wall of the EPR near the crossover passage to the West Penetration Room (furthest away from outside wall). Cables from the West Penetration Room follow this passage over to the cable shaft area at the back of the EPR. In the

Responses to Request for Additional Information Enclosure January 29, 2003 Page 9 cable shaft area, cables from both penetration rooms either pass through the wall into the cable spread room or pass down through the cable shaft to the Electrical Equipment Room or to other locations on other levels of the Auxiliary Building. Additional discussion of the vulnerability of the EPR is provided in SAAG Report #673, Appendix A - Section A.2.6.

The Control Battery Rooms for each unit are located on the 4th floor immediately behind the EPR between the EPR and the Turbine Building wall. This vulnerability is not important to the tornado results for several reasons. First, the likelihood of tornado damage to the batteries is considered to be less than the EPR because its walls are significantly stronger (against wind damage) and the room is much smaller and further recessed behind the main steam safety valves (a smaller missile target). Second, the loss of the battery "function" is subordinate to the EFW/HPI/ASW functions (assumed) lost when the EPR fails.

The most important aspect of the DC power system is that the power panelboards on each unit are backed up by a distribution center on an adjacent unit. Thus, a loss of the batteries on a given unit will not by itself result in a loss of power to the unit's instrumentation and control systems.

The most significant vulnerability for the instrumentation and control systems was found to be the 4kV power system in the Turbine Building that is necessary to supply power to the battery chargers. The recognition of failure modes for loss of 4kV power to all 3 units and this multi unit dependency for I&C power is a significant new insight of the updated tornado analysis.

The SSF instrumentation and control (I&C) systems are completely separate and independent of the Vital I&C system used in the main control room for EFW and station ASW operation. With the implementation of the modifications described in the submittal, the SSF instrumentation and control systems will be fully protected from tornado damage.

Ouestion 10:

Discuss why the failures of the east and west penetration rooms appear to be considered independent for tornado winds and missiles.

Response

In earlier tornado analyses, a certain degree of independence was considered between east and west penetration rooms. However, the fault tree logic for the Rev. 3 analysis was modified to reflect the (conservative) assumption that the east and west penetration room failures are completely dependent.

Ouestion 11:

For the SSF RCMU system - does each unit have its' own pump?

Responses to Request for Additional Information Enclosure January 29, 2003 Page 10

Response

Yes. The SSF RCM Pump is a positive displacement pump driven by an induction motor, powered from the SSF Power System. The pump is located in the Reactor Building basement sufficiently below the spent fuel pool water level to assure that adequate net positive suction head is available.

Ouestion 12:

Include any other areas in which operators actions may be needed to mitigate the consequences of a tornado (e.g., to align alternate power to an HPI pump from the station ASW switchgear, operators must open a normal power supply breaker in the turbine building or in the blockhouse next to the turbine building. Also describe operator's actions that may be required in the west penetration room to support station ASW or EFW operation.)

Response

The proposed changes in the LAR will result in reduced operator actions following a tornado event. One of the difficult operator actions being eliminated is the flow path alignment of the High Pressure Injection (HPI) pump to the Spent Fuel Pool (SFP).

Currently, when a Tornado Watch is issued, the Natural Disaster Abnormal Procedure is implemented. If the Watch progresses to a Warning, a Nuclear Equipment Operator (NEO) is dispatched to the Ist Floor Aux Bldg to prepare for using the station ASW pump and a licensed operator is dispatched to the SSF to standby for further direction. The NEO at the station ASW Pump opens suction and recirculation valves, vents the pump, and racks in the pump breaker.

Other NEOs are staged in the control rooms and shift maintenance personnel are staged in the OSC (Unit 3 Control Room) and told to prepare for possible need to power an HPI pump from the station ASW switchgear.

If a tornado hits the station resulting in a loss of all feedwater (Main and Emergency), NEOs will be dispatched to the turbine building basement to attempt to cross-connect emergency feedwater with another unit. Another NEO will be dispatched to the Turbine building basement to attempt a manual start of the Turbine Driven Emergency Feedwater (TDEFW) pump.

Assuming the tornado results in a loss of power, the licensed operator at the SSF will be directed to implement the SSF emergency operating procedure (EOP) to provide feedwater via the SSF ASW system and Reactor Coolant Makeup (RCMU) via the SSF RCMU system. The blackout section of the EOP will dispatch two NEOs to the Atmospheric Dump Valves (ADVs) on the 5th floor of the turbine building if the Steam Generators (SGs) are not being fed. In order for the event to progress to the point of needing to use the station ASW Pump, attempts to use another

Responses to Request for Additional Information Enclosure January 29, 2003 Page 11 unit's Emergency Feedwater, to manually start the TDEFW pump, and to activate the SSF must have been unsuccessful.

The blackout section of the EOP attempts to restore power to the 4160-volt busses. For this scenario, it is assumed that 4160 volt Engineered Safeguards switchgear located in cabinets TC, TD, and TE, have been damaged and power can not be restored to the 4160 volt feeder busses. A Keowee Hydro unit would have emergency started or been manually started to energize the standby busses through the underground power path.

Once it is determined that the only source of feedwater available to the unit is station ASW and the standby busses are energized, the NEO pre-staged at the station ASW pump is directed to start the station ASW pump, close a vent valve on the discharge line, and open the pump discharge valve. NEOs at the ADVs will be directed to fully open the valves. An NEO will be dispatched to the Penetration Rooms (Auxiliary building 4th Floor) to fully open the last valves needed to feed the SGs.

Once Feedwater is established, shift Maintenance personnel are dispatched to align power to the chosen HPI Pump ("A" or "B") to the ASW switchgear. The Maintenance personnel isolate 4kV power to the HPI pumps by opening breakers to the 4 kV switchgear or in the blockhouse, both of which are located at ground elevation in the Turbine Building. Power to the HPI pumps is aligned to the ASW switchgear by using pre-staged cables located in the HPI pump rooms. In addition, an NEO will be dispatched to prepare for using an HPI pump off the ASW switchgear.

The NEO will isolate Reactor Coolant Pump (RCP) seal flow by closing *HP-139 (3rd floor Auxiliary building), verify HPI pump motor cooling water flow (HPI pump room), open *HP-24 (suction from the BWST located in the Auxiliary building, HPI hatch area), proceed to East Penetration Room (Auxiliary building 4th floor) to throttle HPI discharge flow.

If the BWST is not available, the Technical Support Center (TSC) will determine the suction source for the HPI pump. If the HPI pump suction from the SFP is selected, this will require valve alignment in the SFP (6th floor Auxiliary building), the East Penetration Room (4th floor Auxiliary building), and SFP cooler room (2nd floor Auxiliary building). In addition, the Spent Fuel Priming Pump must be started (located behind the station ASW switchgear).

If all 4160 Volt switchgears are de-energized for 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, an NEO will be dispatched to purge hydrogen from the electrical generator by opening two valves in the Turbine building first floor.

If a blackout exists on all three units, an NEO will be sent to Load Shed the Essential Inverters (Equipment Room - 3rd Floor Auxiliary building/Turbine building) and emergency start the Diesel Air Compressor (located outside the south end of Turbine building) to provide instrument Air.

• Designates Unit 1, 2, or 3 as applicable.

Responses to Request for Additional Information Enclosure January 29, 2003 Page 12 Ouestion 13:

Although damage to control room equipment is not postulated with the failure of the control room wall during a tornado event no discussion on operator injury or human factor considerations or subsequent tornado missile or water damage is provided.

Response

Original documentation describing the early design and construction of the Unit 3 Control Room (CR) exterior wall is limited to a 1970 memorandum where it is stated that the exterior wall would be designed for tornado wind only and not missiles. It is apparent that the mindset at that time was that tornado missile protection was not necessary due to low risk and the fact that the wall was surrounded by hardened structures. However, a recent assessment of the wall shows a portion of the wall to be vulnerable to a design basis tornado missile. It has also been found to be vulnerable to differential pressure loads in 2 of the 5 segments of this same wall. On the other hand, this wall has been found to be acceptable against design basis wind loads of up to 300 mph.

The specific wall sections vulnerable to differential pressure loads are 2 segments located at the rear of the CR where computer equipment is located. Under these loads, the wall sections would be expected to fall outward and not impact equipment or personnel in the CR involved with tornado event mitigation. There is approximately 23 feet of clearance between these wall sections and the nearest engineered safeguards cabinet. Operations personnel would be expected to be positioned in the main "horseshoe" area at the east end or in the operations offices and kitchen areas along the south wall and the southwest comer of the CR. Modifications to the U3 Control Room north wall will be implemented through the corrective action program to resolve the differential pressure issue.

Failure of the wall sections could reasonably be expected to cause a loss of the Operator Aid Computer (OAC) and the dose control computers used for the Operations Support Center (OSC).

There is also a door and stairway in the northwest comer leading to the Cable Room which could be damaged or blocked. However, there are two other CR access points and this stairway is not used as a primary route for any operator actions performed outside the CR.

The probability of potential tornado missile damage is regarded as very low, on the order of -1E 07 /yr. This expected low probability stems from the walls' favorable orientation to the north, favorable location away from high missile population areas, its elevation (26 feet above grade),

and shielding provided by the Unit 2 reactor building, Unit 3 reactor building, and the Unit 3 spent fuel pool building enclosure. Although these sections cannot [technically] withstand design basis missiles, the walls sections are quite substantial and expected to withstand the impact of more probabilistically significant missiles of lower mass and lower velocity.

Responses to Request for Additional Information Enclosure January 29, 2003 Page 13 Design basis missiles by their definition represent very unlikely events. A definitive tornado missile study using the TORMIS missile simulation code is planned to be completed by mid 2003 to formally evaluate this missile damage probability and address the issue of CR missile protection.

In general, tornado missile damage would be expected to be a localized damage event to areas in the rear of the control room. Damage to the main control boards or to the operators' stations is considered remote as the distance from the plant yard increases and the angle of incidence (with the wall) decreases.

Ouestion 14:

The submittal states that there is currently adequate staffing to align station ASW to a single unit's steam generators in 40 minutes. Discuss procedure revisions, staffing revisions, or other means that have been implemented by Oconee to ensure that the 40-minute time frame is met.

Provide a discussion on the apparent design basis change that the station ASW pump provides secondary side heat removal for only a single unit during a tornado event instead of all units simultaneously.

Response

Operations performed three timing validations in 2001 to ensure station ASW could be aligned within 40 minutes. An integrated validation approach was used which utilized the simulator for control room actions and NEOs dispatched via radio in the actual plant. The NEOs simulated and walked through actions when dispatched from the simulator control room as would be during an actual event. During the validation, a minimum crew of 1 SRO, 2 ROs, and 6 NEOs were utilized. One licensed operator from the Work Control Center was used to man the SSF.

The tornado CLB assumes a tornado damages a single unit with a LOOP for the station. The ability to align station ASW to a single unit with the capability to align to any unit's SGs fully supports the CLB. In addition to station ASW and following implementation of a planned modification to fully protect the SSF from tornadoes, the SSF ASW will be credited and has the capability to remove decay heat removal for one, two, or all of the unit's SGs.

Question 15:

The submittal states that the upper surge tanks can withstand wind loadings associated with a 300 mph tornado. Earlier PRA analyses assumed damage to the upper surge tanks due to tornado wind loads. Describe any changes in the analysis or surge tank installation that significantly reduced the likelihood of upper surge tank failure. Include a discussion on the vulnerability of

Responses to Request for Additional Information Enclosure January 29, 2003 Page 14 the upper surge tank to tornado missiles. Discuss the analysis, data and the impact (delta CDF),

including failure frequency, with the respect to UST failure due to tornado wind loads and missiles as revised by the Rev. 3 tornado analysis.

Response

The original PRA assumption that the UST would fail at F-2 or higher intensity tornado winds, was based on engineering judgment. A detailed wind analysis had never been performed until recently, and this simplifying assumption appeared to be consistent with generic tornado damage experience (field observations). Furthermore, this assumption reasonably bounded many other uncertainties regarding the availability of EFW system equipment following a tornado strike.

During the Rev. 3 analysis update, a decision was made to perform a detailed assessment of the UST wind capacity because the risk results were considered to be sensitive to this assumption. A safety-related engineering calculation was completed that documents the UST can withstand the wind and differential pressure loads from a 300 mph design basis tornado.

Although the UST itself was found to have a significantly higher capacity than previously thought, the analysis shows that the attached EFW suction and recirculation piping are vulnerable to wind damage. The degree of vulnerability of the overall function (of providing EFW suction) is similar to that considered in the earlier risk studies.

More importantly, with this detailed UST evaluation, the Rev.3 analysis was modified to distinguish EFW start failures and EFW run failures as they relate to these different types of piping failures. This distinction was used in conjunction with other event tree and fault tree changes to improve the treatment of safety valve challenges and operator recovery actions.

A set of events for tornado missile damage was added to the Rev. 3 model for completeness; however, this failure mode is a very small component of the overall EFW system failure probability. The UST missile damage probabilities are based on a 1993 update to the original tornado missile risk studies conducted in the 1980s to support Duke's Post-TMI review of Oconee EFW missile protection.

SAAG Report #673 provides additional details concerning EFW modeling assumptions in Appendix A - Section A.2.9 and Appendix B - Section B.6.

Ouestion 16:

Note that the analysis provides for realignment of the HPI system to the station ASW switchgear.

Can this be accomplished in the required time assuming that station ASW is to be realigned as well? Have procedures and operator training been completed?

Responses to Request for Additional Information Enclosure January 29, 2003 Page 15

Response

For the tornado scenario, 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> are available to re-establish HPI flow. With maintenance and NEO dispatch being performed within an hour, 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> are available to perform the valve and power alignment. Shift maintenance personnel perform the alignment of standby bus power to an HPI pump.

Operations performed three timing validations in September 2001 and the longest time for initiating this power alignment was 49 minutes. Maintenance performed a walkthrough timing validation in June 2002 and performed the power alignment in 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. This time was considered conservative based on previous demonstrations that showed 56 minutes and 40 minutes. Although not specifically time validated, the NEO valve alignment required can be easily performed in parallel with the Maintenance work. The NEO valve alignment was not time validated due to the large amount of time available to perform the task.

Operations has proceduralized initiating HPI pump power alignment to the standby bus in the blackout section of the EOP. There operations notifies shift Maintenance to perform EM/O/A/0050/001 (Procedure to provide emergency power to an HPI pump from the station ASW pump switchgear). In parallel, the blackout section of the EOP checks for suction source availability and dispatches an NEO to perform an EOP Enclosure to isolate RCP seals, align HPI pump suction, ensure cooling water is available, and be in position to throttle discharge flow.

Operations has a Training and Qualification Guide that requires walking through the steps associated with HPI being powered from the station ASW switchgear and taking suction from the SFP. In addition, Operations Training has Job Performance Measures (JPMs) related to HPI taking suction from the SFP and aligning cooling water to the HPI pumps. Samplings of JPMs are chosen to evaluate operator's abilities on annual basis.

Ouestion 17:

How long will station vital batteries support instrumentation and control functions following an assumed loss of 4kV power to all three units during a tornado event?

Response

Each unit's vital batteries are sized to last 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following a station blackout. Operators shed non-essential loads within 30 minutes.

Ouestion 18:

The values shown in Table 1 of the submittal are in what units (/yr)?

Responses to Request for Additional Information Enclosure January 29, 2003 Page 16

Response

The Oconee tornado strike frequencies are calculated on an annual basis without consideration of the plant capacity factor. Therefore, in the usual context for a RG-174 submittal, the CDF values provided in the submittal are on a "per reactor-year" basis.

Ouestion 19:

Have the results of the Oconee PRA peer review been evaluated against the proposed tornado license bases changes? Describe the changes incorporated into the proposed tornado license bases change as a result of this review.

Response

The peer review conducted through the B&WOG did not specifically review the tornado analysis or any other external events analysis. There were no comments or findings from this review that would have any significant impact on the tornado model except for the finding regarding human error dependencies (See Item #1 in the Question #28 response).

This issue deals specifically with the case where 2 or more human error events occur in the same cut set. For this situation, it is appropriate to consider any dependencies that may exist between the human actions because the joint failure probability could be significantly higher than the product of their independent failure probabilities.

A process for accounting for these dependencies is being developed for the final Oconee Rev. 3 results; however, it was not available when developing in the risk results for the submittal. The technique for addressing these dependencies is also not compatible with the Boolean solution technique used to quantify the tornado model.

This concern was identified early in the tornado analysis process, but was determined to be acceptable with respect to incremental CDF results used to evaluate this licensing change. This conclusion was based the fact that the baseline CDF would increase more than the increase in the "proposed" CDF case. The reason this occurs is related to the operator action for alignment of HPI to the SFP. For the base case, a dependency analysis would cause an increase in the joint probability of some human error combinations involving the SFP alignment action. Other human error combinations not involving this specific action would also see an increase in joint probability. However, in the proposed case, a dependency analysis would not cause an increase in the joint probability for combinations involving the SFP alignment because the failure probability has effectively been set to 1.0 (function removed). The other human error combinations would have the same increase as in the base case. Therefore, the incremental CDF

Responses to Request for Additional Information Enclosure January 29, 2003 Page 17 values provided in the submittal are conservatively estimated with respect to the lack of a human error dependency analysis.

Ouestion 20:

Describe dependencies on "piggy back" cooling during tornado event mitigation.

Response

The piggyback function is not credited for tornado mitigation since a tornado cannot cause, or occur simultaneously with or following a LOCA (see UFSAR Section 3.2.2). The -PI-LPI piggy back function is credited for mitigation of a small break loss-of-coolant accident (SBLOCA) or rod ejection accident where a long-term source of primary system makeup water would be supplied from the reactor building emergency sump (via an LPI system pump) following the depletion of BWST inventory.

Sump recirculation is modeled in the PRA tornado analysis as dependent on 4kV power. For a loss of 4kV power, conserving and refilling the BWST is necessary to maintain core cooling following a seal LOCA.

Ouestion 21:

Rev. 2 to the Oconee PRA states that for Unit 2 and 3 seal packages the analysis assumes that component cooling water through the RCP thermal barrier coolers is sufficient to continue RCP seal cooling following a loss of HPI. This assumption seems to be based on the RCP recirculation impeller operating. Is this assumption true with the pump tripped and the recirculation impeller inoperable? Are the same assumptions made for Unit 1 when modified with Sulzer seal packages?

Response

The Unit 2 and 3 (Sulzer-Bingham) pumps have a cooling jacket in the pump stuffing box and an external heat exchanger. The cooling jacket maintains cooling to the seals with the pump shut down (no recirculation through the external heat exchanger). The seal return flow should be isolated in the event that seal injection is lost and the pump is secured to limit the flow of hot RCS through the seals and ensure seals are maintained adequately cooled. Automatic system interlocks perform the seal return valve closure on loss of injection if the pump is shut down.

The Unit 1 RCPs have an internal heat exchanger which adequately cools the RCS water whether the pump is operating or shut down. The seal return valve will automatically close only if both CC and injection water are lost to the Unit 1 RCPs.

Responses to Request for Additional Information Enclosure January 29, 2003 Page 18 Based on seal testing at Sulzer the published allowable time for operation of an RCP with no seal cooling (HPI or CC) for the Sulzer seal is 30 minutes. Based on studies done by the CEOG the probability of seal failure for up to 24-hours of operation is very low.

The RCP thermal barrier coolers are not credited in the tornado analysis. All tornado accident sequences of any significance include a loss of normal 4kV power would result in a loss of power to the LPSW pumps and CC pumps needed for this mode of seal cooling.

Question 22:

On page 11 of the submittal it is stated that the loss of 4Kv power will fail LPSW. Is this station 4Kv power? Provide clarification.

Response

Yes. The LPSW pumps are powered from the Essential 4kV Buses located on the mezzanine floor (grade level) of the Turbine Building. During a loss of off-site power, emergency power can be supplied to the Essential Buses from the Standby Buses in the protected Blockhouse via the Main Feeder Buses. The Main Feeder Buses have been identified as the primary tornado vulnerability of the 4kV Auxiliary Power System. Additional information regarding these design features and analysis assumptions are provided in SAAG #673, "Oconee PRA Rev. 3 Tornado Analysis Update."

Question 23:

The station ASW reliability was stated to be adjusted to reflect the need to access components in the east penetration room. Since the east penetration room wall is likely to fail with the west penetration room how is accessed accomplished or quantified?

Response

Damage to either penetration room is assumed to fail the station ASW function either due to piping damage or an inability to open the isolation valve.

Question 24:

Is the Oconee PRA Rev. 3 completed - if not what is the schedule?

Responses to Request for Additional Information Enclosure January 29, 2003 Page 19

Response

No. Completion of the Level 1 analysis for Rev. 3 of the Oconee PRA is expected to occur in early 2003.

Ouestion 25:

Oconee UFSAR Section 9.6, "Standby Shutdown Facility", does not state or credit the SSF as a backup facility for tornado mitigation (fire, sabotage, or flooding are referenced). No revision is proposed in the amendment request.

Response

As stated in the last paragraph of the LAR cover letter, other sections of the UFSAR affected by the submittal will be revised, as necessary to reflect approval of this submittal in a time frame consistent with normal UFSAR update practices including revising the SSF UFSAR section to credit tornado mitigation.

Ouestion 26:

The submittal discusses the loss of offsite power to all 3 Oconee units with a high conditional probability that instrumentation power will be lost. The PRA includes this in run time failures for ASW and EFW. Why was the loss of instrumentation power not modeled as recovery of offsite power or recovery of instrumentation power within the required time frame?

Response

The Oconee tornado analysis assumes that off-site power is not recoverable in time to prevent core damage when the 230kV switchyard is impacted by F-2 or greater tornado winds. The station battery chargers are powered from their respective unit's 600V power system which is powered from the 4kV Engineered Safeguards Buses. With a loss of offsite power to all 3 Oconee units; all station battery chargers are left without power if the emergency power system fails due to tornado damage or other random failures.

The SSF has its own independent set of instrumentation and power supplies. However, if the SSF fails to provide secondary side heat removal, it is not credited with providing alternate control indication EFW or station ASW because it is not proceduralized, not trained upon, and the dominant SSF failure modes involve loss of the SSF Diesel Generator. Therefore, the reason that an instrumentation power "recovery" event is not modeled is because there are no available means to reliably recover I&C power.

Responses to Request for Additional Information Enclosure January 29, 2003 Page 20 Ouestion 27:

The submittal states that Oconee participated in the BWOG PRA certification program (May 7 11, 2001). Has the final report been completed? Confirm the version of the Oconee PRA reviewed and whether the revised tornado analysis included in the submittal was included in the review.

Response

The final report was completed in September 2001. The review examined a mixture of both Rev.

2 analyses and a significant number of Rev. 3 analyses that had been completed (or sufficiently developed) at that time. The scope of the review did not include external events specifically.

(See Question #19)

Ouestion 28:

Describe the 4 peer review findings received by Oconee during the BWOG peer review that were classified as "important and necessary" to address to ensure the technical adequacy of the PRA, the quality of the PRA, or the quality of the PRA update process.

Response

1. 1 - Revision 2 of the PSA did not include a method for methodically evaluating the dependence among human actions. The human reliability analysis for Revision 3 had not progressed to the extent that review of the evaluation of human reliability dependencies was possible. However, the methodology to be implemented for Revision 3 was found acceptable if applied properly.

1. 2 - The ISLOCA frequency reflects a point estimate of cutsets of valve failure modes that have very large uncertainties. A point estimate does not represent a reliable estimate of the mean ISLOCA frequency due to the propagation of uncertainties through the ISLOCA cutsets.

1. 3 - Key contributions to LERF may have been underestimated. Primary issues identified relate to the quantification of the SGTR event tree and with the mapping of SG tube rupture cutsets to an appropriate plant damage state.

1. 4 - The completeness in modeling common cause basic events in the PRA model were potentially inadequate. No justification was provided for omitting a number of common cause component groups typically found in other PRAs.

Of these four findings, only item #1 has the potential to impact the tornado analysis. However, as described in the response to Question #19, the lack of a human reliability dependency

Responses to Request for Additional Information Enclosure January 29, 2003 Page 21 evaluation results in a more conservative estimate of the incremental core damage frequency and is therefore acceptable.

Question 29:

For a Tier 2 analysis RG 1.174 states that the licensee should provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when specific plant equipment is out of service. Although changes to equipment surveillance intervals or completion times are not requested, the proposed licensing basis revisions should be evaluated with respect to potential risk significant outage configurations and any applicable restrictions. Provide a discussion on any restrictions found as a result of the proposed tornado license bases change (SSF or Keowee maintenance schedules and severe weather forecast for example).

Response

An update to the Oconee ORAM-Sentinel model is planned immediately following completion of the Rev. 3 Level 1 PRA analysis. However, the proposed changes are not expected to result in any significant changes to the current configuration risk management program. The existing program uses a blended approach of quantitative and qualitative evaluation of each configuration assessed. The current ORAM-Sentinel model is very restrictive regarding SSF and Keowee maintenance activities (based on Rev. 2 Oconee PRA and "defense-in-depth").

The Oconee ORAM-Sentinel model considers both internal and external initiating events with the exception of seismic events. Besides tornado events, Oconee is subject to several other important accident initiators involving extensive damage (or loss of functions) to systems in the Turbine Building (e.g., Fire and Flood). Like tornado events, these events also rely heavily on the SSF to provide a backup means of accident mitigation. Thus, the overall change in plant risk during maintenance activities is expected to be similar between Rev. 2 and Rev. 3 results.

With regard to severe weather, the Oconee Natural Disaster Procedure (APIOIAI17001006) contains specific actions for Tornado "Watches" and "Warnings" to restore critical systems and equipment to service. Additional scheduling improvements are being evaluated with regard to the SSF and Keowee Underground Path to avoid long equipment outages during "tornado season". Long periods of unavailability have the potential to extend beyond the initial weather forecast window. No additional restrictions or administrative controls are proposed.

Question 30:

The ORAM-SENTINEL model used at Oconee is stated to utilize the full Oconee Rev. 2 PRA along with traditional deterministic methods. Confirm the applicability of the Rev. 2 model to

Responses to Request for Additional Information Enclosure January 29, 2003 Page 22 accurately reflect the risk associated work activities involving equipment associated with the proposed licensing basis change and the revised tornado PRA model.

Response

See response to Question 29.

Question 31:

How long will the SSF diesel generator operate off the SSF day tank supply before the day tank supply is exhausted?

Response

An independent fuel system, complete with a separate underground storage tank, duplex filter arrangement, a fuel oil transfer pump, and one-hour day tank, is supplied for the SSF diesel electric generating unit. For the SSF to be considered operable, Technical Specification 3.10.1 requires (in-part) that there be greater than or equal to 200 and 25,000 gallons of fuel oil in the day and underground tanks, respectively. Upon SSF diesel engine start, a fuel oil transfer pump automatically starts and transfers fuel oil from the underground fuel oil storage tank to the day tank. In operating modes 1, 2, and 3, this transfer is verified on a 92-day surveillance frequency and the 25,000-gallon capacity of the underground tank ensures that the SSF's 72-hour mission time is assured. Without the fuel oil transfer and based on a conservative consumption rate of 250 gallons per hour, the fuel oil day tank's 200 gallon volume would last approximately 48 minutes.

The Oconee PRA includes detailed modeling of the fuel oil system in the SSF system model as well as detailed modeling for all other SSF support systems necessary to prevent core damage.

The tornado fault tree analysis also incorporates the SSF fault tree logic for both front-line and support systems of the SSF. The dominant failure mode of the SSF is a failure of the diesel generator to run for its mission time.

Question 32:

Provide summary report for Rev. 3 of the Oconee tornado analysis. Specifically, provide information and analysis insights (equipment, procedures, or manual actions for example) that characterize the Rev. 3 Oconee baseline increase in tornado CDF.

Responses to Request for Additional Information Enclosure January 29, 2003 Page 23

Response

The revised tornado model for the Oconee PRA Rev. 3 produces the following core damage frequency results.

Unit I

=

2.41E-05 /rx-yr Unit 2

=

2.13E-05 /rx-yr Unit 3

=

2.07E-05 /rx-yr This core damage frequency is higher than the baseline Rev. 2 PRA result of 1.4E-05*. The increase over the previous analysis is primarily a result of the additional logic for dependent failure mechanisms (spatial dependencies) and new failure modes associated with tornado damage around the U1/U2 Blockhouse that causes a loss of all 4kV power to all three units. In addition to the loss of normal power to ECCS and EFW systems, these failures can result in a loss of following support functions:

"* EFW Cooling Water

"* Makeup Capability To BWST

"* Vital I&C power (when vital batteries are depleted)

• Note: A distinction is made between "an increase in baseline CDF" versus "an increase in the estimate of the baseline CDF." The difference in the Rev. 3 results versus Rev. 2 is an increase in the "estimate" of the risk, not an actual increase in risk. It is also important to note that the Rev. 2 CDF value is applicable to Unit 3 only. As described in the submittal, the replacement of RCP seals on Unit 1 resulted in an actual decrease in CDF.

Ouestion 33:

The vulnerability of the Keowee station is discussed in the summary report for the Rev. 2 Oconee PRA dated December 1996. The excitation and auxiliary power supplies are identified as the dominant tornado failure modes for Keowee.

Although the HPI (once aligned) and the station ASW pump do not rely on the 4160 V busses in the turbine building to mitigate a tornado event, the HPI and station ASW pump do rely on power from Keowee via the underground line. Discuss why the equipment identified as vulnerable at Keowee does not require tornado protection with respect to HPI and station ASW and the Oconee tornado design basis.

Responses to Request for Additional Information Enclosure January 29, 2003 Page 24

Response

The original tornado design basis relied upon protection or physical separation. The original FSAR refers to six sources of electric power, one of which is Keowee Hydro Station. The fact that Keowee Hydro Station is physically separated from the nuclear plant, and the underground path is protected from tornado damage, provided reasonable assurance that power would be available to the station ASW system. Duke's proposed license amendment request improves upon the current licensing basis by protecting the SSF from tornado damage.