Text

Meeting, Handouts for Discussion of June 7, 2002, Submittal on Tornado Mitigation
	ML030830443
Person / Time
Site:	Oconee
Issue date:	03/20/2003
From:	Olshan L; NRC/NRR/DLPM/LPD2
To:	;
References
	TAC MB5361, TAC MB5362, TAC MB5363
	Download: ML030830443 (38)
	v • d • e

NRC FORM 658 U.S. NUCLEAR REGULATORY COMMISSION (9-1999)

TRANSMITTAL OF MEETING HANDOUT MATERIALS FOR IMMEDIATE PLACEMENT IN THE PUBLIC DOMAIN This form is to be filled out (typed or hand-printed) by the person who announced the meeting (i.e., the person who issued the meeting notice). The completed form, and the attached copy of meeting handout materials, will be sent to the Document Control Desk on the same day of the meeting; under no circumstances will this be done later than the working day after the meeting.

Do not include proprietary materials.

DATE OF MEETING The attached document(s), which was/were handed out in this meeting, is/are to be placed 03/20/2003 in the public domain as soon as possible. The minutes of the meeting will be issued in the near future. Following are administrative details regarding this meeting:

Docket Number(s) 50-269,50-270, AND 50-287 Plant/Facility Name OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3 TAC Number(s) (if available)

MB5361, MB5362, AND MB5363 Reference Meeting Notice MARCH 6,2003 Purpose of Meeting (copy from meeting notice)

TO DISCUSS JUNE 7,2002, SUBMITTAL ON TORNADO MITIGATION NAME OF PERSON WHO ISSUED MEETING NOTICE TITLE

L. N. OLSHAN PROJECT MANAGER OFFICE NRR DIVISION DLPM BRANCH PD II-1 Distribution of this form and attachments:

Docket File/Central File PUBLIC NRC FORM 658 (9-1999)

PRINTED ON RECYCLED PAPER This formn was designed using InForms

Duke Energy.

Oconee Nuclear Station Tornado License Amendment Request Meeting March 20, 2003

PDuke fEnergy¥ Oconee Nuclear Station Tornado License Amendment Request Meeting Meeting Objectives

"* Respond to the Staff's recent questions from Duke's June 7, 2002 Tornado Licensing Amendment Request.

"* Provide sufficient level of detail to foster a better understanding & acknowledgement of Duke's current and proposed tornado licensing basis.

"* Address follow-up items expeditiously.

2

I Duke wEnergy.I Oconee Nuclear Station Tornado License Amendment Request Meeting Duke RAI Responses (to date):

>-January 23, 2003

Addressed 34 Questions

>-March 18, 2003 9 Addresses 36 Questions 3

P Duke Oconee Tornado License Energy.

Amendment Request U Recap: Proposed Changes to Oconee LB:

>-UFSAR description of the SFP-HPI flow path will be removed

>-The SSF will be credited as the assured means of safe shutdown following the design basis tornado.

4

ORAFT RESPONSEO ENCLOSURE DUKE RESPONSES TO RAI CONCERNING PROPOSED LICENSE AMENDMENT REQUEST TO FULLY CREDIT THE STANDBY SHUTDOWN FACILITY AND TO ELIMINATE CREDITING THE SPENT FUEL POOL TO HIGH PRESSURE INJECTION SYSTEM FLOW PATH FOR TORNADO MITIGATION, OCONEE NUCLEAR STATION, UNITS 1, 2 AND 3 Question 1:

Numerous tornado vulnerabilities have been identified that appear to be inconsistent with Oconee design basis requirements (for example, Sections 3.1.2 and 3.1.4 of the Oconee UFSAR regarding emergency power capability and shared systems, respectively). Explain how the plant design bases are satisfied given the specific tornado vulnerabilities that have been identified.

Response

Updated Final Safety Analysis Report (UFSAR) Section 3.1.2, Criterion 2: Performance Standards, states that components, which are essential to the prevention of accidents that could affect the public health and safety or the mitigation of their consequences, shall be designed, fabricated, and erected to performance standards that will enable the facility to withstand, without the loss of capability to protect the public, the additional forces that might be imposed by natural phenomena (including tornadoes). The original licensing of Oconee Nuclear Site (ONS) relied upon the Station Auxiliary Service Water (ASW) system to meet this design criterion for tornadoes. The principles supporting the original tornado design basis were protection or physical separation. This is evident in that the original FSAR refers to physically separated Station ASW lines (one in the East Penetration Room and one in the West Penetration Room) as well as six sources of electric power. The Atomic Energy Commission (AEC) accepted this design philosophy for meeting Criterion 2. The proposed change continues to satisfy this design philosophy. Duke has reviewed Section 3.1.4 and has concluded that the Standby Shutdown Facility (SSF) and Station ASW systems should be included in the list of shared systems. The UFSAR will be changed through the corrective action program to address the information missing from Section 3.1.4.

A staff memorandum dated February 9, 1982, described actions necessary to address the capability to deliver Auxiliary Feedwater (AFW) flow following a seismic event or tornado (Recommendation GL-4). The staff's position in this memorandum with respect to decay heat removal following a tornado was that Duke would be required to either, 1) confirm that all portions of the SSF ASW system will be adequately protected from tornado missiles, or 2) provide the results of an analysis which demonstrates that adequate decay heat removal can be continuously maintained through the existing auxiliary service water system. The proposed change in this license amendment request will result in all portions of the SSF ASW system being adequately protected from tornado missiles, as well as wind and differential pressure loads.

)RAFT RESPONSJ4 Responses to Request for Additional Information Enclosure March 19, 2003 Page 2 Thus, Duke believes the change requested through this submittal satisfies both the original design requirements for the plant as well as the post-Three Mile Island (TMI) requirements.

Secondary side heat removal (SSHR) tornado vulnerabilities were described to the NRC in post TMI correspondence. In a letter dated November 19, 1982, Duke characterized potential damage to the penetration rooms and Turbine Building due to wind loadings. The probability of a loss of Emergency Feedwater (EFW) and SSF ASW due to wind effects was conservatively estimated to be 8.1E-5/reactor year. Subsequent Duke correspondence (letters dated September 15, 1986, July 17, 1987, and December 19, 1988) focused on the probability of a loss of SSHR due to tornado missile damage. In a safety evaluation dated July 28, 1989, the staff concluded that the probability of failure of the EFW and Station ASW systems combined with the protection against tornado missiles afforded by the SSF ASW system, satisfies the Standard Review Plan (SRP) probabilistic criterion, and was therefore, acceptable.

Note that the use of the term "vulnerability" in this discussion should be defined as an equipment vulnerability to tornado damage and should not be considered a "severe accident vulnerability" as commonly referred to in the IPE submittals and Generic Letter 88-20. At no time has the analysis indicated that Oconee tornado risk poses a severe accident vulnerability. Furthermore, most of the new risk insights from the updated PRA analysis stem from a more comprehensive and detailed understanding of the functional and spatial dependencies rather than the identification of new vulnerabilities to equipment damage.

In summary, the original tornado design basis relied upon protection and separation. Subsequent post-TMI risk assessments quantified the protection afforded by this design approach and concluded that the Oconee design basis provided sufficient protection against tornado damage.

The more detailed risk analyses presented in Duke's June 7, 2002, license amendment request do not alter this conclusion. Although some different vulnerabilities associated with tornadoes were identified through the most recent risk assessment, the conclusions of the risk analyses continue to support the adequacy of the design. In addition, Duke's plans to protect the SSF improve upon the current design basis by eliminating tornado vulnerabilities that could impact the SSF function. This approach satisfies both the original licensing requirements and the post-TMI requirements.

Ouestion 2:

The risk-benefit of hardening the west penetration and cask decontamination room walls appears to be secondary compared to the risk-significance of the tornado vulnerabilities that have been identified. Discuss the risk benefit that could be achieved (both per unit and for the station as a whole) by eliminating each of the tornado vulnerabilities that have been identified. Also discuss

ORAFT RESPONS Responses to Request for Additional Information Enclosure March 19, 2003 Page 3 measures that could be taken and the risk benefit that could be achieved by improving the reliability of the SSF. Given this risk perspective, explain why these additional actions are not warranted.

Response

The primary objective of the modifications to fully protect the SSF systems and equipment is to provide Oconee with a deterministic tornado mitigation strategy that is not susceptible to tornado damage. Duke's proposed changes to the tornado licensing basis were developed using defense in-depth and risk informed evaluations. Duke agrees that the risk benefit of these modifications is relatively low and not cost justifiable on core damage frequency reduction alone. However, this option is the best improvement to the plant based on defense-in-depth considerations.

Duke has previously evaluated potential changes to the plant to reduce risk through the Individual Plant Examination (IPE) and IPE for External Events (IPEEE) studies. As noted in these submittals, several changes have been implemented to reduce overall plant risk. The IPE and IPEEE studies concluded that significant modifications to the facility to reduce tornado risk were not cost-justified. It would be a very extensive effort to quantify the risk benefit associated with each of the tornado vulnerabilities that have been identified. However, sensitivity studies of some of the vulnerabilities were performed as part of the current tornado design basis initiative.

Based on the spatial dependencies associated with tornadoes, these sensitivity studies concluded that a significant redesign of the power plant would be necessary to dramatically reduce tornado risk.

Duke agrees that improvements in SSF reliability will have a positive impact in terms of reducing plant risk. As with other key safety systems, the site focuses on minimizing unavailability times and maximizing reliability. These efforts will continue to be a focus area for the site. However, the overall core damage frequency (CDF) at Oconee is not considered to be an outlier with respect to the CDF at other plants. Based on the Oconee design features, the CDF for internal events is lower than the industry median.

External events are the dominant contributors to plant risk at Oconee. As has been its practice since the development of the IPE, Duke continues to focus on potential plant changes that can reduce plant risk. An example is the replacement of the reactor coolant pump seal packages on Oconee ONS-1. This modification significantly reduces the risk associated with reactor coolant pump seal loss of coolant accidents (LOCAs). Another example involved the resolution of a Keowee auxiliary power dependency on ONS-1 4160-volt busses. Duke also is performing a self-initiated technical audit (SITA) during the spring of 2003 to evaluate seismic risk.

)RAFT RESPONSE Responses to Request for Additional Information Enclosure March 19, 2003 Page 4 Although tornado risk is a significant contributor to core damage frequency (CDF) at Oconee, the overall CDF risk for the plant is commensurate with the risk of other nuclear facilities and is below the NRC safety goal of 1E-4. As a result, Duke does not believe that the risk from tornadoes warrants significant changes to the plant design.

Ouestion 3:

The submittal proposes to establish the SSF as the "assured" means for mitigating tornado events and indicates that hardening of the west penetration and decontamination room walls will yield a risk benefit that is on the order of 1E(-6) per year for each of the three Oconee units.

a. Explain how the proposed mitigation strategy is different from the current strategy (which already credits the SSF ASW capability), and how the plant design basis, roles, requirements, and procedures relative to use and upkeep of the EFW, Station ASW, and the SSF ASW systems will change.

Response

From a broad perspective, the license amendment request (LAR) does not alter the previously established tornado mitigation strategy; however, the one proposed change to this strategy is to eliminate reliance on the Spent Fuel Pool (SFP) to High Pressure Injection (HPI) flow path.

Protecting the SSF from tornado damage ensures that the SSF is available following a tornado and also eliminates the potential failure of the EFW and Station ASW piping that passes through this room. The proposed change is relatively minor with respect to Oconee's tornado mitigation strategy since Duke does not plan any changes in emergency or abnormal procedures with respect to operation of EFW, SSF ASW, or Station ASW. The decay heat removal hierarchy in the EOP is:

1) Remain on MEFW,

2) EFW,

3) Condensate booster pumps (CBPs),

4) EFW from an alternate unit,

5) HPI feed-and-bleed cooling,

6) SSF ASW, and

7) Station ASW.

For the tornadoes that cause of a loss of offsite power, MFW and the CBPs are not available.

The preferred source of SSHR is EFW. Following a tornado, operators will attempt to establish SSHR with EFW. If this is not successful, SSF ASW would be aligned. If SSF ASW fails,

ORAFT RESPONSEI Responses to Request for Additional Information Enclosure March 19, 2003 Page 5 Station ASW would be relied upon as the last option for SSHR. The key licensing and design basis change associated with this license amendment request is to require the SSF functions to be protected from the design basis tornado loads (wind, differential pressure, and missiles). The design requirements and roles of EFW and Station ASW will not be altered.

b. From a risk perspective, compare the failure probability of the SSF to that of Station ASW, EFW for the affected unit, and EFW from another unit (both individually and collectively).

What mitigation strategy (or strategies) provides the most risk benefit? Describe and quantify the risk-significant impacts that contribute to the failure probability of each strategy.

Response

A direct comparison of the failure probabilities for these systems is both complex and difficult because of various functional and spatial dependencies, varying levels of wind fragilities for various structures and equipment, and different timing considerations for different accident sequences. The underlying new insight from the updated risk analysis is that support system dependencies are very important (for a single unit and between multiple units). Since instrumentation and control power is required for EFW and Station ASW operation, both systems are dependent on 4160-volt auxiliary power for long-term success. The response to Question 7 presents a comparison of the SSF failure probability to that of the emergency power system.

With additional failure modes besides AC power, it is obvious that the EFW and Station ASW systems are significantly more likely to fail in a tornado event than the SSF.

Providing EFW from another unit is not credited in the risk analysis. This approach is considered to be conservative. The risk benefit of this function is considered to be minimal for tornado sequences because it is subject to the same multi-unit dependencies and other limitations.

c. The SSF was designed specifically for fire, flooding and sabotage events. The existing Surveillance Requirements and AOTs for the SSF-related SSCs that are relied upon for tornado mitigation do not appear to be commensurate with Surveillance Requirements and AOTs that have been established in the STS for equipment that is relied upon for preventing and mitigating other event scenarios, and changes to the SSF TS requirements have not been proposed in this regard. Given the tornado vulnerabilities that have been identified and the increased importance this places on the SSF, explain why changes to the SSF TS requirements are not deemed necessary.

ORAFT RESPONS Responses to Request for Additional Information Enclosure March 19, 2003 Page 6

Response

Although the original licensing purpose of the SSF was not based on tornado events, the role of the SSF in tornado mitigation has long been recognized by Duke and the NRC staff and was considered in its original design requirements. The changes proposed in the LAR do not significantly change the role of the SSF for tornado mitigation and therefore, changes to either the current Technical Specifications (TS) or Selected Licensee Commitments (SLCs) are not warranted. The incremental CDF associated with SSF unavailability is actually dominated by non-tornado events (fire, floods, and loss of off-site power) and is not significantly affected by the proposed changes.

The current 7-day Completion Time originated during TS negotiations between Duke and the NRC in the mid-1980s through the early 1990s. The NRC acknowledges a 7-day restoration period for major SSF subsystems in a May 11, 1992, SER that notes, "The LCO in TS 3.18.2 through 3.18.6 include an allowable inoperability period of 7 days for the SSF subsystems. This provision is compatible with the STSfor emergency feedwater and other safety related systems."

Following approval of the proposed changes in the LAR, applicable SSF UFSAR and TS/SLC Bases descriptions will be revised to include tornado mitigation information. The following list depicts the current TSs and SLCs associated with SSF equipment:

1. TS 3.10.1 provides controls and testing requirements for the SSF, specifically:

SSF ASW system

Portable Pumping system

Reactor Coolant Makeup system

Power (& Instrumentation) system.

2. TS 3.10.2 provides controls and testing requirements for the SSF Battery Cell Parameters

3. TS 5.5.14 describes the requirement for the SSF fuel oil testing program

4. SLC 16.7.12 provides controls for the SSF diesel generator air start pressure instrumentation;

5. SLC 16.7.13 provides controls for SSF instrumentation; and

6. SLC 16.9.14 provides criteria for inspection of the SSF diesel generator.

In addition, the ONS In-Service Testing and Generic Letter 89-10 programs provide controls for SSF components to ensure that system reliability and performance is fully monitored. SSF components found to not be in compliance with any of these controls would be addressed via Duke's corrective action program. Following approval of the proposed changes in the LAR,

ORAFT RESPONSEI Responses to Request for Additional Information Enclosure March 19, 2003 Page 7 applicable SSF UFSAR, TS and SLC Bases descriptions will be revised to include tornado mitigation information.

d. Provide a graph that shows the probability of tornado occurrence at the Oconee Station vs.

Time of Year, and explain how operability of the SSF will be assured and maintained during periods when the probability of tornado occurrence is relatively high.

Response

Figure 1 provides a graph of the seasonal distribution of tornado occurrences for the region surrounding the Oconee site. This graph clearly shows that the months of March, April, and May have a significantly higher occurrence rate and a higher number of high-intensity (F-3 and F-4) tornadoes. The equivalent tornado strike frequency during these months is roughly twice the average annual strike frequency.

There are two major maintenance activities that occur on a periodic basis that result in significant SSF outages. The first is the SSF annual outage for preventive maintenance which usually requires 3 - 7 days. There is also a special 10-year outage and inspection that is conducted in conjunction with the normal annual outage and requires an approximately 15 - 18 days of unavailability. The second major maintenance activity is related to the unwatering of the ONS-2 Condenser Circulating Water (CCW) System during certain ONS-2 Refueling Outages.

Typically, this activity occurs with every other ONS-2 refueling outage (2 cycles - 3 years) and can last 6 - 30 days depending on the extent of CCW inspections and repairs necessary. During this time, the SSF is unavailable because its suction piping connects to the CCW inventory through the ONS-2 CCW piping.

In 2002, the annual train rotation schedule (for all plant systems) was revised to place the SSF annual outage in June to specifically address this aspect of tornado risk for future SSF annual outages. A review of the scheduling practices for ONS-2 CCW outages is planned to evaluate further improvements to reduce seasonal tornado risk and overall impact on SSF unavailability.

All other planned maintenance activities for the SSF (such as monthly or quarterly PMs) are typically performed within the timeframe of a normal work shift (12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ). Short term SSF unavailability is less risk sensitive with regard to "tornado season" because of the opportunity to postpone work at the "last minute" or return the system to service when severe weather conditions are forecast. The Oconee Natural Disaster Procedure (AP/0/A/1700/006) contains specific actions for Tornado "Watches" and "Warnings" to restore critical systems and equipment to service including the SSF.

)RAFT RESPONSE Responses to Request for Additional Information March 19, 2003 Figure 1 - Distribution of Tornados by Month and Intensity Tornados within 125 NM of Oconee (1950 - 1993)

N F4 (207-260 mph) 55 FF3 (158-206 mph)

NF2 (113-157 mph)

NF1 (73-112 mph) 54 49 20 18 8

6 0

0 1

Aug Sept Oct 60 -

Enclosure Page 8 50-40 +

38 0

0 I

I-30 E z 20 10 0-28 11 19 Jan Aeb Feb 34 i1 Mar 1i4 4i 3

0 0 Apr May 8

11 June 0

July Month C_.-OI Dec Nov I

DRAFT RESPONSF Responses to Request for Additional Information Enclosure March 19, 2003 Page 9

e. Confirm that all SSF SSCs that are relied upon for tornado mitigation are classified as QA-1, and that the UFSAR will be revised to clearly reflect this.

Response

The following SSF SSCs are relied upon for tornado mitigation and are classified as QA-1 systems:

"* SSF ASW System

"* SSF Reactor Coolant Makeup (RCMU) System

"* SSF Heating, Ventilation and Air Conditioning (HVAC) Service Water System

"* SSF Diesel & Diesel Support Systems (excludes a portion of SSF Diesel Air Start System located upstream of air receiver tanks).

"* Reactor Coolant System (RCS) isolation valves controlled from SSF

"* SSF Electrical Power

"* SSF Instrumentation to monitor required RCS and Steam Generator (SG) parameters

"* SSF Pressurizer heaters - The feeder breakers from the SSF motor control center (MCC) are QA-1, however, the rest of the circuit including the heaters themselves are QA-5.

If forced CCW flow and siphon flow are interrupted due to a tornado and the SSF is required to operate, the SSF Portable Pumping System would be used to re-supply the underground piping that feeds the SSF Service Water Systems. The SSF submersible pump as well as the SSF portable pumping system is not safety grade and is installed manually according to emergency procedures. The SSF portable pump system is stored in the SSF Response Room where it is protected against the effect of tornado generated missiles and wind. Technical Specifications associated with the use of the SSF submersible pump and to its non-QA status were previously evaluated and found acceptable by the Staff as noted in a May 11, 1992 Safety Evaluation Report (SER).

Ouestion 4:

The various vulnerabilities that have been identified (especially those associated with emergency power) place much more importance on the SSF than previously realized. Unfortunately, the SSF has not proved to be very reliable and this detracts significantly from the existing tornado mitigation strategy that has been approved for Oconee. It would seem that regardless of the improvements that are planned to assure the SSF function, the risk benefit (with respect to the

ORAFT RESPONSE Responses to Request for Additional Information Enclosure March 19, 2003 Page 10 SSF) will be limited by the relatively low reliability of the SSF. From a risk perspective, explain why it makes sense to harden the west penetration and cask decontamination room walls specifically to assure the SSF capability. What fraction of the total risk benefit applies specifically to the SSF function as opposed to EFW and Station ASW?

Response

As discussed in the response to Question #2, the risk benefit of the SSF modifications are secondary to the defense-in-depth improvement that is realized. The small risk benefit of the additional SSF tornado protection is entirely associated with the improved availability of the SSF functions following a tornado strike. Currently, both the EFW and Station ASW systems are equally or more susceptible to tornado damage in other areas of the plant and thus do not benefit measurably from the additional protection of the West Penetration Room.

Question 5:

Provide the following information relative to the revised tornado risk analysis for the Oconee station:

a. What probability is assigned for inability to access/open the ADVs for depressurizing a steam generator? Explain.

Response

The action to align the Station ASW within 40 minutes requires a relatively complex set of local manual actions in the Auxiliary and Turbine Buildings using several operators. The human reliability assessment determined that the critical part of this action is the opening of the Atmospheric Dump Valves (ADVs). The action would take up to about 10 minutes to perform following an initial response time of 15 minutes (the point at which the decision is made to initiate flow from Station ASW). However, these values are based on validation testing and do not reflect potential post-tornado conditions. Accounting for reduced accessibility and other stresses in a potentially adverse environment, the average execution time has been increased to 25 minutes. This assumption results in an estimated failure probability of 0.55.

b. What probability is assigned for a pressurizer safety valve to stick open? Explain, including any distinction that is made for when the pressurizer safety valve is expected to pass water.

ORAFT RESPONS Responses to Request for Additional Information Enclosure March 19, 2003 Page 11

Response

The probability of failure of the Pressurizer Safety Valves (PSVs) to reseat is assumed to be 0.1 based on liquid relief. The Pressurizer Power Operated Relief Valve (PORV) is credited in the analysis for providing RCS pressure control for a period of approximately 30 minutes following a loss of SSHR. After 30 minutes without SSHR, the primary system becomes saturated and the PSVs are also required to open to control RCS pressure. Therefore, successful operation of the PORV provides up to 30 minutes to align SSF ASW to prevent challenging the PSV with liquid relief.

If the Pressurizer PORV is unavailable, the PSVs will cycle in steam relief until SSHR is reestablished or until the pressurizer becomes water solid. This is expected to occur after approximately 16 minutes without SSHR.

c. Explain how current operating experience with respect to failure of the pigtail connection for providing emergency power to the HPI pumps is reflected in the risk analysis for tornado mitigation.

Response

A defective cabling connector represents an example of random equipment failure that would typically be counted against the pump. Random failures of the HPI pumps to start and run are modeled in the tornado analysis.

d. The submittal indicates that elimination of the SFP-HPI flow path results in a slight increase in risk. Describe the specific mitigation sequences that rely on the SFP-HPI flow path and the risk contribution for each.

Response

There are two types of sequences for which the SFP-HPI flow path are useful for tornado accident mitigation. The first type is a tornado event that causes a loss of the Borated Water Storage Tank (BWST) and the Station ASW system must be used for decay heat removal because of a loss of both the SSF and EFW. In this case, HPI makeup is necessary to allow the primary system to be cooled down to maintain acceptable steam generator tube stresses. The second type also involves a loss of the BWST, but a Reactor Coolant Pump (RCP) seal LOCA results from a loss of seal cooling. Without the BWST, HPI injection must be restored from the SFP to prevent core uncovery. The risk benefit of the SFP-HPI flow path is provided in the table below for each sequence.

ORAFT RESPONSI Responses to Request for Additional Information Enclosure March 19, 2003 Page 12 Oconee SFP-HPI Flow Path Risk Benefit (per Rx-yr)

Units 1 & 2 ONS-3 I - Station ASW Sequence 1E-07 4E-07 2 - RCP Seal LOCA Sequence 2E-07 2E-07 Ouestion 6:

Describe the requirements that pertain to the pressurizer PORV and block valve, including I&C and power supplies (TS, QA, seismic, tornado protection, etc.). What probability is assigned to the pressurizer PORV for failure to open, and what is the basis for this determination? What probability is assigned to the pressurizer PORV to fail in the open position with subsequent failure of the Block valve to close, and what is the basis for this determination?

Response

The PORV and PORV block valve are seismically designed. The PORV block valve is environmentally qualified, while the PORV is not. Both the PORV and the PORV block valve receive safety-related power. However, the actuators on these valves are not fully QA-1. There are no Technical Specification requirements for the PORV during normal operation. The Bases to TS 3.10.1 require the SSF RCS isolation valves (RC-4 is one) to be operable such that the corresponding SSF RC makeup system is considered operable. The PORV and PORC block valve do have Technical Specification requirements during the LTOP mode of operation.

Located inside the Reactor Building, the PORV and PORV Block Valve are protected from tornado damage. However, power cabling and instrumentation for the PORV are located in the East Penetration Room and are vulnerable to tornado damage. The control system for the PORV Block Valve is designed so that the valve can be controlled and powered from the SSF. The power and control cabling for the PORV Block Valve are routed through the West Penetration Room where they are also vulnerable to tornado damage. Based on the current plant design, the equipment in the East and West Penetration Rooms are assumed to fail when the rooms are impacted by F-4 or higher intensity tornado winds.

A list of the independent failure modes modeled for the PORV and PORV Block Valve are provided in the table below.

)RAFT RESPONSI Responses to Request for Additional Information Enclosure March 19, 2003 Page 13 Table - Modeled Failure Modes for the PORV and PORV Block Valve Failure Mode Description Probability Pilot-Operated Relief Valve 3RC-66 Fails To Open On Demand 5.88E-03 PORV (3RC-66) Fails To Close On Demand (steam relief) 3.45E-01 PORV Block Valve Is Closed During Power Operation 1.OOE-01 PORV Is Left Unavailable After Test Or Maintenance 3.00E-03 Operators Fail To Close The PORV Block Valve 1.50E-03 PORV Block Valve 3RC-4 Fails To Close On Demand 1.73E-03 PORV Block Valve Is Left Unavailable After Test Or Maintenance 3.OOE-03 The failure probability of the PORV to close on demand is based on 30 cycles of steam relief during the first 16 minutes following a loss of all secondary-side heat removal. Beyond 16 minutes, the pressurizer is expected to become water solid and the PORV transition into liquid relief. The risk analysis conservatively assumes that PORV will stick open during liquid relief and require the Block Valve to close if feedwater is subsequently restored.

The tornado fault tree also contains logic that recognizes a loss of the PORV function if DC power is lost to its power panelboard, and that the PORV Block Valve will be without motive power if the SSF does not have 600-volt power (e.g., SSF Diesel Generator {D/G} Start Failure).

Ouestion 7:

For those tornado events that involve a loss of emergency power and a failure of the SSF to function:

a. For a given tornado, what is the probability that emergency power will be lost? What is the probability that emergency power will be lost with a subsequent failure of the SSF? How is the SSF failure probability affected by hardening the west penetration and cask decontamination rooms?

Response

There are two important tornado failure modes for the emergency power system; damage to the Main Feeder Busses in the Turbine Building and damage to vital support systems at the Keowee Hydro Station. Table 1 below provides a listing of the conditional failure probability associated with these systems.

ORAFT RESPONSI Responses to Request for Additional Information Enclosure March 19, 2003 Page 14 Currently, failure of the SSF due to tornado damage is only assumed for severe tornados causing F-4 or greater damage impacting the West Penetration Rooms or Cask Decontamination Rooms housing vital SSF piping and cabling. Independent failure of the SSF ASW has an estimated probability of 0.077, and failure of the SSF RCMU system is estimated at 0.072. Independent failure of the SSF D/G or other SSF systems supporting both SSF ASW and the RCMU pumps has an estimated probability of approximately 0.23. Thus, the additional tornado protection proposed in the submittal provides only a small improvement in overall SSF availability following a tornado strike and is only applicable for F-4 and higher intensity tornado. This improvement is estimated to provide a core damage frequency reduction of 1.4E-06.

Table 1 - Oconee AC Power Tornado Damage Probabilities Conditional Damage Probabilities

F-Scale Strike 4160-volt (For U3)

Keowee West Pen Frequency Power System Ul MFB Damage Damage (given Room Damage (Given U3 Strike)

ONS tornado Damage (F-2 or strike)

(SSF Failure) greater)

F-2 5.37E-05 0.289

.063 0.062 F-3 4.12E-05 0.452

.206 0.155 F-4 3.59E-05 0.474

.251 0.224

.053 F-5 1.71E-06 0.507

.333 0.312

.119

Note: The events representing these damage probabilities are not "independent" due to spatial and functional dependencies that exist between the systems.

b. Describe measures that can be taken in accordance with emergency procedures to restore emergency power, secondary heat removal, and primary makeup (including specific operator actions that are required for each unit, time line, and consequences). Confirm that staffing for each unit is adequate to accomplish the necessary actions in accordance with accident analysis and PRA assumptions.

Response

This response provides an overview of the operator actions taken in response to a tornado.

Oconee's procedures are structured to evaluate different shutdown strategies in a prioritized manner. A minimum control room crew of two Reactor Operators (RO) and one Senior Reactor Operator (SRO) and seven NEOs will be required to mitigate an event that requires use of the

ORAFT RESPONSF Responses to Request for Additional Information Enclosure March 19, 2003 Page 15 Station ASW Pump on one unit and a Loss of Offsite Power (LOOP) on the other two units. An additional licensed operator from the Work Control Center was used to staff the SSF.

When a Tornado Watch is issued, the Natural Disaster Abnormal Procedure is implemented. If the Watch progresses to a Warning, a Nuclear Equipment Operator (NEO-A) is dispatched to the 1st Floor Aux Bldg to prepare for using the Station ASW pump. A Nuclear Equipment Operator (NEO-B) and a licensed operator are dispatched to the SSF to standby for further direction.

NEO-A at the Station ASW Pump opens suction and recirculation valves, vents the pump, and racks in the pump breaker. Other NEOs are staged in the control rooms and shift maintenance personnel are staged in the OSC (ONS-3 Control Room) and told to prepare for possible need to power an HPI pump from the Station ASW switchgear.

If a tornado hits the station resulting in a loss of all feedwater (Main and Emergency), two NEOs (NEO-C & NEO-D) will be dispatched to the turbine building basement to attempt to cross connect emergency feedwater with another unit. Another NEO (NEO-E) will be dispatched to the Turbine building basement to attempt a manual start of the TDEFW pump. Note that cross connecting EFW is not credited in the PRA model. However, if available and another unit is unaffected by the tornado damage, procedures would use EFW from another unit.

If EFW can be successfully aligned, EFW suction is transferred from the Upper Surge Tank (UST) to the hotwell as UST inventory is depleted. Operator actions to align EFW to the hotwell involve breaking vacuum by opening valve *V-186 on the east side of the condenser on the third floor of the Turbine Building along with aligning valves in the basement of the Turbine Building. Eventually, EFW inventory from the UST and hotwell will be depleted and long-term secondary side heat removal is established through alignment of Station ASW. This method of long-term cooling is necessary due to the unavailability of LPI caused by the loss of 4kV power.

Assuming the tornado results in a loss of power, the licensed operator at the SSF will be directed to implement the SSF Emergency Operating Procedure (EOP) to provide feedwater via the SSF ASW system and RCMU via the SSF RCMU system. The SSF ASW and RCMU systems will maintain the plant in Mode 3 for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

While SSHR restoration is in progress, the blackout section of the EOP directs a licensed operator to perform parallel actions to attempt to restore power to the 4160-volt busses. The operator will try to manually re-power the 4160-volt busses by one of the following in order of priority:

1) CT-I from the switchyard or Keowee Hydro unit overhead path (CT-2 or CT-3 depending on the unit) to the Main Feeder Busses

ORAFT RESPONSEI Responses to Request for Additional Information Enclosure March 19, 2003 Page 16

2) CT-4 from the underground Keowee Hydro unit to the Standby Busses to the Main Feeder Busses

3) CT-5 from Central Switchyard to the Standby Busses to the Main Feeder Busses

4) CT-5 from a dedicated line from Lee Combustion Turbine to the Standby Busses to the Main Feeder Busses Even if the operator is not successful in powering the 4160-volt busses, he will ensure power to Standby Bus #1 to allow use of the Station ASW Pump from the Aux Service Water Switchgear.

If auxiliary power is not available at Keowee, the Keowee operators have a procedure that will manually align Keowee such that it is fed auxiliary power through its transformer. This procedural recovery was implemented as a result of the tornado PRA model insights.

In order for the event to progress to the point of needing to use the Station ASW pump, attempts to use another unit's EFW, to manually start the TDEFW pump, and to activate the SSF must have been unsuccessful. For this event, it is assumed that if plant damage is significant enough to damage 4160-volt busses (TC, TD, and TE) that NEO-C, D, and E return to the control room due to inaccessibility of the EFDW cross-connects and TDEFDW pump. If the SGs are not being fed, the blackout section of the EOP will dispatch NEO-C and NEO-D to the ADVs on the 5th floor of the turbine building.

If it is determined that the only source of feedwater available to the unit is Station ASW and Standby Bus #1 is energized, NEO-A, pre-staged at the Station ASW pump, is directed to start the Station ASW pump, close a vent valve on the discharge line, and open the pump discharge valve. NEOs C&D at the ADVs will be directed to fully open the valves. NEO-E will be dispatched to the Penetration Rooms (Auxiliary building 4th Floor) to fully open the last valves needed to feed the SGs.

Once Feedwater is established, shift Maintenance personnel are dispatched to align power to the chosen HPI Pump ("A" or "B") to the ASW switchgear. This means of primary system makeup would be used if the SSF reactor coolant makeup system is not available. The Maintenance personnel isolate 4kV power to the HPI pumps by opening breakers to the 4 kV switchgear or in the blockhouse, both of which are located at ground elevation in the Turbine Building. Power to the HPI pumps is aligned to the ASW switchgear by using pre-staged cables located in the HPI pump rooms. In addition, NEO-B (previously at the SSF) will be dispatched to prepare for using an HPI pump off the ASW switchgear. NEO-B will isolate Reactor Coolant Pump (RCP) seal flow by closing *HP-139 (3rd floor Auxiliary building), verify HPI pump motor cooling water flow (HPI pump room), open *HP-24 (suction from the BWST located in the Auxiliary building, HPI hatch area), and then proceed to East Penetration Room (Auxiliary building 4th floor) to throttle HPI discharge flow.

)RAFT RESPONSI Responses to Request for Additional Information Enclosure March 19, 2003 Page 17 If the BWST is not available, the Technical Support Center (TSC) will determine the suction source for the BPI pump. If the HPI pump suction from the SFP is selected, this will require valve alignment in the SFP (6th floor Auxiliary building), the East Penetration Room (4th floor Auxiliary building), and SFP cooler room (2nd floor Auxiliary building). In addition, the Spent Fuel Priming Pump must be started (located behind the Station ASW switchgear).

If a blackout exists on all three units, a NEO (NEO-E) will be sent to Load Shed the Essential Inverters (Equipment Room - 3rd Floor Auxiliary building/Turbine building) and emergency start the Diesel Air Compressor (located outside the south end of Turbine building) to provide instrument Air.

If all 4160-volt switchgears are de-energized for 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , a NEO (NEO-F) will be dispatched to purge hydrogen from the electrical generator by opening two valves in the Turbine building first floor.

Selected Licensee Commitment (SLC) 16.13.1 provides minimum station staffing requirements.

The staffing required by this SLC was based in part on integrated validations of the EOP. The previously described operator actions for tornadoes were included in this validation process ensuring that adequate staffing is available to implement the tornado mitigation strategy. The validation process assumed significant tornado damage on one unit and a LOOP on the other two units.

The Oconee PRA addresses the accessibility for different operator actions by reducing the reliability of the associated function if the operator action requires access to an unprotected area.

Operator actions below grade elevation are inherently protected from tornado damage and access to equipment is not adversely impacted by potential tornado damage.

Designates ONS-1, 2, or 3 as applicable

c. Describe specific scenarios that cannot be mitigated, including the probability of occurrence.

Response

For successful mitigation, the Turbine-Driven EFW (TDEFW) pump and Station ASW are dependent on 4160-volt power to supply the 600V battery chargers that are necessary for long term instrumentation and control power. Therefore, a loss of emergency power and a failure of the SSF to function will result in a core damage event.

ORAFT RESPONSF Responses to Request for Additional Information Enclosure March 19, 2003 Page 18 Currently, the only tornado damage scenario that can not be mitigated is a direct tornado strike of F-4 or higher winds impacting the West Penetration Room or Cask Decontamination Room of a particular unit. This event would cause the loss of all SSF functions to that unit and loss of all other mitigation strategies (EFW/IPI/Station ASW) because of the damage in the same room or damage to other areas of the Auxiliary or Turbine Buildings, or Keowee. The estimated frequency of this event is 2E-06. The proposed modifications to fully protect the SSF equipment would eliminate the possibility of damage to the SSF due to this extreme tornado damage event.

Ouestion 8:

Provide a complete listing of actions outside of the control room that may be required for each of the Oconee units during a tornado event (for both mitigation and plant shutdown) commensurate with accident analysis and PRA assumptions, and confirm that all relevant areas will be accessible and that operators will be able to complete the prescribed actions following a tornado.

Also, confirm that staffing is adequate for accomplishing the required actions on all units.

Response

See response to Question 7(b).

Ouestion 9:

The submittal indicates that sufficient staffing is available for switching over to Station ASW from EFW on all three units, but sufficient staffing is not available to initially align Station ASW for feeding the steam generators on all three units within the required time period.

a. Explain the basis for this determination, along with critical assumptions and time constraints.

Response

If Station ASW is needed, Operations personnel are dispatched to required areas of the station to perform the alignment function in order to restore secondary side decay heat removal to the affected unit within 40 minutes. The validation discussed below confirmed that this evolution could be conducted successfully following tornado damage to a single unit with a LOOP for the entire site. This validation was reviewed and documented in NRC Inspection Report 01-09, dated November 19, 2001. Although operator staffing levels are insufficient to align Station ASW following a three unit tornado event within the initial 40 minute period, there are sufficient operators to mitigate this scenario from the SSF.

ORAFT RESPONS Responses to Request for Additional Information Enclosure March 19, 2003 Page 19 Operations performed three timing validations in 2001 to ensure that Station ASW could be aligned to the affected unit within 40 minutes. An integrated validation approach was used which utilized the simulator for control room actions and NEOs dispatched via radio in the actual plant. The NEOs simulated and walked through actions when dispatched from the simulator control room as would be during an actual event. During the validation, a minimum crew of 1 Senior Reactor Operators (SROs), 2 Reactor Operators (ROs), and 6 NEOs were utilized. One licensed operator from the Work Control Center (WCC) was used to man the SSF.

The PRA credits Station ASW for tornado mitigation on multiple units only in cases when a "run failure" of SSHR occurs. From a timing perspective, the earliest (worse case) run failure that credits Station ASW is the case of a TDEFWP recirculation pipe break. Without operator action to swap EFW suction to the hotwell, this break could deplete the UST in as little as 110 minutes.

From this point, operators would still have more than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to align Station ASW to prevent core damage if the SSF is not available. Since the actions occur in the timeframe of 2 - 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months or longer after a tornado strike, staffing burdens following the tornado strike will be alleviated such that adequate personnel will be available to transition multiple units to Station ASW in a staggered manner as necessary. In other scenarios, the run failure will occur at later times, or operator actions (e.g., swapping to the hotwell) may provide even longer periods of time to respond (as much as 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months ).

b. What is the risk-significance of not being able to align Station ASW to all three units concurrently following a tornado event?

Response

For Oconee Units 1 & 2, the inability to align Station ASW concurrently on multiple units has no measurable impact on tornado CDF. This is because the same tornado damage that forces the staff to use the ASW system also causes all Instrumentation and Control (I&C) power to be lost for long-term system operation. For ONS-3, the inability to align Station ASW on multiple units has a very small impact (-IE-07 /Rx-yr). This small impact is related to sequences where EFW start failures occur on multiple units, but ONS-1 has 4160-volt power and is able to provide backup I&C power.

c. For the situation where EFW from one unit is being relied upon to provide feedwater for another unit, confirm that sufficient staffing and time are available for switching from EFW to Station ASW on all three units. Provide the basis for this determination, along with critical assumptions and time constraints.

ORAFT RESPONSI4 Responses to Request for Additional Information Enclosure March 19, 2003 Page 20

Response

The PRA does not credit cross-connecting feedwater from either unaffected unit to the damaged unit. The transition from EFW to Station ASW credited in the PRA is addressed in Question 9a.

Ouestion 10:

The submittal proposes to eliminate the qualification that protected or physically separated lines are used to supply cooling water to each steam generator from the FSAR description. Explain.

Response

It was not Duke's intention to imply that protection or physical separation be removed as a qualification in the UFSAR. The SSF SSHR and primary system makeup functions will be protected from tornado damage by modifying the walls to the West Penetration Rooms and Cask Decontamination Rooms. The SSF ASW piping passes through these two rooms with a crossover line in the Reactor Building such that both steam generators are fed from the single line that passes through these rooms. Thus, these modifications ensure that cooling water can be supplied to each steam generator through paths that are protected from tornado damage. With SSF ASW being protected, physical separation is not required to ensure adequate SSHR.

Duke proposes to modify Section 3.2.2 of the UFSAR to more clearly state the design requirements. The second paragraph will be revised as follows:

"The tornado design requirements are met through either protection or physical separation. The Reactor Coolant System, by virtue of its location within the Reactor Building, is protected from tornado damage. A sufficient supply of secondary cooling water for safe shutdown is assured by the SSF auxiliary service water (ASW) pump located in the SSF building structure and taking suction from the CCW intake piping. Primary system makeup is assured by the SSF Reactor Coolant Makeup (RCMU) pump. The SSF is protected from the wind, differential pressure, and missile loads from the 300 mph design basis tornado. Specific SSF capabilities and design criteria are described in Section 9.6."

Ouestion 11:

The submittal proposes to eliminate the qualification that the stored volume of water in the intake and discharge CCW lines below elevation 791 ft. will provide sufficient cooling water for all three units for approximately 37 days after a trip of the three reactors from the FSAR. Explain.

)RAFT RESPONSI Responses to Request for Additional Information Enclosure March 19, 2003 Page 21

Response

The Station ASW design basis of maintaining decay heat removal for 37 days is maintained in Section 9.2.3.1 of the UFSAR. Thus, the submittal does not propose to eliminate this information. With respect to Section 3.1.2 of the UFSAR, the SSF ASW system will be relied upon as the tornado-protected means of achieving safe shutdown following a tornado. The SSF is capable of maintaining the plant in a safe shutdown condition for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Since SSF ASW will be the assured source of SSHR, the information on Station ASW inventory was removed from this section of the UFSAR.

Ouestion 12:

The submittal proposes to eliminate the qualification that the SSF RCMU pump is capable of taking suction from the SFP from the FSAR. Explain.

Response

The proposed UFSAR changes are not intended to eliminate the qualification that the SSF Reactor Coolant Makeup Pump is capable of taking suction from the SFP. The proposed change to Section 3.2.2 of the UFSAR states that "specific SSF capabilities and design criteria are described in Section 9.6."

Section 9.6.3.2 of the UFSAR provides detailed information on the SSF Reactor Coolant Makeup System and states that its suction source is the SFP. The proposed changes were intended to provide the tornado requirements in Section 3.2.2 and the system specific information for the SSF in Section 9.6. This approach was intended both to clarify and minimize the duplication of information contained in the UFSAR.

Ouestion 13:

The submittal indicates that a given unit's turbine-driven EFW pump can provide SSHR for that unit. Describe what capability exists for this pump to supply feedwater to one or two of the other units, in addition to supplying feedwater to its own unit, and explain why this capability is not being credited (contrary to previous assumptions).

Response

The capability exists to supply multiple units from a given unit's TDEFW pump, however, a number of design limitations within the EFW system have prompted Duke to reduce its reliance

ORAFT RESPONSE Responses to Request for Additional Information Enclosure March 19, 2003 Page 22 on the ability to cross-connect EFW systems following tornado events. Much of the EFW piping is routed through the turbine building and vulnerable to damage from severe tornadoes. As such, the time to complete damage assessment would not meet the standards for event mitigation.

Consequently, alignment of EFW from alternate units following tornado events that induce damage within the turbine building is not credited in the tornado PRA.

Ouestion 14:

Explain and justify why exceptions to RG 1.76 are necessary.

Response

The LAR is not proposing changes to the original SSF tornado design basis given in UFSAR Section 9.6. The tornado protection criterion used originates from historical tornado data taken in the vicinity of the Oconee site and differs slightly from the standard data found in RG 1.76.

These specific differences have been individually listed in UFSAR Section 9.6.

The basis for the difference is given in UFSAR Section 3.1.2 (2), "Natural Phenomena." This section of the UFSAR describes that essential systems and components have been designed, fabricated, and erected to performance standards to enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena. The designs are based upon the most severe of the natural phenomena recorded for the vicinity of the site, with an appropriate margin to account for uncertainties in the historical data.

Ouestion 15:

Describe any vulnerabilities and failure modes associated with the CCW inventory that may be pertinent to the tornado mitigation strategy.

Response

For Station ASW, there are no specific failure modes modeled in the risk analysis for the CCW inventory. On the other hand, the SSF has additional cooling loads and requires some replenishment to support long-term SSF operation. The risk analysis credits 3 sources of CCW makeup to support SSF operation. The first is the normal CCW suction from the intake canal

("first siphon") which has a high probability of failure either from direct tornado damage (loss of siphon) or from a loss of Siphon Seal Water (supplied from LPSW) or Essential Vacuum Pumps.

ORAFT RESPONSJ Responses to Request for Additional Information Enclosure March 19, 2003 Page 23 The second source is from CCW reverse gravity flow from the lake discharge back through the Condensate Coolers. This source is entirely passive and is not considered vulnerable to tornado damage. The only modeled failure mode for CCW reverse gravity flow is very low lake level which reduces the flow rate below minimum requirements.

The third source is manual alignment of a portable submersible pump powered by the SSF to refill the CCW inlet line. The portable pump and related equipment are stored in the SSF where they are protected from tornado damage. Human error is the dominant failure mode for this means of CCW makeup.

Ouestion 16:

The SSF is not credited in the UFSAR for taking the plant to cold shutdown. Describe in detail how this will be accomplished on all of the Oconee units following a tornado event, including time required to complete actions, how staffing requirements will be satisfied, and how the Oconee units will be maintained in a safe condition over time.

Response

The SSF has been designed and has the capability to bring all three Oconee Units to Mode 3 and maintain the units in that condition for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The proposed change does not require all of the units to be placed in a cold shutdown condition. Safe shutdown is accomplished through the SSF maintaining the plant in Mode 3. Procedures (OP/0/A/1 102/024 "Plant Damage Assessment and Alignment Following Major Plant Damage," and OP/O/AI 102/025 "Plant Cooldown Following Major Plant Damage,") are available and would be used following a tornado for transitioning the plant to cold shutdown (Mode 5). These procedures were originally written to assess, repair and cooldown the plant within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months following an Appendix R fire, however, following a tornado event, the cooldown time involved could potentially be longer.

If operation of the SSF beyond 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is needed, the Technical Support Center (TSC) would pursue obtaining additional fuel for the SSF diesel generator. In addition, the SSF submersible pump is available and can be used to provide SSF ASW cooling water for SSHR beyond the initial 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

Ouestion 17:

The deterministic evaluation in the submittal states that the SSF RCMU pump flow path replaces the existing SFP-HPI pump flow path for RCP seal injection and primary side makeup. Both of these flow paths currently exist and are currently available to perform this function, and it is not

S)RAFT RESPONSI Responses to Request for Additional Information Enclosure March 19, 2003 Page 24 clear why this change is not characterized as the elimination (instead of a replacement) of the SFP-HPI flow path. Explain.

Response

The SSF RCMU pump flow path will become the assured means of RCS makeup following a tornado event. Following the approval of the proposed changes in the LAR, the SFP-HPI flow path will no longer be credited in the PRA and the licensing basis.

Ouestion 18:

The submittal states that as a consequence of the longer time required to establish RCP seal injection with an HPI pump, a RCP seal LOCA may have already occurred and the strategy would then require mitigation versus prevention.

a. Explain what prevention and mitigation capabilities exist if this should occur.

Response

The LAR statement was included to point out an important advantage of SSF RCMU over SFP HPI for post event primary makeup. Comparatively, the required operator actions outside of the control room to both set-up and align the flow path is much greater for the SFP-HPI flow path as compared to the SSF RCMU flow path. Because the station is not required to evaluate a LOCA with a tornado event, an RCP seal failure was not postulated; however, good engineering judgment dictates that the time saved in re-establishing seal cooling could be beneficial by potentially preventing damage to the seal.

All of the ONS-1, -2, and -3 RCPs now contain Sulzer seal packages which have significantly reduced the risk of a seal LOCA. As described in the LAR, the SFP-HPI flow path was not part of the original licensing basis but was voluntarily added in the early 1990s to address the potential need for primary makeup due to a (beyond design basis) seal LOCA. Following the completion of the seal upgrades, the original anticipated need for the SPF-HPI flow path diminished and, due to a number of technical concerns with the flow path itself, Duke has chosen not to continue crediting this flow path.

b. What is the failure probability of the various means that are available for establishing RCP seal injection? Explain the basis for this determination.

ORAFT RESPONSI Responses to Request for Additional Information Enclosure March 19, 2003 Page 25

Response

The availability of RCP seal injection is entirely dependent on two things: the availability of normal 4160-volt (very high likelihood of failure) and the availability of the SSF RCMU system.

The response to Question 7(a.) provides a comparison of the failure probabilities for emergency power and the SSF.

Ouestion 19:

Explain how differentiation of EFW and SSF ASW "start" and "run" failures give additional time to allow HPI to be re-powered from the Station ASW switchgear. Is this "additional time" sufficient to resolve the RCP seal LOCA problem referred to in the previous question?

Response

Successful feedwater initiation following a tornado strike provides core cooling while actions are taken to restore power to one HPI pump if the 4160-volt power system is damaged. In this case, the role of the "recovered" HPI system would be for primary system makeup to mitigate a seal LOCA rather than to prevent one. A "start failure" of all SSHR would result in core damage before HPI can be re-powered from the Station ASW switchgear.

The principle purpose of differentiating start and run failures in the risk model is to more accurately predict the likelihood of a liquid relief challenge to the PORV or Pressurizer Safety Valves. However, with an intact BWST, successful realignment of HPI power provides operators the option of feed and bleed cooling if a subsequent SSHR "run failure" occurs. The inclusion of this feature in the tornado risk model provides little or no risk benefit because successful feed and bleed cooling requires BWST makeup which is ultimately dependent on the 4160-volt power system. On the other hand, it is potentially important to consider this feature when evaluating the potential benefits of other plant improvements, thus this feature has been retained in the risk model.

Ouestion 20:

The submittal requests NRC approval to eliminate the SFP-HPI flow path from the current licensing basis in part because the flow path is not reliable, and because elimination of the flow path from the licensing basis does not result in a reduction in safety. However, currently both the SFP-HPI flow path and the SSF RCMU flow path are available for primary makeup. Eliminating the SFP-HPI flow path reduces the existing capability, thereby degrading defense-in-depth, and results in a slight increase in risk consequences. This in fact appears to be a reduction in safety.

)RAFT RESPONSI Responses to Request for Additional Information Enclosure March 19, 2003 Page 26

a. Explain the basis for concluding that elimination of the SFP-HPI flow path does not result in a reduction in safety.

Response

The statement, "...there are no reductions in safety associated with eliminating the SFP-HPI flow path from the current LB," given on page 9 of the LAR is an oversight. The removal of the SFP HPI flow path does in fact have some safety significance; however, taken in aggregate, Duke has concluded that the slight increase in risk associated with its removal is outweighed by the risk benefit gained from the removal of a tornado vulnerability associated with SSF RCMU system.

Consequently, there would be a net increase in safety. Therefore, the conclusion is accurately stated in the "No Significant Hazards Consideration" response (Attachment 4 of the LAR) that the proposed changes do not involve a significant reduction in the margin of safety.

b. Explain how defense-in-depth with respect to primary makeup capability is maintained (commensurate with the existing capability that exists) with elimination of the SFP-HPI flow path.

Response

Despite the elimination of the SFP-HPI flow path, defense-in-depth for the primary makeup function is improved with the additional protection to be provided for the SSF and the improvement of the reactor coolant pump seals. It is noteworthy that Duke's original purpose of adding this suction path was to compensate for the poor seal reliability modeled in the Oconee PRA analysis. Full protection of the SSF systems improves the availability of SSF RC Makeup following a tornado strike and HPI makeup from the BWST is maintained.

Regulatory Guide 1.174 provides guidance for assessing whether a licensing basis change meets the defense-in-depth principle. The RG states that consistency with the defense-in-depth philosophy is maintained if the following 7 elements are met.

1.) A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

The proposed changes result in a net improvement in core damage frequency without any adverse effects on the existing containment reliability and consequence mitigation capabilities.

DRAFT RESPONS Responses to Request for Additional Information Enclosure March 19, 2003 Page 27 2.) Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided.

The proposed changes do not add new programmatic activities to compensate for plant design weaknesses.

3.) System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

Defense-in-depth is improved with the additional protection to be provided for the SSF and the improvement of the reactor coolant pump seals. Full protection of the SSF systems improves the availability of SSF ASW and SSF RC Makeup following a tornado strike. HPI makeup from the BWST is maintained. The elimination of the SFP-HPIflow path is compensated for with the improvement of the reactor coolant pump seals. The reliability of the new seals is orders of magnitude better than the original seal design. This improvement more than compensates for the HPI reliability lost due to eliminating the alternate suction source from the SFP which is considered to be of modest to low reliability.

4.) Defenses against potential common cause failures are preserved, and the potential for the introduction of new common cause failure mechanisms is assessed.

The proposed changes eliminate the common mode failure mechanism of tornado damage to West Penetration Room which impacts the availability of the SSF, EFW, HPI, and Station ASW.

5.) Independence of barriers is not degraded.

The proposed changes do not adversely impact the independence of existing barriers.

6.) Defenses against human errors are preserved.

The proposed changes do not adversely impact existing defenses against human error.

7.) The intent of the General Design Criteria in Appendix A to 10 CFR 50 is maintained.

ORAFT RESPONS Responses to Request for Additional Information Enclosure March 19, 2003 Page 28 The intent of the original Oconee Design Criteria is maintained [

Reference:

Response to Question I from Duke's January 9, 2003 RAI submittal].

c. Provide a comparison of the reliability of the SFP-HPI primary makeup capability with the reliability of the SSF RCMU primary makeup capability. Explain the basis for this determination. Discuss measures that could be taken to improve the reliability of the SFP HPI flow path and the amount of improvement that could be achieved.

Response

The availability of HPI makeup from the SFP is highly dependent on the availability of emergency power from Keowee, the availability of secondary-side heat removal, and the heat load of the SFP. However, the risk importance (CDF contribution) of this system is also dependent on the reliability of the SSF, reliability of the RCP seals, and the failure probability of the BWST. The response to Question 7(a) provides information on the failure probabilities Keowee emergency power and the SSF. Response to Question 3 from the January 29, 2003 RAI submittal describes the basis for the failure probability of the BWST. Beyond these functional dependencies, the SFP alignment is a challenging operator action to accomplish. The alignment requires the manipulation of a significant number of valves at very dispersed locations around the plant, and must be completed in a timely and coordinated manner under Station Blackout conditions. The system also has other maintenance and testing limitations that provide additional uncertainty to the reliability of this alignment following a tornado strike.

The maximum potential benefit of any SFP-HPI modification/changes would be limited to the low to middle E-07 range due to spatial and functional dependencies between the failure of the BWST and the loss of all 4160-volt power which in turn has functional dependencies with the EFW and Station ASW (I&C power). The most beneficial plant change with regard to reducing the risk associated with RCS makeup following a tornado strike is to install the most rugged and reliable RCP seals available with current technology. Oconee has already accomplished this task.

In addition, the risk analysis in support of this submittal used a conservative estimate of the RCP seal failure probability (based on WOG2000 model). The CE Owners Group (CEOG) has submitted a Seal Failure Model to the NRC seeking approval for the use of lower seal failure probabilities in risk analyses. This report provides detailed information and analysis supporting significantly lower failure probabilities for the Byron-JacksoniSulzer seals that Oconee has installed.

)RAFT RESPONS Responses to Request for Additional Information Enclosure March 19, 2003 Page 29 Ouestion 21:

During a meeting on December 20, 2002, the licensee indicated that the tornado vulnerabilities associated with the CR-3 block wall and SSF cable trench will be eliminated. Provide a schedule for when these actions will be completed.

Response

SSF Cable Trench:

The planned modification to correct the SSF cable trench missile vulnerability is to install a "Natural Phenomenon Barrier System" that will provide ample missile protection to susceptible portions of the trench. Implementation of this modification is currently scheduled to begin in 2005.

Oconee ONS-3 Control Room North Wall Delta-P and Missile Vulnerabilities:

A change to UFSAR Table 3-23 is being made to change the design requirement for pressure relief blow-out panels for the ONS-1, 2, and 3 control rooms. The change involves specifying that a blow-out panel is required only for the ONS-3 control room. Recent analysis has shown that there is sufficient pressure relief mechanisms in the ONS-1 and 2 control rooms such that additional pressure relief, afforded by blow-out panels, would not be necessary. For the ONS-3 control room, a minor modification, to ensure that the wall can withstand 3 psi differential pressures from a design basis tornado, is currently scheduled to be implemented during the ONS 3 end-of-cycle 21 refueling outage (Fall 2004).

For missiles, an evaluation to review and update the current Oconee TORMIS model is underway and is scheduled to be completed in early May 2003. Following the completion of the TORMIS evaluation, a License Amendment Request (LAR) will be prepared and submitted to the Staff proposing changes to applicable portions of the UFSAR to clarify the control room's missile protection capabilities. Submission of the LAR is currently scheduled for July 2003.

Ouestion 22:

Confirm that the various strategies that are credited in the accident and PRA analyses for mitigating tornado events will not cause steam generator tube stresses to be exceeded.

ORAFT RESPONSE Responses to Request for Additional Information Enclosure March 19, 2003 Page 30

Response

See response to Question 23.

Ouestion 23:

What assurance is there that steamline integrity will be maintained during a tornado event (e.g.,

piping/drain valves remain intact, the bypass valves and main steam valves stay closed, and the control/EHC/instrumentation for these valves are protected so they do not go open). If it is possible that integrity of the main steam lines could be lost during a tornado event, describe how the event will be mitigated.

Response

There are portions of the main steam piping that are not protected from tornado damage.

However, due to the location and inherent ruggedness of the main steam piping, the likelihood of a large break has traditionally been considered to be a low probability event and not of consequence to the PRA risk analysis.

The following features support this position.

"* The main steam headers located outside, between the Reactor Buildings and the Turbine Building (TB) are capable of withstanding 300 mph winds.

"* A 1993 missile analysis estimated that the probability of missile damage to the 3B main steam header (the longest and most exposed segment of steam piping) to be in the low E 03 range. This low probability stems from the thickness of the pipe and its high elevation above grade.

"* After entering the TB and connecting to the ADVs, the steam headers turn down and stay mostly below the turbine deck where it is less exposed to wind loads and mostly protected from tornado missiles.

Although a steam line break would complicate the plant's response to a tornado event, the likelihood of a large break is still considered low in the Rev. 3 risk analysis. It is conservative to assume the secondary side remains pressurized for the tornado scenarios that rely on station ASW. This is because station ASW requires the steam generators to be depressurized and any initial overcooling will delay the subsequent heatup of the RCS prior to establishing station ASW. The EOP and SSF abnormal procedure were reviewed with respect to guidance for mitigating a tornado-induced steam line break. If EFW is relied upon, the current EOP appropriately addresses operator actions to ensure adequate core cooling. Duke's review of the

ORAFT RESPONSEI Responses to Request for Additional Information Enclosure March 19, 2003 Page 31 SSF abnormal procedure determined that additional guidance should be included in this procedure to address scenarios where the steam generators are depressurized. These enhancements are being pursued through the corrective action program.

The following is a description of the plant's response to tornado damage of one or both steam lines. This damage may consist of small breaks (e.g., main steam code safety valve failure) up to very large breaks such as double-ended main steam line breaks. The tornado can result in a range of damage to other plant equipment that will affect the plant's response. For the purposes of this discussion only the SSF ASW pump is credited as a feedwater source, and only the core flood tanks and SSF reactor coolant makeup pump are credited as an RCS makeup source.

The tornado is assumed to cause a loss of power that trips the reactor and the turbine. The reactor coolant pumps will coast down following the loss of power. The hotwell, condensate booster, and main feedwater pumps will trip following the loss of power. If it is also assumed that the main steam lines are damaged, one or both steam generators will blow down and cause the RCS to overcool and contract. The cooldown rate and the lowest resulting RCS temperature are dependent on whether one or both steam generators are affected, the size of the breaks in the secondary pressure boundary, and the extent that a feedwater source continues to deliver flow to one or both steam generators. Actuation of the AFIS or MSLB mitigation circuit (if available) will also determine the rate and magnitude of the overcooling of the RCS, as will operator action.

The plant response will vary significantly based on the above factors. For small steam line breaks the steam boiloff rate can equal the decay heat power, and RCS conditions will approach a normal post-trip response with limited overcooling. As the break size increases the overcooling will be greater. The resulting contraction of the RCS inventory will empty the pressurizer and cause a loss of subcooling. The continued contraction will cause voids to form in the reactor vessel head, and also possibly in one or both hot legs. RCS pressure will be controlled by the hottest temperatures in the loop. The void in the reactor vessel head will not affect heat transfer.

Should the void in either hot leg become excessive, then liquid circulation in that loop will be interrupted, and heat transfer will stop until a feedwater source is established such that boiler condenser mode heat transfer is established. Therefore, interruption of loop circulation will limit the overcooling.

The magnitude of the overcooling is not expected to be significantly different from the current analysis of the double-ended steam line break that is used to calculate the steam generator tube stresses. That analysis combines the largest break size and continued EFW flow for ten minutes.

If the tornado causes a loss of normal feedwater sources, then the overcooling will be less. If the tornado causes two steam line breaks but no loss of normal feedwater sources, then a more realistic operator response time to isolate all feedwater will limit the overcooling to a similar

DRAFT RESPONSI Responses to Request for Additional Information Enclosure March 19, 2003 Page 32 extent. If AFIS or the MSLB circuit actuates as designed following a large enough SLB, then feedwater addition will be limited and the overcooling mitigated. The tube stresses for all tornado scenarios will also benefit from a loss of the BPI System and no RCS repressurization capability while still cold.

After the RCS cooldown has been terminated the heat-up phase will begin. This can be a relatively normal heat-up with water circulating in the loops, or it can evolve into a mode where the reactor vessel is essentially a boiling pot. The boiling pot mode results from the contraction of the RCS inventory causing large hot leg voids and interrupting loop flow. The water in the core will heat up and boil, and the RCS will pressurize. The water in the cold regions of the loop will stagnate. Decay heat will cause a gradual heat-up and pressurization of the RCS. The expansion of the inventory due to the heat-up will reduce the hot leg void volumes. Spillover into the steam generators tubes may or may not occur. This phase will continue until the operator starts the SSF ASW pump and reestablishes the steam generators as heat sinks.

Once SSF ASW flow is established, the heat transfer mode will be either normal natural circulation or high-elevation boiler-condenser cooling mode. SSF ASW injection through the upper feedwater header will provide decay heat removal for both modes.

Depending on the magnitude of the overcooling the core flood tanks may or may not inject. This will provide some RCS makeup volume and also add boron for reactivity control. Calculations for recent Oconee cores indicate that the core will remain subcritical down to 212'F assuming a 10% reduction in control rod worth and no stuck control rods. The SSF reactor coolant makeup system will inject borated water to ensure the reactor remains shut down.

The heat-up phase will occur similar to the heat-up following the tornado-induced loss of all feedwater scenarios. The main difference will be that the heat-up will start from the temperature at the end of the overcooling phase, and therefore the heat-up will lag the loss of all feedwater scenario. Operator restoration of the heat sink via the SSF ASW pump will terminate the heat-up at lower RCS temperatures. Consequently, the compressive SG tube loads are expected to be less than those previously analyzed when relying on Station ASW.

Summary Based on the above discussion of tornado-induced overcooling events including steam line breaks, the plant response is found to be acceptable based on the following requirements being met:

9 The reactor would remain subcritical

0DRAFT RESPONSF Responses to Request for Additional Information Enclosure March 19, 2003 Page 33

"* Decay heat removal will be reestablished via SSF ASW

"* Interruption of natural circulation is likely to occur. However, restoration of normal natural circulation or boiler-condenser natural circulation will occur.

"* RCS overpressurization will not occur. This is bounded by the loss of all feedwater scenario that has been analyzed.

"* Tensile steam generator tube stresses during the overcooling phase will be bounded by or similar to the large steam line break analyzed in the UFSAR. A key contributor is the absence of the HPI System to pressurize the RCS and increase tube loads. Compressive tube stresses are bounded by the design basis tornado event that does not assume a coincident high energy line break.

v t e Letter Sequence Meeting
TAC:MB5361, (Withdrawn, Closed) TAC:MB5362, (Withdrawn, Closed) TAC:MB5363, (Withdrawn, Closed)
Initiation Acceptance... Administration Meeting, Meeting, Meeting, Meeting Questions Answers Results Withdrawal Other: ML050530094
MONTHYEAR2003-03-20 [Table View]

ML030830443

Text

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Response

Reference:

Response

Response

Response

Response

Navigation menu

Search