ML031820616

Responses to Request for Additional Information for the Proposed License Amendment Request to Fully Credit the Standby Shutdown Facility and to Eliminate Crediting the Spent Fuel Pool to High Pressure Injection System Flow Path for Tornado

ML031820616
Person / Time
Site:	Oconee
Issue date:	06/18/2003
From:	Rosalyn Jones Duke Power Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
Download: ML031820616 (37)

Text

P Duke R. A. JONES cWPowere Vice President A Duke Energy Company Duke Power 29672 / Oconee Nuclear Site 7800 Rochester Highway Seneca, SC 29672 864 885 3158 June 18, 2003 864 885 3564 fax U. S. Nuclear Regulatory Commission Document Control Desk Washington, DC 20555

Subject:

Oconee Nuclear Station Docket Nos. 50-269, -270, -287 Responses to Request for Additional Information for the Proposed license Amendment Request to Fully Credit the Standby Shutdown Facility and to Eliminate Crediting the Spent Fuel Pool to High Pressure Injection System Flow Path for Tornado Mitigation, license Amendment Request No. 2001-012 In a letter dated June 7, 2002, Duke Energy Corporation (Duke) submitted a risk informed License Amendment Request (LAR) for Oconee Nuclear Station (ONS) Units 1, 2, and 3, related to the station's tornado licensing and design basis. The proposed LAR revises the Updated Final Safety Analysis Report to eliminate credit for the Spent Fuel Pool to High Pressure Injection pump flow path as one of the sources of primary system makeup following a tornado event. In addition, the submittal credits the Standby Shutdown Facility as the assured means of achieving safe shutdown for all Oconee Units following a tornado.

On January 29, 2003, Duke submitted responses to the Staff's initial LAR questions.

Additional questions were received on January 28, 2003, February 3, 2003, and May 7, 2003. The enclosure to this letter provides Duke's responses to these additional questions.

If there are any inquiries on this submittal or additional information is required, please contact Stephen C. Newman of the ONS Regulatory Compliance Group at 864-885-4388.

Very

yours, R.

s, Vice President Oconee Nuclear Site

Enclosure:

Responses to Request for Additional Information AriZ) t www. duke-energy. corn

cc:

Mr. L. N. Olshan, Project Manager Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Mr. L. A. Reyes, Regional Administrator U. S. Nuclear Regulatory Commission - Region II Atlanta Federal Center 61 Forsyth St., SW, Suite 23T85 Atlanta, Georgia 30303 Mr. M. C. Shannon Senior Resident Inspector Oconee Nuclear Station Mr. Henry Porter, Director Division of Radioactive Waste Management Bureau of Land and Waste Management Department of Health and Environmental Control 2600 Bull Street Columbia, South Carolina 29201-1708

R. A. Jones, being duly sworn, states that he is Vice President, Oconee Nuclear Site, Duke Energy Corporation, that he is authorized on the part of said Company to sign and file with the U. S. Nuclear Regulatory Commission this revision to the Facility Operating License Nos. DPR-38, DPR-47, and DPR-55, for Oconee Units 1, 2, and 3 respectively; and that all the statements and matters set forth herein are true and correct to the best of his knowledge.

R. A.

, Vice President Oconee Nuclear Site Subscribed and sworn to before me this day o 2003 Notary Public My Commission Expires:

SEAL

ENCLOSURE DUKE RESPONSES TO RAI IN REGARDS TO PROPOSED LICENSE AMENDMENT REQUEST TO FULLY CREDIT THE STANDBY SHUTDOWN FACILITY AND TO ELIMINATE CREDITING THE SPENT FUEL POOL TO HIGH PRESSURE INJECTION SYSTEM FLOW PATH FOR TORNADO MITIGATION, OCONEE NUCLEAR STATION, UNITS 1, 2 AND 3 Question 1:

Numerous tornado vulnerabilities have been identified that appear to be inconsistent with Oconee design basis requirements (for example, Sections 3.1.2 and 3.1.4 of the Oconee UFSAR regarding emergency power capability and shared systems, respectively). Explain how the plant design bases are satisfied given the specific tornado vulnerabilities that have been identified.

Response 1:

Updated Final Safety Analysis Report (UFSAR) Section 3.1.2, Criterion 2: Performance Standards, states that components, which are essential to the prevention of accidents that could affect the public health and safety or the mitigation of their consequences, shall be designed, fabricated, and erected to performance standards that will enable the facility to withstand, without the loss of capability to protect the public, the additional forces that might be imposed by natural phenomena (including tornadoes). The original licensing of Oconee Nuclear Station (ONS) relied upon the Station Auxiliary Service Water (ASW) system to meet this design criterion for tornadoes. The principles supporting the original tornado design basis were protection or physical separation. This is evident in that the original FSAR refers to physically separated Station ASW lines (one in the East Penetration Room and one in the West Penetration Room) as well as six sources of electric power. The Atomic Energy Commission (AEC) accepted this design philosophy for meeting Criterion 2. The proposed change continues to satisfy this design philosophy. Duke has reviewed Section 3.1.4 and has concluded that the Standby Shutdown Facility (SSF) and Station ASW systems should be included in the list of shared systems. The UFSAR will be changed through the corrective action program to address the information missing from Section 3.1.4.

A staff memorandum dated February 9, 1982, described actions necessary to address the capability to deliver Auxiliary Feedwater (AFW) flow following a seismic event or tornado (Recommendation GL-4). The staff's position in this memorandum with respect to decay heat removal following a tornado was that Duke wouid be required to either, 1) confirm that all portions of the SSF ASW system will be adequately protected from tornado missiles, or 2) provide the results of an analysis which demonstrates that adequate decay heat removal can be continuously maintained through the existing auxiliary service water system. The proposed change in this license amendment request will result in all portions of the SSF ASW system being adequately protected from tornado missiles, as well as wind and differential pressure loads.

Thus, Duke believes the change requested through this submittal satisfies both the original design requirements for the plant as well as the post-Three Mile Island (TMI) requirements.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 2 Secondary side heat removal (SSHR) tornado vulnerabilities were described to the NRC in post-TMI correspondence. En a letter dated November 19, 1982, Duke characterized potential damage to the penetration rooms and Turbine Building due to wind loadings. The probability of a loss of Emergency Feedwater (EF;W) and 5SF ASW due to wind effects was conservatively estimated to be 8.1E-5/reactor year. Subsequent Duke correspondence (letters dated September 15, 1986, July 17, 1987, and December 19, 1988) focused on the probability of a loss of SSHR due to tornado missile damage. In a safety evaluation dated July 28, 1989, the staff concluded that the probability of failure of the EFW and Station ASW systems combined with the protect-on against tornado missiles afforded by the 5SF ASW system, satisfies the Standard Review Plan (SRP) probabilistic criterion, and was therefore, acceptable.

Note that the use of the term "vulnerability" in this discussion should be defined as an equipment vulnerability to tornado damage and should not be considered a "severe accident vulnerability" as commonly referred to in the IPE submittals and Generic Letter 8 8-20. At no time has the analysis indicated that Oconee tornado risk poses a severe accident vulnerability. Furthermore, most of the new risk insights from the updated PRA analysis stem from a more comprehensive and detailed understanding of the functional and spatial dependencies rather than the identification of new vulnerabilities to equipment damage.

In summary, the original tornado design basis relied upon protection and separation. Subsequent post-TMII risk assessments quantified the protection afforded by this design approach and concluded that the Oconee design basis provided sufficient protection against tornado damage.

The more detailed risk analyses presented in Duke's June 7, 2002, license amendment request do not alter this conclusion. Although some different vulnerabilities associated with tornadoes were identified through the most recent risk assessment, the conclusions of the risk analyses continue to support the adequacy of the design. In addition, Duke's plans to protect the SSF improve upon the current design basis by eliminating tornado vulnerabilities that could impact the SSF function. This approach satisfies both the original licensing requirements and the post-TMI requirements.

Question 2:

The risk-benefit of hardening the west penetration and cask decontamination room walls appears to be secondary compared to the risk-significance of the tornado vulnerabilities that have been identified. Discuss the risk benefit that could be achieved (both per unit and for the station as a whole) by eliminating each of the tornado vulnerabilities that have been identified. Also discuss measures that could be taken and the risk benefit that could be achieved by improving the reliability of the SSF. Given this risk perspective, explain why these additional actions are not warranted.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 3 Response 2:

The primary objective of the modifications to fully protect the SSF systems and equipment is to provide Oconee with a deterministic tornado mitigation strategy that is not susceptible to tornado damage. Duke's proposed changes to the tornado licensing basis were developed using defense-in-depth and risk informed evaluations. Duke agrees that the risk benefit of these modifications is relatively low and not cost justifiable on core damage frequency reduction alone. However, this option is the best improvement to the plant based on defense-in-depth considerations.

Duke has previously evaluated potential changes to the plant to reduce zisk through the Individual Plant Examination (IPE) and WE for External Events (IPEEE) studies. As noted in these submittals, several changes have been implemented to reduce overall plant risk. The IPE and IPEEE studies concluded that significant modifications to the facility to reduce tornado risk were not cost-justified. It would be a very extensive effort to quantify the risk benefit associated with each of the tornado vulnerabilities that have been identified. However, sensitivity studies of some of the vulnerabilities were performed as part of the current tornado design basis initiative.

Preliminary estimates of risks for these vulnerabilities have been previously documented in NRC Inspection Report 50-269, 270, 287/02-07. Although the risk values for vulnerabilities changed somewhat in the final tornado PRA as compared to the inspection report, the general insights associated with these vulnerabilities have not. Based on the spatial dependencies associated with tornadoes, Duke has reviewed these sensitivity studies and concluded that a significant redesign of the power plant would be necessary to dramatically reduce tornado risk. Specific issues assessed by Duke are as follows:

• The PRA model concluded that auxiliary power at Keowee could be lost if power is lost to 4kV switchgear ITC. A minor modification and abnormal procedure were implemented to allow recovery of auxiliary power at Keowee. This was accomplished in 2002.

• Station ASW is not fully protected from tornado damage. The atmospheric dump valves and piping above grade are susceptible to tornado damage. In addition, long-term operation of station ASW relies upon availability of control room indications. Resolution of these tornado vulnerabilities would require a significant redesign of station ASW, including protecting piping in the East Penetration Room, providing backup DC power from the ASW switchgear to all three units, and physically protecting the ADVs through a major civil structural modification. The other option is to upgrade station ASW to a high head system that can operate at full SG pressure. These options are quite extensive in scope and do not provide a substantial reduction in risk. Therefore, they were not pursued.

The EFW system is susceptible to tornado damage do to the loss of AC power, DC power, and piping above grade elevation. Major redesigns of the EFW system, including

Responses to Request for Additional Information Enclosure June 18, 2003 Page 4 protecting piping in the East Penetration Room and providing protected power to the control rooms would be necessary to resolve these vulnerabilities. Adding tornado protection features to the East Penetration Room are not possible since blowout panels are required to relieve the pressure in this room following a high energy line break. Duke has performed tests on the TDEFWP cooling to demonstrate that the pump can operate for an extended period of time without cooling. However, other system vulnerabilities make the potential loss of cooling low in risk significance. A major redesign of EFW and its supporting AC and DC power was not considered feasible when compared to the modest reduction in plant risk.

• As discussed in the response to Question 21, Duke is resolving the vulnerability with the Unit 3 north control room wall through a modification and license amendment request.

• As stated previously, Duke has elected to add tornado protection to the West Penetration Rooms and Cask Decontamination Rooms. These modifications will ensure the SSF ASW and reactor coolant makeup functions are protected from tornado damage. They will also provide protection for the EFW and station ASW lines that pass through the West Penetration Room. This modification improves defense in depth by providing an assured means of secondary side cooling and primary system makeup in the event of a tornado.

Duke agrees that improvements in SSF reliability will have a positive impact in terms of reducing plant risk. As with other key safety systems, the site focuses on minimizing unavailability times and maximizing reliability. These efforts will continue to be a focus area for the site. However, the overall core damage frequency (CDF) at Oconee is not considered to be an outlier with respect to the CDF at other plants. Based on the Oconee design features, the CDF for internal events is lower than the industry median.

External events are the dominant contributors to plant risk at Oconee. As has been its practice since the development of the IPE, Duke continues to focus on potential plant changes that can reduce plant risk. An example is the replacement of the reactor coolant pump seal packages on Oconee ONS-1. This modification significantly reduces the risk associated with reactor coolant pump seal loss of coolant accidents (LOCAs). Another example involved the resolution of a Keowee auxiliary power dependency on ONS-1 4160-volt busses. Duke also completed a self-initiated technical audit (SiTA) during the spring of 2003 to evaluate seismic risk.

Although tornado risk is a significant contributor to core damage frequency (CDF) at Oconee, the overall CDF risk for the plant is commensurate with the risk of other nuclear facilities and is below the NRC safety goal of 1E-4. As a result, Duke does not believe that the risk from tornadoes warrants significant changes to the plant design.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 5 Question 3:

The submittal proposes to establish the SSF as the "assured" means for mitigating tornado events and indicates that hardening of the west penetration and decontamination room walls will yield a risk benefit that is on the order of 1E(-6) per year for each of the three Oconee units.

a. Explain how the proposed mitigation strategy is different from the current strategy (which already credits the SSF ASW capability), and how the plant design basis, roles, requirements, and procedures relative to use and upkeep of the EFW, Station ASW, and the SSF ASW systems will change.

Response 3(a):

From a broad perspective, the license amendment request (LAR) does not alter the previously established tornado mitigation strategy; however, the one proposed change to this strategy is to eliminate reliance on the Spent Fuel Pool (SFP) to High Pressure Injection (HPI) flow path.

Protecting the SSF from tornado damage ensures that the SSF is available following a tornado and also eliminates the potential failure of the EFW and Station ASW piping that passes through this room. The proposed change is relatively minor with respect to Oconee's tornado mitigation strategy since Duke does not plan any changes in emergency or abnormal procedures with respect to operation of EFW, SSF ASW, or Station ASW. The decay heat removal hierarchy in the EOP is:

1) Remain on MFW,

2) EFW,

3) Condensate booster pumps (CBPs),

4) EFW from an alternate unit,

5) HPI feed-and-bleed cooling,

6) SSF ASW, and

7) Station ASW.

For the tornadoes that cause of a loss of offsite power, MFW and the CBPs are not available.

The preferred source of SSHR is EFW. Following a tornado, operators will attempt to establish SSHR with EFW. If this is not successful, SSF ASW would be aligned. If SSF ASW fails, Station ASW would be relied upon as the last option for SSHR. The key licensing and design basis change associated with this license amendment request is to require the SSF functions to be protected from the design basis tornado loads (wind, differential pressure, and missiles). The design requirements and roles of EFW and Station ASW will not be altered.

b. From a risk perspective, compare the failure probability of the SSF to that of Station ASW, EFW for the affected unit, and EFW from another unit (both individually and collectively).

Responses to Request for Additibnal Information Enclosure June 18, 2003 Page 6 What mitigation strategy (or strategies) provides the most risk benefit? Describe and quantify the risk-significant impacts that contribute to the failure probability of each strategy.

Response 3(b):

A direct comparison of the failure probabilities for these systems is both complex and difficult because of various functional and spatial dependencies, varying levels of wind fragilities for various structures and equipment, and different timing considerations for different accident sequences. The underlying new insight from the updated risk analysis is that support system dependencies are very important (for a single unit and between multiple units). Since instrumentation and control power is required for EFW and Station ASW operation, both systems are dependent on 4160-volt auxiliary power for long-term success. The response to Question 7 presents a comparison of the SSF failure probability to that of the emergency power system. With additional failure modes besides AC power, it is obvious that the EFW and Station ASW systems are significantly more likely to fail in a tornado event than the SSF.

Providing EFW from another unit is not credited in the risk analysis. This approach is considered to be conservative. The risk benefit of this function is considered to be minimal for tornado sequences because it is subject to the same multi-unit dependencies and other limitations.

c. The SSF was designed specifically for fire, flooding and sabotage events. The existing Surveillance Requirements and AOTs for the SSF-related SSCs that are relied upon for tornado mitigation do not appear to be commensurate with Surveillance Requirements and AOTs that have been established in the STS for equipment that is relied upon for preventing and mitigating other event scenarios, and changes to the SSF TS requirements have not been proposed in this regard. Given the tornado vulnerabilities that have been identified and the increased importance this places on the SSF, explain why changes to the SSF TS requirements are not deemed necessary.

Response 3(c):

Although the original licensing purpose of the SSF was not based on tornado events, the role of the SSF in tornado mitigation has long been recognized by Duke and the NRC staff and was considered in its original design requirements. The changes proposed in the LAR do not significantly change the role of the SSF for tornado mitigation and therefore, changes to either the current Technical Specifications (TS) or Selected Licensee Commitments (SLCs) are not warranted. The incremental CDF associated with SSF unavailability is actually dominated by non-tornado events (fire, floods, and loss of off-site power) and is not significantly affected by the proposed changes.

Responses to Request for Additibnal Information Enclosure June 18, 2003 Page 7 The current 7-day Completion Time originated during TS negotiations between Duke and the NRC in the mid-1980s through the early 1990s. The NRC acknowledges a 7-day restoration period for major SSF subsystems in a May 11, 1992, SER that notes, "The LCO in TS 3.18.2 through 3.18.6 include an allowable inoperability period of 7 days for the SSF subsystems. This provision is compatible with the STSfor emergency feedwater and other safety related systems."

Following approval of the proposed changes in the LAR, applicable SSF UFSAR and TS/SLC Bases descriptions will be revised to include tornado mitigation information. The following list depicts the current TSs and SLCs associated with SSF equipment:

1. TS 3.10.1 provides controls and testing requirements for the SSF, specifically:

SSF ASW system Portable Pumping system

• Reactor Coolant Makeup system e Power (& Instrumentation) system.

2. TS 3.10.2 provides controls and testing requirements for the SSF Battery Cell Parameters

3. TS 5.5.14 describes the requirement for the SSF fuel oil testing program

4. SLC 16.7.12 provides controls for the SSF diesel generator air start pressure instrumentation;

5. SLC 16.7.13 provides controls for SSF instrumentation; and

6. SLC 16.9.14 provides criteria for inspection of the SSF diesel generator.

In addition, the ONS In-Service Testing and Generic Letter 89-10 programs provide controls for SSF components to ensure that system reliability and performance is fully monitored. SSF components found to not be in compliance with any of these controls would be addressed via Duke's corrective action program. Following approval of the proposed changes in the LAR, applicable SSF UFSAR, TS and SLC Bases descriptions will be revised to include tornado mitigation information.

d. Provide a graph that shows the probability of tornado occurrence at the Oconee Station vs.

Time of Year, and explain how operability of the SSF will be assured and maintained during periods when the probability of tornado occurrence is relatively high.

Response 3(d):

Figure 1 provides a graph of the seasonal distribution of tornado occurrences for the region surrounding the Oconee site. This graph clearly shows that the months of March, April, and May have a significantly higher occurrence rate and a higher number of high-intensity (F-3 and F-4) tornadoes. The equivalent tornado strike frequency during these months is roughly twice the average annual strike frequency.

Responses to Request for Additibnal Information Enclosure June 18, 2003 Page 8 There are two major maintenance activities that occur on a periodic basis that result in significant SSF outages. The first is the SSF annual outage for preventive maintenance which usually requires 3 - 7 days. There is also a special 10-year outage and inspection that is conducted in conjunction with the normal annual outage and requires an approximately 15 - 18 days of unavailability. The second major maintenance activity is related to the unwatering of the ONS-2 Condenser Circulating Water (CCW) System during certain ONS-2 Refueling Outages.

Typically, this activity occurs with every other ONS-2 refueling outage (2 cycles - 3 years) and can last 6 - 30 days depending on the extent of CCW inspections and repairs necessary. During this time, the SSF is unavailable because its suction piping connects to the CCW inventory through the ONS-2 CCW piping.

In 2002, the annual train rotation schedule (for all plant systems) was revised to place the SSF annual outage in June to specifically address this aspect of tornado risk for future SSF annual outages. A review of the scheduling practices for ONS-2 CCW outages is planned to evaluate further improvements to reduce seasonal tornado risk and overall impact on SSF unavailability.

All other planned maintenance activities for the SSF (such as monthly or quarterly PMs) are typically performed within the timeframe of a normal work shift (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />). Short term SSF unavailability is less risk sensitive with regard to "tornado season" because of the opportunity to postpone work at the "last minute" or return the system to service when severe weather conditions are forecast. The Oconee Natural Disaster Procedure (AP/0/A/1700/006) contains specific actions for Tornado "Watches" and "Warnings" to restore critical systems and equipment to service including the SSF. Similar maintenance and scheduling practices are used for the Keowee Underground Path as described in the response to Question 29 from Duke's January 9, 2003 RAI submittal.

Responses to Request for Additional Information June 18, 2003 Enclosure Page 9 Figure 1 - Distribution of Tornadoes by Month and Intensity lTornados within 125 NM of Oconee (1950 - 1993) 60 T

• F4 (207-260 mph) 55 49 1

0 F3 (158-206 mph)

• F2 (113-157 mph)

EF1 (73-112 mph) 54 50 +

40 +

38 0)

• 0 C

I-0 I-0 a-E z

30 +

20 -

11 28 3

June Month 20 19 18 11 10 -

0 -

2 J0a Jan Feb Mar May July A Ou Aug Nov Dec Apr Sept Oct

Responses to Request for Additional Information Enclosure June 18, 2003 Page 10

e. Confirm that all SSF SSCs that are relied upon for tornado mitigation are classified as QA-1, and that the UFSAR will be revised to clearly reflect this.

Response 3 e):

The following SSF SSCs are relied upon for tornado mitigation and are classified as QA-1 systems:

SSF ASW System SSF Reactor Coolant Makeup (RCMU) System SSF Heating, Ventilation and Air Conditioning (HVAC) Service Water System SSF Diesel & Diesel Support Systems (excludes a portion of SSF Diesel Air Start System located upstream of air receiver tanks).

Reactor Coolant System (RCS) isolation valves controlled from SSF SSF Electrical Power SSF Instrumentation to monitor required RCS and Steam Generator (SG) parameters SSF Pressurizer heaters - The feeder breakers from the SSF motor control center (MCC) are QA-1, however, the rest of the circuit including the heaters themselves are QA-5.

If forced CCW flow and siphon flow are interrupted due to a tornado and the SSF is required to operate, the SSF Portable Pumping System would be used to re-supply the underground piping that feeds the SSF Service Water Systems. The SSF submersible pump as well as the SSF portable pumping system is not safety grade and is installed manually according to emergency procedures. The SSF portable pump system is stored in the SSF Response Room where it is protected against the effect of tornado generated missiles and wind. Technical Specifications associated with the use of the SSF submersible pump and its non-QA status were previously evaluated and found acceptable by the Staff as noted in a May 11, 1992 Safety Evaluation Report (SER).

Question 4:

The various vulnerabilities that have been identified (especially those associated with emergency power) place much more importance on the SSF than previously realized. Unfortunately, the SSF has not proved to be very reliable and this detracts significantly from the existing tornado mitigation strategy that has been approved for Oconee. It would seem that regardless of the improvements that are planned to assure the SSF function, the risk benefit (with respect to the SSF) will be limited by the relatively low reliability of the SSF. From a risk perspective, explain why it makes sense to harden the west penetration and cask decontamination room walls specifically to assure the SSF capability. What fraction of the total risk benefit applies specifically to the SSF function as opposed to EFW and Station ASW?

Responses to Request for Additional Information Enclosure June 18, 2003 Page 11 Response 4:

As discussed in the response to Question #2, the risk benefit of the SSF modifications are secondary to the defense-in-depth improvement that is realized. The small risk benefit of the additional SSF tornado protection is entirely associated with the improved availability of the SSF functions following a tornado strike. Currently, both the EFW and Station ASW systems are equally or more susceptible to tornado damage in other areas of the plant and thus do not benefit measurably from the additional protection of the West Penetration Room.

Question 5:

Provide the following information relative to the revised tornado risk analysis for the Oconee station:

a. What probability is assigned for inability to access/open the ADVs for depressurizing a steam generator? Explain.

Response 5(a):

The action to align the Station ASW within 40 minutes requires a relatively complex set of local manual actions in the Auxiliary and Turbine Buildings using several operators. The human reliability assessment determined that the critical part of this action is the opening of the Atmospheric Dump Valves (ADVs). The action would take up to about 10 minutes to perform following an initial response time of 15 minutes (the point at which the decision is made to initiate flow from Station ASW). However, these values are based on validation testing and do not reflect potential post-tornado conditions. Accounting for reduced accessibility and other stresses in a potentially adverse environment, the average execution time has been increased to 25 minutes. This assumption results in an estimated failure probability of 0.55.

b. What probability is assigned for a pressurizer safety valve to stick open? Explain, including any distinction that is made for when the pressurizer safety valve is expected to pass water.

Response 5(b):

The probability of failure of the Pressurizer Safety Valves (PSVs) to reseat under liquid relief conditions is assumed to be 0.1 per transient. For steam relief, the estimated PSV failure probability is 9.6E-03 per transient. These values represent an average cumulative conditional failure probability over multiple valve relief cycles during a loss of secondary side heat removal transient. This assumption is based on the approach and probability developed in the NSAC/60 study of Oconee. This approach used test data from EPRI NP-2628 SR, PWR Safety and Relief Valve Test Program (December 1982) to estimate the PSV failure probability.

Responses to Request for Additi6nal Information Enclosure June 18, 2003 Page 12 The primary indicator of valve performance in this test program was the phenomenon of valve chatter. Valve chatter is the rapid open/close cycling caused by excessive valve inlet flow losses from the pressure source (long inlet) or due to passing inappropriate media such as subcooled water. Chatter can possibly cause mechanical binding in the valve in the open position due to the galling of sliding/guide surfaces or failure of a key component in the spring load path.

Documentation from the NSAC/60 study noted that the EPRI data indicated that safety valve performance is sensitive to the valve manufacturer, the piping configuration, and the phase of the pressurized fluid (See NSAC/60 Appendix B, Table B-2, Note #8). For the relief of steam or liquid, the test data showed stable performance (no valve chatter) for the Dresser model 31739A valve (the Oconee model valve) when configured with a short inlet pipe (the Oconee piping configuration). In a long inlet piping configuration, the same valve exhibited chatter in 1 of 2 water tests. Other models and types of valves generally experienced a higher incidence of valve chatter during testing even when configured in the short inlet piping configuration.

While Duke continues to review available data of PSV valve performance and failure rates, Duke's current position is that the previously assumed value is reasonable and acceptable. The overall conclusion of the EPRI test data suggests that liquid relief failure rates are significantly higher than for steam relief and that the failure rate would increase as the fluid became increasingly subcooled. However, the evidence showed that the Oconee specific type of valve exhibited substantially better performance than all other types (no chattering) and would be expected to have a lower failure rate. This conclusion is further supported by the reasoning that a valve that does not chatter during liquid relief does not accumulate significant internal damage over repeated lift cycles (beyond normal wear) and is likely to continue to operate. Therefore, the NSAC/60 value for liquid relief is still considered a reasonable and acceptable value to use in the Oconee risk analysis. Furthermore, this value has been widely accepted and used in PRA analyses for other similar PWR plants in the industry.

The Pressurizer Pilot-Operated Relief Valve (PORV) is credited in the analysis for providing RCS pressure control for a period of approximately 30 minutes following a loss of secondary-side heat removal (SSHR). After 30 minutes without SSHR, the primary system becomes saturated and the PSVs are also required to open to control RCS pressure. Therefore, successful operation of the PORV provides up to 30 minutes to align SSF ASW to prevent challenging the PSV with liquid relief.

If the Pressurizer PORV is unavailable, the PSVs will cycle in steam relief until SSHR is reestablished or until the pressurizer becomes water solid. This is expected to occur after approximately 16 minutes without SSHR.

Note: Additional information regarding the design and performance of the Oconee safety valves was provided to the NRC staff in Duke's response NUREG-0737 Action Item ll.D.1 in letters dated March 23, and July 1, 1982, and January 21, 1983. Additional information was also

Responses to Request for Additional Information Enclosure June 18, 2003 Page 13 provided in letters dated August 6, 1987, January 15, 1988, and February 10, 1988 in response to an April 22, 1987 request for additional information (RAI). The NRC responded in a July 19, 1989 Safety Evaluation Report that, with the exception of a few open items regarding the power operated relief and block valves, Duke had met the RAI requirements concerning NUREG-0737, Action Item ll.D.1.

c. Explain how current operating experience with respect to failure of the pigtail connection for providing emergency power to the HPI punips is reflected in the risk analysis for tornado mitigation.

Response 5(c)-

A defective cabling connector represents an example of random equipment failure that would typically be counted against tie pump. Random failures of the HPI pumps to start and run are modeled in the tornado analysis.

d. The submittal indicates that elimination of the SFP-HPI flow path results in a slight increase in risk. Describe the specific mitigation sequences that rely on the SFP-HPI flow path and the risk contribution for each.

Response 5(d):

The SFP-HPI flow path provides an alternate suction source to the HPI system (1 pump) for sequences in which the BWST fails due to tornado missile damage. There are two types of core damage sequences that use the SFP-HPI flow path for tornado accident mitigation. The first type is a tornado event that uses the Station ASW system for decay heat removal because of a loss of both the SSF and EFW. In this case, HPI makeup is necessary to allow the primary system to be cooled down to maintain acceptable steam generator tube stresses. The second type involves a Reactor Coolant Pump (RCP) seal LOCA resulting from a loss of normal seal cooling and SSF backup cooling. With the restoration of 4kV power to an HPI pump, primary system makeup can be restored from the SFP to prevent core uncovery. This flow path is not credited for sequences involving stuck-open pressurizer safety valves because of the higher leak rate and the limited coolant volume available from the SFP. The estimated risk benefit of the SFP-HPI flow path is provided in the table below for each sequence.

Oconee SFP-HPI Flow Path Risk Benefit (pr Rx-yr) 1Units 1 & 2 qONS-3uI I - Station ASW Sequence IIEUts7 1 4E-07 2 - RCP Seal LOCA Sequence 2E-07 2E-07 Note: While the failure of the BWST due to tornado missile damage does not directly cause the failure of HPI related functions, there are important spatial dependencies with the BWST that

Responses to Request for Additional Information Enclosure June 18, 2003 Page 14 affect the estimated risk values. Thus, the loss of the BWST implies that coincident damage is likely to occur to other important structures and components such as the 4kV power system, the EFW system, and the penetration rooms (for F-4 or higher tornados). In addition, the SSF Reactor Coolant Make-Up pumps are designed to feed all 3 units for up to 72-hours, without additional makeup to the pool, and be able maintain water coverage above the spent fuel assemblies. However, fire truck makeup to the SFP is assumed to start at 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> per the Design Basis Events DBD. This is done to maintain a sufficient level of water above the assemblies to minimize dose. The SSF would not be used to cool down the units beyond Mode 3.

Ouestion 6:

Describe the requirements that pertain to the pressurizer PORV and block valve, including I&C and power supplies (TS, QA, seismic, tornado protection, etc.). What probability is assigned to the pressurizer PORV for failure to open, and what is the basis for this determination? What probability is assigned to the pressurizer PORV to fail in the open position with subsequent failure of the Block valve to close, and what is the basis for this determination?

Response 6:

The PORV and PORV block valve are seismically designed. The PORV block valve is environmentally qualified, while the PORV is not. Both the PORV and the PORV block valve receive safety-related power. However, the actuators on these valves are not fully QA-1. There are no Technical Specification requirements for the PORV during normal operation. The Bases to TS 3.10.1 require the SSF RCS isolation valves (RCA1 is one) to be operable such that the corresponding SSF RC makeup system is considered operable. The PORV and PORC block valve do have Technical Specification requirements during the LTOP mode of operation.

Located inside the Reactor Building, the PORV and PORV Block Valve are protected from tornado damage. However, power cabling and instrumentation for the PORV are located in the East Penetration Room and are vulnerable to tornado damage. The control system for the PORV Block Valve is designed so that the valve can be controlled and powered from the SSF. The power and control cabling for the PORV Block Valve are routed through the West Penetration Room where they are also vulnerable to tornado damage. Based on the current plant design, the equipment in the East and West Penetration Rooms are assumed to fail when the rooms are impacted by F-4 or higher intensity tornado winds.

Responses to Request for Additional Information Enclosure June 18,2003 Page 15 A list of the independent failure modes modeled for the PORV and PORV Block Valve are provided in the table below.

Table - Modeled Failure Modes for the PORV and PORV Block Valve Failure ModeDescription lProbability Pilot-Operated Relief Valve 3RC-66 Fails To Open On Demand 5.88E-03 PORV (3RC-66) Fails To Close On Demand (steam relief) 3.45E-01 PORV Block Valve Is Closed During Power Operation 1.OOE-01 PORV Is Left Unavailable After Test Or Maintenance 3.00E-03 Operators Fail To Close The PORV Block Valve 1.50E-03 PORV Block Valve 3RC-4 Fails To Close On Demand 1.73E-03 PORV Block Valve Is Left Unavailable After Test Or Maintenance 3.00E-03 The failure probability of the PORV to close on demand is based on 30 cycles of steam relief during the first 16 minutes following a loss of all secondary-side heat removal. Beyond 16 minutes, the pressurizer is expected to become water solid and the PORV transition into liquid relief. The risk analysis conservatively assumes that PORV will stick open during liquid relief and require the Block Valve to close if feedwater is subsequently restored.

The tornado fault tree also contains logic that recognizes a loss of the PORV function if DC power is lost to its power panelboard, and that the PORV Block Valve will be without motive power if the SSF does not have 600-volt power (e.g., SSF Diesel Generator {DIGI Start Failure).

Question 7:

For those tornado events that involve a loss of emergency power and a failure of the SSF to function:

a. For a given tornado, what is the probability that emergency power will be lost? What is the probability that emergency power will be lost with a subsequent failure of the SSF? How is the SSF failure probability affected by hardening the west penetration and cask decontamination rooms?

Response 7(a):

There are two important tornado failure modes for the emergency power system; damage to the Main Feeder Busses in the Turbine Building and damage to vital support systems at the Keowee Hydro Station. Table 1 below provides a listing of the conditional failure probability associated with these systems.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 16 Currently, failure of the SSF due to tornado damage is only assumed for severe tornados causing F-4 or greater damage impacting the West Penetration Rooms or Cask Decontamination Rooms housing vital SSF piping and cabling. Independent failure of the SSF ASW has an estimated probability of 0.077, and failure of the SSF RCMU system is estimated at 0.072. Independent failure of the SSF DIG or other SSF systems supporting both SSF ASW and the RCMU pumps has an estimated probability of approximately 0.23. Thus, the additional tornado protection proposed in the submittal provides only a small improvement in overall SSF availability following a tornado strike and is only applicable for F-4 and higher intensity tornado. This improvement is estimated to provide a core damage frequency reduction of 1.4E-06.

Table 1 - Oconee AC Power Tormado Damage Probabilities I

Conditional Damage Probabilities

• F-Scale Strike 4160-volt (For U3)

Keowee West Pen Frequency Power System Ul MFB Damage Damage (given Room Damage (Given U3 Strike)

ONS tornado Damage (F-2 or strike)

(SSF Failure) greater)

F-2 5.37E-05 0.289

.063 0.062 F-3 4.12E-05 0.452

.206 0.155 F-4 3.59E-05 0.474

.251 0.224

.053 F-5 1.71E-06 0.507

.333 0.312

.119

• Note: The events representing these damage probabilities are not "independent" due to spatial and functional dependencies that exist between the systems.

b. Describe measures that can be taken in accordance with emergency procedures to restore emergency power, secondary heat removal, and primary makeup (including specific operator actions that are required for each unit, time line, and consequences). Confirm that staffing for each unit is adequate to accomplish the necessary actions in accordance with accident analysis and PRA assumptions.

Response 7(b):

This response provides an overview of the operator actions taken in response to a tornado.

Oconee's procedures are structured to evaluate different shutdown strategies in a prioritized manner. A minimum control room crew of two Reactor Operators (RO) and one Senior Reactor Operator (SRO) and seven Nuclear Equipment Operators (NEOs) will be required to mitigate an event that requires use of the Station ASW Pump on one unit and a Loss of Offsite Power (LOOP) on the other two units. An additional licensed operator from the Work Control Center was used to staff the SSF.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 17 The scenario described below focused only on tornado damage to a single unit. The other two units are assumed to have tripped due to loss of the switchyard; however, their 4160 volt power bus is not damaged. Keowee emergency starts and automatically provides power to the other two units. There are no immediate field actions that must be taken on the other two units, however in time, a NEO will be required to restore non-essential loads outside the control room and to verify the Main Steam Relief valves have all seated. Neither of these actions are Time Critical.

When a Tornado Watch is issued, the Natural Disaster Abnormal Procedure is implemented. If the Watch progresses to a Warning, a Nuclear Equipment Operator (NEO-A) is dispatched to the 1st Floor Aux Bldg to prepare for using the Station ASW pump. A Nuclear Equipment Operator (NEO-B) and a licensed operator are dispatched to the SSF to standby for further direction.

NEO-A at the Station ASW Pump opens suction and recirculation valves, vents the pump, and racks in the pump breaker. Other NEOs are staged in the control rooms and shift maintenance personnel are staged in the OSC (ONS-3 Control Room) and told to prepare for possible need to power an HPI pump from the Station ASW switchgear.

If a tornado hits the station resulting in a loss of all feedwater (Main and Emergency), two NEOs (NEO-C & NEO-D) will be dispatched to the turbine building basement to attempt to cross-connect emergency feedwater with another unit. Another NEO (NEO-E) will be dispatched to the Turbine building basement to attempt a manual start of the TDEFW pump. Note that cross-connecting EFW is not credited in the PRA model. However, if available and another unit is unaffected by the tornado damage, procedures would use EFW from another unit.

If EFW can be successfully aligned, EFW suction is transferred from the Upper Surge Tank (UST) to the hotwell as UST inventory is depleted. Operator actions to align EFW to the hotwell involve breaking vacuum by opening valve *V-186 on the east side of the condenser on the third floor of the Turbine Building along with aligning valves in the basement of the Turbine Building. Eventually, EFW inventory from the UST and hotwell will be depleted and long-term secondary side heat removal is established through alignment of Station ASW. This method of long-term cooling is necessary due to the unavailability of LPI caused by the loss of 4kV power.

Assuming the tornado results in a loss of power, the licensed operator at the SSF will be directed to implement the SSF Emergency Operating Procedure (EOP) to provide feedwater via the SSF ASW system and RCMU via the SSF RCMU system. The SSF ASW and RCMU systems will maintain the plant in Mode 3 for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

While SSHR restoration is in progress, the blackout section of the EOP directs a licensed operator to perform parallel actions to attempt to restore power to the 4160-volt busses. The operator will try to manually re-power the 4160-volt busses by one of the following in order of priority:

Responses to Request for Additional Information Enclosure June 18,2003 Page 18

1) CT-1 from the switchyard or Keowee Hydro unit overhead path (CT-2 or CT-3 depending on the unit) to the Main Feeder Busses

2) CT-4 from the underground Keowee Hydro unit to the Standby Busses to the Main Feeder Busses

3) CT-5 from Central Switchyard to the Standby Busses to the Main Feeder Busses

4) CT-5 from a dedicated line from Lee Combustion Turbine to the Standby Busses to the Main Feeder Busses Even if the operator is not successful in powering the 4160-volt busses, he will ensure power to Standby Bus #1 to allow use of the Station ASW Pump from the Aux Service Water Switchgear.

If auxiliary power is not available at Keowee, the Keowee operators have a procedure that will manually align Keowee such that it is fed auxiliary power through its transformer. This procedural recovery was implemented as a result of the tornado PRA model insights.

In order for the event to progress to the point of needing to use the Station ASW pump, attempts to use another unit's EFW, to manually start the TDEFW pump, and to activate the SSF must have been unsuccessful. For this event, it is assumed that if plant damage is significant enough to damage 4160-volt busses (TC, TD, and TE) that NEO-C, D, and E return to the control room due to inaccessibility of the EFDW cross-connects and TDEFDW pump. If the SGs are not being fed, the blackout section of the EOP will dispatch NEO-C and NEO-D to the ADVs on the 5th floor of the turbine building.

If it is determined that the only source of feedwater available to the unit is Station ASW and Standby Bus #1 is energized, NEO-A, pre-staged at the Station ASW pump, is directed to start the Station ASW pump, close a vent valve on the discharge line, and open the pump discharge valve. NEOs C&D at the ADVs will be directed to fully open the valves. NEO-E will be dispatched to the Penetration Rooms (Auxiliary building 4th Floor) to fully open the last valves needed to feed the SGs.

Once Feedwater is established, shift Maintenance personnel are dispatched to align power to the chosen HPI Pump ("A" or "B") to the ASW switchgear. This means of primary system makeup would be used if the SSF reactor coolant makeup system is not available. Maintenance personnel isolate the BPI pump from the faulted 4kV power supply by opening either the pump breaker at the Engineered Safeguards Buses on the ground floor of the Turbine Building or by opening the Main Feeder Bus breakers in the blockhouse.

Power to the HPI pumps is aligned to the ASW switchgear by using pre-staged cables located in the HPI pump rooms. In addition, NEO-B (previously at the SSF) will be dispatched to prepare for using an HPI pump off the ASW switchgear. NEO-B will isolate Reactor Coolant Pump (RCP) seal flow by closing *HP-139 (3rd floor Auxiliary building), verify BPI pump motor cooling water flow (HPI pump room), open *HP-24 (suction from the BWST located in the

Responses to Request for Additional Information Enclosure June 18, 2003 Page 19 Auxiliary building, HPI hatch area), and then proceed to East Penetration Room (Auxiliary building 4th floor) to throttle HPI discharge flow.

If the BWST is not available, the Technical Support Center (TSC) will determine the suction source for the HPI pump. If the HPI pump suction from the SFP is selected, this will require valve alignment in the SFP (6th floor Auxiliary building), the East Penetration Room (4th floor Auxiliary building), and SFP cooler room (2nd floor Auxiliary building). In addition, the Spent Fuel Priming Pump must be started (located behind the Station ASW switchgear).

If a blackout exists on all three units, a NEO (NEO-E) will be sent to Load Shed the Essential Inverters (Eouiprneni Room - 3rd Floor Auxiliary building/Turbine building) and emergency start the Diesel Air Compressor (located outside the south end of Turbine building) to provide instrument Air.

Of the remaining NEOs, two are dedicated to support the unaffected units and are staged in the control room. If necessary and if conditions warrant, either of these NEOs can be dispatched to support any unit. For example, if all 4160-volt switchgears are de-energized for 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, a NEO (NEO-F or -G) will be dispatched to purge hydrogen from the electrical generator by opening two valves in the Turbine building first floor.

Selected Licensee Commitment (SLC) 16.13.1 provides minimum station staffing requirements.

The staffing required by this SLC was based in part on integrated validations of the EOP. The previously described operator actions for tornadoes were included in this validation process ensuring that adequate staffing is available to implement the tornado mitigation strategy. The validation process assumed significant tornado damage on one unit and a LOOP on the other two units.

The Oconee PRA addresses the accessibility for different operator actions by reducing the reliability of the associated function if the operator action requires access to an unprotected area.

Operator actions below grade elevation are inherently protected from tornado damage and access to equipment is not adversely impacted by potential tornado damage.

• Designates ONS-1, 2, or 3 as applicable

c. Describe specific scenarios that cannot be mitigated, including the probability of occurrence.

Response 7(c):

For successful mitigation, the Turbine-Driven EFW (TDEFW) pump and Station ASW are dependent on 4160-volt power to supply the 600V battery chargers that are necessary for long-term instrumentation and control power. Therefore, a loss of emergency power and a failure of the SSF to function will result in a core damage event.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 20 Currently, the only tornado damage scenario that can not be mitigated is a direct tornado strike of F-4 or higher winds impacting the West Penetration Room or Cask Decontamination Room of a particular unit. This event would cause the loss of all SSF functions to that unit and loss of all other mitigation strategies (EFWIHPI/Station ASW) because of the damage in the same room or damage to other areas of the Auxiliary or Turbine Buildings, or Keowee. The estimated frequency of this event is 2E-06. The proposed modifications to fully protect the SSF equipment would eliminate the possibility of damage to the SSF due to this extreme tornado damage event.

Ouestion 8:

Provide a complete listing of actions outside of the control room that may be required for each of the Oconee units during a tornado event (for both mitigation and plant shutdown) commensurate with accident analysis and PRA assumptions, and confirm that all relevant areas will be accessible and that operators will be able to complete the prescribed actions following a tornado.

Also, confirm that staffing is adequate for accomplishing the required actions on all units.

Response 8:

See response to Question 7(b).

Question 9:

The submittal indicates that sufficient staffing is available for switching over to Station ASW from EFW on all three units, but sufficient staffing is not available to initially align Station ASW for feeding the steam generators on all three units within the required time period.

a. Explain the basis for this determination, along with critical assumptions and time constraints.

Response 9(a):

If Station ASW is needed, Operations personnel are dispatched to required areas of the station to perform the alignment function in order to restore secondary side decay heat removal to the affected unit within 40 minutes. The validation discussed below confirmed that this evolution could be conducted successfully following tornado damage to a single unit with a LOOP for the entire site. This validation was reviewed and documented in NRC Inspection Report 01-09, dated November 19, 2001. Although operator staffing levels are insufficient to align Station ASW following a three unit tornado event within the initial 40 minute period, there are sufficient operators to mitigate this scenario from the SSF.

Operations performed three timing validations in 2001 to ensure that Station ASW could be aligned to the affected unit within 40 minutes. An integrated validation approach was used

Responses to Request for Additional Information Enclosure June 18, 2003 Page 21 which utilized the simulator for control room actions and NEOs dispatched via radio in the actual plant. The NEOs simulated and walked through actions when dispatched from the simulator control room as would be during an actual event. During the validation, a minimum crew of 1 SRO, 2 ROs, and 6 NEOs were utilized.

As defined in SLC 16.13.1, a total of eight Non-Licensed Operators (NLOs), ak.a. NEOs, are the minimum number required with at least one unit at power. Two of these 8 NEOs are designated for the two unaffected units, leaving 6 to support the damaged unit. It was subsequently determined that a total of seven NEOs would be actual number necessary for supporting the station's tornado mitigating and recovery activities. See response to Question 7(b). One licensed operator from the Work Control Center (WCC) was used to man the SSF.

The PRA credits Station ASW for tornado mitigation on multiple units only in cases when a "run failure" of SSHR occurs. From a timing perspective, the earliest (worse case) run failure that credits Station ASW is the case of a TDEFWP recirculation pipe break. Without operator action to swap EFW suction to the hotwell, this break could deplete the UST in as little as 110 minutes.

From this point, operators would still have more than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to align Station ASW to prevent core damage if the SSF is not available. Since the actions occur in the timeframe of 2 - 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> or longer after a tornado strike, staffing burdens following the tornado strike will be alleviated such that adequate personnel will be available to transition multiple units to Station ASW in a staggered manner as necessary. In other scenarios, the run failure will occur at later times, or operator actions (e.g., swapping to the hotwell) may provide even longer periods of time to respond (as much as 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />).

b. What is the risk-significance of not being able to align Station ASW to all three units concurrently following a tornado event?

Response 9 b):

For Oconee Units 1 & 2, the inability to align Station ASW concurrently on multiple units has no measurable impact on tornado CDF. This is because the same tornado damage that forces the staff to use the ASW system also causes all Instrumentation and Control (I&C) power to be lost for long-term system operation. For ONS-3, the inability to align Station ASW on multiple units has a very small impact (-1E-07 /Rx-yr). This small impact is related to sequences where EFW start failures occur on multiple units, but ONS-1 has 4160-volt power and is able to provide backup I&C power.

c. For the situation where EFW from one unit is being relied upon to provide feedwater for another unit, confirm that sufficient staffing and time are available for switching from EFW to Station ASW on all three units. Provide the basis for this determination, along with critical assumptions and time constraints.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 22 Response 9(c):

The PRA does not credit cross-connecting feedwater from either unaffected unit to the damaged unit. The transition from EFW to Station ASW credited in the PRA is addressed in Question 9a.

Ouestion 10:

The submittal proposes to eliminate the qualification that protected or physically separated lines are used to supply cooling water to each steam generator from the FSAR description. Explain.

Response 10:

It was not Duke's intention to imply that protection or physical separation be removed as a qualification in the UFSAR. The SSF SSHR and primary system makeup functions will be protected from tornado damage by modifying the walls to the West Penetration Rooms and Cask Decontamination Rooms. The SSF ASW piping passes through these two rooms with a crossover line in the Reactor Building such that both steam generators are fed from the single line that passes through these rooms. Thus, these modifications ensure that cooling water can be supplied to each steam generator through paths that are protected from tornado damage. With SSF ASW being protected, physical separation is not required to ensure adequate SSHR.

Duke proposes to modify Section 3.2.2 of the UFSAR to more clearly state the design requirements. The second paragraph will be revised as follows:

"The tornado design requirements are met through either protection or physical separation. The Reactor Coolant System, by virtue of its location within the Reactor Building, is protectedfrom tornado damage. A sufficient supply of secondary cooling waterfor safe shutdown is assured by the SSF auxiliary service water (ASW) pump located in the SSF building structure and taking suction from the CCW intake piping. Primary system makeup is assured by the SSF Reactor Coolant Makeup (RCMU) pump. The SSF is protected from the wind, differential pressure, and missile loads from the 300 mph design basis tornado. Specific SSF capabilities and design criteria are described in Section 9.6."

Question 11:

The submittal proposes to eliminate the qualification that the stored volume of water in the intake and discharge CCW lines below elevation 791 ft. will provide sufficient cooling water for all three units for approximately 37 days after a trip of the three reactors from the FSAR.

Explain.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 23 Response 11:

The Station ASW design basis of maintaining decay heat removal for 37 days is maintained in Section 9.2.3.1 of the UFSAR. Thus, the submittal does not propose to eliminate this information. With respect to Section 3.1.2 of the UFSAR, the SSF ASW system will be relied upon as the tornado-protected means of achieving safe shutdown following a tornado. The SSF is capable of maintaining the plant in a safe shutdown condition for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Since SSF ASW will be the assured source of SSHR, the information on Station ASW inventory was removed from this section of the UFSAR.

Ouestion 12:

The submittal proposes to eliminate the qualification that the SSF RCMU pump is capable of taking suction from the SFP from the FSAR. Explain.

Response 12:

The proposed UFSAR changes are not intended to eliminate the qualification that the SSF Reactor Coolant Makeup Pump is capable of taking suction from the SFP. The proposed change to Section 3.2.2 of the UFSAR states that "specific SSF capabilities and design criteria are described in Section 9.6."

Section 9.6.3.2 of the UFSAR provides detailed information on the SSF Reactor Coolant Makeup System and states that its suction source is the SFP. The proposed changes were intended to provide the tornado requirements in Section 3.2.2 and the system specific information for the SSF in Section 9.6. This approach was intended both to clarify and minimize the duplication of information contained in the UFSAR.

Ouestion 13:

The submittal indicates that a given unit's turbine-driven EFW pump can provide SSHR for that unit. Describe what capability exists for this pump to supply feedwater to one or two of the other units, in addition to supplying feedwater to its own unit, and explain why this capability is not being credited (contrary to previous assumptions).

Response 13:

The capability exists to supply multiple units from a given unit's TDEFW pump, however, a number of design limitations within the EFW system have prompted Duke to reduce its reliance on the ability to cross-connect EFW systems following tornado events. Much of the EFW piping is routed through the turbine building and vulnerable to damage from severe tornadoes. As such, the time to complete damage assessment would not meet the standards for event mitigation.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 24 Consequently, alignment of EFW from alternate units following tornado events that induce damage within the turbine building is not credited in the tornado PRA.

Ouestion 14:

Explain and justify why exceptions to RG 1.76 are necessary.

Response 14:

The LAR is not proposing changes to the original SSF tornado design basis given in UFSAR Section 9.6. The tornado protection criterion used originates from historical tornado data taken in the vicinity of the Oconee site and differs slightly from the standard data found in RG 1.76.

These specific differences have been individually listed in UFSAR Section 9.6.

The basis for the difference is given in UFSAR Section 3.1.2 (2), "Natural Phenomena." This section of the UFSAR describes that essential systems and components have been designed, fabricated, and erected to performance standards to enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena. The designs are based upon the most severe of the natural phenomena recorded for the vicinity of the site, with an appropriate margin to account for uncertainties in the historical data.

Question 15:

Describe any vulnerabilities and failure modes associated with the CCW inventory that may be pertinent to the tornado mitigation strategy.

Response 15:

For Station ASW, there is no specific failure modes modeled in the risk analysis for the CCW inventory. Alternatively, the SSF ASW system has additional cooling loads and requires some replenishment to support long-term SSF operation. Specifically, the SSF ASW pump minimum flow line, the SSF ASW air ejector line, water from the SSF HVAC service water system, and water from the SSF diesel service water system (prior to flow diversion) all contribute to the heat-up of water contained in the Unit 2 CCW supply pipe.

Water inventory in the CCW pipe could be reduced due to the following:

a. Supplying water to affected units SGs using the SSF ASW system.

b. SSF DSW flow diversion to the yard.

c. Depletion due to operation of other non-SSF Systems (HPSW, LPSW, etc).

d. Lose second siphon after first siphon is lost.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 25

e. CCW pipe break above 775'.

Based on an initial lake water temperature of 90TF and the expected increase in temperature of the water contained in the Unit 2 CCW supply pipe from the SSF service water systems, the temperature of water supplied to the SSF HVAC condensers could approach the equipment's 1 10TF operating temperature limit. In order to prevent this condition from occurring and to insure that an adequate volume of water is maintained in the Unit 2 CCW pipe for SSF service water system use, the SSF submersible pump is installed within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and 20 minutes after diesel emergency start if siphon flow and forced CCW flow are unavailable when the diesel is started.

If CCW siphon flow and forced CCW flow are lost after diesel emergency start, the SSF submersible pump is installed within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and 20 minutes after losing both forced CCW flow and siphon flow. Since the lake water delivered by the submersible pump is more likely to be cooler and denser than the water already in the CCW intake pipe, it will mix with the warmer water as it travels towards the bottom of the pipe and ultimately, will maintain water temperatures of SSF service water systems within acceptable limits. The operating temperature limit for other SSF Service Water System components is bounded by the operating temperature limit for the SSF HVAC condensers.

In the very unlikely case where CCW inventory is not replenished and assuming the most conservative (3 unit) event scenario, it is estimated that the quantity of water trapped below elevation 791 feet would [hypothetically] be able to supply the SSF ASW system for approximately 6 days assuming none of the sources of inventory loss described earlier are present. However, as discussed previously, elevated CCW water temperature issues can also challenge the long-term operation of the SSF if the submersible pump is not used.

The ONS PRA credits 3 sources of CCW makeup to support SSF operation. The first is the Emergency CCW suction from the intake canal ("first siphon") which has a high probability of failure either from direct tornado damage (loss of siphon) or from a loss of Siphon Seal Water (supplied from LPSW) or loss of Essential Siphon Vacuum (ESV) pumps.

The second source is manual alignment of a portable submersible pump powered by the SSF to refill the CCW inlet piping. The portable pump and related equipment are stored in the SSF where they are protected from tornado damage. Human error is the dominant failure mode for this means of CCW makeup.

The third source is from CCW reverse gravity flow from the lake discharge back through the Condensate Coolers to the CCW inlet piping where the SSF ASW and Station ASW pumps take their suction. This source is entirely passive due to normally-open valves and is not considered vulnerable to tornado damage. The CCW discharge piping is underground, and the bottom of the CCW discharge pipe is 791 feet mean sea level (MSL). The piping through the Condensate

Responses to Request for Additional Information Enclosure June 18, 2003 Page 26 Coolers is in the Turbine Building basement at approximately 775-790 feet MSL. The only modeled failure mode for CCW reverse gravity flow is low lake level which reduces the flow rate below minimum requirements.

Lake Keowee is the water source for reverse gravity flow. Lake Jocassee is about 11 miles to the north (upstream). The Jocassee Hydroelectric Station is a pumped storage facility which is normally capable of providing makeup water to Lake Keowee. The Keowee Hydroelectric Station releases water downstream to Lake Hartwell. During the 1980s, Keowee lake levels were sometimes very low - as low as 783.6 feet MSL in 1981. However, more restrictive administrative limits were placed on Keowee lake level during the 1990s. The vicinity of Oconee Nuclear Station experienced a historically record drought during 2000-2003. During this extreme drought, Keowee lake level was administratively maintained above approximately 793 feet by curtailed releases to Lake Hartwell and by drawdown of Lake Jocassee. Therefore, the probability of inadequate lake level for reverse gravity flow is estimated to be 0.01 based on historical data and other factors.

Question 16:

The SSF is not credited in the UFSAR for taking the plant to cold shutdown. Describe in detail how this will be accomplished on all of the Oconee units following a tornado event, including time required to complete actions, how staffing requirements will be satisfied, and how the Oconee units will be maintained in a safe condition over time.

Response 16:

The SSF has been designed and has the capability to bring all three Oconee Units to Mode 3 and maintain the units in that condition for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The proposed change does not require all of the units to be placed in a cold shutdown condition. Safe shutdown is accomplished through the SSF maintaining the plant in Mode 3. Procedures (OP/0IA/1 102/024 "Plant Damage Assessment and Alignment Following Major Plant Damage," and OP/0/A/1 102/025 "Plant Cooldown Following Major Plant Damage,") are available and would be used following a tornado for transitioning the plant to cold shutdown (Mode 5). These procedures were originally written to assess, repair and cooldown the plant within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following an Appendix R fire, however, following a tornado event, the cooldown time involved could potentially be longer.

If operation of the SSF beyond 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is needed, the Technical Support Center (TSC) would pursue obtaining additional fuel for the SSF diesel generator. In addition, the SSF submersible pump is available and can be used to provide SSF ASW cooling water for SSHR beyond the initial 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 27 Ouestion 17:

The deterministic evaluation in the submittal states that the SSF RCMU pump flow path replaces the existing SFP-HPI pump flow path for RCP seal injection and primary side makeup. Both of these flow paths currently exist and are currently available to perform this function, and it is not clear why this change is not characterized as the elimination (instead of a replacement) of the SFP-HPI flow path. Explain.

Response 17:

The SSF RCMU pump flow path will become the assured means of RCS makeup following a tornado event. Following the approval of the proposed changes in the LAR, the SFP-HPI flow path will no longer be credited in the PRA and the licensing basis.

Question 18:

The submittal states that as a consequence of the longer time required to establish RCP seal injection with an HPI pump, a RCP seal LOCA may have already occurred and the strategy would then require mitigation versus prevention.

a. Explain what prevention and mitigation capabilities exist if this should occur.

Response 18(a):

The LAR statement was included to point out an important advantage of SSF RCMU over SFP-HPI for post event primary makeup. Comparatively, the required operator actions outside of the control room to both set-up and align the flow path is much greater for the SFP-HPI flow path as compared to the SSF RCMU flow path. Because the station is not required to evaluate a LOCA with a tornado event, an RCP seal failure was not postulated; however, good engineering judgment dictates that the time saved in reestablishing seal cooling could be beneficial by potentially preventing damage to the seal.

All of the ONS-1, -2, and -3 RCPs now contain Sulzer seal packages which have significantly reduced the risk of a seal LOCA. As described in the LAR, the SFP-HPI flow path was not part of the original licensing basis but was voluntarily added in the early 1990s to address the potential need for primary makeup due to a (beyond design basis) seal LOCA. Following the completion of the seal upgrades, the original anticipated need for the SPF-HPI flow path diminished and, due to a number of technical concerns with the flow path itself, Duke has chosen not to continue crediting this flow path.

b. What is the failure probability of the various means that are available for establishing RCP seal injection? Explain the basis for this determination.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 28 Response 18(b):

The availability of RCP seal injection is entirely dependent on two things: the availability of normal 4160-volt (very high likelihood of failure) and the availability of the SSF RCMU system.

The response to Question 7(a.) provides a comparison of the failure probabilities for emergency power and the SSF.

Question 19:

Explain how differentiation of EFW and SSF ASW "start" and "run" failures give additional time to allow HPI to be re-powered from the Station ASW switchgear. Is this "additional time" sufficient to resolve the RCP seal LOCA problem referred to in the previous question?

Response 19:

Successful feedwater initiation following a tornado strike provides core cooling while actions are taken to restore power to one HPI pump if the 4160-volt power system is damaged. In this case, the role of the "recovered" HPI system would be for primary system makeup to mitigate a seal LOCA rather than to prevent one. A "start failure" of all SSHR would result in core damage before HPI can be re-powered from the Station ASW switchgear.

The principle purpose of differentiating start and run failures in the risk model is to more accurately predict the likelihood of a liquid relief challenge to the PORV or Pressurizer Safety Valves. However, with an intact BWST, successful realignment of HPI power provides operators the option of feed and bleed cooling if a subsequent SSHR "run failure" occurs.

The inclusion of this feature in the tornado risk model provides little or no risk benefit because successful feed and bleed cooling requires BWST makeup which is ultimately dependent on the 4160-volt power system. On the other hand, it is potentially important to consider this feature when evaluating the potential benefits of other plant improvements, thus this feature has been retained in the risk model.

Ouestion 20:

The submittal requests NRC approval to eliminate the SFP-HPI flow path from the current licensing basis in part because the flow path is not reliable, and because elimination of the flow path from the licensing basis does not result in a reduction in safety. However, currently both the SFP-HPI flow path and the SSF RCMU flow path are available for primary makeup.

Eliminating the SFP-HPI flow path reduces the existing capability, thereby degrading defense-in-depth, and results in a slight increase in risk consequences. This in fact appears to be a reduction in safety.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 29

a. Explain the basis for concluding that elimination of the SFP-HPI flow path does not result in a reduction in safety.

Response 20(a):

The statement, "...there are no reductions in safety associated with eliminating the SFP-HPI flow path from the current LB," given on page 9 of the LAR is an oversight. The removal of the SFP-HPI flow path does in fact have some safety significance; however, taken in aggregate, Duke has concluded that the slight increase in risk associated with its removal is outweighed by the risk benefit gained from the removal of a tornado vulnerability associated with SSF RCMU system.

Consequently, there would be a net increase in safety. Therefore, the conclusion is accurately stated in the "No Significant Hazards Consideration" response (Attachment 4 of the LAR) that the proposed changes do not involve a significant reduction in the margin of safety.

b. Explain how defense-in-depth with respect to primary makeup capability is maintained (commensurate with the existing capability that exists) with elimination of the SFP-HPI flow path.

Response 20(b):

Despite the elimination of the SFP-HPI flow path, defense-in-depth for the primary makeup function is improved with the additional protection to be provided for the SSF and the improvement of the reactor coolant pump seals. It is noteworthy that Duke's original purpose of adding this suction path was to compensate for the poor seal reliability modeled in the Oconee PRA analysis. Full protection of the SSF systems improves the availability of SSF RC Makeup following a tornado strike and HPI makeup from the BWST is maintained.

Regulatory Guide 1.174 provides guidance for assessing whether a licensing basis change meets the defense-in-depth principle. The RG states that consistency with the defense-in-depth philosophy is maintained if the following 7 elements are met.

1.) A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

The proposed changes result in a net improvement in core damage frequency without any adverse effects on the existing containment reliability and consequence mitigation capabilities 2.) Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 30 The proposed changes do not add new programmatic activities to compensate for plant design weaknesses.

3.) System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

Defense-in-depth is improved with the additional protection to be provided for the SSF and the improvement of the reactor coolant pump seals. Full protection of the SSF systems improves the availability of SSF ASW and SSF RC Makeup following a tornado strike. HPJ makeup from the BWST is maintained The elimination of the SFP-HPIflow path is compensated for with the improvement of the reactor coolant pump seals. The reliability of the new seals is orders of magnitude better than the original seal design. This improvement more than compensates for the HPI reliability lost due to eliminating the alternate suction source from the SFP which is considered to be of modest to low reliability.

4.) Defenses against potential common cause failures are preserved, and the potential for the introduction of new common cause failure mechanisms is assessed.

The proposed changes eliminate the common mode failure mechanism of tornado damage to West Penetration Room which impacts the availability of the SSF, EFW HPI, and Station ASW.

5.) Independence of barriers is not degraded.

The proposed changes do not adversely impact the independence of existing barriers.

6.) Defenses against human errors are preserved.

The proposed changes do not adversely impact existing defenses against human error.

7.) The intent of the General Design Criteria in Appendix A to 10 CFR 50 is maintained.

The intent of the original Oconee Design Criteria is maintained [

Reference:

Response to Question 1 from Duke's January 9, 2003 RAI submittal].

c. Provide a comparison of the reliability of the SFP-HPI primary makeup capability with the reliability of the SSF RCMU primary makeup capability. Explain the basis for this

Responses to Request for Additional Information Enclosure June 18, 2003 Page 31 determination. Discuss measures that could be taken to improve the reliability of the SFP-HPI flow path and the amount of improvement that could be achieved.

Response 20(c):

The availability of HPI makeup from the SFP is highly dependent on the availability of emergency power from Keowee, the availability of secondary-side heat removal, and the heat load of the SFP. However, the risk importance (CDF contribution) of this system is also dependent on the reliability of the SSF, reliability of the RCP seals, and the failure probability of the BWST. The response to Question 7(a) provides information on the failure probabilities Keowee emergency power and the SSF. Response to Question 3 from the January 29 2003 RAI submittal describes the basis for the failure probability of the BWST. Beyond these functional dependencies, the SFP alignment is a challenging operator action to accomplish. The alignment requires the manipulation of a significant number of valves at very dispersed locations around the plant, and must be completed in a timely and coordinated manner under Station Blackout conditions. The system also has other maintenance and testing limitations that provide additional uncertainty to the reliability of this alignment following a tornado strike.

The maximum potential benefit of any SFP-HPI modification/changes would be limited to the low to middle E-07 range due to spatial and functional dependencies between the failure of the BWST and the loss of all 4160-volt power which in turn has functional dependencies with the EFW and Station ASW (I&C power). The most beneficial plant change with regard to reducing the risk associated with RCS makeup following a tornado strike is to install the most rugged and reliable RCP seals available with current technology. Oconee has already accomplished this task.

In addition, the risk analysis in support of this submittal used a conservative estimate of the RCP seal failure probability (based on WOG2000 model). The CE Owners Group (CEOG) has submitted a Seal Failure Model to the NRC seeking approval for the use of lower seal failure probabilities in risk analyses. This report provides detailed information and analysis supporting significantly lower failure probabilities for the Byron-Jackson/Sulzer seals that Oconee has installed.

Ouestion 21:

During a meeting on December 20, 2002, the licensee indicated that the tornado vulnerabilities associated with the CR-3 block wall and SSF cable trench will be eliminated. Provide a schedule for when these actions will be completed.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 32 Response 21:

SSF Cable Trench:

The planned modification to correct the SSF cable trench missile vulnerability is to install a "Natural Phenomenon Barrier System" that will provide ample missile protection to susceptible portions of the trench. Implementation of this modification is currently scheduled to begin in 2005.

Oconee ONS-3 Control Room North Wall Delta-P and Missile Vulnerabilities:

A change to UFSAR Table 3-23 is being made to change the design requirement for pressure relief blow-out panels for the ONS-1, 2, and 3 control rooms. The change involves specifying that a blow-out panel is required only for the ONS-3 control room. Recent analysis has shown that there are sufficient pressure relief mechanisms in the ONS-1 and 2 control rooms such that additional pressure relief, afforded by blow-out panels, would not be necessary. For the ONS-3 control room, a minor modification, to ensure that the wall can withstand 3 psi differential pressures from a design basis tornado, is currently scheduled to be implemented during the ONS-3 end-of-cycle 21 refueling outage (Fall 2004).

For missiles, an evaluation to review and update the current Oconee TORMIS model is underway and is scheduled to be completed in June 2003. Following the completion of the TORMIS evaluation, changes will be made to applicable portions of the UFSAR in order to both (1) clarify the control room's missile protection capabilities and (2) incorporate the TORMIS methodology into the Oconee licensing basis. Completion of this activity is currently scheduled for August 2003.

Ouestion 22:

Confirm that the various strategies that are credited in the accident and PRA analyses for mitigating tornado events will not cause steam generator tube stresses to be exceeded.

Response 22:

The Oconee once through steam generators have been analyzed for both tensile and compressive steam generator stresses. Tensile stresses occur when the RCS cools down relative to the steam generator shell. Compressive stresses occur when the RCS heats up relative to the steam generator shell.

The worst case tensile stresses have been analyzed assuming a double-ended steam line break on one steam generator with 10 minutes of continued EFW flow to the faulted SG. Based on the response to Question 23, it is not expected that a tornado induced steam line break will result in a

Responses to Request for Additional Information Enclosure June 18, 2003 Page 33 more severe overcooling than that already analyzed. Therefore, tensile stresses are bounded by the existing steam line break tube stress analysis.

The worst case tensile stresses have been analyzed assuming a double-ended steam line break on one steam generator with 10 minutes of continued EFW flow to the faulted SG. Since the tornado causes a loss of power, the only feedwater addition expected with a concurrent steam line break is EFW. Smaller steam line breaks will not result in as severe an overcooling and therefore only the double-ended rupture is considered. The expected response is that AFIS will actuate mitigating the overcooling followed by prompt operator action to isolate the faulted SG(s) provided AFIS is unavailable. Failing either of those, the event reverts back to a main steam line break without power and 10 minutes of continued EFW to the faulted SG. Without power, the overcooling aspect is limited somewhat since natural circulation will be established.

Therefore, it is not expected that a tornado induced steam line break will result in a more severe overcooling than that already analyzed and it is concluded that tensile stresses will be bounded by the existing steam line break tube stress analysis.

Ouestion 23:

What assurance is there that steamline integrity will be maintained during a tornado event (e.g.,

piping/drain valves remain intact, the bypass valves and main steam valves stay closed, and the control/EHC/instrumentation for these valves are protected so they do not go open). If it is possible that integrity of the main steam lines could be lost during a tornado event, describe how the event will be mitigated.

Response 23:

Damage to the steam lines is not postulated in Oconee's licensing basis. Although there are portions of the main steam piping that are not protected from tornado damage, due to the location and inherent ruggedness of the main steam piping, the likelihood of a large break has traditionally been considered to be a low probability event and not of consequence to the PRA risk analysis.

The following features support this position.

The main steam headers located outside, between the Reactor Buildings and the Turbine Building (TB) are capable of withstanding 300 mph winds.

A 1993 missile analysis estimated that the probability of missile damage to the 3B main steam header (the longest and most exposed segment of steam piping) to be in the mid E-C8 range. This low probability stems from the thickness of the pipe and its high elevation above grade.

Responses to Request for Additional Information Enclosure June 18, 2003 Page 34

• After entering the TB and connecting to the ADVs, the steam headers turn down and stay mostly below the turbine deck where it is less exposed to wind loads and mostly protected from tornado missiles.

Based on the above considerations, the likelihood of a large break is still believed to be low in the Rev. 3 risk analysis. However, Duke has not quantified the wind capacity of the main steam piping inside the Turbine Building. Thus, an engineering review of this piping is being conducted per the corrective action program to validate the assumption in the PRA that the risk of main steam line failure during a tornado is low. If the engineering analysis concludes that the risk of steam line failure is high, additional corrective actions will be taken to ensure overall plant risk due to tornadoes is minimized.