ML042990009

Safety Evaluation, Change the Licensing Basis for Tornado Mitigation

ML042990009
Person / Time
Site:	Oconee
Issue date:	11/04/2004
From:	Hackett E NRC/NRR/DLPM/LPD2
To:	Rosalyn Jones Duke Energy Corp
Olshan L N, NRR/DLPM, 415-1419
References
TAC MC4608, TAC MC4609, TAC MC4610
Download: ML042990009 (16)

Text

November 4, 2004 Mr. Ronald A. Jones Vice President, Oconee Site Duke Energy Corporation 7800 Rochester Highway Seneca, SC 29672

SUBJECT:

EVALUATION OF A REQUEST TO CHANGE THE LICENSING BASIS FOR TORNADO MITIGATION AT OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3 (TAC NOS. MC4608, MC4609, AND MC4610)

Dear Mr. Jones:

By application to the U.S. Nuclear Regulatory Commission (NRC) dated June 7, 2002, as supplemented by letters dated January 29 and June 18, 2003, Duke Energy Corporation, the licensee for Oconee Nuclear Station (Oconee), Units 1, 2, and 3, requested changes to the licensing basis for tornado mitigation at Oconee. The proposed changes would: a) establish the standby shutdown facility (SSF) as the assured means of achieving safe shutdown following a tornado event, and b) eliminate any reliance on the flow path from the spent fuel pool to the high pressure injection system as a source of reactor coolant makeup water for mitigating tornado events. Your request was submitted as risk-informed changes to the licensing basis for the Oconee units.

By letter dated September 9, 2004, you withdrew the amendment request based primarily on the higher than expected cost for plant modifications needed to ensure that SSF functions would be fully tornado protected. By letter dated September 22, 2004, the NRC staff acknowledged your withdrawal and provided a brief summary of some of the issues that we identified during our review of your amendment request. The enclosure provides our detailed evaluation of your amendment request. The NRC staff is providing this evaluation with the intent that it will assist you in your future considerations regarding tornado mitigation.

Sincerely,

/RA/

Edwin M. Hackett, Project Director Project Directorate II Division of Licensing Project Management Office of Nuclear Reactor Regulation Docket Nos. 50-269, 50-270, and 50-287

Enclosure:

As stated cc: See next page

November 4, 2004 Mr. Ronald A. Jones Vice President, Oconee Site Duke Energy Corporation 7800 Rochester Highway Seneca, SC 29672

SUBJECT:

EVALUATION OF A REQUEST TO CHANGE THE LICENSING BASIS FOR TORNADO MITIGATION AT OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3 (TAC NOS. MC4608, MC4609, AND MC4610)

Dear Mr. Jones:

By application to the U.S. Nuclear Regulatory Commission (NRC) dated June 7, 2002, as supplemented by letters dated January 29 and June 18, 2003, Duke Energy Corporation, the licensee for Oconee Nuclear Station (Oconee), Units 1, 2, and 3, requested changes to the licensing basis for tornado mitigation at Oconee. The proposed changes would: a) establish the standby shutdown facility (SSF) as the assured means of achieving safe shutdown following a tornado event, and b) eliminate any reliance on the flow path from the spent fuel pool to the high pressure injection system as a source of reactor coolant makeup water for mitigating tornado events. Your request was submitted as risk-informed changes to the licensing basis for the Oconee units.

By letter dated September 9, 2004, you withdrew the amendment request based primarily on the higher than expected cost for plant modifications needed to ensure that SSF functions would be fully tornado protected. By letter dated September 22, 2004, the NRC staff acknowledged your withdrawal and provided a brief summary of some of the issues that we identified during our review of your amendment request. The enclosure provides our detailed evaluation of your amendment request. The NRC staff is providing this evaluation with the intent that it will assist you in your future considerations regarding tornado mitigation.

Sincerely,

/RA/

Edwin M. Hackett, Project Director Project Directorate II Division of Licensing Project Management Office of Nuclear Reactor Regulation Docket Nos. 50-269, 50-270, and 50-287

Enclosure:

As stated cc: See next page DISTRIBUTION:

PUBLIC PDII-1 R/F MRoss-Lee DClarke LOlshan OGC ACRS RHaag, RII DLPM DPR ADAMS Accession Number: ML042990009

• No major changes to SE OFFICE PM:PDII-1 LA:PDII-1 (A)

SC:DSSA SC:PDII-1 (A)

D:PDII-1 NAME LOlshan DClarke JYerokun MRoss-Lee EHackett DATE 10/27/04 11/02/04 8/18/04 10/27/04 11/4/04 OFFICIAL RECORD COPY

Oconee Nuclear Station, Units 1, 2, and 3 cc:

Ms. Lisa F. Vaughn Duke Energy Corporation Mail Code - PB05E 422 S. Church St.

P.O. Box 1244 Charlotte, NC 28201-1244 Ms. Anne W. Cottingham, Esq.

Winston and Strawn 1400 L St, NW Washington, DC 20005 Manager, LIS NUS Corporation 2650 McCormick Dr., 3rd Floor Clearwater, FL 34619-1035 Senior Resident Inspector U.S. Nuclear Regulatory Commission 7812B Rochester Highway Seneca, SC 29672 Mr. Henry Porter, Director Division of Radioactive Waste Management Bureau of Land and Waste Management Dept. of Health and Env. Control 2600 Bull St.

Columbia, SC 29201-1708 Mr. Michael A. Schoppman Framatome ANP 1911 North Ft. Myer Dr.

Suite 705 Rosslyn, VA 22209 Mr. B. G. Davenport Regulatory Compliance Manager Oconee Nuclear Site Duke Energy Corporation ON03RC 7800 Rochester Highway Seneca, SC 29672 Ms. Karen E. Long Assistant Attorney General NC Department of Justice P.O. Box 629 Raleigh, NC 27602 Mr. R. L. Gill, Jr.

Manager - Nuclear Regulatory Issues and Industry Affairs Duke Energy Corporation 526 S. Church St.

Mail Stop EC05P Charlotte, NC 28202 Mr. Richard M. Fry, Director Division of Radiation Protection NC Dept of Environment, Health, & Natural Resources 3825 Barrett Dr.

Raleigh, NC 27609-7721 Mr. Peter R. Harden, IV VP-Customer Relations and Sales Westinghouse Electric Company 6000 Fairview Road 12th Floor Charlotte, NC 28210 Mr. Henry Barron Group Vice President, Nuclear Generation and Chief Nuclear Officer P.O. Box 1006-EC07H Charlotte, NC 28201-1006

Enclosure EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION OF A REQUEST TO CHANGE THE LICENSING-BASIS CRITERIA FOR TORNADO MITIGATION AT OCONEE UNITS 1, 2, AND 3 DOCKET NOS. 50-269, 50-270, AND 50-287

1.0 INTRODUCTION

By application to the U.S. Nuclear Regulatory Commission (NRC) dated June 7, 2002, as supplemented by letters dated January 29 and June 18, 2003, Duke Energy Corporation (Duke, or the licensee) requested changes to the licensing basis criteria for tornado mitigation for Oconee Nuclear Station, Units 1, 2, and 3. The proposed changes would: a) establish the standby shutdown facility (SSF) as the assured means of providing secondary side heat removal (SSHR) following a tornado event, and b) eliminate any reliance on the flow path from the spent fuel pool (SFP) to the high pressure injection (HPI) system as a source of reactor coolant makeup (RCMU) water for mitigating tornado events. The licensees request was submitted as risk-informed changes to the Oconee licensing basis in order to address tornado mitigation vulnerabilities that have been identified. These vulnerabilities are summarized below in Section 2.2.

By letter dated September 9, 2004, the licensee withdrew the amendment request based primarily on the higher than expected cost for plant modifications needed to ensure that SSF functions would be fully tornado protected.

2.0 REGULATORY EVALUATION

The proposed risk-informed changes to the Oconee licensing basis are related to the SSHR and RCMU capabilities that are credited for tornado mitigation at Oconee, Units 1, 2, and 3.

The review criteria and regulatory guidance that are most pertinent to the proposed changes include NUREG-0800, Standard Review Plan, Section 19.0, Use of Probabilistic Risk Assessment in Plant-Specific, Risk-Informed Decisionmaking: General Guidance, and Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis. These documents provide the applicable guidance for NRC staff review of risk-informed changes to a plants licensing basis and will be used, in conjunction with existing licensing-basis criteria, in judging the acceptability of the changes that are proposed to the Oconee tornado mitigation capability relative to SSHR and RCMU.

2.1 Existing Oconee Licensing Basis for Tornado Mitigation The construction permits for the Oconee units were issued before the General Design Criteria (GDC) of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix A, became effective and therefore, the GDC are not regulatory requirements for the Oconee units.

Instead, Dukes implementation of the seventy (draft) GDC that were initially proposed for nuclear power plant construction permits, as noticed by the Atomic Energy Commission in the Federal Register on July 11, 1967, became part of the Oconee licensing basis. Stemming in part from these criteria, some of the fundamental elements of the Oconee licensing basis that pertain to tornado mitigation are reflected in the Oconee Updated Final Safety Analysis Report (UFSAR), Section 3.1.2, Criterion 2 - Performance Standards (Category A), Section 3.1.4, Criterion 4 - Sharing of Systems (Category A), Section 3.2.2, System Quality Group Classification, and Section 3.3, Wind and Tornado Loadings. The following are specific criteria that were established for assuring reactor safety following a tornado event:

UFSAR Section 3.1.2 indicates that essential systems and components (including HPI among others) and electric emergency power sources, have been designed, fabricated, and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena. The designs are based upon the most severe of the natural phenomena recorded for the vicinity of the site, with appropriate margin to account for uncertainties in the historical data.

UFSAR Section 3.1.4 indicates that safety will not be impaired by the sharing of systems between the Oconee units.

UFSAR Section 3.2.2 defines design criteria for loss-of-coolant accidents (LOCAs) and natural phenomena. Among other things, the criteria indicate that a tornado will not be allowed to cause a LOCA. With respect to tornados, the design objectives of UFSAR Section 3.2.2 include the capability to shutdown safely all three units.

UFSAR Section 3.3.2.3, Effect of Failure of Structures or Components Not Designed for Tornado Loads states, The Reactor Coolant System will not be damaged by a tornado. Capability is provided to shutdown safely all three units.

With respect to SSHR following a tornado, the current Oconee licensing basis credits the redundant and diverse sources of secondary makeup capability provided by the other units emergency feedwater (EFW) systems; the tornado-protected, low-head, station auxiliary service water (ASW) pump; and the high-head SSF ASW pump. This approach was adopted because the EFW system of the affected unit is not tornado-protected and can not be relied upon following a tornado. The SSF ASW system was specifically recognized and credited for accomplishing the SSHR function in the event that a tornado disables the Keowee Hydro Units (KHUs), the emergency power source for the Oconee units, resulting in a station blackout situation because off-site power is assumed to be disabled by the tornado. The station ASW system was considered to be the tornado-protected means of accomplishing the SSHR function because it was able to provide water to the steam generators (SGs) through protected or physically separated lines, it could be powered from an emergency bus, and it had approximately 37 days worth of water stored in the buried condenser circulating water (CCW) piping that was available for feeding the SGs.

In addition to the tornado vulnerabilities associated with the KHUs and the EFW system of the affected unit, the Oconee licensing basis also recognized and allowed the following tornado-missile vulnerabilities: a) for the EFW system of the affected unit, the upper surge tanks and piping in the east and west penetration rooms; b) for the tornado-protected station ASW system, piping in the east and west penetration rooms; and c) for the SSF ASW system, a small portion of piping in the west penetration room. Although these vulnerabilities are somewhat contrary to the fundamental licensing-basis criteria that were established for tornado mitigation (referred to above), they were recognized and allowed by the NRC.

Unlike SSHR, the specific provisions for providing RCMU following a tornado, including minimum flow considerations, were not explicitly addressed in the Oconee licensing basis.

Therefore, the licensing basis for RCMU following a tornado is governed by the fundamental criteria discussed above, which requires sufficient capability to shutdown safely the Oconee units following a tornado; no specific exceptions to this were recognized and allowed by the NRC.

2.2 Tornado Mitigation Vulnerabilities A recent NRC inspection at the Oconee Nuclear Station documented a number of deficiencies associated with the existing Oconee tornado mitigation capability. NRC Supplemental Inspection Report 50-269,270,281/02-07 dated May 31, 2002, for the three Oconee units includes the following information in this regard:

(1)

Loss of Auxiliary Power to the Keowee Hydroelectric Units Failure of the Unit 1 4KV buses due to tornado wind or missile effects results in a loss of the assured source of power for the KHU auxiliary equipment, resulting in a loss of emergency power for all three units. Duke promptly implemented a plant modification to enable the operators to power the KHU auxiliaries from the electrical output of the KHUs. Consequently, no appreciable change in core damage frequency (CDF) has resulted.

(2)

Turbine-Driven Emergency Feedwater (TDEFW) Pump Cooling A tornado-induced failure of the Unit 1 safety-related 4KV buses would de-energize the support systems (high pressure and low pressure service water cooling) for the TDEFW pump. This previously unrecognized failure mechanism resulted in an increase in CDF of about 1E(-6) per Reactor Year (RY).

(3)

Operation of the Atmospheric Dump Valves (ADVs)

Damage and debris due to tornado effects could render the ADVs unavailable for SG depressurization, thereby eliminating use of the tornado-protected station ASW system for SSHR. This previously unrecognized failure mechanism resulted in an increase in CDF of about 9E(-7)/RY.

(4)

Access to Valve LP-28 In the event that the borated water storage tank (BWST) is damaged by a tornado, the Oconee design basis credits operator action to align the HPI pump to take suction from the SFP for a source of reactor coolant system (RCS) makeup water. The manually operated BWST isolation valve, which is located only a few feet from the tank, must be closed to avoid diverting water from the SFP to the damaged BWST. Damage and debris due to tornado effects may render the valve inaccessible. This previously unrecognized failure mechanism resulted in an increase in CDF of about 7E(-8)/RY.

(5)

Tornado-Protected Station ASW Pump Flow Control Duke identified that there are potential run-out and flow control difficulties with the tornado-protected station ASW pump when feeding multiple SGs. Initial feeding of three or more SGs (multiple units) would place the pump in a run-out flow condition. If tornado-related damage occurred to discharge piping in the unprotected west penetration room, pump run-out conditions would worsen. Such piping damage would make it even more difficult to establish and maintain proper flow when feeding multiple SGs. In addition, the complex communications between remote locations for feeding multiple SGs would also tend to increase the failure probability. The licensee concluded that using the tornado-protected ASW pump to provide SG feedwater to more than one unit was not considered credible. This previously unrecognized failure mechanism resulted in an increase in CDF of about 5E(-8)/RY.

(6)

SG Tubes Differential Temperature Issue Due to the time necessary to evaluate alternate core cooling strategies and to place the tornado-protected station ASW pump into service, the compressive SG tube stresses were calculated to exceed the manufacturers design limits. The licensee established a new differential temperature limit of 108 EF based on initiating station ASW pump flow within 40 minutes. Duke was continuing to evaluate the effect of this new temperature limit on SG tube compressive stresses. The report did not include an estimation of the resultant change in CDF due to this deficiency.

(7)

SFP Suction for High Pressure Injection The water inventory in the SFP was not sufficient to ensure a 24-hour mission time for a HPI pump during all conditions and the ability of the SFP to perform this function is limited. Assuming that operators could wait for nine hours before aligning the HPI pump suction to the SFP, the licensee estimated that the SFP would be unable to perform this function for about 10 percent of the time. This previously unrecognized failure mechanism resulted in an increase in CDF of about 6E(-7)/RY.

(8)

Pressurizer Safety Valve Reseating Design documents for the pressurizer Code safety valves did not include qualification for being able to reseat after passing 500EF reactor coolant. Scenarios that rely on use of the tornado-protected station ASW pump for SSHR could involve a 40-minute delay in establishing feedwater flow to the SGs. During this 40-minute delay, the RCS will heat up, causing reactor pressure to increase and lift the pressurizer Code safety valves.

Steam would be released initially, followed by reactor coolant. If the pressurizer Code safety valves failed to reseat when reactor pressure eventually subsided, the tornado-protected station ASW pump and HPI pump combination would not be able to maintain adequate core cooling with the continuous loss of reactor coolant through the failed open safety valves. Based on industry testing that has been completed indicating (according to Duke) that valves of the type used at Oconee could pass hot water and reseat successfully, and based on an actual event at another facility of the same nuclear steam supplier, Duke concluded that the originally assigned failure probability of the Oconee pressurizer Code safety valves to close was acceptable. Consequently, no change in CDF due to this deficiency was reported.

(9)

Unit 3 North Control Room Wall The north wall of the Unit 3 control room was not originally designed and constructed to withstand the effects of the design-basis tornado (i.e., tornado missiles and differential pressure). In the submittal dated June 18, 2003, in response to Question 21, Duke indicated that a modification would be made to enable the wall in question to be able to withstand the necessary differential pressure loads caused by the design basis tornado, and that the missile impact would be evaluated using the TORMIS computer code. To the extent that this condition is corrected, no change in CDF is expected.

(10)

Additional Tornado Mitigation Deficiencies Inspection Report 02-07 also indicated that the following additional limitations in the Oconee tornado mitigation strategy were identified by the licensee:

Postulated tornado events could cause the loss of electrical power to the battery chargers of multiple units, which would lead to a loss of the vital instrumentation that is necessary for operating the EFW and tornado-protected station ASW systems. This previously unrecognized failure mechanism resulted in an increase in CDF of about 6E(-7)/RY.

Postulated tornado events could result in a loss of the 4160 VAC standby bus feeders that pass from the Units 1 and 2 tornado-protected block house to the Unit 3 main feeder bus. This previously unrecognized failure mechanism resulted in an increase in CDF of about 2.5E(-6)/RY.

Postulated tornado events could result in collective effects that fail the BWST and the west penetration room of a particular unit coupled with the failure of electrical connections between the standby and main feeder buses for multiple units. This previously unrecognized failure mechanism resulted in an increase in CDF of about 2.8E(-6)/RY.

Inspection Report 02-07 noted that the present estimate of CDF due to tornado on a particular reactor unit is approximately 2.2E(-5)/RY versus the 1.4E(-5)/RY that was estimated prior to taking into consideration all of the new tornado vulnerabilities that had been identified. This represents an increase in CDF of about 8E(-6)/RY (changes in risk modeling account for some of the increase). Many of these newly discovered vulnerabilities are contrary to the existing Oconee tornado-mitigation licensing basis (discussed in Section 2.1, above), and the licensees proposed changes would modify the existing Oconee licensing basis such that most of the vulnerabilities noted above would be acceptable as is.

3.0 TECHNICAL EVALUATION

The licensees submittal of June 7, 2002, as supplemented by letters dated January 29 and June 18, 2003, requested NRC review and approval to: a) establish the SSF as the assured means for achieving safe shutdown of the Oconee units following a tornado event, and b) eliminate any reliance on the flow path from the SFP to the HPI system as a source of RCMU for mitigating tornado events. Pursuant to RG 1.174, these proposed changes were submitted as a risk-informed license amendment request.

The NRC staffs review of risk-informed changes to a plants licensing basis is performed in accordance with the guidance provided in Standard Review Plan (SRP) Chapter 19.0 and in RG 1.174. SRP Chapter 19.0 states that the decision making process will use the results of the risk analyses in a manner that complements traditional engineering approaches, supports the defense-in-depth (DID) philosophy, and preserves safety margins. Thus, risk analysis will inform, but it will not determine regulatory decisions. The proposed changes to the Oconee licensing basis are considered to be relatively risk-neutral, and this evaluation focuses primarily on the traditional engineering considerations as outlined in SRP Chapter 19.0 and RG 1.174, including the licensees characterization of the proposed change with respect to the plant licensing basis, compliance with existing regulations, adherence to the DID principles, and preservation of safety margins.

3.1 SSF as the Assured Means of Accomplishing SSHR Following a Tornado Currently, with respect to SSHR, the NRC staff now understands that those portions of SSF piping and cabling that pass through the west penetration and the cask decontamination rooms are vulnerable to damage from tornado effects. As discussed above in Section 2.1, the licensee previously indicated that the SSF was only vulnerable to damage due to tornado-induced failure of the west penetration rooms. Duke planned to harden the walls of the west penetration and cask decontamination rooms to protect these areas from the effects of tornado missiles, thereby establishing the single train SSF as a fully tornado-protected means of achieving safe shutdown. Consequently, in light of the numerous vulnerabilities associated with the existing licensing basis SSHR capability that have been identified (as noted above in Section 2.2), Duke had requested NRC approval to change the existing Oconee licensing basis to credit a fully tornado-protected SSF as the assured means of accomplishing SSHR following a tornado, instead of crediting the combined capabilities of the tornado-protected station ASW system, EFW from the unaffected units, and the existing (currently not fully tornado-protected)

SSF ASW system.

The proposed change to credit the SSF as the assured means of accomplishing the SSHR function following a tornado would have eliminated reliance on the other means of accomplishing the SSHR function that are currently credited. The NRC staff found that because the licensees risk evaluation of the proposed change did not compensate for the tornado vulnerabilities that have been identified (discussed in Section 2.2), the licensees evaluation is non-conservative and the proposed change would likely result in a slight increase in risk. Nonetheless, the NRC staff concludes that the proposed change satisfied the criteria in RG 1.174 for making risk-informed licensing-basis changes.

Compliance with Existing NRC Requirements The licensees proposed change to credit the SSF ASW system as the assured means of accomplishing the SSHR function following a tornado represents a significant departure from the intended functions of the SSF of mitigating fire, flooding, and sabotage events; and for providing additional DID capability. Existing technical specification (TS) completion time (CT) restrictions and surveillance requirements for the SSF did not include assured tornado-mitigation capability as a prime consideration, and existing TS requirements for the SSF must therefore be reconsidered. For example, the existing 45-day CT for the SSF was allowed primarily because other means of performing the SSHR function were considered to be available. The licensee failed to adequately consider and propose TS requirements that are appropriate and necessary for the SSF assured tornado mitigation function.

Defense-in-Depth Considerations RG 1.174 identifies a number of elements that can be used as guidelines for assessing whether or not a proposed licensing-basis change satisfies the DID principle. The NRC staffs assessment of the proposed change against each of these elements follows.

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

Currently, the licensing basis credits the tornado-protected station ASW system, EFW from the unaffected units, and the SSF ASW system; the proposed change would only credit the SSF ASW system as the assured means of providing SSHR. While the licensees proposed plan (subsequently withdraw) to harden the west penetration and cask decontamination room walls against tornado missiles would have provided some benefit, the licensee has not demonstrated that this would have been enough to compensate for the additional SSHR capabilities currently afforded by the station ASW system and the EFW systems of the unaffected units under the existing licensing basis.

Over-reliance on programmatic activities to compensate for weaknesses in plant designs is avoided.

The only programmatic activity that would be relied upon in support of the proposed change is to establish administrative controls to staff the SSF whenever a tornado warning is in effect. This action is necessary to ensure that the operators are on location and able to operate the SSF before a tornado actually strikes the Oconee station, possibly rendering the SSF inaccessible, and does not constitute over-reliance on programmatic activities. However, the administrative control that is planned is considered to be inadequate in that the tornado warning could have resulted from a tornado strike at the Oconee station, in which case it would be too late to man the SSF.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g.,

no risk outliers).

The existing licensing basis for establishing SSHR following a tornado provides redundancy, independence, and diversity by relying on the combined capabilities of the tornado-protected station ASW system, EFW from the unaffected units, and the (currently not fully tornado-protected) SSF ASW system. By relying only on a fully tornado-protected SSF ASW system as the assured means of providing SSHR following a tornado, redundancy and diversity are lost. Also, the SSF is considered to be relatively unreliable, which detracts somewhat from its independence. While the proposed action to harden the west penetration and cask decontamination room walls against the effects of tornado missiles eliminates the SSF tornado missile vulnerability that currently exists, the licensee has not demonstrated that the planned improvement is enough to overcome the loss of redundancy and diversity that would result from the proposed change.

Defenses against potential common cause failures are preserved, and the potential for the introduction of new common cause failure mechanisms is assessed.

Eliminating the redundancy and diversity of the SSHR capability that is provided under the existing licensing basis for tornado mitigation will degrade defenses against common cause failures, although the proposed improvement to harden the west penetration and cask decontamination room walls from the effects of tornado missiles would have improved defenses against common cause failure due to tornado missiles. However, the licensee has not demonstrated that the proposed improvement is enough to overcome the loss of redundancy and diversity that would result from the proposed change.

Independence of barriers is not degraded.

The proposed change does not establish new barrier failure modes that have not been considered previously and therefore, independence of barriers is not degraded by the proposed change.

Defenses against human errors are preserved.

The proposed change would eliminate reliance on the station ASW system and on the EFW systems of the unaffected units. This would tend to preserve defenses against human errors because operator actions that are required for aligning these sources of SSHR would no longer be credited by the proposed change.

The intent of the GDC in Appendix A to 10 CFR 50 is maintained.

Since the GDC as published in 10 CFR 50, Appendix A, do not apply to Oconee, the NRC staff considered the intent of the preliminary version of the GDC and other licensing-basis criteria that were applied to the Oconee units in evaluating this particular principle. In order to credit the SSF ASW system as the assured means of establishing SSHR following a tornado, the licensee had planned to fully protect the SSF from the effects of tornados. While this would have satisfied the intent of the Oconee licensing basis in most respects, it fell short with respect to reliability considerations and the capability to establish and maintain long-term cooling. Reliability of the SSHR function was established as a licensing-basis criterion for the Oconee units following the accident that occurred at Three Mile Island (TMI), Unit 2, by post-TMI Action Plan Item II.E.1.1, Auxiliary Feedwater System Evaluation. The mission time of the SSF is only 72-hours, which does not provide for long-term cooling, and the licensee has not established how long-term cooling capability is assured by the proposed change. Additionally, no assurances have been established that the portable CCW makeup pump will be able to access and transfer water from a usable source to the buried Unit 2 CCW piping (the SSF ASW suction source) following a tornado. Under the existing licensing basis, the tornado-protected station ASW pump is assured a 37-day supply of water from the Unit 2 CCW system for long-term cooling. Therefore, the proposed change did not fully satisfy the intent of the licensing-basis criteria that were established for the Oconee units. Furthermore, the proposed changes to the Oconee UFSAR description that were submitted included elimination of the long-term cooling capability that is currently credited for tornado mitigation. This change to the Oconee licensing basis was not specifically called out and recognized as such in the amendment request.

Safety Margins RG 1.174 provides a set of guidelines that can be used for assessing whether the impact of a proposed licensing-basis change is consistent with the principle that sufficient safety margins are maintained. The NRC staffs assessment of the proposed change against this set of guidelines follows.

Codes and standards or their alternatives approved for use by the NRC are met.

The proposed change is a change to the Oconee licensing basis that would credit a fully tornado-protected SSF ASW system for providing SSHR following a tornado, instead of crediting the combined capabilities of the tornado-protected station ASW system, the EFW systems of the unaffected units, and the (currently not fully tornado protected)

SSF ASW system. Any plant modifications that the licensee would make to implement the proposed change would be performed in accordance with the Oconee licensing-basis requirements. Therefore, applicable codes and standards or their alternatives approved for use by the NRC would be met.

Safety analysis acceptance criteria in the licensing basis (e.g., UFSAR, supporting analyses) are met, or proposed revisions provide sufficient margin to account for analysis and data uncertainty.

The proposed change did not affect any of the detailed, quantitative safety analyses that have been completed for the Oconee units, but qualitative assumptions associated with long-term cooling are impacted. As noted under the last bullet in the DID discussion (above), the capability to establish and maintain long-term cooling is not assured by the proposed change. Under the existing licensing basis, use of the tornado-protected station ASW pump assures a 37-day supply of water from the Unit 2 CCW system for long-term cooling.

Summary The licensee had requested NRC approval to change the licensing basis for the Oconee units to credit a fully tornado-protected SSF ASW system as the assured means of accomplishing the SSHR function following a tornado, instead of crediting the combined capabilities of the tornado-protected station ASW system, the EFW systems of the unaffected units, and the (currently not fully tornado-protected) SSF ASW system. Based on the results of this review, the NRC staff found that the licensee did not adequately consider and address the traditional engineering review criteria. Major shortcomings that were identified include:

The licensee failed to adequately consider and propose TS requirements that are appropriate and necessary for the SSF assured tornado mitigation function.

The licensee failed to consider and address reliability and long-term cooling considerations.

The proposed change did not preserve redundancy and diversity; and the licensee failed to demonstrate that defenses against common-cause failures are preserved by the proposed change.

Based on the results of this evaluation, the NRC staff has determined that the licensees amendment request did not satisfy the criteria for making risk-informed changes to the plant licensing basis and therefore, the proposed change to credit a fully tornado-protected SSF as the assured means of providing SSHR during a tornado event has not been adequately justified.

3.2 Elimination of the SFP to HPI Pump Suction Flow Path from the Licensing Basis The UFSAR for the Oconee units, Section 3.2.2, indicates that the HPI Pump (either A or B train) can take suction from the SFP or the BWST for providing RCMU during a tornado event with a concurrent loss of offsite power (LOOP). Another source of RCMU that is listed in the UFSAR is the SSF RCMU pump taking suction from the SFP. Duke requested NRC approval to eliminate credit for the SFP-HPI RCMU suction flow path from the UFSAR description for the following reasons:

The SSF RCMU pump takes a suction from the SFP at a much slower rate than the HPI pump, providing better control of the SFP inventory and allowing more time before it is necessary to add water to the SFP.

The SFP-HPI RCMU flow path was not credited in the original UFSAR for the Oconee units, but was added in the early 1990s to address primary side losses due to potential reactor coolant pump (RCP) seal LOCAs. The Oconee RCP seal packages have since been replaced with Sulzer seal packages that are more reliable, thereby eliminating the original reason for crediting the SFP-HPI RCMU flow path.

A number of technical concerns associated with use of the SFP-HPI RCMU flow path have been identified and consequently, the flow path is not considered to be a reliable source of RCMU.

The SFP-HPI RCMU flow path has low risk significance and involves significant operator actions outside the control room.

The licensee credits improvements that were made previously to the Oconee RCP seals that (according to Duke) obviate the need for the SFP-HPI RCMU flow path, and credited the proposed hardening of the Oconee west penetration and cask decontamination rooms against the effects of tornados for maintaining DID.

The means of providing RCMU following a tornado was not specifically discussed in the Oconee UFSAR prior to the July 1990 UFSAR update, and the capability that was credited does not fully satisfy the criteria that were established for tornado mitigation (discussed in Section 2.1). The licensee did not request NRC review and approval of the 1990 UFSAR update with respect to the RCMU capability that was described and consequently, acceptability of the specific capability that was credited by the licensee in the UFSAR is in question. In the June 7, 2002, amendment request, the licensee requested NRC approval to make a change to the RCMU capability that was established and included in the 1990 UFSAR update even though the NRC did not review and approve this capability. Recognizing that the RCMU capability as currently described in the UFSAR is questionable and has not been approved by the NRC, the NRC staffs evaluation will focus on whether or not the proposed means of providing RCMU via the tornado-protected SSF RCMU pump is acceptable for satisfying the Oconee licensing-basis criteria that were established for tornado mitigation. However, acceptability of the RCMU capability as currently described in the UFSAR is not included within the scope of this evaluation.

SSF as the Assured Means of Providing Reactor Coolant Makeup Following a Tornado In order to judge the adequacy of the SSF for providing RCMU following a tornado, the worst-case RCMU requirements for this event must be established. In particular, RCMU considerations would include: a) shrinkage of the RCS as a result of plant cooldown, including any cooldown events that may occur as a result of a tornado (such as due to missile-induced failure of the main steam lines); b) the most limiting RCS leakage that is allowed by TS requirements; c) other RCS inventory losses that could occur as a result of the plant response following a tornado (e.g., RCP seal leakage, pressurizer safety valve actuation, power-operated relief valve failure); and d) margin for uncertainties. The capacity of the SSF RCMU pump for each unit is only 29 gallons per minute; barely adequate for cooling the RCP seals and for maintaining hot shutdown conditions, much less compensate for any of the other considerations that apply. Therefore, the licensee has not adequately demonstrated that the SSF RCMU pumps have sufficient capacity for tornado mitigation.

In addition to specific RCMU considerations and similar to what was discussed in Section 3.1 of this evaluation, crediting the SSF as the assured means of accomplishing the RCMU function following a tornado represents a significant departure from the intended SSF functions of mitigating fire, flooding, and sabotage events; and for providing additional DID capability.

Therefore, the same considerations that are discussed in Section 3.1 relative to TS requirements, mission time, reliability, and long-term cooling capability would also apply to RCMU capability. As noted above in Section 3.1, these areas have not been adequately addressed by the licensee.

Summary The licensee has requested NRC approval to change the licensing basis of the Oconee units to eliminate the SSF-HPI flow path from the UFSAR description as a means of providing RCMU following a tornado. Recognizing that the RCMU capability as currently described in the UFSAR has not been approved by the NRC and is questionable, the NRC staffs evaluation focused on whether or not the proposed means of providing RCMU via the tornado-protected SSF RCMU pump is acceptable for satisfying the Oconee licensing-basis criteria that were established for tornado mitigation. However, acceptability of the RCMU capability as currently described in the UFSAR was not included within the scope of this evaluation. While the NRC staff agrees that hardening the west penetration and cask decontamination room walls against the effects of tornado missiles would have improved the existing tornado mitigation capability, the licensee has not adequately demonstrated that the SSF RCMU pumps have sufficient capacity for mitigating tornado events. Furthermore, the licensee did not adequately evaluate use of the SSF in the proposed manner, taking into consideration TS requirements, mission time, reliability, and long-term cooling capability. Therefore, the licensee has not adequately demonstrated that the SSF is capable of providing RCMU following a tornado in accordance with the Oconee licensing basis.

3.3 Specific Shortcomings of the Licensees Evaluation As discussed in Sections 3.1 and 3.2 of this evaluation, the NRC staff found that the licensees assessment of the proposed changes to the Oconee tornado mitigation licensing-basis capability failed to recognize and adequately address all pertinent considerations. Major shortcomings include:

Because the main steam lines outside containment are not fully protected from tornados and the Oconee units do not have main steam isolation valves, multiple failures of the main steam lines could occur as a consequence of tornado-induced damage to the shared turbine building and enclosed main steam lines. Failure of the main steam lines due to a tornado could result in rapid cooldown of the RCS and excessive SG tube stresses; consequently resulting in an unanalyzed radiological release to the environment via the shared turbine building.

Because the east penetration room is not protected from tornado missiles, system piping that transverses these rooms and communicates directly with the RCS could be subject to tornado missile damage and consequential LOCA; and damage to other penetrations could result in containment failure.

The capability to cool the plant down to residual heat removal (RHR) system entry conditions was established as a licensing-basis criterion for the Oconee units during the resolution of post-TMI Action Plan Item II.E.1.1.

The capability to provide long-term cooling following a tornado is included in the Oconee licensing basis and must be maintained.

4.0 CONCLUSION

Based on the NRC staffs review of the information that was submitted and as discussed in Section 3.0 of this evaluation, the NRC staff has identified the following concerns:

The proposed change to credit the SSF as the assured means of providing SSHR following a tornado did not satisfy many of the traditional engineering aspects of the criteria provided in RG 1.174 for risk-informed licensing-basis changes and considerations associated with use of the SSF for this purpose were not adequately recognized and addressed by the licensee.

The SSF cannot be relied upon for providing RCMU following a tornado because the licensee has not demonstrated that the SSF RCMU pumps are of sufficient capacity and issues associated with use of the SSF for this purpose were not adequately recognized and addressed by the licensee.

Specific considerations that have not been adequately recognized and/or addressed by the licensee include (for example): failure of the main steam piping due to tornado missiles and potential consequences, such as SG tube failures and radiological release to the environment; potential failures that can result in a LOCA, such as with failure of a pressurizer safety valve to close while discharging liquid reactor coolant during one of numerous actuations, or due to piping penetration failures in the east penetration room as a result of tornado missile damage; and the capability to cool the plant down to RHR system entry conditions and to provide for long-term cooling.

While the NRC staff agrees that hardening the west penetration and cask decontamination room walls against the effects of tornado missiles would have improved the existing tornado mitigation capability, the licensee has not demonstrated that this alone is sufficient to fully address and resolve the tornado vulnerabilities and concerns that have been identified.

However, irrespective of this, hardening of the west penetration and cask decontamination room walls does not require NRC approval and these modifications can be made in accordance with 10 CFR 50.59 requirements.

Principal Contributor: J. Tatum