ML070290328

Tornado/Helb Mitigation Strategies and Regulatory Commitments

ML070290328
Person / Time
Site:	Oconee
Issue date:	11/30/2006
From:	Barron H Duke Energy Carolinas, Duke Power Co
To:	Dyer J Office of Nuclear Reactor Regulation
References
ONS2006001
Download: ML070290328 (77)

Text

Duke Henry B. Barron Energ Group Executive and Chief Nuclear Officer ECO7H/526 South Church Street Charlotte, NC 28202-1006 Mailing Address:

P. 0. Box 1006 ECO7H Charlotte,NC 28201-1006 ONS2006001 704-382-2200 November 30, 2006 704-382-6056 fax hbarron@duke.onergy.com James Dyer Director, Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission 11555 Rockville Pike Rockville, Maryland 20852-2738

Subject:

Duke Power Company LLC d/b/a Duke 'I Energy Carolinas, LLC (Duke)

Oconee Nuclear Station, Units 1, 2, and 3 Docket Numbers 50-269, 50-270, and 50-287 Tornado/HELB Mitigation Strategies and Regulatory Commitments

References:

1. Letter to NRC from Henry B. Barron (Duke) dated April 28, 2006, "High Energy Line Break: Mitigation Strategy."

2. Letter to NRC from Henry B. Barron (Duke) dated April 12, 2006, "Future Oconee Tornado Mitigation Strategy."'

3. Letter to NRC from Henry B. Barron (Duke) dated January 31, 2006, "Project Plans for Tornado and High Energy Line Break Events Outside Containment."'

4. Letter to NRC from R. A. Jones, (Duke) dated November 21, 2005, High Energy Line Break and Tornado Mitigation Strategy."

5. Letter to Bruce H. Hamilton (Duke) from Christopher Miller (NRC), dated July 12, 2006, "Tornado and High Energy Line Break Mitigation Strategies."

6. Letter to Austin C. Thies, (Duke) from A. Giambusso (NRC) dated December 15, 1972.

7. Letter to A. C. Thies (Duke) from A. Schwencer (NRC) dated January 17, 1973.

8. Letter to NRC from R. A. Jones (Duke) dated August 20, 2003, "High Energy Line Break Outside Reactor Building Methodology."

The purpose of this letter is to provide updated mitigation strategies, regulatory commitments and responses of Duke Power Company LLC d/b/a Duke Energy Carolinas, LLC (Duke) to the six key issues identified in Reference.5 related to High Energy Line Break (HELB) outside containment and to tornado issues at the Oconee Nuclear Station (ONS). These matters have been the focus of continuing discussions with the Nuclear Regulatory Commission (NRC) staff and of a comprehensive internal

Nuclear Regulatory Commission Tornado/HELB Mitigation Strategies and Regulatory Commitments November 30, 2006 Page 2 review by Duke. The results of those discussions and review are reflected in this submittal.

The updated mitigation strategies described herein are based on the plant configuration that will exist after implementation of the commitments in the attachments to this letter.

Implementation of the updated mitigation strategies and the related commitments will clarify and, in some cases, revise the ONS current licensing basis; will address issues raised by the NRC regarding the ONS current licensing basis; and will collectively enhance the station's overall design, safety and risk margin.

The specific actions that Duke will be implementing have been selected and prioritized based upon a thorough assessment of operational, risk and safety benefits, as well as regulatory considerations and resource requirements. These actions will require a significant investment of resources by Duke and are intended to resolve outstanding tornado and HELB licensing basis issues. Duke believes these actions collectively represent the most appropriate use of resources to enhance safety and resolve regulatory issues.

In broad terms, the actions selected for implementation include: 1) station modifications that provide reinforcement of an expansive portion of key structures to better withstand the effects of postulated tornados, 2) the installation of a new PSW/HPI system capable of establishing safe shutdown conditions independent of the Standby Shutdown Facility,

3) the expansion of piping inspection programs intended to minimize the potential of HELBs, and 4) the submittal of several License Amendment Requests to revise and clarify the licensing basis.

Duke's updated mitigation strategies and commitments are provided in several attachments to this letter. Attachments 1 and 2 address the updated tornado mitigation strategy. Attachment 1 is a summary of the updated tornado mitigation strategy, including regulatory commitments. Attachment 2 provides a detailed description of the features associated with the updated tornado mitigation strategy.

Attachments 3 and 4 address the updated HELB mitigation strategy. Attachment 3 is a summary of the updated HELB mitigation strategy, including regulatory commitments. is a detailed description of the features associated with the updated HELB mitigation strategy.

Information previously provided to the NRC in References 1-4 and 8 has been revised and incorporated into Attachments 1 through 4 of this submittal, which supersede those noted references. In some cases, commitment dates in the previous references have been revised in this submittal, for example, the completion date for the Unit 3 Control Room north wall modification. That specific completion date has been extended because of the need to implement design contingencies that have affected project scope resulting from uncertainty with the licensing of Fiber Reinforced Polymer

Nuclear Regulatory Commission Tornado/HELB Mitigation Strategies and Regulatory Commitments November 30, 2006 Page 3 technology. Finally, responses to the six issues identified in Reference 5 are addressed in Attachment 5.

Duke commits to verbally notifying in advance the Deputy Director, Division of Reactor Licensing of the NRC, followed by a written communication, of significant changes in the scope and/or completion dates of the commitments in Attachments 1 and 3. The notification will include the reason for the changes and the modified commitments and/or schedule. Duke will also keep the NRC informed of progress of tornado/HELB activities on a periodic basis so that any related NRC inspections may be appropriately scheduled.

In parallel with updating the tornado and HELB mitigation strategies, a risk reduction effort that is intended to improve the reliability and availability of the Standby Shutdown Facility (SSF) is in progress. As Duke implements the SSF risk reduction effort, as well as the updated tornado and HELB mitigation strategies and commitments, it is possible that additional, related issues will be identified that may adversely affect system, structure or component operability. Issues identified as a result of these activities will be entered into the ONS corrective action program. As committed to in this letter, the installation of a new PSW system and HPI system improvements will reduce reliance on the SSF by providing a system capable of independently establishing safe shutdown conditions, and thereby significantly improve overall plant risk. The design, installation and testing of this system will necessarily involve many of the same personnel involved in the SSF risk reduction effort because of the similarity of the functions performed by the systems and the need to incorporate lessons learned from years of SSF operation.

These personnel have unique knowledge of the accomplishment of the safe shutdown function at ONS. In recognition of the factors discussed above, Duke requests that the NRC delay or suspend any enforcement activities in these areas in accordance with Section 5 of the NRC Enforcement Manual and Section 06.06a of NRC Inspection Manual Chapter 0305, as appropriate. This will assist in ensuring the appropriate allocation of Duke and NRC Staff resources to accomplish timely resolution of licensing basis issues and implementation of risk reduction activities.

Duke is committed to an orderly and thorough approach to both tornado and HELB mitigation regulatory issues at ONS so that the commitment dates provided in Attachments 1 and 3 can be achieved. Achievement of these commitment dates is dependent on timely NRC acceptance of the sufficiency of these actions to close the regulatory issues, Duke is continuing to proceed, consistent with its corporate governance requirements, to obtain necessary internal approvals to fund the implementation of these commitments,

Nuclear Regulatory Commission Tornado/HELB Mitigation Strategies and Regulatory Commitments November 30, 2006 Page 4 Inquiries concerning this letter should be directed to Mr. Richard Freudenberger at (864) 885-3908.

Sincerely, Henry B. Barron Group Vice President and Chief Nuclear Officer Nuclear Generation

Nuclear Regulatory Commission Tornado/HELB Mitigation Strategies and Regulatory Commitments November 30, 2006 Page 5 Attachments:

1. Summary, Tornado Mitigation Strategy and Regulatory Commitments

2. Tornado Mitigation Strategy

3. Summary, High Energy Line Break (HELB) Mitigation Strategy and Regulatory Commitments

4. High Energy Line Break (HELB) Mitigation Strategy

5. Responses to Key Issues Identified in NRC Letter of July 12, 2006 cc: w/attachments:

Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Dr. W. D. Travers Regional Administrator U.S. Nuclear Regulatory Commission - Region II Sam Nunn Atlanta Federal Center, 23 T85 61 Forsyth St., SW Atlanta, GA 30303-8931 Mr. L. N. Olshan Senior Project Manager Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Mail Stop 0-8 G9A 11555 Rockville Pike Rockville, Maryland 20852-2738 Mr. Tim McGinty Deputy Director Division of Operator Reactor Licensing Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission 11555 Rockville Pike Rockville, Maryland 20852-2738 Mr. Charles Casto Director, DRP U.S. Nuclear Regulatory Commission - Region II Sam Nunn Atlanta Federal Center, 23 T85 61 Forsyth St., SW Atlanta, GA 30303-8931

Nuclear Regulatory Commission Tornado/HELB Mitigation Strategies and Regulatory Commitments November 30, 2006 Page 6 Mr. Joseph W. Shea Director, DRS U.S. Nuclear Regulatory Commission - Region II Sam Nunn Atlanta Federal Center, 23 T85 61 Forsyth St., SW Atlanta, GA 30303-8931 Mr. James Moorman Chief, Branch 1, DRP U.S. Nuclear Regulatory Commission - Region II Sam Nunn Atlanta Federal Center, 23 T85 61 Forsyth St., SW Atlanta, GA 30303-8931 Mr. Robert E. Carroll U.S. Nuclear Regulatory Commission - Region II Sam Nunn Atlanta Federal Center, 23 T85 61 Forsyth St., SW Atlanta, GA 30303-8931 Mr. Dan Rich NRC Senior Resident Inspector Oconee Nuclear Station Mr. Henry Porter, Director Division of Radioactive Waste Management Bureau of Land and Waste Management Department of Health & Environmental Control 2600 Bull Street, Columbia, SC 29201

Nuclear Regulatory Commission Tornado/HELB Mitigation Strategies and Regulatory Commitments November 30, 2006 Page 7 bcc: w/attachments:

B. H. Hamilton D. A. Baxter R. Mike Glover L. E. Nicholson B. G. Davenport L. F. Vaughn S. D. Capps T. P. Gillespie R. J. Freudenberger G. K. Mc Aninch T. D. Brown A. D. Park J. E. Smith S. C. Newman J. N. Robertson W. Patton R. E. Hall T. D. Mills R. L. Gill - NRI&IA R. D. Hart-CNS C. J. Thomas - MNS D. Repka NSRB, EC05N ELL, EC050 File - T.S. Working ONS Document Management

ATTACHMENT 1

SUMMARY

TORNADO MITIGATION STRATEGY AND REGULATORY COMMITMENTS

Nuclear Regulatory Commission - Summary, Tornado Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 2 Summary'1 The updated tornado mitigation strategy assumes that a large tornado engulfs the Oconee Nuclear Station (ONS) during full power operation and disables the emergency and non-emergency electrical buses located in the Turbine Building of the three units.

A further assumption is that a tornado will not cause concurrent damage to the Keowee Hydro Units (KHU).

The overall objective of the updated tornado mitigation strategy would be to maintain the unit(s) in safe shutdown 2 (SSD) conditions until damage control measures would be implemented to restore systems needed for cooldown and ultimately for transition to cold shutdown conditions. The strategy would utilize two systems, identified as the Standby Shutdown Facility (SSF) and an upgraded Station Auxiliary Service Water (ASW) system, renamed the Protected Service Water system (PSW). The PSW electrical system also provides power to portions of the existing High Pressure Injection (HPI) system. Collectively, the PSW and portions of the HPI system powered by the PSW switchgear will be referred to as PSW/HPI. Either the SSF or PSW/HPI system would be capable of providing secondary side decay heat removal (SSDHR) and reactor coolant pump seal injection (RCP SI) subsequent to a tornado to maintain the affected units sub-cooled with a pressurizer (PZR) steam bubble in SSD conditions for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This mission time is consistent with the SSF Current Licensing Basis (CLB).

The current ONS tornado mitigation strategy relies extensively on the SSF. Although defense-in-depth is provided by existing emergency feedwater (EFW), Station ASW and HPI systems, each of these systems relies heavily on manual actions and provides less margin to principal safety barriers, i.e., Reactor Coolant System (RCS) pressure boundary, than the SSF.

A significant benefit of PSW/HPI, compared to the EFW or existing Station ASW system, would be the elimination of certain operator actions outside the main Control Rooms (CR). Specifically, the actions eliminated would include the initial manual operation of the atmospheric dump valves (ADV) for once-through steam generator (SG) depressurization and manual alignment of the Station ASW valves and breakers to supply water to the SGs. Since SG depressurization would no longer be required, the tube-to-shell differential temperature limits would not be challenged. Other manual actions eliminated by PSW/HPI would be the manual alignment of the Spent Fuel Pool (SFP) to HPI flow path and manual connection of the ASW switchgear power supply to the HPI pump.

An additional benefit would be that the new PSW/HPI system could be placed into service quickly which would minimize potential operation of the PZR safety relief valves General verb usage convention in this attachment is as follows: 1) "will" reflects a documented commitment, 2) "would" reflects a future state, and 3) "is" and "was" reflect the present or previous state.

2 Safe Shutdown is defined as Mode 3 with an average Reactor Coolant System (RCS) temperature >

525 0 F.

Nuclear Regulatory Commission - Summary, Tornado Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 3 under saturated water lift and repetitive cycling conditions following a complete loss of main and EFW. This would reduce the risk of RCP seal damage. As a result, there would be reasonable assurance that natural circulation could be established and maintained during the event.

In accordance with the CLB, single active failures will not be assumed in the updated tornado mitigation strategy. However, the strategy would employ two systems and would provide physical separation between them or additional physical barriers to protect one or more of the systems. This approach would reduce the possibility of concurrent failure of the systems due to equipment failures or the effects of a tornado.

The updated tornado mitigation strategy, as related to operation of SSDHR and RCP SI, is described in further detail in Attachment 2, Sections 1 and 2. In summary, for these functions:

The mitigation function of SSDHR would be accomplished via steam relief through the main steam relief valves (MSRV), with subsequent ADV usage to limit unnecessary MSRV cycling, and secondary makeup with either the SSF ASW pump (controlled from the SSF CR) or PSW pump (controlled from the main CR). The SSF ASW pump would be powered by the SSF electrical power system. The PSW pump would be powered by tornado protected switchgear with an underground feeder from the KHU. This switchgear would also have a power supply from the Central/Lee 100kV'transmission line. The PSW and SSF ASW pumps, in conjunction with their associated piping and supporting equipment, would be capable of concurrently feeding the six fully pressurized steam generators in the three units, while utilizing the Unit 2 condenser circulating water inlet piping as a water source. This source can be replenished by a submersible pump for long-term operation. Upon a loss of main and emergency SSDHR capability, either the SSF ASW system or the PSW system would be placed into service to establish SSDHR and RCS natural circulation so as to minimize two-phase discharge through the PZR safety relief valves.

The mitigation function of RCP Sl would be accomplished by using either the SSF reactor coolant makeup pump (controlled from the SSF CR) or a single HPI pump per unit (controlled from each unit's main CR) cooled by the PSW system and powered by tornado-protected PSW switchgear with an underground feeder from KHU. This switchgear would also have a power supply from the Central/Lee 100kV transmission line. The SSF reactor coolant makeup pump or the selected HPI pump would be placed in service upon a loss of RCP seal cooling to preclude seal degradation. The suction source for the SSF reactor coolant makeup pump is provided by the associated unit's SFP. The suction source for the selected HPI pump would be provided by the associated unit's Borated Water Storage Tank that would be protected from tornado effects. PZR heaters, reactor vessel head vent, and RCS high point vents (powered from tornado-protected PSW switchgear with an underground feeder from KHU) would

Nuclear Regulatory Commission - Summary, Tornado Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 4 be available for PZR pressure and level control from each unit's main CR in conjunction with operation of PSW. Similarly, SSF powered and controlled PZR heaters, and RCS letdown valves back to the associated unit's SFP, are also available for PZR pressure and level control from the SSF CR.

The structures, systems, and components (SSC) that perform the functions that support the updated tornado mitigation strategy will be protected from tornado wind and differential pressure as delineated in Attachment 2, Section 5.1. In addition, these components will either be protected from missile damage or demonstrated to have an acceptably low probability of missile damage using a TORMIS evaluation. The TORMIS evaluation will demonstrate that the integrated probability of significant damage, resulting from a missile strike to SSCs required to prevent a radioactive release in excess of 10CFR1 00 limits, is less than a mean value of 1 E-06/rx-yr for each unit. This conclusion will be demonstrated by evaluating the SSDHR, RCP SI and integrity of the RCS pressure boundary functions using TORMIS.

Protection against tornado wind, differential pressure and missiles, is further described in Attachment 2, Sections 3-5. Transition to CSD conditions is discussed in Attachment 2, Section 6. Related emergency operating procedures are discussed in Attachment 2, Section 7.

Nuclear Regulatory Commission - Summary, Tornado Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 5 Regulatory Commitment Table The following table identifies tornado-related actions committed to by Duke Power Company LLC d/b/a Duke Energy Carolinas, LLC (Duke) in this submittal. Other actions discussed in the submittal represent intended or planned actions by Duke. They are described to the Nuclear Regulatory Commission (NRC) for the NRC's information and are not regulatory commitments.

Corn pleti on No. Commitment Completion Date 1T Physically protect the Unit 3 Control Room north wall from the 12-2008 effects of a tornado per associated UFSAR Class 1 structure tornado wind, differential pressure, and missile criteria.

2T Physically protect the Standby Shutdown Facility (SSF) diesel 12-2007 fuel vents from the effects of a tornado per associated UFSAR SSF tornado wind, differential pressure and missile criteria.

3T Analyze and/or protect as required, the elevated/exposed 12-2007 portions of the Standby Shutdown Facility (SSF) cable/pipe trench (at the north end of the SSF and where the SSF and CT-5 trenches intersect) from the effects of tornado wind, differential pressure and missile criteria.

4T Analyze and protect as required, each unit's Borated Water 12-2009 Storage Tank and associated piping per the UFSAR Class 1 structure tornado wind, differential pressure, and missile criteria.

5T Improve the protection of tornado mitigation equipment located 12-2009 within the West Penetration Room (WPR) and Cask Decontamination Tank Room (CDR) from the effects of a tornado. The WPR block walls will be upgraded to the UFSAR Class 1 structure tornado wind and differential pressure criteria using Fiber Reinforced Polymer. Duke will evaluate the need for additional missile protection for the CDR/WPR wall using TORMIS.

Nuclear Regulatory Commission - Summary, Tornado Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 6 6T Submit a License Amendment Request (LAR) to use Fiber Complete Reinforced Polymer (FRP) technology for application in strengthening selected masonry walls against the effects of tornado wind and differential pressure. The LAR will commit to utilizing technical procedures to control testing of concrete substrate and installation and inspection of the FRP systems and in-service inspection of the FRP system once installed.

7T Submit a License Amendment Request (LAR) establishing a 7-2007 new tornado licensing basis (LB) and mitigation strategy. The LAR will address the two redundant mitigation systems, Standby Shutdown Facility (SSF) and Protected Service Water/High Pressure Injection (PSW/HPI) used in the tornado mitigation strategy.

The LAR will commit to the following and include information concerning:

" Basic elements of the Selected Licensee Commitments changes to ensure licensing basis clarity and systems structures and component (SSC) operability such that tornado mitigation capability is maintained.

• The use of TORMIS to collectively assess certain SSCs (with the exception of the Keowee Hydro Units (KHU)) that support the Secondary Side Decay Heat Removal (SSDHR), Reactor Coolant Pump (RCP) Seal Injection or Reactor Coolant System (RCS) pressure boundary functions in the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the event that are not currently protected in accordance with UFSAR tornado missile criteria.

" The elimination of credit for the Spent Fuel Pool to HPI pump flow path.

o In accordance with the Current Licensing Basis (CLB),

single active failures will not be assumed in the updated tornado mitigation strategy.

" Existing damage repair guidelines and procedures will be enhanced to: 1) extend safe shutdown capability of the SSF beyond the 72-hour CLB, and 2) establish cold shutdown conditions. This enhanced capability will not be part of the revised LB and will not be required for operability of the SSF.

• A description of the upgrade of the current low pressure

Nuclear Regulatory Commission - Summrary, Tornado Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 7 Auxiliary Service Water (ASW) system to a high head PSW system that can be actuated, aligned, and controlled from the main Control Rooms (CR) for SSDHR. This system will be credited for both tornado and HELB events.

The ASW upgrade also includes the installation of new PSW switchgear with alternate power provided from the KHU via a tornado protected, underground feeder path.

The PSW switchgear and supporting equipment will be located in a new tornado protected building. Power will also be provided from the Central/Lee 100kV transmission line through a new transformer that will be located to further reduce concurrent damage of the station switchyard, KHU and the new transformer, Specifically, the modification will provide alternate power for:

1. The PSW/HPI system itself,

2. An HPI pump per unit for RCP seal injection that can be promptly aligned from the main CRs,

3. A sufficient number of pressurizer (PZR) heaters (also operated from the main CRs) to maintain a steam bubble in the PZR for RCS pressure control,

4. The existing vital instrumentation and control battery chargers,

5. The SSF SSCs in case the SSF diesel generator is unavailable,

6. RCS High Point Vent and Reactor Vessel Head Vent valves for boration and RCS inventory control. At least one high point vent is required to control RCS inventory at safe shutdown conditions.

8T Installation of the PSW/HPI modifications. 12-2010 9T A program will be developed to monitor site missile inventories. 12-2007 10T Verbally notify in advance the Deputy Director, Division of As necessary, Reactor Licensing of the NRC, followed by a written until 12-2010 communication, of significant changes in the scope and/or completion dates of the commitments in Attachment 1 of this submittal. The notification will include the reason for the changes and the modified commitments and/or schedule.

ATTACHMENT 2 TORNADO MITIGATION STRATEGY

Nuclear Regulatory Commission - Tornado Mitigation Strategy November 30, 2006 Page 2 Introduction1 The Oconee Nuclear Station (ONS) updated tornado mitigation strategy would utilize two systems to provide secondary side decay heat removal (SSDHR) and reactor coolant pump seal injection (RCP SI). The two systems are identified as the Standby Shutdown Facility (SSF) and an upgraded Auxiliary Service Water (ASW) system, renamed the Protected Service Water (PSW) system. The PSW electrical system also provides power to portions of the existing High Pressure Injection (HPI) system.

Collectively, the PSW and portions of the HPI system powered by the PSW switchgear will be referred to as PSW/HPI. The SSF or PSW/HPI system would be capable of providing SSDHR and RCP Si subsequent to a tornado to maintain the affected units sub-cooled with a pressurizer (PZR) steam bubble in safe shutdown 2 (SSD) conditions for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The updated tornado mitigation strategy, as related to SSDHR and RCP SI, are described in further detail below. Piping and cable routings are described for Unit 3 but generally are applicable to Units 1 and 2.

1. Secondary Side Decay Heat Removal SSDHR will be provided by the SSF ASW or the PSW systems.

1.1 Protected Service Water System PSW/HPI system modifications would allow the PSW system to be actuated, aligned and controlled from the main Control Rooms (CR) so that SSDHR can be promptly and concurrently established to each steam generator (SG) on the three units. PSW alignment and control would be accomplished in time to prevent two phase discharge of water through the PZR safety relief valves and to establish natural circulation assuming the RCPs are not available as a consequence of the event. Only one SG per unit would be required to maintain adequate cooling to the Reactor Coolant System (RCS). PSW-related isolation and control valves would be located below grade underneath a concrete slab in the Auxiliary Building (AB) and would be protected from tornado damage in this location.

The PSW system will be a high pressure system so that water can be introduced to a fully pressurized SG. Initial steam pressure control would be accomplished by the main steam relief valves (MSRVs) located on the main steam (MS) piping downstream of the SGs. Subsequently, the steam pressure would be controlled using the atmospheric dump valves (ADV) to limit the number of MSRV cycles. The PSW pump would receive water from the Unit 2 condenser circulating water (CCW) inlet piping. The majority of

' General verb usage convention in this attachment is as follows: 1) "will" reflects a documented commitment, 2) "would" reflects a future state, and 3) "is" and "was" reflect the present or previous state.

2 Safe Shutdown is defined as Mode 3 with an average Reactor Coolant System (RCS) temperature >

525 0F.

Nuclear Regulatory Commission - Tornado Mitigation Strategy November 30, 2006 Page 3 the piping that supplies water to the pump is embedded. The portion of the piping that is not embedded is below grade in the Turbine Building (TB) basement. There is limited susceptibility to tornado missiles through equipment openings located in the third and fifth floor of the TB. Make-up to the CCW piping would be provided by a portable submersible pump that would be contained in a tornado-protected facility and powered from the SSF electrical power system or the PSW switchgear.

1.2 Standby Shutdown Facility Auxiliary Service Water System The SSF ASW system also provides a secondary heat removal mitigation path.

Operators are dispatched to the SSF upon receipt of a tornado warning 3 from the National Weather Service. Tornado warnings are monitored using a weather radio in the Unit 1 and 2 main CR and work control center. The SSF ASW system is actuated, aligned and controlled from the SSF CR. System components are powered from the SSF electrical power system. Should the SSF electrical power system become unavailable, the PSW switchgear would have the capability of providing backup power to the SSF power system. The backup function of the PSW switchgear would be a defense-in-depth measure and would not be part of the revised licensing basis.

Water is supplied to the SSF ASW pump via the Unit 2 CCW inlet piping. Make-up to the CCW piping would be provided by a portable submersible pump as discussed in Section 1.1.

The SSF ASW pump is sized to provide sufficient flow to the six SGs of the three units.

Flow can be controlled from the SSF CR to each SG. However, only one SG per unit is required to maintain adequate decay heat removal. The SSF ASW pump is a high pressure pump and is designed to provide flow concurrently to six fully pressurized SGs. Steam is initially relieved from each generator through the MSRVs.

Subsequently, the steam pressure may be controlled using the ADVs to limit the number of MSRV cycles.

The following sections, 1.3-1.6, discuss system and component separation for SSDHR. Separation of the components provides qualitative assurance of the accomplishment of the SSDHR function.

1.3 Secondary Side Decay Heat Removal Systems - Feedwater Pipe Routing The piping for both SSDHR systems enters the Reactor Building (RB) through the penetration rooms. The piping in the East Penetration Room (EPR) is physically separated from the piping in the West Penetration Room (WPR) by the RB.

3 A Tornado Watch is issued to alert people to the possibility of tornado development in your area. A Tornado Warning is issued when a tornado has actually been sighted or is indicated by radar.

Nuclear Regulatory Commission - Tornado Mitigation Strategy November 30, 2006 Page 4 The PSW system would feed both SGs on each unit. The PSW supply header to the 'A' SG would enter the RB from the EPR. The PSW supply header to the 'B' SG would enter the RB from the WPR and from the Cask Decontamination Tank Room (CDR) directly below it.

The SSF ASW system also feeds both SGs. The piping enters the RB from the WPR and from the CDR directly below it. Once the piping enters the RB, the piping splits to feed both the 'A' SG and the 'B' SG. The piping inside the RB is protected from tornado effects.

1.4 Secondary Side Decay Heat Removal Systems - Instrumentation SG. level indication and RCS temperature indication are required to support the SSDHR function.

a. SG Level Indication Cable Routing There are two trains of SG level indication for each SG inside the main CRs. One train of level indication for the 'A' and 'B' SGs enters containment through the EPR. One train of level indication for the 'A' and 'B' SGs enters containment through the WPR.

The train of level instrumentation that enters containment through the WPR also passes through the EPR.

There is one train of SG level indication for each SG inside the SSF CR. The level instrumentation for the 'A' and 'B' SGs enters containment through the WPR.

b. RCS Temperature Indication Cable Routing RCS temperature indication includes RCS hot and cold leg temperature and core exit thermocouple indication. With the exception of cold leg temperature indication, the RCS temperature instrumentation that supports operation of the PSW/HPI system from the main CRs enters containment through the EPR. The cold leg temperature indication that supports operation of the PSW/HPI system from the main CRs enters containment through the WPR. Cold leg temperature indication serves as a backup to hot leg or core exit thermocouple indication. The instrumentation that supports operation of the SSF ASW from the SSF CR enters containment through the WPR.

1.5 Secondary Side Decay Heat Removal - Main Steam The MS lines that are external to the RB are not fully enclosed in a tornado protected structure. The MS lines pass from the RB to the TB up to the turbine stop valves.

Branch lines extend from the MS line to various components located in the TB. The MS piping outside the TB is elevated. For this reason, a large damaging missile, such as an automobile, is unlikely to strike this piping and its supports. Additionally, the main and branch steam piping metal provides a measure of protection against other smaller

Nuclear Regulatory Commission - Tornado Mitigation Strategy November 30, 2006 Page 5 tornado missiles. The majority of the branch piping is located belowv the concrete floor of the turbine deck which further protects the lines from tornado missiles. The MS lines would be shown to meet ONS Updated Final Safety Analysis Report (UFSAR) missile criteria or otherwise, be analyzed using TORMIS (see Section 5.2 of this attachment).

1.6 Secondary Side Decay Heat Removal - Power Supply The PSW pump would receive power from the PSW switchgear that would be located in a tornado protected enclosure. The switchgear would receive power from the Keowee Hydro Units (KHU) through the underground path. The KHU are located approximately 3/ of a mile away from ONS. This switchgear would also have a power supply from the Central/Lee 100 kV transmission line through a new transformer. The new transformer would be located to further reduce the possibility of concurrent damage to transformer CT-5, the switchyard, KHU, and the new transformer. The power supply from the new transformer will not be protected from the effects of a tornado. However, it would be designed with commonly available materials and equipment so that power could be restored to the PSW switchgear in a timely manner should that line be damaged in a tornado event.

PSW instrumentation and control (I&C) power will be provided via a new protected PSW system-specific 125 VDC I&C subsystem in combination with existing plant vital I&C power. SSF ASW I&C power is received from the SSF 125 VDC power system. The SSF 125 VDC power system is located inside the protected SSF.

2. RCP Sl RCP Sl would be provided to each unit using either a PSW powered HPI pump or the SSF reactor coolant makeup pump.

2.1 RCP Sl from the PSW/HPI System Modifications to the PSW/HPI system, RCS high point vent valves and PZR heater electrical power supplies and controls would allow one HPI pump from each unit to be aligned and controlled from the main CRs in a timely manner in order to provide RCP SI. Borated water would be supplied to the HPI pumps from the Borated Water Storage Tank (BWST). The BWST will be protected from tornado damage per UFSAR Class 1 structure criteria. Some lines that lead from the BWST to the HPI, low pressure injection and building spray pumps, while enclosed in structures, will not be fully protected from tornado missiles, ýbut will be evaluated :by TORMIS (see Se.tciorh 5.2).

RCP Sl would be performed to prevent seal degradation in a time frame consistent with that previously establishedifor SSF RCP SI. The modifications would also allow the RCS high point vents and PZR heaters to be operated from the main CRs. The HPI pump can provide RCP SI in excess of that required to offset losses through the RCP seals. Increases in PZR level are controlled by aligning letdown through the RCS high point vents.

Nuclear Regulatory Commission - Tornado Mitigation Strategy November 30, 2006 Page 6 2.2 RCP Sl from the SSF System In the updated tornado mitigation strategy, the SSF RCP SI is the alternate seal injection path. A SSF reactor coolant (RC) makeup pump is located in the RB of each unit. Operators are dispatched to the SSF upon receipt of a tornado warning from the National Weather Service. System components are powered from the SSF diesel generator. Should the SSF diesel generator fail, the PSW switchgear would have the capability to provide backup power to the SSF power system. The backup function of the PSW switchgear would be a defense-in-depth measure and would not be part of the revised licensing basis.

Borated water is supplied to the SSF RC makeup pumps from the Spent Fuel Pool (SFP) for the respective unit. The SSF RC makeup pump is sized to provide makeup in excess of that required to offset losses through the RCP seals. Increases in PZR level are controlled by aligning letdown from the RCS to the SFP. RCS letdown to the SFP is accomplished from the SSF CR. Sufficient PZR heaters can be energized from the SSF CR and powered from the SSF electrical power system to offset ambient heat losses and steam leakage from the PZR.

The following sections, 2.3-2.5, discuss system and component separation for RCP SI. Separation of the components provides qualitative assurance of the accomplishment of the RCP Sl function.

2.3. RCP Sl - Seal Injection, Pipe and Cable Routing The RCP Sl piping from PSW/HPI to the four RCPs initially enter the EPR from the pipe chase below. Two of the RCP Sl lines crossover from the EPR to the WPR and enter the RB from the WPR. The other two RCP Sl lines enter the RB from the EPR.

Additionally, portions of HPI, low pressure injection and building spray lines, which are interconnected with the RCP SI injection path, are also located in the WPR. Missile damage in the EPR is remote because of its proximity to adjacent structures.

Additionally, large portions of the WPR are shielded from potential tornado missile damage by the BWST.

The RCP SI piping from the SSF is entirely located inside the RB. Therefore, the RCP SI piping associated with the SSF is physically protected from tornado effects.

However, the electrical supply and I&C cables associated with SSF RCP Sl are not fully protected. These cables run through the WPR and CDR before entering the RB and are largely shielded from potential tornado missile damage by the BWST. The RB does not act as a physical barrier between the HPI and RCP SI lines and SSF related cables that pass -through -the WPR.

2.4 RCP SI - Support I&C Cable Routing PZR level indication, PZR heater control, RCS pressure indication and RCS letdown

Nuclear Regulatory Commission - Tornado Mitigation Strategy November 30, 2006 Page 7 control are required to support the RCP SI function.

a. PZR Level Indication Cable Routing PZR level transmitter cables, that support level indication in the CR, enter the RB

,through the EPR. PZR level transmitter cables, that support level indication in the SSF CR, enter the RB through the WPR.

b. PZR Heater Control Cable Routing Similarly, PZR heater cables that would support PSW/HPI heater control from the main CRs, enter the RB through the EPR. Cables that support heater control from the SSF enter the RB from the WPR.

c. RCS Pressure Indication Cable Routing Instrument tubing that provides RCS pressure indication to the main CRs enters the RB through the EPR. Instrument cabling that provides RCS pressure indication to the SSF enters the RB through the WPR.

d. RCS Letdown Control Cable Routing While maintaining SSD conditions, RCP seal injection flow may exceed RCS losses. As such, RCS inventory may increase with time. Letdown must be established to offset the increase in inventory.

Letdown would be established for the PSW/HPI system through RCS high point vent valves. The control cable for one set of the RCS high point vent valves enters containment through the EPR and the other enters containment through the WPR (by way of the EPR). These valves can be controlled from the main CRs. Only one vent path is required to establish the necessary letdown flow to maintain SSD.

Letdown for the SSF would be accomplished by opening the SSF RCS letdown valves back to the SFP. The control cables for these valves enter containment through the WPR.

2.5 RCP SI - Power Supply The SSF RCP SI components receive power from the SSF electrical power system which is fully protected from the effects of a tornado by the SSF structure. PSW/HPI components would receive power from the new PSW switchgear that would be located in a tornado protected enclosure. The switchgear would receive power from the KHU through the underground path. The KHU are located approximately 3/4 of a mile away from ONS. This switchgear would also have a power supply from the Central/Lee 100kV transmission line through a new transformer that will be located to further reduce

Nuclear Regulatory Commission - Tornado Mitigation Strategy November 30, 2006 Page 8 the possibility of concurrent damage to transformer CT-5, the switchyard, KHU, and the new transformer. This power supply will not be protected from the effects of a tornado, but would be designed with commonly available materials and equipment so that power could be restored to the PSW switchgear in a timely manner should that line be damaged in a tornado event.

PSW I&C power will be provided via a new protected PSW system-specific 125 VDC I&C subsystem in combination with existing plant vital I&C power. These buses would be powered from the 125 VDC control battery chargers via the protected PSW switchgear and the 125 VDC control batteries. Power would be transmitted from the protected switchgear to the battery chargers in cables that are located below ground or in the AB. The control batteries and vital instrument buses are located in the AB.

SSF RCP SI I&C power is received from the SSF 125 VDC power system. The SSF 125 VDC power system is located inside the SSF.

3. Physical Separation of the SSF and PSW/HPI Systems - Summary The RB provides physical separation between the SSF ASW and PSW systems. Piping and I&C cables that support PSW to the 'A' SG enter the RB through the EPR. I&C power supply components located in the control battery rooms, equipment rooms and cable rooms that support the PSW system are also located on the east side of the RB.

Piping and l&C cables that support the SSF ASW system enter containment through the WPR. I&C power supply components are located in the SSF on the west side of the RB.

Additional defense-in-depth is provided by the piping and I&C cables that support PSW to the 'B' SG. These components enter the RB through the WPR (with the exception of I&C cable that enters the WPR through the EPR in a portion of the EPR that is largely protected from missiles).

The PSW and SSF ASW pumps both take suction from the CCW header located beneath the TB on the east side of the RB. Although the suction source is not physically separated between systems, it is almost completely protected from tornado missile strikes.

The RB also provides physical separation (with one notable exception to be described) between the SSF and HPI RCP Sl systems. Two of the four HPI RCP Sl lines enter the RB through the EPR. All of the required HPI RCP Sl supporting I&C cables also enter the RB through the EPR (although there are alternate I&C cables that enter through the WPR by way of the EPR that provide additional defense-in-depth). All SSF RCP SI piping is located in the RB. Supporting I&C cable enters the RB through the WPR.

Two of the HPI RCP Sl lines enter the RB through the WPR by way of the EPR.

Additionally, portions of HPI, low pressure injection and building spray lines, which are

Nuclear Regulatory Commission - Tornado Mitigation Strategy November 30, 2006 Page 9 interconnected with the RCP Sl injection path, are also located in the WPR. These lines are therefore not physically separated by the RB from the cables that support SSF RCP SI. But, there is significant spatial separation between these lines and SSF cables at most points. Duke will evaluate, using TORMIS (see Section 5.2), the need for additional missile protection for a portion of the WPR wall to ensure that the likelihood of concurrent missile damage to the both the HPI and SSF RCP SI systems would be acceptably low.

4. Existing SSF and PSW/HPI Missile Protection for Areas not Fully Protected The EPR is partially shielded from tornado missiles by the MS line support structure on the side adjacent to the high energy line break blowout panels (north side of Unit 1, south side of Units 2 and 3), by the TB and AB on the east side, the RB on the west side and the Fuel Handling Building on the side opposite the blowout panels. Some components that would supply I&C power to the PSW/HPI system would be located in the cable spread, equipment and control battery rooms. The equipment, battery and cable spread rooms are largely protected from tornado missiles by the TB operating deck.

A majority of each unit's CDR/WPR exterior wall are shielded on the exposed western face from missiles by the large BWSTs located directly in front of the wall. Duke will evaluate the benefit of additional missile protection for that wall to protect SSF cables located within the CDR/WPR for each unit.

5. Protection Against the Effects of a Tornado The protection against the effects of a tornado will be discussed in terms of wind, DP and missiles.

5.1 Protection Against the Effects of Tornado Wind and DP The SSF and PSW/HPI components that perform the functions to support the tornado mitigation strategy are or will be protected from wind and DP as outlined in ONS UFSAR Section 3.3.2, UFSAR Table 3-23 and UFSAR Section 9.6.3.1 (for the main SSF building structure) with the following exceptions:

• The WPR building frame is currently required to withstand a UFSAR Class 1 structure tornado wind and DP load, but the external masonry wall is not.

This masonry wall will be upgraded to tornado wind and DP criteria using Fiber Reinforced Polymer technology since RCP Sl equipment common to

.both the PSW/HPI and SSF systems is contained within this room.

• UFSAR Table 3-23 indicates that the electrical equipment and cable rooms, that would contain equipment important to PSW/HPI, were constructed to UFSAR Class 1 structure tornado wind, DP and missile criteria. This UFSAR statement is incorrect. The masonry in-fill walls were constructed in the same

Nuclear Regulatory Commission - Tornado Mitigation Strategy November 30, 2006 Page 10 manner (not UFSAR criteria) as the balance of AB rooms that would contain equipment important to PSW/HPI, such as the WPR, EPR and control battery rooms. Therefore, the UFSAR will be revised to reflect the as-built condition of the electrical equipment and cable room walls.

The maximum UFSAR Class I structure tornado wind speed is 300 mph and the maximum DP is 3 psid. The DP is applied over five seconds. Associated loads are taken separately at 1) the maximum wind speed, 2) the maximum DP, and 3) the maximum wind speed plus one-half the maximum DP.

Analysis results indicate that the Unit 1 MS headers and moisture separator branch lines can withstand tornado wind loads. Duke expects the analyses for other Unit 1 branch lines to be enveloped by the Unit 1 moisture separator branch line results. Duke also expects the analysis for the Unit 2 and 3 steam lines will be enveloped by the Unit 1 results.

5.2 Protection against Tornado Missiles The components that perform the functions to support the mitigation strategy will be: 1) protected from tornado missile damage in accordance with existing UFSAR Class 1 structure or SSF criteria or, 2) demonstrated to have an acceptably low probability of tornado missile damage using TORMIS. The TORMIS methodology has been accepted by the Nuclear Regulatory Commission (NRC) and applied by other licensees. Additionally, the NRC has previously accepted the application of this method for the evaluation of the SSDHR function at ONS. 4 The TORMIS methodology can be used to establish compliance with the Standard Review Plan guidance for tornado missile protection by demonstrating that the probability of significant damage, resulting from a missile strike to systems, structures and components (SSC) required to prevent a radioactive release in excess of 10CFR1 00, is less than a mean value of 1 E-06/yr. For a multi-unit site, this criterion is applied to each unit individually, i.e., 1E-06/rx-yr for each unit. "Significant damage" is defined as damage which prevents an SSC from performing its tornado mitigation function.

The following functions are required for tornado mitigation:

o Secondary Side Decay Heat Removal o Reactor Coolant Pump Seal Injection o Integrity of the Reactor Coolant System Pressure Boundary 4 Weins, Leonard A., Project Manager, Division of Reactor Projects 1/11, Office of Nuclear Reactor Regulation, to Tucker, H. B., Vice President, Nuclear Production Department, Duke Power Company, "Safety Evaluation report of Effect of Tornado Missiles on Oconee Emergency Feedwater System," dated July 28, 1989.

Nuclear Regulatory Commission - Tornado Mitigation Strategy November 30, 2006 Page 11 The potential for damage to unprotected SSCs that support these functions (with the exception of KHU) will be collectively assessed against the TORMIS acceptance criterion. The ONS TORMIS evaluation will credit the redundancy and separation provided by the SSF systems and the PSW/HPI systems to fulfill the SSDHR and RCP SI functions. Supporting components will be modeled as described herein. Secondary effects will also be modeled as deemed necessary based on engineering judgment.

The TORMIS methodology will not be applied to systems and components required to cool down beyond SSD conditions.

The TORMIS methodology, as approved by the NRC, provides the following conservatisms:

• Use of the Fujita (F) Scale. Current meteorological research predicts significantly lower tornado wind speeds for the most severe categories of tornadoes.

Other elements within the TORMIS computer code provide additional analysis margin as described in the Technical Evaluation Report 5 used to support the NRC's Safety Evaluation Report (SER) 6 on TORMIS. This includes the missile injection model, damage assessment analysis, and other elements.

The considerations for use of the EPRI approach as discussed in the NRC TORMIS SER will be addressed as follows:

NRC TORMIS SER condition - Tornado characteristicsshould be based on data taken from broad regions and small areas around the site and the justification should be provided for the values selected.

o The tornado hazard will be calculated using data for a broader region (EPRI NP-2005 Region A) and in the vicinity of the site.

NRC TORMIS SER condition - The F-Scale tornado classificationshould be used instead of the modified form describedin the EPRI report.

• The modified Fujita F-Scale will not be used to characterize tornado wind velocities.

NRC TORMIS SER condition - Reductions in wind speed near the ground should be more thoroughlyjustified than in the EPRI report.

• A velocity profile value of 0.82 will be used to define the ratio of ground velocity to velocity at the 33-foot elevation. This value has been 6 Electric Power Research Institute Report - EPRI NP-2005, Volumes 1 and 2, "Tornado Missile Risk Evaluation Methodology," dated August 1981.

6 Memorandum from L. S. Rubenstein to Frank J. Miraglia, "Safety Evaluation Report - Electric Power Research Institute (EPRI) topical Reports concerning Tornado Missile Probabilistic Risk Assessment (PRA) Methodology," dated October, 1983.

Nuclear Regulatory Commission - Tornado Mitigation Strategy November 30, 2006 Page 12 employed by DC Cook and other licensees in TORMIS submittals which have been reviewed and approved by the NRC.

NRC TORMIS SER condition - Missile inventories should be site specific.

o Missile inventories will be based on site specific inspections and will be monitored using a site program.

NRC TORMIS SER condition - Provide justification to any deviations to the EPRI method.

o No deviations beyond those required by the SER are planned.

Note: Modifications will be implemented to qualify the BWST and associated interconnected piping and instrumentation outside the AB for each unit to UFSAR tornado protection requirements. This change will support the elimination of the SFP as an alternate suction source to HPI pumps following a tornado strike.

6. Transition to Cold Shutdown The SSF or PSW/HPI systems would be capable of providing SSDHR and RCP SI subsequent to a tornado to maintain the affected units sub-cooled with a PZR steam bubble in SSD conditions for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This mission time is consistent with the SSF Current Licensing Basis (CLB).

Existing damage repair guidelines and procedures will be enhanced to: 1) extend SSD capability of the SSF beyond the 72-hour CLB, and 2) establish cold shutdown (CSD) conditions 7 . Using realistic assumptions, Duke estimates of SSF operational limitations such as diesel generator fuel inventory and availability of cooling water, indicate that there is capability for continued operation of the SSF beyond its 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> CLB mission time without imposition of new operator actions. This enhanced capability provides an added margin of safety, but will not be part of the revised licensing basis and will not be required for operability of the SSF. The PSW/HPI system would be utilized to support cooldown of the affected units to approximately 250 0 F, where they will remain until additional damage control measures can facilitate further cooldown to CSD conditions.

7. Emergency Operating Procedures The ONS tornado mitigation strategy relies on timely alignment and control of redundant SSDHR and RCP Sl systems:

• Alignment and control of SSF ASW and reactor coolant makeup from the SSF CR

, Alignment and control of PSW and HPI RCP SI from the main CR 7 Cold Shutdown is defined as Mode 5, Reactor Coolant System temperature < 2000 F.

Nuclear Regulatory Commission - Tornado Mitigation Strategy November 30, 2006 Page 13 The SSF is manned upon receipt of a tornado warning. If the SSDHR and/or RCP Sl functions are lost, action would be taken to concurrently activate both sets of SSDHR and/or RCP SI systems subsequent to a tornado. Specific details of these actions will be delineated in emergency operating procedures. The ultimate means of providing SSDHR and RCP SI would be coordinated between the main CR and SSF operators.

For the three units, operators would be able to restore PSW/HPI SSDHR cooling to at least one SG within 15 minutes and HPI seal injection to the four RCPs within 20 minutes. Using the SSF ASW and RC makeup systems, operators would be able to complete the same tasks within 14 and 20 minutes, respectively. The response times would be verified and validated in accordance with existing ONS requirements.

ATTACHMENT 3

SUMMARY

HIGH ENERGY LINE BREAK (HELB) MITIGATION STRATEGY AND REGULATORY COMMITMENTS

Nuclear Regulatory Commission - Summary, HELB Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 2 Summary1 The HELB Mitigation Strategy and reconstituted HELB design basis to be incorporated into a revised Licensing Basis for Oconee Nuclear Station (ONS) addresses the level of protection provided to systems, structures and components necessary to reach safe shutdown (SSD)2 following a given HELB outside containment and the resulting environmental and flooding effects. This strategy was initially outlined in References 1, 4, and 8.

Two HELB mitigation systems, identified as the current Standby Shutdown Facility (SSF) and an upgraded Auxiliary Service Water system, renamed the Protected Service Water system (PSW), would be utilized for the three ONS units. These systems would be primarily for mitigation of HELB events in the Turbine Building (TB) that could affect the associated unit's emergency power and emergency feedwater systems.

The PSW electrical system provides power to portions of the existing High Pressure Injection (HPI) system. Collectively, the PSW and portions of the HPI system powered by the PSW switchgear will be referred to as PSW/HPI. Either the SSF or PSW/HPI system would be capable of providing secondary side decay heat removal (SSDHR) and reactor coolant pump seal injection (RCP SI) subsequent to a HELB event to maintain the affected units sub-cooled with a pressurizer steam bubble in SSD conditions for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This mission time is consistent with the SSF Current Licensing Basis (CLB).

Upon implementation of the updated HELB mitigation strategy, existing damage repair guidelines and procedures will be enhanced to: 1) extend safe shutdown capability of the SSF beyond the 72-hour CLB, and 2) establish CSD conditions 3 . Using realistic assumptions, Duke estimates of SSF operational limitations such as diesel generator fuel inventory and availability of cooling water, indicate that there is capability for continued operation of the SSF beyond its 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> CLB mission time, without imposition of new operator actions. This capability provides additional safety margin, but will not be part of the revised licensing basis and will not be required for operability of the SSF.

The PSW/HPI system would be utilized to support cooldown of the affected units to approximately 250'F, where they will remain until additional damage control measures can facilitate further cooldown to CSD conditions.

The PSW system would reduce reliance on systems and components located in the TB and would be capable of mitigating non-Main Steam related HELBs in that building.

The PSW system would be redundant to and diverse from the SSF system. Its mission

'General verb usage convention in this attachment is as follows: 1) "will" reflects a documented commitment, 2) "would" reflects a future state, and 3) "is" and "was" reflect the present or previous state.

2 Safe Shutdown is defined as Mode 3 with an average Reactor Coolant System (RCS) temperature >

5250 F.

3 Cold Shutdown is defined as Mode 5, Reactor Coolant System temperature < 2000 F.

Nuclear Regulatory Commission - Summary, HELB Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 3 would be to achieve and maintain SSD by maintaining shutdown margin, reactor coolant system inventory and reactor coolant temperature and pressure within acceptable limits.

Reliance on power and control power equipment necessary to reach SSD, currently located in the TB, would be eliminated by PSW.

The HELB mitigation strategy, as related to operation of SSDHR and RCP SI, is similar to the summary provided in Attachment 1 for the tornado strategy.

Nuclear Regulatory Commission - Summary, HELB Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 4 Regulatory Commitments The following table identifies HELB-related actions committed to by Duke Power Company LLC d/b/a Duke Energy Carolinas, LLC (Duke) in this submittal. Other actions discussed in the submittal represent intended or planned actions by Duke. They are described to the Nuclear Regulatory Commission (NRC) for the NRC's information and are not regulatory commitments.

No. Commitment Completion Date HELB Piping Inspection Program 1H Implement an inspection prograrn that ensures the Auxiliary Complete Building Main Steam and Main Feedwater girth and accessible attachment welds are re-inspected at least once during each subsequent 10 year ASME Section XI In-service Inspection, interval for weld flaws and thickness.

2H Implement an inspection program that ensures the following Unit 1, 03-2008 welds are re-inspected at least once during each subsequent Unit 2, 09-2008 10 year ASME Section Xl In-service Inspection interval for weld Unit 3, 03-2009 flaws and thickness:

a. Other Auxiliary Building high energy piping critical crack locations at welds

b. Selected Turbine Building high energy piping girth welds

c. Selected Turbine Building high energy piping critical crack locations at welds 3H Complete initial ASME Section XI In-service Inspection interval 07-2008 ultrasonic testing of the Auxiliary Building Main Steam and Main Feedwater girth welds and accessible attachment welds for weld flaws and thickness. Accessible attachment welds are to undergo visual examination for general weld quality as well as surface examination using either a magnetic particle or a liquid penetrant test.

Nuclear Regulatory Commission - Summary, HELB Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 5 4H Complete initial ASME Section XI In-service Inspection interval 03-2012 ultrasonic testing of the following welds for weld flaws and thickness. Accessible attachment welds are to undergo visual examination for general weld quality as well as surface examination using either a magnetic particle or a liquid penetrant test:

a. Other Auxiliary Building high energy piping critical crack locations at welds

b. Selected Turbine Building high energy piping girth welds

c. Selected Turbine Building high energy piping critical crack locations at welds 5H Implement an inspection program that ensures that accessible Complete piping base metal downstream of Main Feedwater isolation valves located in the East Penetration Room and not enclosed by the guard pipe receive an ASME Section X1 In-service Inspection interval ultrasonic testing inspection at least once every 10 years.

6H Implement an inspection program that ensures the following Unit 1, 03-2008 piping base metal receive an ASME Section XI In-service Unit 2, 09-2008 Inspection interval ultrasonic testing inspection at least once every 10 years. Unit 3, 03-2009

a. Auxiliary Building high energy piping critical crack locations not at welds

b. Selected Turbine Building high energy piping critical crack locations not at welds 7H Complete the initial ASME Section XI In-service Inspection Complete interval ultrasonic testing inspection of piping base metal downstream of Main Feedwater isolation valves located in the East Penetration Room and not enclosed by the guard pipe.

8H Complete initial ASME Section XI In-service Inspection interval 03-2012 ultrasonic testing inspection of the following piping base metal:

a. Auxiliary Building high energy piping critical crack locations not at welds

b. Selected Turbine Building high energy piping critical crack locations not at welds

Nuclear Regulatory Commission - Summary, HELB Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 6 9H Implement an inspection program that requires external visual Complete inspection of accessible attachment welds at the terminal ends inside the main feedwater guard pipe at least once every 10 years.

10H Complete initial visual inspections of accessible attachment 06-2007 welds at the terminal ends inside the main feedwater guard pipes.

Repair of Electrical Penetration Enclosures Located in the EPR to the Correct Configuration 11 H Inspect and repair the Unit 2 East Penetration Room electrical Complete penetration termination enclosures to their correct configuration. Missing and/or damaged covers, gaskets, and fasteners will be repaired or replaced.

12H Inspect and repair the Unit 1 East Penetration Room electrical 12-2006 penetration termination enclosures to their correct configuration. Missing and/or damaged covers, gaskets, and fasteners will be repaired or replaced.

13H Inspect and repair the Unit 3 East Penetration Room electrical Complete penetration termination enclosures to their correct configuration. Missing and/or damaged covers, gaskets, and fasteners will be repaired or replaced.

14H Create an inspection plan to select a portion of Units 1, 2 and 3 Complete enclosures to open and inspect for signs of internal debris and corrosion.

15H Revise station procedures and processes as needed to ensure 03-2007 penetration termination enclosures are maintained in their correct configurations.

EPR Flood Prevention Modifications 16H Complete the design and installation of flood outlet devices for Complete the Unit 1 East Penetration Room.

17H Complete the design and installation of flood outlet devices for Complete the Unit 2 East Penetration Room.

18H Complete the design and installation of flood outlet devices for Complete the Unit 3 East Penetration Room.

Nuclear Regulatory Commission - Summary, HELB Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 7 19H Complete the design and installation of flood impoundment and 12-2007 exterior door flood improvement features for the Unit 1 East Penetration Room 20H Complete the design and installation of flood impoundment and 12-2007 exterior door flood improvement features for the Unit 2 East Penetration Room.

21 H Complete the design and installation of flood impoundment and 12-2007 exterior door flood improvement features for the Unit 3 East Penetration Room.

HELB Design and Licensing Basis Reconstitution 22H Submit License Amendment Requests (LARs) to establish Unit 1, 03-2008 23H an updated HELB Licensing Basis and HELB mitigation Unit 2, 09-2008 strategy for Oconee Nuclear Station (ONS). The LARs will 24H address deviations from and clarifications of selected Unit 3, 03-2009 portions of References 6 (the Giambusso letter) and 7 (the Schwencer letter) and the criteria that will be substituted or clarified. Each unit LAR will include licensing basis changes based on design basis documents replacing OS 73.2.

The first LAR will commit to the following and will also provide the analysis results for Unit 1.

• The LAR will outline the basic elements of Selected Licensee Commitment changes to ensure licensing basis clarity and component operability such that HELB mitigation capability is maintained.

• The LAR will identify Turbine Building (TB) high energy piping girth welds and critical crack locations at welds whose failure would result in adverse interactions impacting the ability to achieve safe shutdown (SSD) or cold shutdown (CSD), as appropriate, following a HELB event. These welds are referenced in Commitment #'s 2H and 4H as "selected TB high energy piping girth welds" or "selected TB high energy critical crack locations at welds", respectively.

• The LAR will identify TB high energy critical crack locations not at welds whose failure would result in adverse interactions impacting the ability to achieve SSD or CSD, as appropriate, following a HELB event. These welds are referenced in Commitment #Ws6H and 8H as "selected TB high energy critical crack locations not at

Nuclear Regulatory Commission - Summary, HELB Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 8 welds" The LAR will identify crack locations in high energy piping other than Main Steam and Main Feedwater in the Auxiliary Building (AB) per the criteria in Commitments 22H-24H. These locations are referenced in Commitment #'s 2H and 4H as "other AB high energy piping critical crack locations".

o The LAR will identify crack locations in high energy piping in the Auxiliary Building (AB) per the criteria in Commitments 22H-24H. These locations are referenced in Commitment #'s 6H and 8H as "AB high energy piping critical crack locations".

• High energy systems will be defined as those systems with operating temperatures greater than or equal to 200 F or pressures greater than .or equal to 275 psig. For those systems that operate at high energy conditions less than 1% of the total plant operating time or at high energy conditions less than 2% of the total system operating time, no breaks or cracks will be postulated.

• For piping that is seismically analyzed, i.e. stress analysis information is available and the analysis includes seismic loading, intermediate breaks will be postulated in equivalent Class 2 or 3 piping at axial locations where the calculated stress for the applicable load cases exceed 0. 8 (SA + Sh). Applicable load cases include internal pressure, dead weight (gravity), thermal, and seismic (defined as operational basis earthquake, OBE). Intermediate breaks will not be postulated at locations where the expansion stress exceeds 0.8SA.

Thermal stress is a secondary stress, and taken in absence of other stresses, does not cause ruptures in pipe. This approach is permitted by GL 87-11 as a deviation from Reference 6.

• For piping that is not rigorously analyzed or does not include seismic loadings, intermediate breaks will be postulated at locations as provided in BTP MEB 3-1 (Section B.1.c(2)(b)(i)). This MEB 3-1 section provides more detail than the associated requirements in Reference 6, as amended by Reference 7, so that the most adverse locations can be identified as required in these references.

• Terminal ends are vessel/pump nozzles, building

Nuclear Regulatory Commission - Summary, HELB Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 9 penetrations, in-line anchors, and branch to run connections that act as essentially rigid constraints to piping thermal expansion. A branch appropriately modeled in a rigorous stress analysis with the run flexibility and applied branch line movements included and where the branch connection stress is accurately known will use the stress criteria noted above for postulating break locations as noted above in the 6 th bullet. For unanalyzed branch connections or where the stress at the branch connection is not accurately known, break locations will be postulated as noted in the 7 th bullet above.

Reference 6, as amended by Reference 7, provided criteria to determine pipe break orientation at break locations and specifies that longitudinal breaks in piping runs and branch runs be postulated for nominal pipe sizes greater than or equal to four inches.

Circumferential breaks are to be postulated at the terminal ends. The design of existing and potentially new rupture restraints may be used to mitigate the results from such breaks, including prevention of pipe whip and alteration of the break flow. For ONS, longitudinal breaks will not be postulated at terminal ends.

0 For piping that is seismically analyzed (i.e. stress analysis information is available and the analysis includes seismic loading), critical cracks will be postulated in equivalent Class 2 or 3 piping at axial locations where the calculated stress for the applicable load cases exceed O.4 (SA + Sh). Applicable load cases will include internal pressure, dead weight (gravity),

thermal and seismic (defined as operational basis earthquake, OBE). This approach is in accordance with BTP MEB 3-1 (Section B.1 .e(2)) which is deviation from the requirements of Reference 7.

• For piping that is not rigorously analyzed or does not include seismic loadings, critical cracks will not be postulated since the effects of postulated circumferential and longitudinal breaks at these locations will bound the effects from critical cracks (See the 7 th bullet above).

o Actual stresses used for comparison to the break and crack thresholds noted above will be calculated in accordance with the ONS piping code of record, USAS

Nuclear Regulatory Commission - Summary, HELB Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 10 B31.1.0. (1967 Edition) Allowable stress values SA and S1, will be determined in accordance with the USAS B31.1.0 or the USAS B31.7 (February 1968 draft edition with errata) code as appropriate.

o Moderate energy line breaks will not be postulated.

Moderate energy rules were not in place when ONS was licensed and built and the effect of moderate energy cracks have not been evaluated.

• Systems and components necessary to reach CSD will not be protected from HELBs. Station repair guidelines will be employed to effect repairs as required to those systems and components necessary to reach CSD. The affected unit will remain at SSD conditions while those necessary repairs are completed. Current damage repair guidelines and procedures will be enhanced, as necessary, to extend SSD capability beyond the 72-hour Current Licensing Basis (CLB) and to establish CSD.

The enhanced capability will not be part of the CLB or related to operability of the Standby Shutdown Facility (SS F).

a A single active failure will be postulated in the Protected Service Water/High Pressure Injection (PSW/HPI) or SSF systems for the initial event mitigation as well as achieving and maintaining SSD. Single active failures will not be postulated during plant cooldown to CSD.

The LAR will include a provision to continue reliance on the CLB regarding application of the single failure criteria to the letdown piping.

0 Onsite emergency power distribution systems located in the TB will not be credited for mitigation of HELBs that could occur in the TB. New switchgear, to be installed as part of the PSW system, along with the SSF will be utilized for mitigation of HELBs that could occur in the TB.

• The new PSW and the East Penetration Room flood prevention modifications will be designed and constructed to the quality standards applicable to a safety-related system.

o A new time critical action will be created for the operators to place the PSW system into operation within 15 minutes following a complete loss of main and emergency feedwater with a complete loss of 4160 VAC

Nuclear Regulatory Commission - Summary, HELB Mitigation Strategy and Regulatory Commitments November 30, 2006 Page 11 power. A single HPI pump per unit can be aligned to the Borated Water Storage Tank and started to reestablish seal cooling for the reactor coolant pumps. A new time critical action will be created for the operators to place HPI into operation (from PSW power) within 20 minutes following a complete loss of 4160 VAC power. The new time critical actions will be time validated in accordance with the current ONS standards for emergency procedures. The operator would then maintain SSD conditions and energize pressurizer heaters as necessary to maintain reactor coolant pressure within limits.

25H Verbally notify in advance the Deputy Director, Division of As necessary, Reactor Licensing of the NRC, followed by a written until 03-2012 communication, of significant changes in the scope and/or completion dates of the commitments in Attachment 3 to this submittal. The notification will include the reason for the changes and the modified commitments and/or schedule.

ATTACHMENT 4 HIGH ENERGY LINE BREAK (HELB) MITIGATION STRATEGY

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 2 Introduction 1 In order to describe the Oconee Nuclear Station (ONS) updated HELB mitigation strategy, this section will first discuss the key concepts and assumptions planned for use in the HELB reconstitution project. These concepts and assumptions were first proposed in 2003 in Reference 8. Following that discussion, the mitigation functions described in Reference 6, as amended by Reference 7, are described with an explanation of how Duke intends to meet those functions considering the reconstituted HELB design basis. These discussions provide the basis for the updated HELB mitigation strategy.

Key Concepts and Assumptions The updated HELB mitigation strategy is predicated upon certain key concepts and assumptions. The first of these concepts/assumptions addresses the measures to be taken to minimize postulated pipe failures that could affect structures, systems and components (SSC) necessary to reach safe shutdown 2 (SSD) and those SSCs necessary to reach cold shutdown3 (CSD) conditions. SSCs located in the Turbine Building (TB) are protected from postulated breaks and cracks that could occur in the Auxiliary Building (AB). In addition, SSCs located in the AB are protected from postulated breaks and cracks that could occur in the TB. For high energy piping breaks and cracks postulated to interact with SSCs necessary to reach SSD, periodic volumetric inspection of locations will be conducted. Further, for high energy piping breaks that could potentially affect structures housing systems and components necessary to reach CSD, periodic volumetric inspections of those break locations will be conducted. Duke believes these inspections will provide a high degree of confidence in the continued structural integrity of high energy piping in these locations.

For high energy piping breaks and cracks that could potentially affect systems and components necessary to reach CSD, periodic volumetric inspection of those break and crack locations will not be performed and the SSCs will not be protected from the effects of HELBs. Station repair guidelines will be utilized to repair those systems and components necessary to reach CSD. Inherent in this concept is the maintenance of SSD conditions until-the necessary repairs are completed. As described herein, the planned modifications would enable the plant to remain at SSD conditions while repairs would be made to systems and components necessary to reach CSD.

The second key concept/assumption regards the postulation of single active failures of systems or components during event mitigation. Single active failures will be postulated for the systems required for initial HELB event mitigation. Once the plant has been stabilized at SSD conditions, a plant cooldown would be initiated, as warranted, to bring General verb usage convention in this attachment is as follows: 1) "will" reflects a documented commitment, 2) "would" reflects a future state, and 3) "is" and "was" reflect the present or previous state.

2 Safe Shutdown is defined as Mode 3 with average Reactor Coolant System (RCS) temperature > 525°F

' Cold Shutdown is defined as Mode 5, Reactor Coolant System temperature < 200 0 F.

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 3 the unit to CSD, following completion of repairs, should repairs be necessary. No single active failures will be postulated during the cooldown phase. This approach is consistent with the concept/assumption that damaged SSCs needed for cooldown can be repaired prior to commencement of cooldown.

The third key concept/assumption addresses the identification of high energy systems where breaks or cracks are to be postulated. Reference 6, as amended by Reference 7, required that protection be provided to those systems that normally operate at temperatures greater than or equal to 200°F or at pressures greater than or equal to 275 psig. That requirement will be modified as follows: HELB protection will not be required if the operating time of a system at high energy conditions is less than 1% of the total plant time (e.g., Emergency Feedwater), or if the operating time of a system at high energy conditions is less than 2% of the total system operating time (e.g. Low Pressure Injection). For systems meeting these limitations, no breaks or cracks are to be postulated. This assumption is supported by the very low probability of a HELB occurring during the limited operating time of these systems at high energy conditions.

The fourth key concept/assumption involves the postulation of break and crack locations, as discussed in the Current Licensing Basis (CLB) - Reference 6 and 7 as documented in the MDS Report OS-73.2 and its Supplement 14. The consideration of arbitrary intermediate breaks will be eliminated; circumferential and longitudinal break locations will be postulated as follows:

a. For piping that is seismically analyzed (i.e. stress analysis information is available and the analysis includes seismic loading), intermediate breaks will be postulated in equivalent Class 2 or 3 piping at axial locations where the calculated stress for the applicable load cases exceed 0. 8 (SA + Sh). Applicable load cases include internal pressure, dead weight (gravity), thermal, and seismic (defined as operating basis earthquake, OBE). Intermediate breaks will not be postulated at locations where the expansion stress exceeds 0. 8 SA. Thermal stress is a secondary stress, and taken in absence of other stresses, does not cause ruptures in pipe. This approach is permitted by GL.87-11.

b. For piping that is not rigorously analyzed or does not include seismic loadings, intermediate breaks will be postulated at locations as provided in BTP MEB 3-1 (Section B.1 .c (2)(b)(i)). This BTP MEB 3-1 section provides more detail than the associated requirements in Reference 6 so that the most adverse locations can be identified as required in Reference 6.

c. Terminal ends are vessel/pump nozzles, building penetrations, in-line anchors, and branch-to-run connections that act as essentially rigid constraints to piping thermal expansion. A branch appropriately modeled in a rigorous stress analysis with the run flexibility and applied branch line movements included, and where MDS Report OS-73.2,"Analysis of Effects Resulting from Postulated Piping Breaks Outside Containment for Oconee Nuclear Station, units 1, 2 & 3" dated April 25, 1973 and its Supplement 1 dated June 22, 1973.

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 4 the branch connection stress is accurately known, will use the stress criteria for postulating break locations as noted above in Item a. For unanalyzed branch connections or where the stress at the branch connection is not accurately known, break locations will be postulated as noted above in Item b.

d. Reference 6 provided criteria to determine pipe break orientation at break locations and specifies that longitudinal breaks in piping runs and branch runs be postulated for nominal pipe sizes greater than or equal to four inches.

Circumferential breaks are to be postulated at the terminal ends. The design of existing and potentially new rupture restraints may be used to mitigate the results from such breaks, including prevention of pipe whip and alteration of the break flow. For ONS, longitudinal breaks will not be postulated at terminal ends.

For the postulation of critical cracks, the following applies:

e. For piping that is seismically analyzed (i.e. stress analysis information is available and the analysis includes seismic loading), critical cracks will be postulated in equivalent Class 2 or 3 piping at axial locations where the calculated stress for the applicable load cases exceed O.4(SA + Sh). Applicable load cases include internal pressure, dead weight (gravity), thermal and seismic (defined as the operating basis earthquake, OBE). This approach is in accordance with BTP MEB 3-1 (Section B.1 .e(2)) which is being substituted for the requirements in Reference 7.

f. For piping that is not rigorously analyzed or does not include seismic loadings, critical cracks will not be postulated, since the effects of postulated circumferential and longitudinal breaks at these locations will bound the effects from critical cracks (see Item b above).

Actual stresses used for comparison to the break and crack thresholds noted above will!

be calculated in accordance with the ONS piping code of record, USAS B31.1.05.

Allowable stress values SA and Sh will be determined in accordance with the USAS B31.1.0 code or the USAS B31.76 code as appropriate.

Mitigation Functions Reference 6, as amended by Reference 7, describes certain mitigation functions that must be fulfilled in order to meet the overall HELB requirements. Listed below are these functions and a description of how those functions would be met by the updated HELB mitigation strategy.

Item #10 in Reference 6.

Verification that failure of any structure, including nonseismic Category / structures, USAS B31.1.0, 1967 Edition, "Power Piping" 6 USAS B31.7 (dated February 1968, with Errata of June 1968), "USA Standard Code for Pressure Piping"

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 5 caused by the accident, will not cause failure of any other structures in a manner to adversely affect:

a) Mitigation of the consequences of the accidents; and, b) Capabilityto bring the unit(s) to a CSD condition.

The updated HELB mitigation strategy will include an evaluation of potential interactions between postulated HELBs and TB structural components. Thrust loads calculated for this evaluation would be determined in accordance with ANSI 58.27. An energy approach would be used to first determine if the applied thrust loads (with a whip moment arm) would exceed the plastic capacity of pipe and determine if a plastic hinge will form. Should a plastic hinge form and the pipe whip impact the structural component, the response of the component would be determined, and a code check would be performed to the requirements of the structural steel code of record, AISC 8 ,

Dynamic load and increase factors would be employed to capture the impact response of the structure.

Certain structural components may fail to meet the requirementsof AISC. In those cases, stability of the structure would be reviewed and confirmed, and the localized effects evaluated. Periodic volumetric inspection of select high energy piping locations will be implemented for those identified interactions with structural components that fail to meet the functionality requirements and whose failure may affect the ability of systems and components necessary to reach SSD, and subsequent cooldown to CSD.

The updated HELB mitigation strategy will also evaluate any potential interactions with the Auxiliary Building (AB) structure. These interactions include any internal pressurization effects that may occur in the East Penetration (EPR) and West Penetration Rooms following pipe ruptures that may occur in those rooms.

Pressurization effects have been calculated utilizing the GOTHIC 4.0 code. Since the AB is a reinforced concrete structure with infill un-reinforced masonry partition walls, any identified interactions have been evaluated in accordance with the appropriate concrete code of record, ACl 9 . Certain walls of the AB have been fortified with steel plates and columns. These components have been evaluated to the requirements of the AISC code. Certain exterior walls ('blow-out panels') in the EPR are designed to fail in the aftermath of either a Main Steam (MS) or Main Feedwater (MFW) line break, relieving pressure to the atmosphere. Calculations have been completed that confirm the ability of the blow-out panels to function as designed. Certain structural components may fail to meet the requirements of the referenced codes. In those cases stability of the structure would be reviewed and confirmed, and the localized effects evaluated.

7 ANSI/ANS-58.2-1988, "American National Standard, Design Basis for Protection of Light Water Nuclear Power Plants Against the Effects of Postulated Pipe Rupture."

8 American Institute of Steel Construction, Manual of Steel Construction, 6 h Edition 9 American Concrete Institute, ACI 318-63, "Building Code Requirements for Reinforced Concrete, June 1963" and ACI 531-79, "Building Code Requirements for Concrete Masonry Structures, 1979"

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 6 Periodic volumetric inspection of select high energy piping locations will be implemented for those identified interactions with structural components that result in a failure to meet the structural functionality requirements and when the structural failure may affect the ability of systems and components necessary to reach SSD, and subsequent cooldown to CSD.

Item #11 in Reference 6, as amended by Reference 7.

Verification that rupture of a pipe carrying high energy fluid will not directly or indirectly result in:

a) Loss of required redundancy in any portion of the protectionsystem. (as defined in IEEE-279), Class 1E electric system (as defined in IEEE-308), ES equipment, cable penetrations, or their interconnectingcables required to mitigate the consequences of that accident and place the reactor(s) in a cold shutdown condition1 o; or Environmentalinduced failures caused by a leak or rupture of the pipe which would not of itself result in protective actions but does disable protection functions. In this regard,a loss of redundancy is permitted but a loss of function is not permitted.

Forsuch situations plant shutdown is required.

The original HELB mitigation strategy, as documented in the MDS Report OS-73.2, identified break locations inside the TB that could result in the combined loss of main and emergency feedwater as well as the complete loss of 4160V power to Engineered Safeguards (ES) equipment. Modifications were implemented to provide an alternate means of providing the decay heat removal function utilizing Emergency Feedwater (EFW) from an alternate unit to address the single active failure of the station Auxiliary Service Water (ASW) pump. A single HPI pump with a single source of electrical power, not vulnerable to HELB effects inside the TB, would be utilized to support plant cooldown.

The updated HELB mitigation strategy would provide redundant means to feed either steam generator for the decay heat removal function. One train of HPI would be provided to meet the plant cooldown function. The updated strategy will allow for a decreased reliance on systems and components located in the TB. Inherent in this strategy is the reliance on modifications to the ASW system11 and its associated electrical distribution system. Power to a single HPI pump in each unit would be provided from the new electrical power distribution system. Improvements would be made to minimize operator actions outside the Control Room (CR) to align the modified 10 Duke has interpreted the loss of protection systems, Class 1 E electrical systems and engineered safeguards equipment to be acceptable provided the postulated break did not require their use in the mitigation of the pipe break. Duke's interpretation was reflected in the MDS report which was subsequently accepted by the Atomic Energy Commission.

" The Station Auxiliary Service Water System will be renamed the Protected Service Water (PSW)

System to distinguish this system from the Standby Shutdown Facility Auxiliary Service Water System.

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 7 systems. In addition, the strategy involves the SSF for HELB mitigation in order to address postulated single active failures in the PSW/HPI system.

The updated HELB mitigation strategy requires the installation of a modified alternate means of achieving SSD conditions, the PSW/HPI system. The PSW/HPI system will be utilized for mitigating HELB events postulated to occur in the TB that could disable the associated unit's protection systems, Class 1E power, or ES equipment. The PSW system would receive QA-1 power from the Keowee Hydro Units via an underground cable to its associated transformer/switchgear located external to the TB. The PSW electrical distribution system would provide QA-1 power to a high head service water pump and associated electrically operated valves to feed up to six fully pressurized steam generators (SG) concurrently. In addition, the PSW electrical distribution system would provide QA-1 power to a single HPI pump per unit and its associated electrically operated valves to establish makeup from the Borated Water Storage Tank (BWST) to the Reactor Coolant System (RCS) and seal injection flow to the Reactor Coolant Pumps (RCP).

Since the PSW system would be capable of being aligned and started from the main CRs, it would eliminate operator actions in the TB needed to align EFW. Also, since the system would be capable of concurrently feeding the six fully pressurized Steam Generators (SG), current operator actions necessary to manually operate the Atmospheric Dump Valves to depressurize the SGs to enable feeding of the SGs, would no longer be time critical. An added benefit of the system would be the ability to maintain water levels in the SGs to provide long-term SSD capability. After reaching SSD, the upgraded system would be capable of cooling the plant down to the Low Pressure Injection (LPI) system entry conditions.

The PSW system would be capable of being promptly aligned to deliver flow to the SGs within 15 minutes following the HELB event. This capability would prevent overheating of the RCS and minimize challenging the Pressurizer Relief Valves under saturated water lift and repetitive cycling conditions.

The PSW system, with the SSF as a back up, would be able to mitigate non-MS line breaks that could occur in the TB. Per the CLB, ES systems mitigate MS breaks that could occur. Periodic volumetric piping inspections will be implemented for high energy piping locations whose failure could impact systems and components necessary to protect the pressure boundary of the MS system.

As noted, the PSW system would be capable of cooling the RCS down to LPI system entry conditions. Single active failures will not be assumed to occur in any systems and components needed during the cooldown phase. Damage repair guidelines would be utilized to repair damaged equipment needed to establish CSD.

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 8 Item #12 in Reference 6.

Assurance should be provided that the CR will be habitable and its equipment functional after a steam line or feedwater line break or that the capability for shutdown and cooldown of the unit(s) will be available in another habitablearea.

The MDS report stated that the integrity of the main CRs was protected from postulated ruptures in the MS and MFW system. The main CRs are protected from postulated MS and MFW line breaks in the EPR by a structural reinforced concrete wall between the main CRs and the penetration room. As the report also stated, there are no large openings in the wall, and the small openings have pressure seals which prevent any steam or water pathways into the main CR.

The Control Room Ventilation and Air Conditioning systems are designed to maintain the environment in the control area (main CR, cable room, and electrical equipment room) within acceptable limits for personnel and electrical equipment. The chilled water system and power for the ventilation and air conditioning systems are located inside the TB. These systems may not be available following postulated HELBs inside the TB.

However, existing analysis shows that the main CR would remain habitable and the equipment located there would remain functional should there be a prolonged loss of the ventilation and air conditioning systems to the control area. As a back up to the main CR, the SSF CR is fully capable of monitoring and controlling the plant at SSD conditions using the SSF systems.

Item #13 in Reference 6, as amended by Reference 7.

Environmentalqualificationshould be demonstratedby test for that electrical equipment requiredto function in the steam-airenvironment resulting from a high energy fluid line break. The information required for our review should include the following:

a) Identification of all electricalequipment necessary to meet requirements of 11 above. The time after the accident in which they are required to operate should be given.

b) The test conditions and the results of test data showing that the system will perform their intended function in the environment resultingfrom the postulatedaccident and the time interval of this accident. Environmental conditions used for the tests should be selected from a conservative evaluation of accident conditions.

c) The results of a study of steam systems identifying locations where barrierswill be required to prevent steam jet impingement from disabling a protectionsystem. The design criteria for the barriersshould be stated and the capabilityof the equipment to survive within the protected environment should be described.

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 9 d) An evaluation of the capability of safety related electricalequipment in the CR to function in the environment that may exist following a pipe break accident should be provided. Environmental conditions used for the evaluation should be selected from conservative calculationsof accident conditions.

e) An evaluation to assure that the onsite power distributionsystem and onsite sources (diesels and batteries) will remain operable throughout the event.

The mitigation strategy for ensuring that systems and components required to function in the resulting environment following a HELB follows closely the strategy described in Item #11 above.

Auxiliary Building The environmental effects following postulated HELBs outside containment were described in the MDS Report and later documented in the Environmental Qualification Criteria Manual. The only areas outside containment that were subjected to appreciable pressure and temperature effects following a HELB were the penetration rooms. The adverse environmental effects were created by a terminal end break in the MS or MFW line in these rooms. The existing electrical equipment located inside the penetration rooms needed to mitigate the consequences of these postulated breaks has been evaluated to demonstrate that it would function in the postulated steam-air environment.

Duke has reanalyzed the postulated MS and MFW line breaks inside the penetration rooms using as-built data for the plant. The electrical equipment relied upon to mitigate these HELBs has been evaluated and found to be functional for the postulated steam-air environment. The updated HELB mitigation strategy would not utilize PSW and the SSF for mitigation of the postulated MS and MFW line breaks inside the penetration rooms. The existing plant systems (e.g., ES) would continue to be relied upon to mitigate these breaks because emergency power from the TB would still be available.

Duke will perform periodic volumetric inspections of the girth welds and accessible attachment welds for the MS and MFW systems as well as for other postulated high energy piping breaks and critical cracks located at welds in the AB. Duke will also perform periodic inspections of base metal locations on the MFW system and other high energy piping critical cracks not located at welds in the AB. These inspections will demonstrate the integrity of the piping and eliminate the postulation of breaks and cracks in the AB.

Turbine Building The environmental effects following postulated HELBs inside the TB were negligible as documented in the MDS Report. Therefore, no environmental qualification testing was performed for any. of the electrical equipment located in the TB to demonstrate that the equipment could continue to perform its intended function in the environment

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 10 resulting from the postulated pipe rupture. IE Bulletin (IEB) 79-01 B required licensees to perform a detailed review of the environmental qualification of Class 1E electrical equipment to ensure that the electrical equipment would function during and after postulated accident conditions (including HELBs outside containment). A new environmental profile was not necessary for the TB in response to IEB 79-01 B.

Duke was also required to evaluate the environmental effects on non-safety control systems and their impact on safety systems in accordance with IE Information Notice 79-22; only the MS line and MFW line breaks were considered in the evaluation. An environmental profile inside the TB was chosen to be a temperature of 212°F for 30 minutes, followed by a ramp down to 120°F over the next 90 minutes. Humidity was assumed to be 100% non-condensing. This evaluation indicated that the turbine bypass valves could potentially open when subjected to the assumed environmental conditions. In addition, the main and startup feedwater control valves may not close via Integrated Control System control following a reactor trip. The consequences of these potential failures in non-safety control systems were considered to be acceptable for MS line breaks (MSLB) and MFW line breaks provided ES remained available.

The updated HELB mitigation strategy would utilize the PSW/HPI system and the SSF for HELBs inside the TB that disable protection systems, Class 1 E power, or ES. The PSW/HPI system, the SSF, and their associated electrical distribution systems would be located outside of the TB. Therefore, any adverse environmental conditions created inside the TB would not impact operation of the PSW/HPI system or the SSF.

Therefore, no environmental profile will be required for HELBs that would be mitigated by the PSW/HPI system or the SSF.

The PSW/HPI system and the SSF would be capable of maintaining SSD conditions for many of the postulated HELBs that could occur in the TB. However, analysis of the effects from individual postulated breaks and crack locations is not sufficiently complete to support a description of the intended mitigation strategy for MSLBs and other HELBs that may result in a compromise of the MS pressure boundary. The continuing analysis will consider non-safety control system malfunctions induced by environmental effects, the validity of the assumed environmental profile in the TB and the capabilities of the PSW/HPI system and the SSF to mitigate these HELBs.

The installation of barriers inside the TB to prevent disabling of protection systems was not required by the MDS report. The report described HELBs inside the TB that could potentially damage mechanical, electrical, and structural portions of the station. The potential damage was identified on a case-by-case basis. The postulated pipe ruptures in the MS system did not create any damage to protection systems, Class 1 E electrical systems or ES equipment needed to mitigate the consequences of the break.

Postulated ruptures of other high energy systems (e.g. MFW or auxiliary steam) could result in the complete loss of 4160V/600V/208V power to ES equipment on the affected unit. However, other means were provided to safely shutdown the unit without the benefit of ES equipment. Therefore, no barriers were considered to be necessary to

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 11 protect the protection systems, Class 1 E electrical systems or ES equipment and their associated cabling from postulated pipe ruptures inside the TB. The installation of the PSW/HPI system as part of the updated HELB mitigation strategy replaces and enhances those other means described in the MDS report.

As previously discussed in Item 12, the functionality of the safety related electrical equipment in the main CR following a HELB was addressed in the MDS report. The new PSW/HPI system controls would be located inside the associated unit main CRs.

Therefore, the functionality of the electrical equipment inside the main CRs must be maintained. Current analysis indicates that the electrical equipment located in the main CRs remains functional should there be a prolonged loss of ventilation and air conditioning. As part of the updated HELB mitigation strategy, any additional heat load created by the new PSW/HPI components would be factored into the loss of ventilation calculations to verify the electrical equipment remains functional and the main CRs remains habitable.

The current onsite power distribution system and batteries relies upon equipment located inside the TB. Specifically, the 4160V switchgears TC, TD, and TE provide power to the applicable unit's equipment (including the battery chargers). These switchgears and the associated main feeder buses supplying power to the switchgears may be vulnerable to postulated HELBs inside the TB. The installation of the new PSW/HPI electrical distribution system will provide the required electrical power to selected plant equipment necessary to achieve and maintain SSD conditions, should the current onsite power distribution system be lost. The PSW/HPI electrical distribution system will provide power to the following:

" The new high head PSW pump and associated valves to deliver water to the steam generators.

• One HPI pump per unit and the associated valves to deliver water from the BWST to the RCP seals and RCS makeup.

" A sufficient number of pressurizer heaters on each unit to maintain a steam bubble.

• RCS High Point Vent and Reactor Vessel Head Vent valves for boration and RCS inventory control. The head vents are needed to support a natural circulation cooldown.

• Two battery chargers per unit to maintain power to the vital Instrumentation and Control batteries. This capability ensures the availability of required instrumentation to reach SSD and subsequent cooldown.

In the MDS report, it was apparently assumed that non-MSLB HELBs did not result in an uncontrolled blowdown of either steam generator. In that respect, the loss of power

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 12 to ES equipment was considered to be an acceptable consequence. MS pressure boundary control was assumed to be maintained by the automatic closure of the main turbine stop valves. MS pressure boundary isolation relies upon single isolation valves to perform the function. As core decay heat decreases, additional operator actions may be needed to isolate the MS branch lines. Since the PSW/HPI electrical distribution will not provide power to these valves, local operator action would be relied upon to isolate the MS branch lines. These assumptions will continue to remain part of the CLB.

Item #15 in Reference 6.

A discussion should be provided of the potential for flooding of safety related equipment in the event of a failure of a feedwater line or any other line carryinghigh energy fluid.

The updated HELB mitigation strategy does not require that flood protection be provided for systems and components located in the TB with the exception of systems and components required to protect the MS system pressure boundary. Flood protection will be provided for SSD systems and components located in the AB. No additional flood protection will be provided for systems and components necessary to reach CSD.

However, damage repair guidelines would be utilized for repair of those systems and components necessary to reach CSD.

The AB HELB flood prevention modifications will allow water from a MFW break or crack in the EPR to be collected and directed outside of the AB. This will prevent water from reaching the lower levels of the AB, and challenging the ability of important safety related systems and components to function.

The first series of modifications included the installation of a passive flow outlet device on the west wall of the EPR of each unit that will utilize a rupture disc design to release water outside of the EPR and AB. A second series of modifications will provide flood impoundment. This improvement will provide the capability to impound water released into the EPR and direct the water to the flood outlet device noted above.

Item #16 in Reference 6.

A description should be provided of the quality control and inspection programs that will be required or have been utilized for piping outside containment.

The PSW system would be designed and constructed to meet Duke's standards for a safety-related system (QA-1). The EPR flood prevention modifications will also be designed and constructed to QA-1 requirements.

As noted throughout this submittal, periodic piping volumetric inspections will be implemented to demonstrate the integrity of the subject piping at the postulated

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 13 break/crack location. These volumetric inspections will determine the piping wall thickness, to a suitable distance, on either side of the subject weld and determine the integrity of the weld, i.e. that the weld meets ASME Section X112 requirements. These inspections will be used to eliminate postulation of the particular break and crack location(s). Prompt repairs would be made should any inspection discover thinning of the pipe wall below acceptable standards, or weld indications that do not meet the standards of ASME Section XI. Repairs would be made in accordance with the applicable quality standards of the piping system.

Item #21 in Reference 6.

A description should be provided of the methods or analyses performed to demonstrate that there will be no adverse effects on the primary and/or secondary containmentstructures due to a pipe rupture outside these structures.

In general, the Reactor Building (RB) penetrations represent terminal ends in the piping analyses. Two types of piping penetration designs were installed at ONS; those for the small bore piping penetrating the primary containment, and those for the MS and MFW piping penetrating the primary containment. Each RB penetration is designed to withstand the forces and moments that could be applied to the terminal end should a break occur in the piping line outboard of the terminal end. This design protects the primary containment from breaks that could occur outboard of the terminal end.

The small bore penetration design is provided below. The design consists of a hollowed out dished head and either struts or penetration inserts. The dished head is located inside the RB and is designed to absorb the axial and lateral forces and torsional moment should a break occur in the piping outboard of the terminal end. The inside circumference of the dished head is welded directly to the outside surface of the process pipe. The outside diameter of the dished head is welded directly to a housing that is in turn welded to the primary containment liner. The penetration inserts or struts were located outside of the RB in the penetration rooms. The inserts/struts are designed to absorb lateral forces from the break.

12 American Society of Mechanical Engineers Section Xl, "Rules for Inservice Inspection of Nuclear Power Plant Components"

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 14 Small Bore Pioina Penetration RB EPR Insert I Strut The MDS report described breaks postulated to occur at the small bore containment penetrations. These breaks were located outboard (penetration room side) of the terminal end. Containment integrity is protected from breaks postulated to occur at these locations.

The design of the MS and MFW RB penetrations differ from the small bore RB penetrations. For these lines, structural anchors have been installed adjacent to the RB penetrations. The two MFW structural anchors are located in the EPR. These anchors are designed to absorb the large forces and moments that could occur in the aftermath of a postulated MFW break occurring outboard of the structural anchor. The MFW anchors consist of a collar wrapped around the outside diameter of the piping. The collar is connected at both ends to the piping via two circumferential fillet welds. The collar is in turn welded to a series of structural wide flange members that span back to the RB wall. The wide flange members are then welded to embedded structural tees located in the RB wall. A simplified sketch of the MFW penetration follows:

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 15 MFW Penetration RB EPR The MDS report described breaks postulated to occur at the MFW containment penetrations. These breaks were located outboard (penetration room side) of the terminal end. Containment integrity is protected from breaks postulated to occur at these locations.

The MS RB penetration is similar to the MFW design. While the MFW structural anchor is located inside the EPR, the structural anchor adjacent to the MS penetration is located inside of containment, as shown below.

MS Penetration Welds RB

Nuclear Regulatory Commission - HELB Mitigation Strategy November 30, 2006 Page 16 The MDS report described breaks postulated to occur at the MS containment penetrations. These breaks were located outboard (penetration room side) of the terminal end. Containment integrity is protected from breaks postulated to occur at these locations.

ATTACHMENT 5 RESPONSES TO KEY ISSUES IDENTIFIED IN JULY 12, 2006 NRC LETTER

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 2 Issue #1 - Use of TORMIS The April 12, 2006, letter states that the TORMIS computer code will be used to evaluate the probabilityof damage from tornado-generatedmissiles for certain structures, systems, and components (SSCs) Address the issues discussed in the NRC staff's October 26, 1983 TORMIS safety Evaluation for those SSCs for which TORMIS is used. All SSCs that are relied upon for tornado mitigation (including Keowee, atmospheric dump valves (ADVs), etc.) and are not adequatelyprotected (irrespective of function) must be collectively assessed. Physicalseparationof SSCs is not considereda viable option for evaluating the effects of tornadoes.

Duke Response:

Issue / Background The TORMIS methodology can be used to establish compliance with the Standard Review Plan (SRP) guidance for tornado missile protection by demonstrating that the probability of significant damage, resulting from a missile strike to systems, structures and components (SSC) required to prevent a radioactive release in excess of 10CFR100, is less than a mean value of 1 E-06/yr. For a multi-unit site, this criterion is applied to each unit individually, i.e., 1 E-06/rx-yr for each unit. "Significant damage" is defined as damage which prevents an SSC from performing its tornado mitigation function.

The following functions are required for tornado mitigation:

• Secondary Side Decay Heat Removal

• Reactor Coolant Pump Seal Injection

• Integrity of the Reactor Coolant System Pressure Boundary The potential for damage to unprotected SSCs that support these functions (with the exception of the Keowee Hydro Units (KHU)) will be collectively assessed against the TORMIS acceptance criterion. The Oconee Nuclear Station (ONS) TORMIS evaluation will credit the redundancy and separation provided by the Standby Shutdown Facility (SSF) systems and the Protected Service Water (PSW)/High Pressure Injection (HPI) systems to fulfill the Secondary Side Decay Heat Removal Functions (SSDHR) and Reactor Coolant Pump Safety Injection (RCP SI) functions. Supporting components would be modeled as described herein. Secondary effects would also be modeled as deemed necessary based on engineering judgment. The TORMIS methodology will not be applied to systems and components required to cool down beyond safe shutdown 1 (SSD) conditions.

Safe Shutdown is defined as Mode 3 with average Reactor Coolant System (RCS) temperature > 525TF

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 3 The TORMIS methodology, as approved by the NRC, provides the following conservatisms:

• Use of the Fujita (F) Scale. Current meteorological research predicts significantly lower tornado wind speeds for the most severe categories of tornadoes.

" Other elements within the TORMIS computer code provide. additional analysis margin as described in the Technical Evaluation Report2 used to support the NRC's Safety Evaluation Report (SER)3 on TORMIS. This includes the missile injection model, damage assessment analysis, and other elements.

The considerations for use of the EPRI approach as discussed in the NRC TORMIS SER will be addressed as follows:

NRC TORMIS SER condition - Tornado characteristicsshould be based on data taken from broadregions and small areas around the site and the justification should be provided for the values selected.

• The tornado hazard will be calculated using data for a broader region (EPRI NP-2005 Region A) and in the vicinity of the ONS site.

NRC TORMIS SER condition - The F-Scale tornado classificationshould be used instead of the modified form described in the EPRI report.

o The modified Fujita F-Scale will not be used to characterize tornado wind velocities.

NRC TORMIS SER condition - Reductions in wind speed near the ground should be more thoroughly justified than in the EPRI report.

• A velocity profile value of 0.82 will be used to define the ratio of ground velocity to velocity at the 33-foot elevation. This value has been employed by DC Cook and otherlicensees in TORMIS submittals which have been reviewed and approved by the NRC.

NRC TORMIS SER condition - Missile inventories should be site specific.

• Missile inventories will be based on site specific inspections and will be monitored using a site program.

NRC TORMIS SER condition - Providejustification to any deviations to the EPRI method.

• No deviations beyond those required by the SER are planned.

2 Electric Power Research Institute Report - EPRI NP-2005, Volumes 1 and 2, "Tornado Missile Risk Evaluation Methodology," dated August 1981.

3 Memorandum from L. S. Rubenstein to Frank J. Miraglia, "Safety Evaluation Report - Electric Power Research Institute (EPRI) topical Reports concerning Tornado Missile Probabilistic Risk Assessment (PRA) Methodology," dated October, 1983.

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 4 Note: Modifications will be implemented to qualify the Borated Water Storage Tank (BWST) and associated interconnected piping and instrumentation outside the Auxiliary Building (AB) for each unit to Updated Final Safety Analysis Report (UFSAR) tornado protection requirements. This change will support the elimination of the Spent Fuel Pool (SFP) as an alternate suction source to HPI pumps following a tornado strike.

Regulatory Perspective In the original UFSAR, Duke indicated that physical separation would be used to protect against tornado missiles. The NRC recognized ONS's use of physical separation for this purpose in the original Safety Evaluation Report (SER) and in early versions of the SRP.

In resolving Systematic Evaluation Program (SEP) Issue 156.1.5, "Tornado Missiles,"

the NRC concluded that the guidance relative to tornado missile protection prior to 1972 was not adequate. The NRC delegated resolution of this issue for the 41 plants included in the SEP to the IPEEE. ONS was one of the 41 plants listed in the SEP and received the NRC's review and approval of the IPEEE in 2000. No additional actions were required relative to tornado missile protection as a result of the NRC-approved ONS IPEEE submittal.

In 1989, the NRC issued an SER that approved ONS's use of the TORMIS methodology to address generic industry, POST TMI, SSDHR issues. Since the late 1980's, the NRC has also approved the use of the TORMIS methodology by other licensees on several occasions.

ONS intends to extend the use of the TORMIS methodology to show that two redundant and largely physically separated systems (SSF and PSW/HPI) afford adequate protection against the effects of tornado missiles. ONS believes that that this approach is conservative relative to the Current Licensing Basis (CLB).

Current Licensing Basis ONS received its original operating license before implementation of the SRP (NUREG 0800) and Reg. Guide 1.70. The principle design criteria for ONS Units 1, 2 and 3 were developed in consideration of the seventy (70) General Design Criteria for Nuclear Power Plant Construction Permits proposed by the Atomic Energy Commission (AEC) in a proposed rule-making published for 10CFR Part 50 in the Federal Register of July 11, 1967.

ONS's Principal Design Criterion 2 (PDC-2) states that those systems and components of reactor facilities which are essential to the prevention of accidents and which could affect the public health and safety or the mitigation of their consequences, be designed, fabricated and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 5 might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. The design basis established reflects: a) appropriate consideration of the most severe of these natural phenomena that have been recorded for the site and the surrounding area and, b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.

For this reason, a tornado is considered a design criterion rather than a design basis event or accident. The original and current ONS UFSAR states that a tornado or tornado missile does not initiate or occur concurrently with a Loss of Coolant Accident.

Relative to tornado missile protection, the current licensing basis was formulated on the following historical elements:

" Only the SSDHR function and associated power supplies were considered when describing the tornado mitigation strategy in the original ONS licensing basis.

The RCP SI function was not addressed.

" Physical separation was identified as a means of defending against tornado missiles by ONS in the original FSAR. The application of physical separation was applied to the 'A' and 'B' steam generator paths of the Station Auxiliary Service Water (ASW) system (since either path was considered capable of providing the necessary flow to restore adequate decay heat removal and the paths were physically separated by containment). Additionally, physical separation was applied to the KHU and the station (reference Section 1C.2.4 of the original FSAR). The NRC acknowledged the use of physical separation as a viable means of defending against missiles in the original SER, stating, "With regard to Class I (seismic) components in the auxiliary building [such components] will be protected by concrete walls and roofs to prevent potential missile penetration, or be separated to prevent failures in redundant systems from such missiles."

• As a result of a Post-TMI issue related to Emergency Feedwater (EFW), the NRC directed ONS to perform a probabilistic risk assessment of the SSDHR function subsequent to a tornado. In Duke's submittal, the TORMIS code was utilized. In the 1989 SER which closed out the Post-TMI EFW issue, the NRC stated, "....the undamaged EFW system in one unit can supply feedwater to the steam generators in a unit with damaged EFW system cross-connections in the pump discharge piping ..... Based on review of your probabilistic analysis, the staff concludes that the Oconee secondary side heat removal capability complies with the criterion for protection against tornadoes, and is therefore acceptable. This conclusion is primarily based on the availability of the SSF ASW system." The NRC essentially excluded the station ASW system as a viable means of providing secondary heat removal since it relied heavily on operator actions that could result in liquid-steam relief through the pressurizer safety valves.

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 6 The RCP SI function and associated missile protection was not addressed in the original ONS licensing basis or as part of the Post-TMI issue. This may have been because the potential failure of reactor coolant pump seals due to loss of seal cooling was not considered an important issue during initial licensing.

Future Licensing Basis The ONS future tornado licensing basis will incorporate the use of TORMIS to collectively assess certain SSCs (with the exception of KHU) that support the SSDHR, RCP SI or Reactor Coolant System pressure boundary functions. TORMIS will be used to evaluate SSCs in the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the event that are currently not protected in accordance with UFSAR Class I structure or SSF tornado missile criteria. ONS will incorporate the RCP Sl function into the scope of the TORMIS analysis to support the elimination of reliance on the SFP to HPI pump flow path as described in the IPEEE and as modeled in the current PRA.

Safety Perspective / Conclusions The ONS TORMIS evaluation will credit the redundancy and separation provided by the SSF systems and the PSW/HPI systems to fulfill the SSDHR and RCP SI functions.

The expected TORMIS results will examine whether the probability of tornado missiles striking and damaging SSCs will be at or below the threshold described in NUREG 0800 that reflects an extremely low probability of occurrence. If the probability of damage from tornado missiles is acceptably small, then the likelihood of a radioactive release in excess of 10CFR100 limits will not be increased. If the overall TORMIS results show that tornado missile damage exceeds the acceptance criteria, physical protection of one or more of the SSCs may be necessary.

Issue #2 - Cold Shutdown Discuss how cold shutdown will be achieved, including: a) a defined time for achieving cold shutdown (e.g., 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />); b) recognition of the strategy/systems to be used (e.g.,

residual heat removal (RHR), low-pressure service water, high-pressureinjection (HPI),

PZR heaters,ADVs, instrument,etc.; c.) identification of specific vulnerabilitiesthat need to be addressed,equipment to be staged (e.g., cable, etc.); and, d.) a human factors assessment of effort/repair that is consistent with the NRC review standards/guidance.

Duke Response (Tornado Perspective):

Issue/Background The proposed tornado strategy maintains SSD conditions for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The proposed strategy does not include provisions that initiate or establish conditions for cold shutdown. The NRC has requested additional information regarding

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 7 plans for maintaining SSD beyond 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and for initiating and establishing cold shutdown.

Regulatory Perspective The CLB largely relies on the SSF to provide SSDHR. The CLB establishes the mission time of the SSF as 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and does not include provisions for establishing or maintaining cold shutdown.

Conclusions / Proposed Licensing Basis for Tornado Mitigation The proposed ONS tornado mitigation strategy will continue to provide a means of establishing and maintaining SSD for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> using either the new PSW/HPI system powered from the PSW protected switchgear or the SSF. Existing damage repair guidelines and procedures will be enhanced to: 1) extend safe shutdown capability of the SSF beyond the 72-hour CLB, and 2) establish cold shutdown (CSD) conditions 4 .

Using realistic assumptions, Duke estimates of SSF operational limitations, such as diesel generator fuel inventory and availability of cooling water, indicate that there is capability for continued operation of the SSF beyond its 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> CLB mission time without imposition of new operator actions. This capability provides an added margin of safety, but will not be part of the revised licensing basis and will not be required for operability of the SSF. The HPI.system would be utilized to support cooldown of the affected units to approximately 250 0 F, where they would remain until additional damage control measures can facilitate further cooldown to CSD conditions.

Duke Response (HELB Perspective):

Issue / Background The equipment located inside the Turbine Building (TB) relied upon to establish cold shutdown is not protected from the effects of a HELB inside the TB. Either the SSF or PSW/HPI system would be capable of providing secondary side decay heat removal and reactor coolant pump seal injection subsequent to a HELB event to maintain the affected units sub-cooled with a pressurizer steam bubble in SSD conditions for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This mission time is consistent with the SSF CLB. Additional damage repair may be required to enable the Low Pressure Service Water (LPSW) and the Decay Heat Removal (DHR) function of the Low Pressure Injection (LPI) systems to achieve cold shutdown.

Regulatory Perspective Reference 6 requested licensees and applicants to analyze and document the Cold Shutdown is defined as Mode 5, Reactor Coolant System temperature < 200°F.

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 8 consequences of postulated pipe failures outside the containment structure, including the rupture of a MS or Main Feedwater line. The requirement was to demonstrate that the reactor could be safely shutdown and maintained in a safe shutdown condition following a HELB outside containment. Included in the letter was a list of general information that would be required for review by the AEC. The list of general information required was amended by Reference 7. As a part of these requirements, numerous statements were made regarding achieving CSD conditions. These associated statements are found in Items 10, 11, and 18 of the Reference 6, as amended by Reference 7, letters.

" Item 10 required that failures of any structure caused by the accident could not adversely affect the capability to bring the unit(s) to a cold shutdown condition.

" Item 11 required that the HELB not result in a loss of the required redundancy in any portion of the protection systems, Class 1 E power, engineered safeguards (ES) equipment, cable penetrations, or their interconnecting cables that are required to mitigate the consequences of that accident and place the reactor(s) in a CSD condition.

" Item 18 required a summary of "emergency procedures that would be followed after a pipe break accident, including the automatic and manual actions required to place the reactor unit(s) in a cold shutdown condition. The estimated times following the accident for the equipment and personnel operational actions should be included in the procedure summary."

MDS Report OS-73.2 and its Supplement 1 contain the evaluations completed by Duke to address a HELB outside containment. Each of the above items was addressed on a case-by-case basis for each break. Items 10 and 11 are addressed on Pages 4-7 of in this letter. Item 18 will be addressed on a case-by-case basis for establishing SSD conditions. Duke does not intend to provide emergency procedures and times associated with plant cooldown and the establishment of CSD.

In general, a HELB outside containment is not considered to be a design basis event for ONS. However, a main steam line break (MSLB) is considered to be a design basis event for ONS. Design basis events are those events listed in Chapter 15 of the UFSAR. Mitigation of a MSLB is described in Chapter 15 of the UFSAR and relies upon protection systems, Class 1E power, and ES equipment.

Proposed Licensing Basis for HELB Induced Damage inside the TB ONS will eliminate operator actions required to be performed inside the TB to place the reactor(s) in a SSD condition following damage to safety-related systems located inside the TB. Operator actions inside the TB and damage repairs will be utilized to enable a plant cooldown. There are no time critical actions associated with plant cooldown or the establishment of cold shutdown.

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 9 Two separate SSD systems will be available to mitigate the consequence of damage to safety related systems inside the TB. The primary safe shutdown path will be the PSW/HPI system. The alternate safe shutdown path will be the SSF system. The primary safe shutdown path can maintain SSD conditions in excess of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, while the alternate safe shutdown path can maintain SSD conditions for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The primary safe shutdown path, the PSW/HPI System, has a protected electrical power distribution system capable of powering the high-head PSW pump, a single HPI pump on each unit, up to 400 kW of pressurizer (PZR) heaters per unit, two control battery chargers per unit to maintain power on the vital instrumentation and control electrical distribution system, and the associated electrically operated valves to align the PSW and HPI systems for operation. In addition, electrical power can be supplied to the reactor vessel head vents and Reactor Coolant System (RCS) high point vent valves from the PSW switchgear. The PSW switchgear can be powered from KHU via the underground path or from a 100 kV transmission line from Central/Lee. The PSW pump can deliver sufficient flow to the six fully pressurized steam generators concurrently to adequately remove-core decay heat.

The PSW/HPI systems can provide for a plant cool down; however, additional equipment would be needed to initiate plant cool down. The atmospheric dump valves (ADV) would be used to establish a plant cool down. Since the unit would be in a natural circulation condition, the reactor vessel head vents are required to be opened to prevent developing a steam bubble in the reactor vessel head. With PSW/HPI, utilizing the ADVs, and opening the reactor vessel head vents, the unit(s) can be cooled to approximately 250 0 F. Plant cool down to cold shutdown relies on restoring the LPI and the LPSW systems. The power supply for LPI and LPSW is located inside the TB.

Damage repair guidelines would be employed to restore LPSW and the DHR function of LPI to enable a plant cool down to CSD.

The alternate safe shutdown path, the SSF System, also has a protected electrical power distribution system capable of powering the high-head SSF ASW pump, a reactor coolant makeup (RCM) pump on each unit, two groups of PZR heaters per unit, and the associated motor-operated valves to align the SSF-ASW and RCM systems for operation. The SSF electrical power distribution system receives emergency power from its own diesel generator. The SSF-ASW pump can deliver sufficient flow to the six fully pressurized SGs to adequately remove core decay heat. A time critical action already exists for the operators to place this system into operation following a loss of 4160VAC power. The RCM pump can be aligned to the SFP and started to reestablish seal cooling for the Reactor Coolant Pumps (RCP). A time critical action already exists for the operators to place the RCM system into operation following a loss of 4160VAC power. No new time critical actions are being introduced relative to the SSF system.

Therefore no new time validations would be required.

Unlike the primary shutdown path (PSW/HPI), the alternate safe shutdown path (SSF) cannot provide for a plant cooldown. The operator would maintain SSD conditions and

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 10 energize PZR heaters as necessary to maintain reactor coolant pressure within limits.

The RCM pump has a limited capacity and cannot be utilized to accommodate the shrinkage of the reactor coolant inventory during cooldown. The PSW/HPI would need to be recovered to allow for plant cooldown. Similarly, additional equipment would be needed to initiate plant cooldown. These include the ADVs and the reactor vessel head vents. The ADVs would be used to establish a plant cooldown. With PSW/HPI, use of the ADVs, and opening of the reactor vessel head vents, the affected units can be cooled to approximately 250 0 F. Plant cooldown to cold shutdown relies on restoring the LPI and LPSW systems.

Safety Perspective The proposed installation of the PSW System is an enhancement to the overall mitigation strategy for postulated HELB-related damage to safety-related systems located inside the TB. The PSW system coupled with the HPI system is capable of maintaining SSD for extended periods of time. In addition the PSW system provides the capability to cool the plant to approximately 250 0 F. The existing SSF systems will serve as a backup to the PSW system. The SSF has a defined mission time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Should the PSW system be unavailable, the SSF would be able to maintain SSD for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The PSW system is not postulated to fail due to HELB-related damage inside the TB.

However, the application of a single active failure must be considered. The PSW system has two diverse power sources. Assuming one power source has failed, the other would remain available for HELB mitigation. The PSW electrical system has the capability of powering either the 'A' or 'B' HPI pump on each unit. Should a failure of the HPI pump be postulated, operators can manually swap power to the other HPI pump. There are two valves that can provide HPI pump suction from the BWST. The PSW electrical system provides power to one of these valves. Should this valve fail, the operators can locally open the other valve. The PSW electrical system also supplies power to a reactor coolant pump seal injection throttle valve. Should this valve fail, the operators could locally isolate and bypass the failed throttle valve to control RCP seal injection flow.

The identified single active failures would initially be mitigated by the use of the SSF systems. However, these postulated single active failures could be addressed in a reasonably short time frame such that the established mission time of the SSF would not be challenged. Should the PSW pump fail, then the SSF-ASW pump would be available. The PSW electrical system has the capability to provide power to the SSF systems. Operators can manually align power to the SSF electrical power system from the PSW electrical power system to allow operation of the SSF systems. Therefore, the SSF diesel generator would not be required to operate in excess of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In addition, since HPI would continue to receive power from the PSW electrical system, the SSF RCM pump would not be required to operate in excess of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 11 The LPSW and LPI systems are required to cool the plant down from 250°F to below 200'F (cold shutdown). Existing damage repair procedures are in place to restore the LPSW and LPI systems following postulated damage to electrical equipment located inside the TB. The electrical equipment needed to recover LPSW and LPI following postulated HELB damage inside the TB is stored on site.

Conclusions The updated HELB mitigation strategy credits redundant means of establishing and maintaining SSD conditions following damage caused by a postulated HELB inside the TB. The operator actions required to place these systems into service are considered to be time critical actions and will be time validated in accordance with the current standards applicable to emergency procedures. Plant cooldown and the establishment of cold shutdown conditions are not considered to be time critical actions and therefore, will not be time validated. There is adequate assurance that damage repairs can be accomplished within the required mission times. The PSW/HPI system is the credited path for plant cooldown to approximately 250°F. The PSW system will be capable of maintaining long term decay heat removal in excess of 30 days. This provides reasonable assurance that repairs can be made to restore the LPI and LPSW systems to service to place the reactor in a cold shutdown condition. Therefore, staging of additional equipment is not necessary.

Issue #3 - Technical Specifications To ensure licensing-basisclarity and component operability, Technical Specifications (TSs) need to properly address the tomado/HELB mitigation systems (e.g., protected service water/HPI, standby shutdown facility, etc.) in a manner that is consistent with the Standard TS requirements that have been established for the function that are being performed by these systems. For example, the minimum requiredmission time should be 7 days and the Completion Times should be limited to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> in most cases.

Duke Response:

Regulatory Perspective The PSW operability requirements will be incorporated into the Selected Licensing Commitments Manual and its Bases. This position is based on 10CFR50.36 requirements and preliminary ONS PRA results for the new PSW system and the applicability of NUREG 1430 for standard technical specifications.

10CFR50.36 Requirements 10CFR50.36 establishes four criteria for when a technical specification (TS) must be established. Criteria 3 and 4 are directly applicable to PSW. Criterion 3 establishes the need for a Technical Specification whose function is to mitigate a design basis accident

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 12 (DBA) or transient that assumes the failure of, or presents a challenge to, the integrity of a fission product barrier. PSW does not mitigate any ONS UFSAR Chapter 15 design basis event. In addition, the CLB for ONS, as delineated in UFSAR Section 3.2.2, is that a tornado or tornado missile, like other natural phenomena, is a design criterion, and will not initiate or occur simultaneously with the limiting DBA. Consistent with this philosophy, a tornado or tornado missile is not assumed to initiate or occur simultaneously with a Chapter 15 design basis event. Therefore, Criterion 3 is not applicable.

Criterion 4 addresses when a risk assessment indicates that an SSC is significant to public health and safety. ONS analysis indicates that the risk impact of PSW intended functions are lower than those of SSF. Allowed Outage Times (AOT) would be on the order of -21 days for PSW versus -8 days for SSF. PSW would have to be out of service for -200 days to reach the Maintenance Rule a(4) limit while the comparable time for SSF is -80 days. Therefore, PSW is not significant to public health and safety and Criterion 4 is not met. System and component operability linked to PSW intended functions would be enveloped by Maintenance Rule requirements, which, in many ways, are more comprehensive than the Technical Specification requirements that would be established.

NUREG 1430 PSW operability requirements do not readily fit into the standardization process established by the NUREG. The document does not contain any criteria for a protected service water system. The system in the NUREG with the closest fit is EFW, but EFW requirements are tied to mitigation of DBAs. Tornado and HELB events are not at the same level of risk as associated with SSCs required to mitigate DBAs.

Conclusion Duke believes that operability requirements for PSW should be incorporated into the Selected Licensing Commitments Manual and its Bases based on regulatory guidance and the relative risk of the PSW system.

Issue #4 - Reactor Coolant Letdown Line The reactorcoolant system letdown line exits containment and enters the EPR, where it presents an HELB concern and could possibly be damaged by tornado-generated missiles, resulting in a significant loss-of-coolant accident. Discuss how this vulnerability will be addressed,including the possibility of moving the flow-limiting orifice inside containment.

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 13 Duke Response (Tornado Perspective):

Issue / Background A small portion of the RCS letdown line between the first isolation valve in the east penetration room (EPR) of the AB and containment is not completely protected against tornado missiles.

Regulatory Perspective Although a non-isolable portion of the letdown line is not fully protected from tornado missiles, damage to the line as the result of tornado missiles is not credible. Duke will apply the TORMIS methodology to demonstrate this conclusion.

Current Licensing Basis UFSAR Section 3.2.2 indicates that, "a tornado will not be allowed to cause a LOCA".

Safety Perspective The subject pipe has a nominal diameter of 2-1/2 inches and the length of the non-isolable portion of the pipe in the east penetration room is about 10 feet. The pipe is located in an alcove formed by the arch of the outer containment wall and a concrete wall on one side of the EPR. The letdown line is almost completely protected within this alcove by adjacent walls and various structural elements within the AB including structural columns and equipment adjacent to the piping. Lead shielding around the pipe affords further protection. Inspection of existing TORMIS results indicate that the probability of striking the letdown pipe is approximately 3E-8, without crediting the physical protection afforded by the alcove, adjacent structures and equipment and the shielding around the pipe.

Duke Response (HELB Perspective):

Issue / Background The letdown line taps off the Reactor Coolant (RC) B1 cold leg and branches into two headers before flowing into the two Letdown Coolers. Before entering the coolers each header passes through their respective RC/HPI isolation valves (xHP-1 or xHP-2).

Valves xHP-1 and xHP-2 are not currently credited to automatically close should a break occur in the letdown line.

After leaving the coolers each header passes through their respective containment isolation valve (xHP-3 or xHP-4). These valves will close on a channel 1 ES signal should a break occur in the Letdown line. The headers then rejoin before exiting containment through Penetration 6 to the EPR.

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 14 Regulatory Perspective Reference 6 required the postulation of breaks at terminal ends. Further, the letter required the postulation of an unrelated single active failure in addition to the break postulation. The letdown containment penetration qualifies as a terminal end. Should a break occur at this location, valves xHP-3 and xHP-4 will close on a channel 1 ES signal (low RCS pressure), but valves xHP-1 and xHP-2 are not credited to close. Applying a single unrelated active failure either to the function of xHP-3 or xHP-4 to close could result in a limited RCS break in the EPR.

Current Licensing Basis The original Duke HELB report, OS-73.2, described the mitigation of the letdown break at the containment penetration by the closure of valves xHP-3 & 4 to isolate the break.

The report noted that isolation is anticipated within 160 seconds and that off-site releases were within acceptable limits. The report did not postulate a single active failure of either xHP-3 or xHP-4 to close.

The Safety Evaluation Report (SER) for Units 2 & 3 (dated 7/6/73) approved the original HELB report and noted that protection was to be provided for fluid piping systems that exceed 200'F and 275 psig. Since the letdown line is cooled before leaving containment, the conditions of the line in the EPR are 120°F and 2160 psig. Thus, the letdown line at this location is not a high energy line. The AEC SER acknowledged this in the following statement, "The reactor coolant letdown is cooled before leaving the reactor building so this system is essentially a high pressure system rather than a high pressure and high temperature system." Further, the HELB report and the SER did not require any modifications for mitigation of the letdown break.

Safety Perspective The risk associated with a break on the letdown line inside the EPR is low. First, as noted above, letdown is cooled by the letdown cooler inside containment, so that the line has a low temperature of 120°F in the EPR. Thus, there are no thermal fatigue issues. Second, the line is analyzed for seismic, and the stresses in the line fall below the break threshold of BTP MEB 3-1. Thus, there are no primary stresses that could cause a failure. Furthermore, the line is constructed of 0.5" wall thickness stainless steel. Therefore, erosion/corrosion is not an issue.

The letdown line contains only a limited number of welds, and the length of piping between the containment penetration and the isolation valve (xHP-5) is less than 10 feet. Applying typical failure rates for this type of piping produces a low probability of pipe rupture. The effects of a letdown break in the EPR do not affect the ability of xHP-1, xHP-2, xHP-3, or xHP-4 to close. Therefore, the automatic feature to close xHP-3 and xHP-4 provides a reliable means to isolate a potential rupture (without operator action) although it is not single failure proof. The additional capability of operators to

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 15 close xHP-1 or xHP-2 in the event that xHP-3 or xHP-4 fails to close provides additional assurance of an acceptable risk.

Conclusions No single active failure was assumed in the MDS Report for the letdown line break in the EPR. Given the low temperature of the line, the low primary stress, the robustness of the design, and limited number of piping welds, the probability of such a break is low.

The existing isolation capability is reliable and provides an acceptably low risk impact.

Further, it is not practical to relocate the pressure reducing orifice to inside containment.

This would be a significant design change and would also involve operator radiation dose considerations.

ONS described this event in the original HELB report and the predecessor to the NRC (AEC) agreed with the mitigation strategy. Duke concludes that due to the low probability of an un-isolated break, the acceptable risk of the break and the AEC acceptance of the original mitigation strategy, the current design and licensing basis of the letdown break in the EPR is acceptable. ONS will continue to employ the previously approved CLB of not postulating a single active failure of either valve xHP-3 or xHP-4 to close for the letdown line.

Issue #5 - Application of Generic Letter 87-11 The April 28, 2006 letter discusses key concepts and assumptions for HELB.

Regarding break and crack postulation addressed under the fifth concept/assumption discuss if all of Generic Letter 87-11, "Relaxationof Arbitrary Intermediate Pipe Rupture Requirements," will be applied, or the specific exceptions that are planned to be requested.

Duke response:

Future Licensing Basis The CLB for HELB includes Reference 6 as amended by Reference 7, as documented in MDS Report OS-73.2 and its Supplement 1. Duke will continue to consider these.

documents to represent its future licensing basis for HELB with substitutions or clarifications as discussed in this response. In addition, moderate energy line breaks will not be postulated as ONS was neither designed nor constructed for moderate energy line breaks.

Safety Perspective Although adoption of GL 87-11 implies a reduction in the number of break locations, inclusion of the selected portions of BTP MEB 3-1 in the ONS HELB design and licensing basis will result in an increase in the number of postulated HELB locations

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 16 outside containment when compared to the number postulated in the MDS HELB report.

Each of these new locations will require that ONS formulate a mitigation strategy. In doing this, the overall safety of the plant is improved.

ONS plans to adopt the provision of BTP MEB 3-1 regarding the elimination of arbitrary intermediate breaks for analyzed lines that include seismic loading. Adoption of this provision will allow the station to focus attention to those high stress areas that have a higher potential for catastrophic pipe failure. Breaks for analyzed lines that do not contain seismic loading and for piping that is not rigorously analyzed and does not include seismic loadings will be postulated at every piping weld and fitting. The inclusion of these strategies will provide a comprehensive listing of breaks for which mitigation strategies will be determined. These actions would increase the overall safety of the plant.

ONS also plans to adopt the provision of BTP MEB 3-1 regarding the elimination of critical crack areas for analyzed lines that include seismic loading. Adoption of this provision will allow the station to focus attention to those medium and high stress areas that have a higher potential for leakage cracks to form. The inclusion of this strategy will provide a comprehensive crack scenario for which mitigation strategies will be determined. These actions will increase the overall safety of the plant.

Regarding inspection of MS seam welds in the EPR, ONS provided the quality construction attributes of this line in the original HELB report. Table 1.2-1 of the report noted that the welds in the line, including the seam welds, received a radiographic examination during fabrication. The straight pipe material on the main steam (MS) line in the EPR is ASTM A-155, Class 1, Grade KC-70 or ASTM A-672, Class 22, Grade C70. Both materials are plate that is fabricated into a pipe and electric fusion welded along the seam. A review of the ASTM material specifications indicates that the pipe is heat treated and received a full radiograph examination. Typically, heat treatment of a post welded fabricated piece results in the melding of the base material and the weld material. This process may make it difficult if not impossible to ascertain the exact location of the seam welds. There is approximately 11.5 ft. of straight MS piping in the EPR that is of seamed construction.

There are two elbows in the MS piping in the EPR. The material of the elbows is ASTM A-234 Grade WPC or WPBW-70 and believed to contain no welded seams. Connecting the straight pipe and elbows are four girth welds (some units contain three girth welds).

ONS has committed to volumetrically inspect 100% of the girth welds. Afterward, these girth welds will receive volumetric inspections during each future in-service inspection interval. However, based on the quality inherent in the original design and construction (i.e. received full radiograph, heat treated) of this piping, ONS does not plan an initial or periodic volumetric inspection of the seam welds.

Regarding inspection of the MS terminal end welds, the original requirement for inspections of the area were communicated in Supplement 1 to the MDS HELB report.

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 17 In the response to Question 7 regarding the circumstances and action supporting the acceptability of ONS's design, under (3), the following is noted: "Duke will increase the in-service inspection to include the metal surface inspection for the postulated break area every 5 years to detect any surface defects." In the MDS HELB report, the postulated break area is not at the terminal end (structural anchor) which is located inside the RB, but rather is located away from the anchor point inside the EPR (See MS break location in EPR sketch below). Note that the break location is inside the EPR away from the structural anchor.

MS Break Location in EPR Liner EPR'* .

.. /

• Welds Break R 1V RB Location

!*i Collar Based on the design of the MS structural anchor, it is apparent that no periodic inspection of the outboard fillet weld was considered or is possible today. The effects from a MS break adjacent to the containment penetration have been shown to be acceptable in the original MDS report, and the effects from a break at the outboard isolation weld would be similar to that originally postulated. Since ONS has committed to periodically inspect the MS girth welds, as described above, and the previous analysis has shown that safe shutdown can be attained following a MS break at these locations, further evaluation or inspection of the MS outboard terminal end weld is unnecessary.

Regarding the inspection of the MFW terminal end weld, during the Spring 2006 Unit 3 and the Fall 2006 Unit 1 outages, ONS successfully visually inspected the outboard (EPR side weld) terminal end weld. However, due to interferences with the portions of the liner that project into the EPR and the anchor structure, ONS was unable to inspect the inboard (RB side) terminal end weld. Both the inboard and outboard weld visual

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 18 inspections will be attempted during the upcoming Unit 2 outage slated for the Spring 2007. ONS will apprise the NRC of the status of these inspections following those outages. See the sketch below.

MFW Break Location in EPR RB EPR ONS agrees that these inspections are important in ascertaining the overall fitness of the MFW lines in the EPR, but the inability to inspect certain Welds does not mean that a break should be postulated at those locations. The location of the MFW terminal end break was given in the HELB report and detailed here in the MFW sketch shown above.

A rupture restraint was designed and implemented in 1974 to mitigate the break located just upstream of the outboard (EPR) terminal end weld. The SER for Units 2 & 3 (dated 7/6/73) approved the original HELB report, and noted the following: "The staff has evaluated the assessment performed by the applicant and has concluded that the applicant has analyzed the facilities in a manner consistent with the intent of the criteria and guidelines provided by the staff. The staff agrees with the applicant's selection of pipe failure locations and concludes that all required accident situations have been addressed appropriately by the applicant." ONS concludes that the original MFW terminal end break location is sufficient for meeting the HELB requirements.

Conclusions The CLB for HELB includes References 6 and 7 as documented in MDS Report

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 19 OS-73.2 and its Supplement 1. Duke will continue to consider these documents to represent its future licensing basis for HELB with deviations or clarifications as discussed on Pages 3 and 4 of Attachment 4. The selected provisions of BTP MEB 3-1 to be adopted concern the postulation of breaks and cracks based on stress calculations compared to given thresholds for high energy piping outside containment.

Adoption of this portion of BTP MEB 3-1 in this regard will allow ONS to implement a systematic strategy for determining break and crack locations. The use of BTP MEB 3-1 in the way described will result in additional postulated break and crack locations compared to those postulated in the original HELB report. This will result in a more robust HELB design and licensing basis and thus improve the overall safety of the plant.

ONS has demonstrated the quality attributes of the MS line in the EPR. The seam welds of the straight portions of the piping received 100% radiographic inspections. The piping was heat treated so that the seam welds may be indistinguishable from the base metal. Based on these factors, inspection of the seam welds is unnecessary.

The MS terminal end break location in the EPR was clearly described in the original HELB report. There are no differences in the resulting effects from a postulated break at the location described in the original HELB report and those effects from a postulated break at the outboard terminal end weld. Inspection of the outboard terminal end weld is impractical due to interferences with the anchor and RB structure. The MS break location described in the original HELB report meets the intent of the original requirements, and thus inspection of the MS outboard terminal end weld is not required.

The MFW terminal end break location(s) in the EPR were clearly described in the original HELB report. Inspection of the terminal end welds is important for determining the overall fitness of the MFW system in the EPR, but the inability to inspect a particular weld does not mean that a break should be postulated at those locations. The MFW break location described in the original HELB report meets the intent of the original HELB requirements and although ONS will continue to attempt inspection of these welds, the inability to do so does not require the postulation of new break location(s).

Issue #6 - Protection of Electrical Penetrations Affording protection to only those electricalpenetrationsneeded for safe shutdown (as indicated in the April 28, 2006 letter, Mitigation Function 4) may not be all that is needed, assuming that water and foreign materialgets in all non-sealed enclosures from water spray or steam. If the enclosures are to be replaced or modified, the new or modified enclosures should be quantified by test, experience or analysis in accordance with the requirements of Title 10 of the code of FederalRegulations (10 CFR), Part50, Section 50.49.

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 20 Duke Response:

Regulatory Perspective Reference 6, as amended by Reference 7, established the Environmental Qualification (EQ) requirement for HELBs outside containment. The requirement is found in Item 13 of Reference 6, as amended by Reference 7, and is stated below:

"Environmental qualification should be demonstrated by test for that electrical equipment required to function in the steam-air environment resulting from a high energy fluid line break."

The requirements of Item 11 listed in Reference 6, as amended by Reference 7, are summarized below:

a. A high energy line break cannot directly or indirectly result in a loss of required redundancy in any portion of the protection system (as defined in IEEE-279),

Class 1E electrical system (as defined in IEEE-308), engineered safety feature equipment, cable penetrations, or their interconnecting cables required to mitigate the consequences of that accident and place the reactor(s) in a cold shutdown condition.

b. Loss of redundancy is permitted for environmental induced failures caused by a leak or rupture of a high energy line, which would not of itself result in protective action but does disable protection functions. However, loss of function is not permitted. For such situations, plant shutdown would be required.

Subsequent to issuance of References 6 and 7, the NRC issued IE Bulletin 79-01 B in January 1980. This Bulletin required licensees to perform a detailed review of the EQ of Class 1E electrical equipment to ensure that the electrical equipment will function during and after postulated accident conditions. The postulated accident conditions were defined as those environmental conditions resulting from both Loss of Coolant Accidents and/or HELBs inside primary containment and HELB outside the primary containment. It was noted in the Bulletin that the service conditions for areas outside containment exposed to HELB were previously evaluated as part of Reference 6. The listed equipment and the environmental conditions reviewed and approved in the plant specific HELB SER would continue to remain the licensing basis for EQ evaluations for HELBs outside containment.

Duke provided the temperature, pressure, and humidity conditions inside the penetration rooms following HELBs inside the rooms. Only the MSLB and main feedwater line breaks (MFWLB) were found to create significant environmental conditions (pressure, temperature, and humidity) inside the penetration rooms. The NRC verified and approved the parameters identified by Duke in a Safety Evaluation Report dated May 22, 1981.

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 21 The NRC issued the Equipment Qualification Rule (1 OCFR50.49) on January 21, 1983.

In a letter dated April 11, 1983, the NRC requested that Duke address the new rule.

Duke responded that the flooding and environmental effects resulting from HELBs outside containment, as documented in the MDS Report and Supplement 1 would be used for evaluating the environmental qualification of safety-related electrical equipment in accordance with IEB 79-01B. Completion of the environmental qualification of safety-related electrical equipment in accordance with IEB 79-01 B demonstrated compliance with 10CFR50.49 (b)(1). Duke also evaluated the effects of non-safety control systems on safety systems in accordance with IE Information Notice 79-22. The environmental profile established for the penetration rooms following a HELB inside the rooms was not changed. Modifications were implemented where needed to preclude potentially unacceptable interactions between non-safety electrical circuits and safety circuits inside the penetration rooms. Based on the existing design features and previous efforts concerning IE Information Notice 79-22, Duke concluded there was reasonable assurance that non-safety related equipment would not preclude the accomplishment of essential safety function in accordance with 10CFR50.49(b)(2). Finally, Duke addressed 10CFR50.49(b)(3) by providing an integrated plan and schedule for addressing Regulatory Guide 1.97. The NRC reviewed and concluded that Duke's electrical equipment EQ program for ONS complied with the requirements of 10 CFR 50.49.

Current Licensing Basis The environmental conditions specified in the CLB for HELBs outside containment are based on the information provided in MDS Report OS-73.2 and Supplement 1 as approved by the subsequent Safety Evaluation Report (SER) for Units 2 & 3 from the AEC (dated 7/6/73). The environmental effects from postulated HELBs are addressed in Section 2.3.1 of MDS Report OS-73.2. The environmental effects considered were pressure, temperature, and humidity. In addition, the potential for flooding of required electrical equipment was considered. Spraying and wetting of electrical equipment were not listed as an environmental parameter to be considered. The resultant effects (environmental and flooding) were listed on a case-by-case basis for the postulated breaks. The only area of the plant that was subjected to significant environmental conditions was the penetration rooms. The breaks of concern inside the penetration rooms were the MFWLB and MSLB. The only postulated breaks for MS and main feedwater were at the terminal end. Other break and crack locations in the MS and MFW systems inside the AB were eliminated based on the stress criteria established in MDS Report OS-73.2.

A list of required electrical equipment needed to mitigate a MSLB or a MFWLB inside the penetration rooms was developed. The following systems were identified as being required to mitigate the consequences of the MS and main feedwater terminal end breaks in the penetration rooms:

a. Reactor Protection System (low reactor coolant pressure trip)

b. Turbine Stop Valve Closure Signals

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 22

c. Engineered Safeguards (ES) Actuation System (low reactor coolant pressure)

d. High Pressure Injection (actuated on ES signal)

e. Core Flood System

f. Low Pressure Injection (actuated on ES signal)

The resulting effects (from pipe whip, jet impingement, environmental, and flooding) were considered for the above systems needed to mitigate the postulated MS and main feedwater pipe ruptures. It was determined that an unrestrained pipe whip from the postulated terminal end break on either main feedwater line would result in unacceptable consequences inside the penetration rooms. As a result, modifications were implemented to install pipe restraints on the main feedwater piping. The restraints for the main feedwater RB terminal end were designed to the following protection criteria:

a. Restrain the lines to prevent pipe whip

b. Limit the double ended break gap to a 0-inch gap insofar as possible based on thermal expansion tolerances.

c. Prevent jet impingement from the terminal end break

d. Limit and direct flow of leakage away from vulnerable mechanical and electrical equipment The required electrical equipment located inside the penetration rooms were qualified to meet the calculated environmental profiles established in the MDS Report with consideration of the committed plant modifications described in that report.

Future Licensing Basis The adoption of selected portions of BTP MEB 3-1 as substitutions or clarification of certain items in Reference 6, as amended by Reference 7, will require new "critical crack" locations to be postulated in certain high energy piping systems (e.g.,MFW) inside the EPR. Pipe whip is not an effect that must be considered for "critical'cracks."

However, any new flooding potential must be evaluated.

Safety Perspective MDS Report OS-73.2 postulated no high energy line breaks that impacted the electrical penetrations (inside the penetration rooms) from the associated pipe whip or jet impingement. Adoption of selected portions of BTP MEB 3-1 may create new "critical crack" locations which may create a new potential for jet impingement or spray onto the electrical penetrations. These new effects will be addressed through periodic inspections of crack locations.

Conclusions The electrical equipment located inside the penetration rooms meets the CLB

Nuclear Regulatory Commission - Responses to Key Issues Identified in July 12, 2006 NRC Letter November 30, 2006 Page 23 requirements for EQ. The environmental condition described in the MDS Report provides the criteria for which electrical equipment needed for safe shutdown must be designed and tested. The issuance of IEB 79-01 B did not supersede the previous environmental profiles that were to be applied to the qualification of safety related electrical equipment used in the mitigation of HELBs outside containment. IE Information Notice 79-22 did not supersede the environmental profiles in the penetration rooms established for evaluating the effects on non-safety electrical equipment on safety-related electrical equipment. The responses provide by Duke regarding iEB 79-01B and IE Information Notice 79-22 adequately addressed the subsequent issuance of Environmental Qualification Rule in 10CFR5O.49.

The adoption of selected portions of BTP MEB 3-1 for deviations or clarification of References 6 and 7 may introduce new jet impingement and spray concerns with the electrical penetrations. These new concerns will be addressed by periodic volumetric inspections of piping locations.