ML16088A261

Safety Evaluation Regarding Implementation of Mitigating Strategies and Reliable Spent Fuel Pool Instrumentation Related to Orders EA-12-049 and EA-12-051

ML16088A261
Person / Time
Site:	Palo Verde
Issue date:	07/20/2016
From:	Halter M Japan Lessons-Learned Division
To:	Edington R Arizona Public Service Co
Boska, John NRR/JLD 415-2901
References
CAC MF0774, CAC MF0775, CAC MF0776, CAC MF0829, CAC MF0830, CAC MF0831, EA-12-049, EA-12-051
Download: ML16088A261 (84)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 Mr. Randall K. Edington Executive Vice President Nuclear/

Chief Nuclear Officer Arizona Public Service Company P.O. Box 52034, MS 7602 Phoenix, AZ 85072-2034 July 20, 2016

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 -

SAFETY EVALUATION REGARDING IMPLEMENTATION OF MITIGATING STRATEGIES AND RELIABLE SPENT FUEL POOL INSTRUMENTATION RELATED TO ORDERS EA-12-049 AND EA-12-051 (CAC NOS. MF0829, MF0830, MF0831, MF0774, MF0775, AND MF0776)

Dear Mr. Edington:

On March 12, 2012, the U.S. Nuclear Regulatory Commission (NRC) issued Order EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design-Basis External Events" and Order EA-12-051, "Order to Modify Licenses With Regard To Reliable Spent Fuel Pool Instrumentation," (Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML12054A736 and ML12054A679, respectively). The orders require holders of operating reactor licenses and construction permits issued under Title 1 O of the Code of Federal Regulations Part 50 to modify the plants to provide additional capabilities and defense-in-depth for responding to beyond-design-basis external events, and to submit for review Overall Integrated Plans (OIPs) that describe how compliance with the requirements of Attachment 2 of each order will be achieved.

By letter dated February 28, 2013 (ADAMS Accession No. ML13136A022), Arizona Public Service Company (APS, the licensee) submitted its OIP for the Palo Verde Nuclear Generating Station, Units 1, 2, and 3 (Palo Verde, PVNGS) in response to Order EA-12-049. At six month intervals following the submittal of the OIP, the licensee submitted reports on its progress in complying with Order EA-12-049. These reports were required by the order, and are listed in the enclosed safety evaluation. By letter dated August 28, 2013 (ADAMS Accession No. ML13234A503), the NRC notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-049 in accordance with NRC Office of Nuclear Reactor Regulation (NRR) Office Instruction LIC-111, "Regulatory Audits" (ADAMS Accession No. ML082900195). By letters dated November 25, 2013 (ADAMS Accession No. ML13308C153), and September 8, 2014 (ADAMS Accession No. ML14239A181), the NRC issued an Interim Staff Evaluation (ISE) and audit report, respectively, on the licensee's progress. By letter dated December 17, 2015 (ADAMS Accession No. ML15351A449), APS submitted a compliance letter which stated that all three units at Palo Verde had achieved full compliance with Order EA-12-049. By letter dated December 24, 2015 (ADAMS Accession No. ML15364A034), APS submitted its Final Integrated Plan (FIP) in response to Order EA-12-049.

By letter dated February 28, 2013 (ADAMS Accession No. ML13070A077), APS submitted its OIP for Palo Verde in response to Order EA-12-051. At six month intervals following the submittal of the OIP, the licensee submitted reports on its progress in complying with Order EA-12-051. These reports were required by the order, and are listed in the enclosed safety evaluation. By letter dated March 26, 2014 (ADAMS Accession No. ML14083A620), the NRC notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-051 in accordance with NRC NRR Office Instruction LIC-111, similar to the process used for Order EA-12-049. By letters dated October 29, 2013 (ADAMS Accession No. ML13296A006), and September 8, 2014 (ADAMS Accession No. ML14239A181 }, the NRC staff issued an ISE and audit report, respectively, on the licensee's progress. By letter dated December 17, 2015 (ADAMS Accession No. ML15351A449), APS submitted a compliance letter in response to Order EA-12-051. The compliance letter stated that the licensee had achieved full compliance with Order EA-12-051.

The enclosed safety evaluation provides the results of the NRC staffs review of APS' strategies for Palo Verde. The intent of the safety evaluation is to inform APS on whether or not its integrated plans, if implemented as described, will adequately address the requirements of Orders EA-12-049 and EA-12-051. The staff will evaluate implementation of the plans through inspection, using Temporary Instruction 191, "Implementation of Mitigation Strategies and Spent Fuel Pool Instrumentation Orders and Emergency Preparedness Communications/Staffing/

Multi-Unit Dose Assessment Plans" (ADAMS Accession No. ML14273A444). This inspection will be conducted in accordance with the NRC's inspection schedule for the plant.

If you have any questions, please contact John Boska, Orders Management Branch, Palo Verde Project Manager, at 301-415-2901 or at John.Boska@nrc.gov.

Docket Nos.: 50-528, 50-529, and 50-530

Enclosure:

Safety Evaluation cc w/encl: Distribution via Listserv Sincerely, J;?a,,z~~~

Mandy K. Halter, Acting Chief Orders Management Branch Japan Lessons-Learned Division Office of Nuclear Reactor Regulation

1.0 2.0 2.1 2.2 3.0 3.1 3.2 3.2.1 3.2.1.1 3.2.1.1.1 3.2.1.1.2 3.2.1.1.3 3.2.1.2 3.2.1.2.1 3.2.1.2.2 3.2.1.2.3 3.2.2 3.2.3 3.2.3.1 3.2.3.1.1 3.2.3.1.2 3.2.3.2 3.2.3.2.1 3.2.3.2.2 3.2.3.2.3 3.2.3.3 3.2.3.3.1 3.2.3.3.2 3.2.3.3.3 3.2.3.3.4 3.2.3.4 3.2.3.5 3.2.3.6 3.2.4 3.3 3.3.1 3.3.2 3.3.3 3.3.4 TABLE OF CONTENTS INTRODUCTION REGULATORY EVALUATION Order EA-12-049 Order EA-12-051 TECHNICAL EVALUATION OF ORDER EA-12-049 Overall Mitigation Strategy Reactor Core Cooling Strategies Core Cooling Strategy and RCS Makeup Core Cooling Strategy Phase 1 Phase 2 Phase 3 RCS Makeup Strategy Phase 1 Phase 2 Phase 3 Variations to Core Cooling Strategy for Flooding Event Staff Evaluations Availability of Structures, Systems, and Components Plant SSCs Plant Instrumentation Thermal-Hydraulic Analyses Use of CENTS Computer Code for the ELAP Analysis Initial Values for Key Plant Parameters and Assumptions Core Decay Heat Calculation Reactor Coolant Pump Seals 1989 Palo Verde Unit 3 - Loss of Offsite Power Event RCP Seal Pop-Open Failure Pressure-Dependent RCP Seal Leakage Determination RCP Seal Leakage of 25 gpm per Pump Used in the ELAP Analysis Shutdown Margin Analyses FLEX Pumps and Water Supplies Electrical Analyses Conclusions Spent Fuel Pool Cooling Strategies Phase 1 Phase 2 Phase 3 Staff Evaluations

3.3.4.1 3.3.4.1.1 3.3.4.1.2 3.3.4.2 3.3.4.3 3.3.4.4 3.3.5 3.4 3.4.1 3.4.2 3.4.3 3.4.4 3.4.4.1 3.4.4.1.1 3.4.4.1.2 3.4.4.2 3.4.4.3 3.4.4.4 3.4.5 3.5 3.5.1 3.5.2 3.5.3 3.5.4 3.5.5 3.5.6 3.6 3.6.1 3.6.1.1 3.6.1.2 3.6.1.3 3.6.1.4 3.6.2 3.6.3 3.7 3.7.1 3.7.2 3.7.3 3.7.3.1 3.7.3.2 3.7.4 3.7.5 3.7.6 3.7.7 Availability of Structures, Systems, and Components Plant SSCs Plant Instrumentation Thermal-Hydraulic Analyses FLEX Pumps and Water Supplies Electrical Analyses Conclusions Containment Function Strategies Phase 1 Phase 2 Phase 3 Staff Evaluations Availability of Structures, Systems, and Components Plant SSCs Plant Instrumentation Thermal-Hydraulic Analyses FLEX Pumps and Water Supplies Electrical Analyses Conclusions Characterization of External Hazards Seismic Flooding High Winds Snow, Ice, and Extreme Cold Extreme Heat Conclusions Planned Protection of FLEX Equipment Protection from External Hazards Seismic Flooding High Winds Snow, Ice, Extreme Cold, and Extreme Heat Reliability of FLEX Equipment Conclusions Planned Deployment of FLEX Equipment Means of Deployment Deployment Strategies FLEX Connection Points Mechanical Connection Points Electrical Connection Points Accessibility and Lighting Access to Protected and Vital Areas Fueling of FLEX Equipment Conclusions

3.8 3.8.1 3.8.2 3.8.3 3.9 3.9.1 3.9.1.1 3.9.1.2 3.9.1.3 3.9.2 3.9.2.1 3.9.2.2 3.9.2.3 3.9.3 3.10 3.10.1 3.10.2 3.10.3 3.10.4 3.10.5 3.11 3.12 3.13 3.14 3.15 4.0 4.1 4.2 4.2.1 4.2.2 4.2.3 4.2.4 4.2.4.1 4.2.4.2 4.2.5 4.2.6 4.2.7 4.2.8 4.2.9 Considerations in Using Offsite Resources Palo Verde SAFER Plan Staging Areas Conclusions Habitability and Operations Equipment Operating Conditions Loss of Ventilation and Cooling Loss of Heating Hydrogen Gas Accumulation in Vital Battery Rooms Personnel Habitability Main Control Room Spent Fuel Pool Area Other Plant Areas Conclusions Water Sources Steam Generator Make-Up Reactor Coolant System Make-Up Spent Fuel Pool Make-Up Containment Cooling Conclusions Shutdown and Refueling Analyses Procedures and Training Maintenance and Testing of FLEX Equipment Alternatives to NEI 12-06, Revision 0 Conclusions for Order EA-12-049 TECHNICAL EVALUATION OF ORDER EA-12-051 Levels of Required Monitoring Evaluation of Design Features Design Features: Instruments Design Features: Arrangement Design Features: Mounting Design Features: Qualification Augmented Quality Process Instrument Channel Reliability Design Features: Independence Design Features: Power Supplies Design Features: Accuracy Design Features: Testing Design Features: Display

4.3 4.3.1 4.3.2 4.3.3 4.4 5.0 6.0 Evaluation of Programmatic Controls Programmatic Controls: Training Programmatic Controls: Procedures Programmatic Controls: Testing and Calibration Conclusions for Order EA-12-051 CONCLUSION REFERENCES

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO ORDERS EA-12-049 AND EA-12-051 ARIZONA PUBLIC SERVICE COMPANY PALO VERDE NUCLEAR GENERATING STATION UNITS 1. 2. AND 3 DOCKET NOS. 50-528, 50-529, 50-530

1.0 INTRODUCTION

The earthquake and tsunami at the Fukushima Dai-ichi nuclear power plant in March 2011,

highlighted the possibility that extreme natural phenomena could challenge the prevention, mitigation and emergency preparedness defense-in-depth layers already in place in nuclear power plants in the United States. At Fukushima, limitations in time and unpredictable conditions associated with the accident significantly challenged attempts by the responders to preclude core damage and containment failure. During the events in Fukushima, the challenges faced by the operators were beyond any faced previously at a commercial nuclear reactor and beyond the anticipated design-basis of the plants. The U.S. Nuclear Regulatory Commission (NRC) determined that additional requirements needed to be imposed at U.S. commercial power reactors to mitigate such beyond-design-basis external events (BDBEEs).

On March 12, 2012, the NRC issued Order EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events" [Reference 4]. This order directed licensees to develop, implement, and maintain guidance and strategies to maintain or restore core cooling, containment, and spent fuel pool (SFP) cooling capabilities in the event of a BDBEE. Order EA-12-049 applies to all power reactor licensees and all holders of construction permits for power reactors.

On March 12, 2012, the NRC also issued Order EA-12-051, "Order Modifying Licenses With Regard to Reliable Spent Fuel Pool Instrumentation" [Reference 5]. This order directed licensees to install reliable SFP level instrumentation with a primary channel and a backup channel, and with independent power supplies that are independent of the plant alternating current (ac) and direct current (de) power distribution systems. Order EA-12-051 applies to all power reactor licensees and all holders of construction permits for power reactors.

2.0 REGULATORY EVALUATION

Following the events at the Fukushima Dai-ichi nuclear power plant on March 11, 2011, the NRC established a senior-level agency task force referred to as the Near-Term Task Force (NTIF). The NTIF was tasked with conducting a systematic and methodical review of the NRC regulations and processes and determining if the agency should make additional improvements to these programs in light of the events at Fukushima Dai-ichi. As a result of this review, the NTIF developed a comprehensive set of recommendations, documented in SECY-11-0093, "Near-Term Report and Recommendations for Agency Actions Following the Events in Japan,"

dated July 12, 2011 [Reference 1]. Following interactions with stakeholders, these recommendations were enhanced by the NRC staff and presented to the Commission.

On February 17, 2012, the NRC staff provided SECY-12-0025, "Proposed Orders and Requests for Information in Response to Lessons Learned from Japan's March 11, 2011, Great Tohoku Earthquake and Tsunami," [Reference 2] to the Commission. This paper included a proposal to order licensees to implement enhanced BDBEE mitigation strategies. As directed by Staff Requirements Memorandum (SRM)-SECY-12-0025 [Reference 3], the NRC staff issued Orders EA-12-049 and EA-12-051.

2.1 Order EA-12-049 Order EA-12-049, Attachment 2 [Reference 4], requires that operating power reactor licensees and construction permit holders use a three-phase approach for mitigating BDBEEs. The initial phase requires the use of installed equipment and resources to maintain or restore core cooling, containment and SFP cooling capabilities. The transition phase requires providing sufficient, portable, onsite equipment and consumables to maintain or restore these functions until they can be accomplished with resources brought from off site. The final phase requires obtaining sufficient offsite resources to sustain those functions indefinitely. Specific requirements of the order are listed below:

1) Licensees or construction permit (CP) holders shall develop, implement, and maintain guidance and strategies to maintain or restore core cooling, containment, and SFP cooling capabilities following a beyond-design-basis external event.

2) These strategies must be capable of mitigating a simultaneous loss of all alternating current (ac) power and loss of normal access to the ultimate heat sink

[UHS] and have adequate capacity to address challenges to core cooling, containment, and SFP cooling capabilities at all units on a site subject to this Order.

3) Licensees or CP holders must provide reasonable protection for the associated equipment from external events. Such protection must demonstrate that there is adequate capacity to address challenges to core cooling, containment, and SFP cooling capabilities at all units on a site subject to this Order.

4) Licensees or CP holders must be capable of implementing the strategies in all modes of operation.

5) Full compliance shall include procedures, guidance, training, and acquisition, staging, or installing of equipment needed for the strategies.

On August 21, 2012, following several submittals and discussions in public meetings with NRC staff, the Nuclear Energy Institute (NEI) submitted document NEI 12-06, "Diverse and Flexible Coping Strategies (FLEX) Implementation Guide," Revision 0 [Reference 6] to the NRC to provide specifications for an industry-developed methodology for the development, implementation, and maintenance of guidance and strategies in response to the Mitigation Strategies order. The NRC staff reviewed NEI 12-06 and on August 29, 2012, issued its final version of Japan Lessons-Learned Directorate (JLD) Interim Staff Guidance (ISG) JLD-ISG-2012-01, "Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events" [Reference 7],

endorsing NEI 12-06, Revision 0, with comments, as an acceptable means of meeting the requirements of Order EA-12-049, and published a notice of its availability in the Federal Register (77 FR 55230).

2.2 Order EA-12-051 Order EA-12-051, Attachment 2 (Reference 5], requires that operating power reactor licensees and construction permit holders install reliable SFP level instrumentation. Specific requirements of the order are listed below:

All licensees identified in Attachment 1 to the order shall have a reliable indication of the water level in associated spent fuel storage pools capable of supporting identification of the following pool water level conditions by trained personnel: (1) level that is adequate to support operation of the normal fuel pool cooling system, (2) level that is adequate to provide substantial radiation shielding for a person standing on the spent fuel pool operating deck, and (3) level where fuel remains covered and actions to implement make-up water addition should no longer be deferred.

1. The spent fuel pool level instrumentation shall include the following design features:

1.1 Instruments

The instrumentation shall consist of a permanent, fixed primary instrument channel and a backup instrument channel. The backup instrument channel may be fixed or portable. Portable instruments shall have capabilities that enhance the ability of trained personnel to monitor spent fuel pool water level under conditions that restrict direct personnel access to the pool, such as partial structural damage, high radiation levels, or heat and humidity from a boiling pool.

1.2 Arrangement

The spent fuel pool level instrument channels shall be arranged in a manner that provides reasonable protection of the level indication function against missiles that may result from damage to the structure over the spent fuel pool. This protection may be provided by locating the primary instrument channel and fixed portions of the backup instrument channel, if applicable, to maintain instrument channel separation within the spent fuel pool area, and to utilize inherent shielding from missiles provided by existing recesses and corners in the spent fuel pool structure.

- 1.3 Mounting: Installed instrument channel equipment within the spent fuel pool shall be mounted to retain its design configuration during and following the maximum seismic ground motion considered in the design of the spent fuel pool structure.

1.4 Qualification

The primary and backup instrument channels shall be reliable at temperature, humidity, and radiation levels consistent with the spent fuel pool water at saturation conditions for an extended period.

This reliability shall be established through use of an augmented quality assurance process (e.g., a process similar to that applied to the site fire protection program).

1.5 Independence

The primary instrument channel shall be independent of the backup instrument channel.

1.6 Power supplies: Permanently installed instrumentation channels shall each be powered by a separate power supply. Permanently installed and portable instrumentation channels shall provide for power connections from sources independent of the plant ac and de power distribution systems, such as portable generators or replaceable batteries. Onsite generators used as an alternate power source and replaceable batteries used for instrument channel power shall have sufficient capacity to maintain the level indication function until offsite resource availability is reasonably assured.

1. 7 Accuracy: The instrument channels shall maintain their designed accuracy following a power interruption or change in power source without recalibration.

1.8 Testing

The instrument channel design shall provide for routine testing and calibration.

1.9 Display

Trained personnel shall be able to monitor the spent fuel pool water level from the control room, alternate shutdown panel, or' other appropriate and accessible location. The display shall provide on-demand or continuous indication of spent fuel pool water level.

2. The spent fuel pool instrumentation shall be maintained available and reliable through appropriate development and implementation of the following programs:

2.1 Training

Personnel shall be trained in the use and the provision of alternate power to the primary and backup instrument channels.

2.2 Procedures

Procedures shall be established and maintained for the testing, calibration, and use of the primary and backup spent fuel pool instrument channels.

2.3 Testing and Calibration: Processes shall be established and maintained for scheduling and implementing necessary testing and calibration of the primary and backup spent fuel pool level instrument channels to maintain the instrument channels at the design accuracy.

On August 24, 2012, following several NEI submittals and discussions in public meetings with NRC staff, the NEI submitted document NEI 12-02, "Industry Guidance for Compliance With NRC Order EA-12-051, To Modify Licenses With Regard to Reliable Spent Fuel Pool Instrumentation," Revision 1 [Reference 8] to the NRC to provide specifications for an industry-developed methodology for compliance with Order EA-12-051. On August 29, 2012, the NRC staff issued its final version of JLD-ISG-2012-03, "Compliance with Order EA-12-051, Reliable Spent Fuel Pool Instrumentation" [Reference 9], endorsing NEI 12-02, Revision 1, as an acceptable means of meeting the requirements of Order EA-12-051 with certain clarifications and exceptions, and published a notice of its availability in the Federal Register (77 FR 55232).

3.0 TECHNICAL EVALUATION

OF ORDER EA-12-049 By letter dated February 28, 2013 [Reference 10], Arizona Public Service Company (APS, the licensee) submitted an Overall Integrated Plan (OIP) for Palo Verde Nuclear Generating Station (Palo Verde, PVNGS) in response to Order EA-12-049. By letters dated August 28, 2013

[Reference 11]. February 28, 2014 [Reference 12], August 28, 2014 [Reference 13], February 27, 2015 [Reference 14], and August 14, 2015 [Reference 42] the licensee submitted six-month updates to the OIP. By letter dated August 28, 2013 [Reference 15], the NRC notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-049 in accordance with NRC Office of Nuclear Reactor Regulation (NRR) Office Instruction LIC-111, "Regulatory Audits" [Reference 34]. By letter dated June 20, 2013

[Reference 43], the NRC staff issued a request for additional information (RAI) related to the OIP. By letter dated July 18, 2013 [Reference 44]. the licensee submitted a response to the RAI. By letters dated November 25, 2013 [Reference 16], and September 8, 2014 [Reference 17], the NRC issued an Interim Staff Evaluation (ISE) and an audit report on the licensee's progress, respectively. By letter dated December 17, 2015 [Reference 45], APS submitted a compliance letter, which stated that all three units at Palo Verde had achieved full compliance with the requirements of Order EA-12-049. By letter dated December 24, 2015 [Reference 18],

APS submitted its Final Integrated Plan (FIP) in response to Order EA-12-049.

3.1 Overall Mitigation Strategy to Order EA-12-049 describes the three-phase approach required for mitigating BDBEEs in order to maintain or restore core cooling, containment and SFP cooling capabilities.

The phases consist of an initial phase (Phase 1) using installed equipment and resources, followed by a transition phase (Phase 2) in which portable onsite equipment is placed in service, and a final phase (Phase 3) in which offsite resources may be placed in service. The timing of when to transition to the next phase is determined by plant-specific analyses.

While the initiating event is undefined, it is assumed to result in an extended loss of ac power (ELAP) with loss of normal access to the ultimate heat sink. Thus, the ELAP with loss of normal access to the ultimate heat sink is used as a surrogate for a BDBEE. The initial conditions and assumptions for the analyses are stated in NEI 12-06, Section 3.2.1, and include the following:

1. The reactor is assumed to have safely shut down with all rods inserted (subcritical).

2. The de power supplied by the plant batteries is initially available, as is the ac power from inverters supplied by those batteries; however, over time the batteries may be depleted.

3. There is no core damage initially.

4. There is no assumption of any concurrent event.

5. Because the loss of ac power presupposes random failures of safety-related equipment (emergency power sources), there is no requirement to consider further random failures.

Each of the three PVNGS units is a Combustion Engineering (CE) pressurized-water reactor (PWR) with a dry ambient-pressure containment. The reactor coolant system (RCS) has a reactor pressure vessel (RPV), two hot legs, two steam generators (SGs), a pressurizer, four cold legs, and four reactor coolant pumps (RCPs). The FIP describes the licensee's three-phase approach to mitigate a postulated ELAP event.

At the onset of an ELAP all three reactors are assumed to trip from full power. The FLEX strategy selected to mitigate an event from 100 percent power, via borated makeup and core decay heat removal, is to establish natural circulation in the RCS of each unit using symmetric SG cooldown (both SGs). This is accomplished via release of steam from both SGs using one of the two atmospheric dump valves (ADVs) on each steam generator. If electrical power is not restored in a short period of time, the operators will begin a cooldown of the RCS.

Within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the initiating event, operators initiate the Class 1 E 125 volt direct current (Vdc) power system load shed sequence to prolong battery life (A, B, C, and D batteries).

Subsequently, FLEX portable 480 volt alternating current (Vac) generator sets will be deployed to provide power to critical electrical loads such as vital instrumentation, two of four trains of battery chargers and battery compartment exhaust ventilation fans, and to a safety-related diesel fuel oil transfer pump. Portable generator sets are sized with additional capacity to provide power to non-critical loads, such as essential lighting and a control room air recirculation unit if required.

The core decay heat removal function is initially achieved using the one essential turbine-driven auxiliary feedwater (TDAFW) pump per unit. The source of water for the TDAFW pump is the unit's condensate storage tank (CST), and the unit's reactor makeup water tank (RMWT) can be manually aligned to the suction of the TDAFW pump if the CST is not available. Long-term performance of secondary cooling is assured by selection of a conservative operating point for the TDAFW pump and maintaining the RCS above the required pressure and temperature by controlling the SG steaming rate. When core decay heat reduces to the point where it is not sufficient to produce enough steam to drive the TDAFW pump, diesel-powered FLEX SG pumps will be used to feed the SGs to allow for reactor core cooling and heat removal.

The RCS reactivity control is initially achieved by control rod insertion, and some injection of borated water to the RCS is expected due to partial discharge of the safety injection tanks (SITs) as a result of RCS depressurization. When it is aligned, the unit's FLEX portable high-pressure RCS injection pump will provide borated makeup to the RCS from the unit's refueling water tank (RWT).

In its FIP the licensee states that as a result of the ELAP event, cooling to the unit's SFP will be lost and SFP boiling will occur approximately 11.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the initiating event. Boiling will result in SFP water level decreasing to 10 ft. above the active fuel stored in the fuel rack approximately 39 hours4.513889e-4 days <br />0.0108 hours <br />6.448413e-5 weeks <br />1.48395e-5 months <br /> after the initiating event. Operator action is taken to open the fuel building rollup door to keep the fuel building at atmospheric pressure and mitigate the temperature increase. In Phase 2, portable SFP makeup pumps are deployed to supply water from the RWT to each SFP. There is one SFP per unit, each located in its own fuel building. In Phase 3, water for the SFP makeup function will be provided to each unit's RWT from the station reservoirs using a pipeline constructed after the event and pumps sized to match the decay heat.

At the time of an ELAP event containment will be isolated as a result of engineered safety features (ESF) actuation. The licensee's containment evaluation shows that the 72-hour post-ELAP pressure and temperature in the containment is estimated to be less than 20 pounds per square inch absolute (psia) and 200 degrees Fahrenheit (°F) based on a total reactor coolant pump (RCP) seal leakage of 100 gallons per minute (gpm) at the start of the event. Long-term 30-day containment pressure is expected to remain well below the 60 pounds per square inch gage (psig) design pressure. Therefore, no operator action is required; however, operators will monitor containment pressures as a trending tool for RCS leakage, in addition to continuing assessment of the containment integrity.

In addition, a National SAFER [Strategic Alliance for FLEX Emergency Response] Response Center (NSRC) will provide high capacity pumps and large turbine-driven diesel generators (DGs) to restore one residual heat removal (RHR) cooling train per unit to cool the reactor cores in the long term. There are two NSRCs in the United States.

Below are specific details on the licensee's strategies to restore or maintain core cooling, containment, and SFP cooling capabilities in the event of a BDBEE, and the results of the NRC staff's review of these strategies. The NRC staff evaluated the licensee's strategies against the endorsed NEI 12-06, Revision 0, guidance.

3.2 Reactor Core Cooling Strategies Order EA-12-049 requires licensees to maintain or restore cooling to the reactor core in the event of an ELAP concurrent with a loss of normal access to the ultimate heat sink. Although the ELAP results in an immediate trip of the reactor, sufficient core cooling must be provided to account for fission product decay and other sources of residual heat. Consistent with endorsed guidance from NEI 12-06, Phase 1 of the licensee's core cooling strategy credits installed equipment (other than that presumed lost to the ELAP with loss of normal access to the ultimate heat sink) that is robust in accordance with the guidance in NEI 12-06. In Phase 2, robust installed equipment is supplemented by onsite FLEX equipment, which is used to cool the core either directly (e.g., pumps and hoses) or indirectly (e.g., FLEX electrical generators and cables repowering robust installed equipment). The equipment available onsite for Phases 1 and 2 is further supplemented in Phase 3 by equipment transported from an NSRC.

To adequately cool the reactor core under ELAP conditions, two fundamental physical requirements exist: (1) a heat sink is necessary to accept the heat transferred from the reactor core to coolant in the RCS and (2) sufficient RCS coolant is necessary to transport heat from the reactor core to the heat sink via natural circulation in the RCS. Furthermore, inasmuch as heat removal requirements for the ELAP event consider only residual heat, the RCS coolant should be replenished with borated coolant in order to maintain the reactor in a subcritical condition as the RCS is cooled and depressurized.

As reviewed in this section, the licensee's core cooling analysis for the ELAP with loss of normal access to the ultimate heat sink event presumes that, per endorsed guidance from NEI 12-06, all three units would have been operating at full power prior to the event. Therefore, the SGs may be credited as the heat sink for core cooling during the ELAP with loss of normal access to the ultimate heat sink event. Maintenance of sufficient RCS inventory, despite ongoing system leakage expected under ELAP conditions, is accomplished through a combination of installed systems and FLEX equipment. The specific means are discussed in further detail below. The licensee's strategy for ensuring compliance with Order EA-12-049 for conditions where one or more units are shut down or being refueled is reviewed separately in Section 3.11 of this evaluation.

3.2.1 Core Cooling Strategy and RCS Makeup Westinghouse technical report WCAP-17601, "Reactor Coolant System Response to the Extended Loss of AC Power Event for Westinghouse, Combustion Engineering and Babcock &

Wilcox NSSS Designs" (Agencywide Documents Access and Management System (ADAMS)

Accession Nos. ML13042A011 and ML13042A013}, documents the PWR owners group's (PWROG's) generic evaluation of PWR responses to an ELAP event. The evaluation addresses various aspects of the ELAP event to determine what actions could be taken to extend the coping capability of a PWR during an ELAP event. Section 3.2 of WCAP-17601 discusses the PWROG's recommendations for consideration in developing FLEX mitigation strategies for plants (including PVNGS) with the CE Nuclear Steam Supply System (NSSS) design.

During an NRC audit of Order EA-12-049 Mitigation Plans, the NRC staff asked the licensee to discuss its position on each of the recommendations discussed in Section 3.2 of WCAP-17601.

In response, the licensee provided the following information (RAl-30) in its letter dated July 18, 2013 [Reference 44]:

(1) Minimizing RCP seal leakage rates: The RCP seal leakage rate assumed in the Palo Verde ELAP analysis is not dependent on the recommendation to isolate the seal's controlled bleed-off (CBO) line for plants of the CE design as discussed in WCAP-17601. It is based on the Palo Verde specific analysis and assumptions. Therefore, CBO isolation is not required to support the timeline for RCS inventory control provided in the FIP. As CBO isolation modifications are not planned, the licensee will adopt an early cooldown strategy as recommended. The licensee will ensure the CBO line leaving containment is isolated after the event, except for the line's relief valve which lifts at a pressure of about 225 psig to a tank inside containment. The cooldown strategy, consistent with the analytical basis presented in the Palo Verde analysis report NM 1 OOO-A00002, results in a cooldown of the RCS to a target temperature of 360 °F in the RCS cold legs within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following the initiating event. This is well within the recommended time frame of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> discussed in WCAP-17601. The NRC staff finds that the licensee's cooldown strategies, which assist in reducing the RCP seal leakage, are supported by the analysis establishing the basis for mitigating strategies. Therefore, the NRC staff determined that licensee's approach adequately addresses the concern of minimizing the RCP seal leakage rate discussed in Item 1 in WCAP-17601, Section 3.2.

(2) Adequate shutdown margin: The licensee performed a scoping reactivity analysis for the ELAP event. The results showed that during an ELAP event, sufficient shutdown margin is available to maintain the core subcritical at the target temperature of 360 °F (RAl-26 response in Reference 44). Specifically, during an ELAP event, increases in RCS boron concentration (from either boration of the RCS during RCS cooldown due to SIT injection, or RCS boration due to RCS makeup injection) are not required to maintain the core subcritical because of the substantial negative reactivity added by insertion of all control rods. Therefore, the NRC staff concludes that the concern for adequate shutdown margin, discussed in Item 2 of WCAP-17601, Section 3.2, has been addressed. The NRC staff evaluation of acceptability of the shutdown margin analyses for Palo Verde is discussed in Section 3.2.3.4 below.

(3) Time to initiate cooldown and depressurization: The licensee has developed a PVNGS specific FLEX support guideline (FSG), guideline 791S-9ZZ07, "PVNGS Extended Loss of All Site AC Guideline, Modes 1-4." This FSG directs operators to perform an early and extensive cooldown and depressurization of the RCS subsequent to an ELAP as recommended in WCAP-17601. This cooldown is consistent with the plant-specific analysis used to establish the mitigating strategies for an ELAP event. The NRC staff finds that the licensee's approach is consistent with guidance specified in Item 3 of WCAP-17601, Section 3.2, and therefore is adequately addressed.

(4) Prevention of RCS overfill: The FSG directs an early and rapid RCS cooldown during an ELAP event and this precludes overfill conditions for Palo Verde. Plant cooldown and depressurization will not be precluded due to possibility of a solid plant condition, as recommended in WCAP-17601. The NRC staff finds that the licensee's approach is consistent with guidance specified in Item 4 of WCAP-17601, Section 3.2, and therefore is adequately addressed.

(5) Feeding an SG with a portable pump: The licensee will maintain the capability to back up the TDAFW pump with FLEX equipment and has provided operational guidance for deployment and connection of the FLEX pump to the appropriate FLEX connection. The determination of the capacity of backup portable FLEX pumps is based on providing adequate flow to the SGs to remove the worst case core decay heat load at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> following shutdown at an SG pressure associated with preventing SIT nitrogen gas injection into the RCS (RAl-27 response in Reference 44). The NRC staff finds that the licensee's approach is consistent with guidance specified in Item 5 of WCAP-17601, Section 3.2, and therefore is adequately addressed.

(6) Nitrogen injection from SITs: As shown in Palo Verde report NM1 OOO-A00002 and Westinghouse Calculation CN-FSE-12-10, the licensee has analyzed the potential for depletion of the SIT inventory resulting in injection of SIT nitrogen into the RCS. The licensee indicates that its FSG will provide guidance to the operators to vent the SIT cover gas when the SITs have reached a lower limit setpoint of 10 percent wide-range level. This setpoint accounts for the effects of high containment temperature, resulting from an ELAP, on the heatup of the SIT cover gas. The SIT cover-gas heatup is sufficiently slow such that adequate response time to preclude nitrogen injection is available based on SIT wide-range level indication. The NRC staff finds that the licensee's approach is consistent with guidance specified in Item 6 of WCAP-17601, Section 3.2, and therefore is adequately addressed.

(7) Asymmetric natural circulation cooldown: The guidance in WCAP-17601 on asymmetric cooldown is directed at plants that intend to use this approach as their primary strategy. The primary concerns are non-uniform boron concentration in the RCS and the potential for hot RCS liquid to degrade RCP seals in the idle loop(s). The licensee indicates that it will conduct a symmetric cooldown, which addresses these concerns. Following the RCS cooldown, after the licensee transitions SG feed flow from the TDAFW pump to the FLEX SG makeup pump, the resulting FLEX alignment may feed only a single SG, resulting in asymmetric cooling later in the event. At this time the RCS would have been uniformly cooled and borated, such that the concerns identified in WCAP-17601 would not apply. The NRG staff finds that the licensee's approach is consistent with guidance specified in Item 7 of WCAP-17601, Section 3.2, and therefore this item is adequately addressed.

3.2.1.1 Core Cooling Strategy 3.2.1.1.1 Phase 1 The FIP states that in an ELAP event operators will enter existing PVNGS emergency and/or abnormal operating procedures (EOPs and AOPs), which direct the operators to proceed with predetermined actions. The Station Blackout procedure in the EOPs provides direction to dispatch an operator to manually start the station blackout generators (SBOGs). The FSG will be entered when an SBOG is confirmed to be unavailable and it is confirmed that offsite power cannot be restored, by either communication with the load dispatcher or visual verification of physical damage to site infrastructure. Once the FSG guideline is entered, operators will initiate a symmetric RCS cool-down at about 70 °F/hr to an RCS temperature and pressure that would support performance of the TDAFW pump. Core cooling would be accomplished by natural circulation flow in the RCS using the SGs as the heat sink. The SG feedwater would be initiated using the TDAFW pump taking suction from the CST, with steam vented from the SGs via the ADVs. Local manual SG ADV operation is credited when the nitrogen supply used as the motive force for the ADV operation is depleted. The SG pressure is controlled above 155 psia by manipulating ADVs. This provides sufficient steam pressure for operation of the TDAFW pump. The SG level is maintained high in the narrow range, to provide additional operational margin for recovery should the TDAFW pump degrade due to unanticipated conditions.

Completion of the cooldown is projected to occur within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following the initiating event.

The FIP states that the CST has sufficient water inventory for Phase 1 RCS heat removal without the need for additional makeup water sources.

3.2.1.1.2 Phase 2 Upon depletion of the CST inventory, the operator will align the TDAFW pump suction to the RMWT. This operator action is projected to be completed within 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> following the event initiation and will maintain the SG heat removal function. The CST-to-RMWT switchover time is based on an analysis assuming that the CST water volume is sufficient to remove the heat within the water and metal mass of the RCS in addition to decay heat from the reactor core. In case decay heat is not sufficient to produce adequate steam to drive the TDAFW pump, operators will use portable diesel-powered FLEX SG makeup pumps taking suction from the CST or RMWT to maintain the SG heat removal function.

The FIP indicates that the FLEX SG makeup pump has a flow capacity of 300 gpm at 200 psig.

The design criterion used to determine the flow rate is that the SG makeup pump flow rate is sufficient to remove the maximum decay heat at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after shutdown.

The pump discharge pressure is sufficient to deliver the required flow rate at the SG injection point when SG pressure is 200 psig. The cooldown strategy in the FSG will ultimately reduce SG pressure to approximately 155 psia to support continued operation of the TDAFW pump as long as possible.

As the FLEX SG makeup pump is sized to exceed the flow rate required to remove decay heat 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> into the event, it can support recovering level in the SG. There is no specific time during the event that requires this pump to be placed in service, assuming the TDAFW pump continues to operate. However, to provide additional margin to safety, the FLEX SG pump will be staged as a backup for SG feedwater. The licensee stated that the time provided in Item 16 in Table 5 of the FIP to stage the FLEX SG makeup pump is associated with a timing and deployment study performed to support development of the FIP. Actual plant parameters such as SG level and RCS temperature will trigger actions in the controlling procedure to put the FLEX SG feed pump in service, as necessary, to maintain adequate core cooling.

If implemented appropriately and consistent with the FIP, the licensee's approach should conserve RCS inventory to preclude the necessity for RCS makeup during Phase 2.

3.2.1.1.3 Phase 3 Phase 2 strategies will continue for Phase 3, with the staging of the FLEX SG makeup pump to ensure coolant is available for the SGs to perform the core cooling safety function. Upon depletion of the CST and RMWT inventory, the water in the station reservoirs will be used to refill the CST to continue the core cooling safety function. To transport this water, a temporary pipeline will be installed from the station reservoirs to connect to each unit.

The CST has a normal volume of 508,000 gallons during operational modes 1 through 4, and the RMWT has ~volume of 445,000 gallons of water and is designated as a backup source of water to the CST. Item 10 in Table 5 of the FIP indicates that the water inventory in the CST and the RMWT will be depleted at 104 hours0.0012 days <br />0.0289 hours <br />1.719577e-4 weeks <br />3.9572e-5 months <br /> following the initiating event.

The FIP states that during Phase 3, NSRC equipment for the Palo Verde plant is scheduled to arrive within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of its being requested by the licensee. The NSRC equipment is identified in Table 7-1 of the Palo Verde document NM1000-A00124. It includes generators, boration and water purification equipment, and other redundant capabilities. The NSRC equipment will be used to continue Phase 3 coping strategies or transition to recovery strategies.

3.2.1.2 RCS Makeup Strategy 3.2.1.2.1 Phase 1 Item 9 in Table 5 of the FIP indicates that at 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> following the initiating event, a plant cooldown would result in enough of a decrease in the RCS pressure that the SITs will start to inject borated water into the RCS. As the cooldown proceeds, the RCS pressure is expected to decrease to a pressure lower than the SIT nitrogen cover gas pressure. Operators will trend the RCS pressure and vent the SIT nitrogen when the SIT level reaches 1 O percent on the wide-range level instrument. As stated in the FIP, no other operator actions would be needed to maintain adequate RCS inventory in Phase 1.

3.2.1.2.2 Phase 2 The FIP states that during the cooldown process, makeup water will be added to the RCS to compensate for inventory contraction caused by the RCS cooldown and the RCP seal leakage.

Item 15 of table 5 of the Fl P indicates that at 34.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following the initiating event, the operator will use an installed charging pump, powered by a FLEX generator, to replenish the RCS inventory using borated water from the RWT. If the charging pump is not available, the operator will use the FLEX RCS makeup pump to replenish the RCS inventory. The action time of 34.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is within the analytical value of 35.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> used in the CENTS-ELAP analysis to maintain single phase natural circulation flow and to prevent two-phase natural circulation, satisfying the limitation that allows the use of the CENTS code for analysis prior to initiation of reflux boiling. The NRC staff evaluation of acceptability of the ELAP analysis for Palo Verde is discussed in Section 3.2.3.2.1 of this safety evaluation (SE).

3.2.1.2.3 Phase 3 Phase 2 strategies will continue for Phase 3 with the addition of RCS makeup to maintain adequate RCS inventory. The RWT has a Technical Specification required boron concentration of 4,000 to 4,400 parts per million (ppm). The tank's contents are maintained above 60 °F by two redundant 25 kilowatt (kW) electric heaters which prevents the boric acid from precipitating.

During operational modes 1-4 the normal volume available is approximately 675,000 gallons, with a Technical Specification required volume in Mode 1 of 634,000 gallons. Prior to depletion of the RWT, water drawn from the station reservoirs will be mixed with boric acid and used for RCS makeup. To transport this water, a temporary pipeline will be installed from the station reservoirs to the units.

The FIP states that during Phase 3, NSRC equipment for the Palo Verde plant is scheduled to arrive within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after it is requested by the licensee. The NSRC equipment is identified in Table 7-1 of the Palo Verde document NM1000-A00124. It includes generators, boration and water purification equipment, and other redundant capabilities. The NSRC equipment will be used to continue Phase 3 coping strategies or transition to recovery strategies.

3.2.2 Variations to Core Cooling Strategy for Flooding Event In its FIP, Section 7, the licensee states that its flood analysis shows that flooding of the plant site would not occur even during an extreme flooding event. Therefore, there are no variations to the core cooling strategy in the event of a flood. Refer to Section 3.5.2 of this SE for further discussion on flooding.

3.2.3 Staff Evaluations 3.2.3.1 Availability of Structures, Systems, and Components (SSCs)

Guidance document NEI 12-06 provides guidance that the baseline assumptions have been established on the presumption that other than the loss of the ac power sources and normal access to the UHS, installed equipment that is designed to be robust with respect to design-basis external events is assumed to be fully available. Installed equipment that is not robust is assumed to be unavailable. Below are the baseline assumptions for the availability of SSCs for core cooling during an ELAP caused by a BDBEE.

3.2.3.1.1 Plant SSCs In its FIP, Section 4.1, the licensee indicates that the TDAFW pump will automatically start on low SG level and provide water from the CST to the SGs. The Updated Final Safety Analysis Report (UFSAR) Table 3.2-1 [Reference 47] indicates that the TDAFW pump is a Seismic Category 1 component located in the Main Steam Support Structure, which is a Seismic Category 1 structure. In addition, UFSAR Section 10.4.9 indicates that the components, including piping for the TDAFW pump, is enclosed by a Seismic Category I structure or installed underground and the system is designed such that adverse environmental conditions such as tornados, floods, and earthquakes will not impair its safety function. The NRC staff finds that the TDAFW pumps are robust and are expected to be available at the start of an ELAP event consistent with NEI 12-06, Section 3.2.1.3. In FIP Section 4.3, the licensee states that in the event the TDAFW pump fails to start, procedures direct the operators to manually reset and start the pump (which does not require electrical power for motive force or control). Equipment operation and personnel habitability during an ELAP event will be addressed in Sections 3.9.1 and 3.9.2 of this SE, respectively.

The licensee's Phase 2 and 3 core cooling FLEX strategy relies on the continued use of the TDAFW pump or the use of a FLEX SG makeup pump discharging through a primary or alternate connection point to the SGs. The NRC staffs evaluation of the robustness and availability of FLEX connection points for the FLEX SG makeup pump is discussed in this SE, Section 3.7.3.1.

During Phase 1, the SG ADVs are used to vent steam from the SGs for a controlled cooldown and can be remotely operated from the control room as long as the backup nitrogen is maintained. There are two ADVs per SG. UFSAR Section 10.3.2.2.4 states that any one ADV is capable of removing the core decay heat. UFSAR Table 3.2-1 indicates that the ADVs are Seismic Category I components located in the Main Steam Support Structure. Furthermore, UFSAR Section 10.3.2.2.4 indicates that a nitrogen accumulator, designed to Seismic Category I standards, is provided for each ADV. In its FIP, Section 4.3, the licensee states that if nitrogen is depleted, the ADVs can be manually operated by trained operators in the Main Steam Support Structure. The NRC staff finds that the SG ADVs are robust and are expected to be available at the start of an ELAP event consistent with NEI 12-06, Section 3.2.1.3. Personnel habitability during an ELAP event will be addressed in Section 3.9.2 of this SE.

The licensee's Phase 1 core cooling FLEX strategy relies on the CST as the water source for the TDAFW pump. The staffs evaluation of the robustness and availability of the CST for an ELAP event is discussed in SE Section 3.10.1.

The licensee's Phase 2 core cooling FLEX strategy relies on the RMWT as the suction source for the TDAFW pump upon depletion of the CST. The licensee performed an evaluation to demonstrate the seismic capacity of the RMWT and determined it should be available during an ELAP event. In the event the RMWT is not available, the licensee indicated that the RWT could be used as a source of inventory, which would require connecting a FLEX portable pump and hoses to pump water from the RWT to the CST. The staffs evaluation of the robustness and availability of the RMWT and the RWT is discussed in SE Section 3.10.1.

The licensee's Phase 3 core cooling FLEX strategy relies on the 85-acre and 45-acre station reservoirs, in conjunction with a water purification system delivered by the NSRC, to be the credited SG cooling water source. The staffs evaluation of the robustness and availability of the 85-acre and 45-acre station reservoirs for an ELAP event is discussed in SE Section 3.10.1.

The licensee's Phase 1 RCS inventory control FLEX strategy relies on plant-specific RCP seals assuming the maximum leakage of 25 gpm per each of the four RCPs. The licensee's analyses have demonstrated that no FLEX RCS makeup is needed prior to 35.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />; thus, the licensee's strategy does not rely upon any other plant SSCs. In its FIP, Section 4.1, the licensee indicates that as a result of RCS depressurization the SITs will discharge into the RCS, and that the core will remain subcritical regardless of injection from the SITs. The staffs evaluation of the robustness and availability of the SITs for an ELAP event is discussed in SE Section 3.10.2.

The licensee's Phase 2 and Phase 3 RCS inventory control FLEX strategies rely on the use of a portable electric FLEX RCS makeup pump for each unit powered by FLEX 480 Vac DGs, to inject borated water into the RCS either through a primary or alternate connection point. The staffs evaluation of the robustness and availability of FLEX connections points for the FLEX RCS makeup pump is discussed in SE Section 3. 7.3.1.

The licensee's Phase 2 RCS inventory control FLEX strategy relies on the use of the RWT as the borated water source. In its FIP, Section 4.1, the licensee states that RCS inventory makeup from the RWT is sufficient to last for approximately 10 days. The staffs evaluation of the robustness and availability of the RWT for an ELAP event is discussed in SE Section 3.10.2.

The licensee indicated that the Phase 3 RCS inventory control FLEX strategy relies on the 85-acre and 45-acre station reservoirs, in conjunction with a mobile boration unit and water purification system delivered by the NSRC, for indefinite use for injection into the RCS. The staffs evaluation of the robustness and availability of the 85-acre and 45-acre station reservoirs for an ELAP event is discussed in SE Section 3.10.2.

3.2.. 3.1.2 Plant Instrumentation NEI 12-06, Section 3.2.1.10 states in part that:

The parameters selected must be able to demonstrate the success of the strategies at maintaining the key safety functions as well as indicate imminent or actual core damage to facilitate a decision to manage the response to the event within the Emergency Operating Procedures and FLEX Support Guidelines or within the SAMGs (Severe Accident Management Guidelines). Typically these parameters would include the following:

SG Level SG Pressure RCS Pressure RCS Temperature Containment Pressure SFP Level The plant-specific evaluation may identify additional parameters that are needed in order to support key actions identified in the plant procedures/guidance or to indicate imminent or actual core damage.

On pages 38 and 39 of its FIP, the licensee identified that for Mode 1 the following installed instrumentation will remain functional during Phases 1 through 3 of an ELAP event: (1 ) SG wide range water level; (2) SG pressure; (3) core exit thermocouples (CETs); (4) RCS hot leg temperature (T-hot) and RCS cold leg temperature (T-cold); (5) subcooling/saturation margin (using RCS pressure and CETs); and (6) wide range RCS pressure. As a result of load shedding and breaker alignments, the following additional instrumentation is also available to the operator for monitoring: (1) safety injection tanks A and B level and pressure; (2) pressurizer level; (3) reactor vessel level monitoring system (RVLMS); (4) ADV positions; (5) TDAFW pump flow to each SG (A-train power); and (6) condensate storage tank (CST) and refueling water tank (RWT) level.

The licensee stated [Reference 44, RAl-23.b] that the instruments identified above are safety related, seismically qualified, meet the environmental qualification requirements of Title 1 O of the Code of Federal Regulations (10 CFR) Part 50, Section 50.49, "Environmental qualification of electric equipment important to safety for nuclear power plants, and are verified qualified consistent with the criteria in NEI 12-06, Section 3.2.1.12, "Qualification of Installed Equipment."

The estimated maximum temperature within the containment during an ELAP remains below the threshold of the equipment qualification harsh limit of 230 °F. Based on the above discussion of the instrumentation qualifications, and containment temperature during ELAP remaining less than the equipment qualified harsh limit, the NRC staff agrees that the identified instrumentation and components should remain reasonably accurate and reliable for use in mitigating the consequences of an ELAP event.

3.2.3.2 Thermal-Hydraulic Analyses 3.2.3.2.1 Use of CENTS Computer Code for the ELAP Analysis Guidance document NEI 12-06, Section 1.3, states that "plant-specific analyses will determine the duration of each phase," and that "to the extent practical, generic thermal hydraulic analysis will be developed to support plant-specific decision-making."

The licensee evaluated the ELAP sequence of events (SOE) using the CE Nuclear Transient Simulation (CENTS) computer code, which is described in Westinghouse topical report WCAP-15996-A (ADAMS Accession No. ML053320174, Non-Public). The NRC staff previously approved the use of this code in non-loss-of-coolant accident (non-LOCA) design-basis applications (ADAMS Accession No. ML032790634) with the stipulation that the RCS remained in the single-phase liquid flow regime. This condition was imposed due to the lack of benchmarking for the two-phase flow models that would be activated in LOCA scenarios.

Because the postulated ELAP scenario includes leakage from RCP seals and other sources, two-phase natural circulation flow may be reached in the RCS prior to reestablishing primary RCS makeup. Therefore, the NRC staff requested that the industry provide adequate basis for reliance on the CENTS code for ELAP simulations.

In response, the PWROG submitted a white paper (ADAMS Accession No. ML13297A174, non-public due to proprietary information) that provided a comparison of several small-break (SB)

LOCA simulations using the CENTS code to analogous simulations using the CEFLASH-4AS code. The CEFLASH-4AS code, documented in a CE topical report, CENPD-133, Supplement 1 (ADAMS Accession No. ML15267A402, non-public due to proprietary information), was previously approved by the NRC for analysis of design-basis SBLOCAs under the conservative Appendix K paradigm for CE-designed reactors. The NRC staff performed confirmatory analyses with the TRACE code to obtain an independent assessment of coping time for CE reactor designs. The analyses in the white paper showed that the predictions of CENTS were similar or conservative relative to CEFLASH-4AS for key figures of merit for natural circulation conditions, including the predictions of loop flow rates and the timing of the transition to reflux boiling. The NRC staff further observed that the CENTS prediction of the fraction of the initial RCS inventory at the transition to reflux boiling in WCAP-17601 is in reasonable agreement with NRC staff's confirmatory analysis. By letter dated October 7, 2013 (ADAMS Accession No. ML13276A555), the NRC staff concluded that the use of CENTS was acceptable for ELAP evaluations for conditions prior to reflux cooling.

The licensee indicated in Item 15 on page 75 of the FIP that operators are required to start a charging pump or FLEX RCS makeup injection pump within 34.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of the event initiation to meet the above condition for the restricted use of CENTS.

The license's analyses (NM1 OOO-A00002, "Palo Verde Units 1, 2, & 3 Beyond Design Bases Events - Extended Loss of AC Power") used CENTS to run 4 cases with an assumed maximum initial RCP seal leak rate of 1, 10, 17, and 25 gpm per RCP. Case 2 (assuming a maximum initial leakage rate of 25 gpm per pump) was used in determining the required time for operators to establish the RCS makeup flow in order to control RCS inventory.

Based on the above discussion, the NRC noted that the licensee's analysis satisfies the following conditions: ( 1) the mixture level covers the top of the fuel throughout the ELAP event (Figure 15.2-1), and (2) the licensee's use of the CENTS code is within the condition that it not be used past the transition into reflux boiling. The licensee plans to provide FLEX RCS makeup by 34.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, which the licensee determined will preclude reflux conditions for an assumed initial leakage rate of 25 gpm per RCP. The NRG-endorsed NEI white paper limits the use of CENTS to the period prior to initiation of reflux boiling, which is defined as a condition when the flow quality at the top of the SG tubes does not exceed a proprietary value. This limitation allows the use of CENTS for conditions with existence of some amount of steam bubbles in the top of the SG tubes. Comparison of the licensee's analytical results above for condition 2 with the PWROG's limitation imposed on the use of CENTS indicated that the licensee's use of CENTS for the period up to 35.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is within the allowable range. As such, the licensee has complied with the guidance in the endorsed white paper, and the NRC staff finds that the licensee's use of CENTS is acceptable.

3.2.3.2.2 Initial Values for Key Plant Parameters and Assumptions NEI 12-06, Section 3.2 provides a series of assumptions to which initial key plant parameters (core power, RCS temperature and pressure, etc.) should conform. When considering the code used by the licensee and its use in supporting the required event times for the SOE, it is important to ensure that the initial key plant parameters not only conform to the assumptions provided in NEI 12-06, Section 3.2, but that they also represent the starting conditions of the code used in the analyses and that they are included within the code's range of applicability.

The licensee discussed in its plant calculation (NM1000-A00002) the following key plant-specific assumptions used in the ELAP analysis.

1.

The initial values of all key plant parameters are assumed at the nominal values corresponding to full power conditions. The applicable parameters include the power level, core inlet temperature, pressurizer pressure, RCS flow rate, and pressurizer and SG water level.

2.

The best estimate values of the physics data at the end of the cycle are assumed. The applicable physics data includes the xenon reactivity, moderator reactivity coefficient, Doppler feedback coefficient, control rod worth with all rods in, and inverse boron worth.

3.

Capacities of ADVs and the TDAFW pump are based on the nominal design values.

4.

No single failures of structures, systems, and components (SSCs) are assumed.

Regarding assumptions 1, 2, and 3, the NRC staff noted that the use of the nominal values for key plant parameters, the best estimate values for the physics data, and the nominal design values for the capacities of ADVs and the TDAFW pump are consistent with the industry approach and the NRC practice applied to the analysis of a beyond-design-basis event (BOBE).

Therefore, the NRC staff determines that assumptions 1 through 3 are reasonable and adequate.

Assumption 4 conforms to the NRC-endorsed guidance in NEI 12-06, Section 3.2.1.4, boundary condition 4, stating that "no independent failures, other than those causing the ELAP/LUHS event, are assumed to occur in the course of the transient."

3.2.3.2.3 Core Decay Heat Calculation NEI Section 3.2.1.2 states in part:

The initial plant conditions are assumed to be the following:

(1) Prior to the event the reactor has been operating at 100 percent rated thermal power for at least 100 days or has just been shut down from such a power history as required by plant procedures in advance of the impending event.

Pages 73 through 76 of the FIP contains the time constraints for ELAP mitigating strategies.

The ELAP analyses used to establish the time constraints credit operator actions to begin to cool down immediately following the declaration of an ELAP event. The cooldown will decrease the RCS temperature and pressure, which decreases the RCP seal leakage and slows the decrease in RCS inventory. Operator actions are modeled to perform the cooldown by steaming through ADVs and feeding water to the SGs from the CST using the TDAFW pump.

When the CST empties, the operator can align the suction of the TDAFW pump to the RMWT or refill the CST from the RWT, and, subsequently, refill the CST from one of the two seismically designed, below ground reservoirs when water in the RMWT or RWT depletes. The ELAP analyses also credit operator actions to align the high pressure RCS makeup sources (plant charging pump or FLEX RCS injection pump) and replenish the RCS inventory to maintain single phase natural circulation flow and rnaintain the core covered with water. Based on the operator actions for the cooldown and RCS inventory makeup discussed above, the effects of the use of different values of the decay heat curve on the ELAP analysis are that the greater values of the decay heat curve will result in shorter operator action times required for the operator to initiate refill of the CST, and start makeup of the RCS inventory.

Page 16 of the FIP indicated that a plant-specific best-estimate decay heat model was used in the ELAP analysis. The decay heat analysis for Palo Verde was performed using the ORIGEN-S code that is a module of the Oak Ridge National Lab's (ORNL) SCALE 6.1 package.

ORIGEN-S used ORIG EN-ARP cross section libraries that are also part of the ORNL SCALE package. The analyses used parameters that are intended to be representative of or bounding with respect to the Palo Verde core loading patterns.

Westinghouse Electric Company Calculation CN-REA-12-36 presents details of the best estimate Palo Verde calculations, and includes a comparison with the ANS 5.1 standard calculations. The comparison shows that the ANS 5.1 results are comparable to the PVNGS results for cooling times up to 1 year. For longer cooling times, the ANS 5.1 decay heat shows lower values. Decay heat curves for various burnups, enrichments, cycle lengths, cooling times, cross section libraries are illustrated in Figures 31.2 through 31.6 of the RAI 31 response

[Reference 44]. The results from these calculations are considered realistic and conservative, therefore, an additional 2-sigma conservatism is not used.

In summary, the NRC staff finds the PVNGS-specific decay heat calculations acceptable.

Therefore, based on the evaluation above, the NRC staff concludes that the licensee's analytical approach should appropriately determine the sequence of events for reactor core cooling, including time-sensitive operator actions, and evaluate the required equipment to mitigate the analyzed ELAP event, including pump sizing and cooling water capacity.

3.2.3.3 Reactor Coolant Pump (RCP) Seals NEI 12-06, Section 3.2.1. 7, Principle 6 states:

Strategies that have a time constraint to be successful should be identified and a base provided that the time can be reasonably met.

During an ELAP event, cooling to the RCPs' seal packages will be lost and water at high temperatures may result in deformation or degradation of seal materials, leading to an increase in seal leakage from the RCS. Without ac power available to the emergency core cooling system, the RCS inventory loss from the seal leakage for an extended time period could eventually result in inadequate core cooling. Therefore, the licensee has developed a FLEX strategy capable of providing RCS makeup to ensure continued core cooling for the ELAP event. The ELAP analysis credits operator actions to align the high pressure RCS makeup sources and replenish the RCS inventory for maintaining the core covered with water. The effect of the seal leakage rates on the results of the ELAP analysis is that higher seal leakage rates will result in a shorter required operator action time for aligning the high pressure RCS makeup water sources.

The licensee's Overall Integrated Plan (OIP) [Reference 10] indicated that Palo Verde's RCP seals were assumed to have a maximum leakage of 17 gpm per pump at normal operating pressure following an ELAP event. During an audit, the NRC staff requested the licensee to justify the use of the RCP seal leakage rate of 17 gpm per pump assumed in the ELAP analysis.

In its RAl-24 response [Reference 44], the licensee indicated that the maximum RCP seal leakage rate of 17 gpm was calculated using a thermal-hydraulic (T-H) analysis based on an analytical seal-leakage model. The analysis used the following assumptions: (1) a stationary RCP shaft, (2) total loss of all seal cooling, and (3) an initial RCS pressure of 2250 psia and RCS cold-leg temperature of 555 °F.

The T-H analysis simulates the fluid-flow characteristics through the seal housing assembly, including all flow regions associated with the Palo Verde RCPs from the RCP impeller through the third seal and the controlled bleed-off (CBO) flow path. The NRC staff noted that the licensee did not adequately model the RCP internal flow paths in the T-H analysis, nor discuss the considerable modeling uncertainties and their impacts on the calculated flow rates and pressure losses across these flow paths. In addition, the analysis assumed an increase in seal gap of 0.01 inches for each stage for the degraded seal during an ELAP. The licensee claimed that the assumed seal gap increase of 0.01 inches is conservative based on the conclusion of a 1978 General Electrical topical report concerning similarly designed recirculation pump seals installed at boiling-water reactors. However, no information was presented regarding whether this conclusion is supported by subsequent RCP seal leakage testing data and operating experience, nor was information provided to support the application of this assumed seal gap increase to the ELAP analysis of a PWR.

3.2.3.3.1 1989 Palo Verde Unit 3 - Loss of Offsite Power Event In addressing open item 3.2.1.2.A from the NRC's Interim Staff Evaluation (ISE) [Reference 16],

the licensee referenced plant operational data during a loss-of-offsite power (LOOP) event that occurred at Palo Verde Unit 3 in 1989. As discussed in a Palo Verde incident investigation report, the 1989 event resulted in a loss of both seal cooling and seal injection to the RCP seals for about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. During this 1-hour period, the RCS cold leg temperature was maintained between 560 °F and 565 °F, and the seal leakoff flow from RCP 1 B increased by 1.25 gpm.

The licensee stated that the plant conditions of the 1989 event were comparable with that of the ELAP analysis, which assumed that the seal injection and seal cooling were lost and the CBO line was not isolated at the event initiation. The licensee also identified the differences between the ELAP analysis and the 1989 event, and evaluated the effects of the differences on the potential for seal degradation as follows.

One difference was the RCS cold leg temperature. The ELAP analysis predicted an RCS cold leg temperature of 570 °F followed by a 70 °F/hr cooldown, while the 1989 event showed that a RCS cold leg temperature was maintained between 560 °F and 565 °F (a 5 to 10 °F difference) during the applicable 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> period. The 1989 event also showed that the maximum temperature for the flow to the first-stage seal during the event was 437 °F (representing a minimum temperature decrease of 123 °F from the RCS cold leg temperature of 560 °F). The data showed substantial heat loss from the seal flow to the RCP seal housing metal mass.

During normal operation, with cooling provided to the seals, the seal temperature is approximately 100 °F. At the event initiation, the seal housing metal mass around the seals is also in the 100 °F range. The increase in the RCS cold leg temperature from 100 °F to 570 °F is about 2% greater than an increase to 560 °F. With the consideration of overall heat loss to the seal housing metal mass and to the RCP seal components during the event, the licensee stated that the effect of a 2% difference on the seal temperatures is insignificant and an increase in the associated potential for RCP seal degradation is small.

Another difference was the seal design. As stated in the OIP [Reference 1 O], the maximum leakage rate assumed in the ELAP analysis is based on the current Palo Verde Sulzer seal and CE Klein, Schanzlin, and Becker (KSB) RCP combination, while in the 1989 event the seals were the original CE KSB seals in the CE KSB RCPs. The licensee compared the designs of the KSB and Sulzer seals and stated that they are similar in terms of thermal characteristics based on the following design information: (1) the majority of the mass of a seal cartridge is stainless steel which serves as a medium for heat capacitance and heat transfer when hot water from the RCS passes through the seal cartridge; (2) the basic flow paths through the seal cartridge are the same in both designs; (3) the seal rings in both designs are composed of very similar material (graphite/carbon and tungsten-carbon) with slightly different geometries; (4) on a loss of power, the rotating and stationary rings for both designs are stationary, such that no heat is generated from the motion of the rotating ring. The thermal capacitance of the ring is important in determining the seal temperature during the ELAP event. Since both designs use similar materials, the thermal characteristics are similar and heat absorption and loss are similar; and (5) the same type of ethylene propylene rubber 0-ring is used in both designs.

Based on the above discussion, the NRC staff agreed with the licensee that the effect of an RCS cold leg temperature difference of 10 °F on the potential for seal degradation is small and the KSB and Sulzer seals are similar. Considering the small leakage rate (1.25 gpm) observed during the 1989 event, the NRC staff considered that the 1989 event data supports the conclusion that the seal leakage rate of 17 gpm per pump is acceptable. Also, the licensee added conservatism by assuming a seal leakage of 25 gpm per pump in the final ELAP analysis.

3.2.3.3.2 RCP Seal Pop-Open Failure Unlike other CE plants, the CBO lines at PVNGS do not have excess flow check valves.

Therefore, the NRC staff performed a plant-specific review of the RCP seals at Palo Verde to determine the potential susceptibility to RCP seal pop-open failure and the associated leakage rates expected. Regarding operating limits for maintaining seal integrity, the information discussed in Section 4.4.2 of WCAP-17601, which states, "it has been shown that the probability of seal failure greatly increases when there is less than 50 °F of subcooling in the cold legs", is addressed in WCAP-16175. This WCAP explains that hydrodynamic stability analyses of various seal designs indicate the hydrodynamic response of RCP seals is influenced by several operational and design parameters. Specifically, analyses have shown that the face seal should remain stable under the following conditions:

(a) The inlet fluid is sufficiently subcooled (> 50 °F)

(b) The backpressure acting on the seal is greater than half the saturation pressure at the inlet temperature.

In addressing the NRC staff's question regarding applicability of the information in Section 4.4.2 of WCAP-17601, the licensee stated in its RAl-24 response [Reference 44] that "[c]hanges to the CE-designed plant generic operational guidance requiring performance of a rapid RCS cooldown and depressurization early during an ELAP event provided action to address the RCP-seal pop-open concern as well as 0 -ring degradation by lowering RCS temperature."

In addressing open item 3.2.1.2.B from the NRC's ISE [Reference 19), the licensee performed an evaluation of the seal pop-open failure mechanisms for all three stage seals, and stated that the pop-open seal failure is unlikely to occur based on the following information.

First-Stage Seal The normal backpressure to the first-stage seal, assuming the second-stage seal is intact, is about 1320 psia. To meet Criterion (b) from WCAP-16175, the backpressure to the first stage seal must be greater than half the saturation pressure at the inlet temperature to avoid seal pop-open failure. The maximum inlet temperature to the first stage seal is less than the predicted maximum RCS cold leg temperature of 570 °F, which has a corresponding saturation pressure of 1250 psia. Half of the saturation pressure of 1250 psia is 625 psia. Therefore, the backpressure at the first-stage seal of 1320 psia meets Criterion (b).

Second-Stage Seal The 1989 event data showed that the backpressure to the second-stage seal was approximately 410 psia. To meet WCAP-16175 Criterion (b), the inlet temperature to the second-stage seal must be less than 522 °F, which is the saturation temperature for the pressure at 820 psia (two times 410 psia). As discussed in Section 3.2.3.3.1 of this report, the 1989 event data showed that the minimum temperature difference at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> between the RCS cold leg and the first stage inlet was approximately 123 °F. The temperature difference to the second-stage seal will be greater because of the heat loss when the seal water passes to the second stage seal. The estimated maximum temperature to the second-stage seal was 447 °F (570 °F - 123 °F), which meets the Criterion (b) requirement of 522 °F.

• Third-Stage Seal The licensee indicated that from the plant data of the 1989 event the inlet temperature to the third-stage seal reached the alarm setpoint of 158 °F after 22 minutes following initiation of the event. Since the measured data of the maximum third-stage seal temperature reached during the event is not available, the licensee estimated a third-stage seal inlet temperature of 258 °F based on a simple linear extrapolation to 60 minutes, at which time a rapid cooldown strategy would be employed. Since the 1989 event data showed that the pressure to the inlet of the third-stage was 410 psia and the corresponding saturation temperature was 445 °F, the temperature of 258 °F provides subcooling in excess of 50 °F at the third stage inlet, which meets Criterion (a) from WCAP-16175 stating that the inlet fluid should be sufficiently subcooled

(> 50 °F) to avoid seal pop-open failure.

Based on the above discussion, the NRC staff found that the plant data from the 1989 event in combination with the relevant analysis supports the staffs conclusion that the conditions would exist during the ELAP event for each of the three seal stages to meet either Criterion (a) or Criterion (b) from WCAP-16175 that is required to prevent the seal pop-open failure from occurring. In addition, the results of the post-event examination of the RCP seals following the 1989 event showed no indication of seal pop-open.

3.2.3.3.3 Pressure-Dependent RCP Seal Leakage Determination Regarding determination of the pressure-dependent RCP seal leakage rate, the licensee used the CENTS code with the homogeneous equilibrium model (HEM) correlation, based on an assumption that the fluid conditions at the seals would be two-phase for a long period into the ELAP event. The staff notes that the Henry-Fauske (HF) correlation may calculate higher flow rates for subcooled liquid, particularly as the fluid approaches saturation, which would typically be the case in an ELAP following the RCS cooldown but prior to entering the reflux cooling mode. The licensee performed a sensitivity study which showed that using the HF correlation reduced from 49 hours5.671296e-4 days <br />0.0136 hours <br />8.101852e-5 weeks <br />1.86445e-5 months <br /> to 46 hours5.324074e-4 days <br />0.0128 hours <br />7.60582e-5 weeks <br />1.7503e-5 months <br /> the time to two-phase natural circulation (based on 17 gpm initial leak rate per pump) when compared to using the HEM correlation. For the FIP, the seal leakage rate of 25 gpm per pump was assumed and the time of transition to reflux cooling was determined to be 35.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The NRC staff considered the available margin associated with the assumption of a 25 gpm seal leakage rate sufficient to bound the effects of the licensee's reliance on the HEM correlation. Therefore, the NRC staff found the licensee's approach acceptable.

3.2.3.3.4 RCP Seal Leakage of 25 gpm per Pump Used in the ELAP Analysis In the FIP, the licensee assumed an RCP seal leakage rate of 25 gpm per pump that initiates at the start of the ELAP event. Based on its discussion in Section 3.2.3.3.1 through Section 3.2.3.3.4 of this report, the NRC staff found that: (1 ) the 1989 event data supports the staffs conclusion that the use of a seal leakage rate of 17 gpm per pump in the ELAP analysis was reasonable; (2) the likelihood of seal pop-open failure was small during an ELAP event; (3) the method used to determine the pressure-dependent leakage rates for the ELAP analysis for the FIP was adequate; and (4) the use of 25 gpm per pump for the seal leakage in the ELAP analysis was consistent with the NRC safety evaluation for Palo Verde regarding the station blackout (SBO) event (ADAMS Accession No. ML062910280) and provided additional margin of conservatism when compared with the rate of 17 gpm per pump used in the OIP. Therefore, the NRC staff determined that the use of seal leakage of 25 gpm per pump in the ELAP analysis is adequate and acceptable for establishing the FLEX mitigation strategy.

3.2.3.4 Shutdown Margin Analyses NEI 12-06 Table 3-2 indicates that "all PWR plants should have the means to provide borated RCS makeup."

Approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> into the event the licensee will start a symmetric cooldown at a rate of 70

°F/hr using one atmospheric dump valve (ADV) per SG to an RCS cold leg temperature of 360

°F. If the control rod worth from the inserted control rods and the initial boron concentration are not sufficient to overcome the positive reactivity addition from the cooldown, the reactor may return to criticality. Page 23 of the FIP stated that the Palo Verde control rods provide sufficient negative reactivity such that boron injection from the SITs and other sources can be ignored and the core will still maintain more than 2% l'.lp shutdown margin at the applicable RCS conditions (360 °F).

The licensee analyzed the event using the CENTS computer code. The analysis considered the positive reactivity associated with RCS cooldown to the cold leg temperature associated with the target SG pressure in accordance with mitigation strategies. The results of the shutdown margin analysis showed that increases in RCS boron concentration are not required to maintain the core subcritical at the RCS conditions considered for indefinite coping in the licensee's FIP.

Therefore, issues associated with the addition of boric acid to the RCS, including provision for adequate mixing of the injected boric acid throughout the entire RCS volume and the potential need for venting RCS inventory in low-leakage scenarios to create sufficient free volume, are not applicable to PVNGS.

NEI 12-06, Section 11.8.2, states that plant configuration control procedures will be modified to ensure that changes to the plant design will not adversely impact the approved FLEX strategies.

Inasmuch as changes to the core design are changes to the plant design, the staff notes that any core design changes, such as those considered in a core reload analysis, should be evaluated to determine that they do not adversely impact the approved FLEX strategies, especially the analyses which demonstrate that recriticality will not occur during a FLEX RCS cooldown.

Based on the evaluation above, the NRC staff finds the licensee's shutdown margin analysis to be adequate.

3.2.3.5 FLEX Pumps and Water Supplies Core Cooling - SG Makeup Pump During the Phase 2 or Phase 3 core cooling strategies when the residual core decay heat is not sufficient to generate the required SG steam pressure for the TDAFW pump to function, core cooling may be transferred to a portable diesel-driven SG makeup pump. FIP Table 2 indicates that the operating point of the FLEX SG makeup pump will be 300 gpm at 200 psig with the diesel engine at 3100 rpm. The staff noted that the design specification for the FLEX SG makeup pump is provided in PVNGS document NM1000-A00016.ROOO, "Diesel PWR Centrifugal Pumps for PV Diverse Flexible Coping Strategies (FLEX)."

The licensee performed an evaluation, PVNGS Document NM1000-A00020, "APS Palo Verde Nuclear Generating Station Detailed FLEX AFT Fathom Models," to determine the fluid system hydraulic performance and to validate that the FLEX portable pumps have adequate net positive suction head (NPSH) and discharge flow. The NRC staff noted that this calculation assessed different possible lineups based on such variables as suction sources, connection points and hose paths to determine the tank level of the suction source to ensure that the FLEX SG make-up pump procured by the licensee is adequate for providing injection into the SGs at the required flow rate and discharge pressure. The licensee indicated that piping takeoff diagrams and inputs were developed from planned layout of hoses, piping runs per modification packages, and FLEX final delivered diesel-driven pump skids.

The licensee's Phase 2 core cooling FLEX strategy relies on the Reactor Makeup Water Tank (RMWT) as the suction source for the TDAFW pump upon depletion of the CST. The licensee performed an evaluation to demonstrate the seismic capacity of the RMWT and determined it should be available during an ELAP event. In the event the RMWT is not available, the licensee indicated that the RWT could be used as a source of inventory, which would require a FLEX portable pump and hoses to transfer water from the RWT to the CST. The staffs evaluation of the robustness and availability of the RMWT and the RWT is discussed in SE Section 3. 10.1.

The licensee's Phase 3 core cooling FLEX strategy relies on the 85-acre and 45-acre station reservoirs, in conjunction with a water purification system delivered by the NSRC, to be the credited SG cooling water source. The staffs evaluation of the robustness and availability of the 85-acre and 45-acre station reservoirs for an ELAP event is discussed in SE Section 3.10.1.

RCS Inventory Control - RCS Makeup Pump Makeup is provided to the RCS with a portable electric-driven FLEX RCS makeup pump powered with a FLEX 480 Vac generator to compensate for RCS volume contraction during cooldown and RCS leakage such as RCP seal leakage. FIP Table 2 indicates that the operating point of the FLEX RCS makeup pump will be 5 gpm to 40 gpm at 650 psig with engine speed at 100 rpm to 1200 rpm. The staff noted that the design specification for the FLEX RCS makeup pump is provided in PVNGS document NM1000-A00015.ROOO, "Electric PWR Positive Displacement Pumps for PV Diverse Flexible Coping Strategies (FLEX)."

The licensee performed an evaluation, PVNGS Document NM1 OOO-A00020, "APS Palo Verde Nuclear Generating Station Detailed FLEX AFT Fathom Models," to determine the fluid system hydraulic performance and to validate that the FLEX portable pumps have adequate NPSH and discharge flow. The NRC staff noted that this calculation assessed different possible lineups based on such variables as suction sources, connection points and hose paths to determine the tank level of the suction source to ensure that the FLEX RCS make-up pump procured by the licensee is adequate for providing injection into the RCS at the required flow rate and discharge pressure. The licensee indicated that piping takeoff diagrams and inputs were developed from planned layout of hoses, piping runs per modification packages, and FLEX final delivered motor driven pump skids.

The licensee's Phase 2 RCS inventory control FLEX strategy relies on the use of the RWT as the borated water source. FIP Section 4.1 states that RCS inventory makeup from the RWT is sufficient to last for approximately 10 days. The staffs evaluation of the robustness and availability of the RWT for an ELAP event is discussed in SE Section 3.10.2.

The licensee indicated that the Phase 3 RCS inventory control FLEX strategy relies on the 85-acre and 45-acre station reservoirs, in conjunction with a mobile boration unit and water purification system delivered by the NSRC, for indefinite use for injection into the RCS. The staffs evaluation of the robustness and availability of the 85-acre and 45-acre station reservoirs for an ELAP event is discussed in SE Section 3.10.2.

Based on its review, the NRC staff concludes that the portable FLEX pumps should perform as intended to support core cooling and RCS inventory control during an ELAP event, consistent with NEI 12-06, Section 11.2.

3.2.3.6 Electrical Analyses The PVNGS electrical FLEX strategies are practically identical for maintaining or restoring core cooling, containment, and spent fuel pool cooling, except as noted in Sections 3.3.4.4 and 3.4.4.4 of this SE. Furthermore, the electrical coping strategies are the same for all modes of operation.

The licensee would enter its FLEX support guideline (FSG) approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the onset of an ELAP with loss of normal access to the ultimate heat sink event. Specifically, the licensee would enter its FSG following a loss of offsite power and after plant operators determine that the Station Blackout (SBO) generators credited for SBO mitigation cannot be started and are unlikely to be restored within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the initiation of ELAP event.

During Phase 1 PVNGS initial coping relies on installed equipment and on-site resources. The operator will enter existing PVNGS emergency operating procedures. The PVNGS ELAP strategy includes utilizing safety-related batteries to initially power the required key instrumentation and applicable direct current (de) components during Phase 1. PVNGS has two independent trains of safety equipment, labeled "A" and "B. Train "A" has two independent Battery Banks, "A" (PKA-F11) and "C" (PKC-F13), and Train "B" has two independent Battery Banks, "B" (PKB-F12) and "D" (PKD-F14). Thus PVNGS has a total of four independent Class 1 E 125 Vdc station batteries in Banks A, B, C, and D and associated 125 Vdc/120 Vac distribution systems. The 120 Vac power is produced by inverters powered from the 125 Vdc buses. These systems are located within the control building in each of the three units. The control building is a safety-related structure designed to meet design basis external hazards.

These battery banks are used to power required instrumentation, control systems, and valve operators during the ELAP event. One single instrument train ("A" or "B. as a result of load shed) of the required safety instrumentation is required in Phase 1 for the licensee's reactor core cooling and heat removal strategy. The PVNGS strategy shows that the required instrumentation will be powered by the Class 1 E station batteries at the start of the initiating event. When an ELAP is declared, plant operators will commence extended de load shedding but will maintain one train of critical instruments.

The NRC staff reviewed calculation APS-PVNGS-13-003, "Project Study Report ELAP Battery Discharge Capacity Study," Revision 1, and verified the capability of the Class 1 E batteries to supply de power to the required loads and alternating current (ac) power to the critical instrumentations through inverters during Phase 1 of the mitigation strategies plan for an ELAP as a result of a BDBEE. The above calculation required that all manual load sheds should be completed within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> of the start of the ELAP event per FLEX guideline 791S-9ZZ07, "PVNGS Extended Loss of All Site AC Guideline Modes 1-4." The licensee's analysis identified the required Phase 1 loads and their associated ratings (amperage and minimum voltage) and non-essential loads that would be shed to ensure battery operation for at least 34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br /> before battery voltage dropped below a minimum voltage of 105 Vdc. The licensee expects the Phase 2 FLEX portable diesel generators (PDGs) to be deployed, staged, and energized to power the battery chargers and required instruments in less than 34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br />, well before batteries deplete.

Each safety-related Class 1 E battery at each PVNGS Unit contains 60 cells and was manufactured by Exide Technologies (GNB Flooded NCN-33).

The NRC staff reviewed calculation 13-NM1000-A00048, "Load Shed - Battery Discharge Capacity Analysis," Rev. 0, and Palo Verde guideline 791S-9ZZ07, Revision 3, "PVNGS Extended Loss of All Site AC Guideline Modes 1-4," which provided the bases for operator actions to complete the load shed sequence on the station battery Train "A" or "B" within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the initiating event. These actions will ensure 125 Vdc/120 Vac power is available for at least 34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br /> after the initiation of the ELAP event. Additional loads on the batteries (such as atmospheric dump valves (ADVs)) will be shed within 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> of initiation of an ELAP event.

The licensee analyzed the extended duty cycle in accordance with NEI White Paper, "EA 049 Mitigating Strategies Resolution of Extended Battery Duty Cycles Generic Concern,"

(ADAMS Accession No. ML13241A186) which was endorsed by the NRC (see ADAMS Accession No. ML13241A188). In addition to the NEI white paper, the NRC sponsored testing at Brookhaven National Laboratory that resulted in the issuance of NUREG/CR-7188, "Testing to Evaluate Extended Battery Operation in Nuclear Power Plants," in May of 2015. The purpose of this testing was to examine whether existing vented lead-acid batteries can function beyond their defined design-basis duty cycles (or beyond-design-basis duty cycles if existing SBO coping analyses were utilized) in order to support the necessary safety functions during an ELAP. The study evaluated battery performance availability and capability to supply the necessary de loads to support core cooling and instrumentation requirements for extended periods of time.

The testing provided an indication of the amount of time available (depending on the actual load profile) for batteries to continue to supply de power to the core-cooling equipment beyond the original duty cycles for a representative plant. The testing also demonstrated that battery availability can be significantly extended using load shedding techniques to allow more time to recover ac power. The testing further demonstrated that battery performance is consistent with manufacturer performance data. According to the NUREG, the projected availability of a battery can be accurately calculated using the Institute of Electrical and Electronics Engineers (IEEE)

Standard 485-2010, "IEEE Recommended Practice for Sizing Lead-Acid Batteries for Stationary Applications," or using an empirical algorithm described in the report. The licensee plans to deploy its FLEX 800 kW, 480 Vac PDGs to supply ac power to the battery chargers to recharge the battery banks and power the required instruments before batteries deplete (34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br /> after initiation of an ELAP event). Actual validation exercises performed by the licensee have shown that the deployment of the Phase 2 PDGs could occur within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of the initiating event.

The PVGNS Phase 2 strategy includes transitioning from installed plant equipment to the portable on-site FLEX equipment. Operators will initiate RCS borated make-up capability by staging two trailer-mounted 800 kW, 480 Vac FLEX PDGs per unit to a pre-designated seismically qualified pad south of each unit. A set of dedicated color coded cables will be stored with each PDG. Based on the proposed FLEX design, these PDGs may be connected to primary or alternate receptacle connection boxes at external building locations. After the generator sets are connected, isolation breakers can be closed and loads added, as required by the FSG. In the FIP, the licensee stated that capability will be available to connect to either train of the Class 1 E switchgear and align to the required equipment in that train. The FLEX portable 480 Vac generator sets will also power the essential loads including vital instrumentation, two of four trains of battery chargers, electrical room exhaust ventilation fans, and the safety-related essential diesel fuel oil transfer pump. According to the FIP, the licensee will store eight 800 kW FLEX PDGs onsite in the seismically robust Flex Storage Buildings (FSBs) to meet the 'N+1 "

criteria for spare equipment (6 PDGs needed for the FLEX strategy, and 2 spares). If an "N" FLEX PDG is not available, the licensee will have a backup "N+1 " 800 kW, 480 Vac FLEX PDG.

In the event where an "N+1" generator is used, it will be transported from the FSB to the staging area outside the Diesel Generator Building and connected to the in-plant electrical distribution system using FLEX cables.

The NRC staff reviewed the summary of FLEX PDG sizing calculations CN-PEUS-13-02, "Palo Verde Unit 3 FLEX - Load Flow & Motor Starting Calculation - 480V Train A," Revision 1, and CN-PEUS-13-04, "Palo Verde Unit 3 FLEX - Load Flow & Motor Starting Calculation -480V Train 8," Revision 1, and determined that one 480 Vac, 800 kW Phase 2 FLEX PDG is capable of supplying the loads required for either the primary buses (Train A loads of 263 kW) or the alternate buses (Train B loads of 317 kW). These calculations noted that the equipment specifications for the 480 Vac FLEX PDGs were written such that the 480 Vac FLEX PDGs must be capable of providing 500 kW at the maximum ambient temperature of 130 °F.

The NRC staff also reviewed single line electrical diagrams and electrical physical layout figures in the FIP, the licensee evaluation on separation and isolation of the FLEX PDGs from the Class 1 E emergency DGs, and procedures that direct operators how to align, connect, and protect associated systems and components. Based on the NRC staff's review, the above calculations confirmed that the FLEX PDGs should have sufficient capacity and capability to supply the Phase 2 necessary loads following an ELAP. Additionally, the licensee will ensure that installed plant equipment is protected from adverse electrical interactions with the portable equipment by utilizing procedure controls and modifications that only allow the alignment of a single power source to each electrical bus.

Table 3 of the FIP lists additional equipment such as two 4.16 kilovolt (kV), 2 megawatt (MW) diesel generators that will be available on site to be used as defense-in-depth. The licensee stated that availability of defense-in-depth generators onsite will provide the station with flexibility to mitigate an unexpected event. Although not credited for the initial FLEX response, a combination of plant modifications and onsite availability of the two 4.16 kV, 2 MW diesel generators will add a safety margin to the overall FLEX philosophy. The two 4.16 kV, 2 MW diesel generators are stored in an FSB and could supply power to one train of the UHS for one unit for events that would not result in damage to the seismically designed PVNGS redundant spray ponds, such as an extreme heat event. In the FIP, the licensee stated that initiating shutdown and spent fuel pool cooling by using these diesel generators early in the event will eliminate the need for a significant amount of Phase 2 FLEX equipment and manpower.

According to the licensee, the 4.16 kV, 2 MW diesel generators could be moved onto a pre-designated seismic pad south of each unit (approximately 200 ft. from the switchgear receptacle boxes) and they can be connected to primary or alternate switchgear receptacle boxes. After the 4.16 kV diesel generators are connected, an isolation switch could be closed and loads can be added as required by the FSG. The 4.16 kV seismically qualified manual isolation switches are located at the ground elevation of the control building, and can be accessed from the diesel generator pad location or from the unit's control room. Two sets of cables plus a spare per unit (6 total) are available in deployable trailers that have a diesel-driven cable deployment mechanism.

For Phase 3, PVNGS Document NM1000-A00124, "Strategic Alliance for FLEX Emergency Response (SAFER) "SAFER Response Plan for Palo Verde Nuclear Generating Station,"

shows that the NSRC will supply eight 1 MW, 4.16 kV combustion turbine generators with three 4.16 kV distribution systems, and three 480 Vac, 1000 kW combustion turbine generators, with associated electrical connectors and cables, to the Palo Verde site within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the equipment is requested. The FIP stated that with the two 4.16 kV generators already on site, each unit would have four MW of 4.16 kV power available. The licensee would transition to these generators to continue Phase 2 coping strategies, and to initiate recovery actions. The NSRC turbine generators have design temperature ratings of -30 °F minimum and 130 °F maximum and as such these turbine generators are designed to operate at full capacity under the Palo Verde site sustained maximum temperature of 104.8 °F and minimum temperature of 37.6 °F. The FLEX 4.16 kV connections which have been added to each unit would permit connection of the NSRC supplied 4.16 kV turbine generators to the existing 4. 16 kV electrical distribution system. The licensee stated in the FIP that the 4 kV connections would permit powering components needed to cool the plant to cold shutdown, and provided load calculations in the following documents: NM1000-A00178, Rev. 2, Palo Verde FLEX-Load Flow and Motor Starting Calculation-4160 V Train "B", and NM1 OOO-A00181, Rev. 1, Palo Verde FLEX-Load Flow and Motor Starting Calculation-4160 V Train "A". However, the licensee did not provide FLEX procedures for accomplishing the transition to cold shutdown, so the NRC staff considers this to be a recovery action following the initial FLEX response. Pages 87 and 88 in the FIP shows the 4 kV connections.

3.2.4 Conclusions Based on this evaluation, the NRC staff concludes that the licensee has developed guidance that should maintain or restore core cooling and RCS inventory during an ELAP event consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.3 Spent Fuel Pool Cooling Strategies Order EA-12-049 requires that SFP cooling capabilities be maintained or restored as part of an overall strategy to mitigate a BDBEE. In NEI 12-06, Table 3-2 and Table D-3 summarize an acceptable approach consisting of three separate capabilities for the SFP cooling strategies.

This approach uses a portable pump to provide the capability for 1) makeup via hoses on the refueling floor capable of exceeding the boil-off rate for the design basis heat load; 2) makeup via connection to spent fuel pool cooling piping or other alternate location capable of exceeding the boil-off rate for the design basis heat load; and 3) spray via portable monitor nozzles from the refueling floor using a portable pump capable of providing a minimum of 200 gallons per minute (gpm) per unit (250 gpm if overspray occurs). During the event, the licensee selects the method to use based on plant conditions. This approach also requires a strategy to mitigate the effects of steam from the SFP, such as venting.

As described in NEI 12-06, Section 3.2.1. 7 and JLD-ISG-2012-01, Section 2.1, strategies that must be completed within a certain period of time should be identified and a basis that the time can be reasonably met should be provided. In NEI 12-06, Section 3 provides the performance attributes, general criteria, and baseline assumptions to be used in developing the technical basis for the time constraints. Since the event is beyond design basis, the analysis used to provide the technical basis for time constraints for the mitigation strategies may use nominal initial values (without uncertainties) for plant parameters, and best-estimate physics data. All equipment used for consequence mitigation may be assumed to operate at nominal setpoints and capacities. In NEI 12-06, Section 3.2.1.2 describes the initial plant conditions for the at-power mode of operation; Section 3.2.1.3 describes the initial conditions; and Section 3.2.1.6 describes SFP initial conditions.

In NEI 12-06, Section 3.2.1.1 provides the acceptance criterion for the analyses serving as the technical basis for establishing the time constraints for the baseline coping capabilities to maintain SFP cooling. This criterion is keeping the fuel in the SFP covered with water.

The ELAP causes a loss of cooling in the SFP. As a result, the pool water will heat up and eventually boil off. The licensee's response is to provide makeup water. The timing of operator actions and the required makeup rates depend on the decay heat level of the fuel assemblies in the SFP. The sections below address the response during operating, pre-fuel transfer or post-fuel transfer operations. The effects of an ELAP with full core offload to the SFP is addressed in Section 3.11. The PVNGS has one SFP per unit, located in each unit's Fuel Building.

3.3.1 Phase 1 The licensee stated in its FIP that during Phase 1, cooling to the SFP will be lost and SFP boiling will occur approximately 11.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the initiating event. The SFP boiling will result in SFP water level decreasing to 1 O ft. above the active fuel stored in the fuel racks approximately 39 hours4.513889e-4 days <br />0.0108 hours <br />6.448413e-5 weeks <br />1.48395e-5 months <br /> after the initiating event. The licensee stated that operator action is conservatively taken to open the Fuel Building roll-up door to keep the building at atmospheric pressure and temperature.

3.3.2 Phase 2 The licensee stated in its FIP that during Phase 2, operators will deploy a portable FLEX diesel-driven SFP makeup pump for each unit to supply water from the RWT to the SFP. The licensee stated that this pump provides a makeup flow rate of at least 58 gpm in order to maintain adequate SFP level at 10 ft. above the fuel for events starting during power operation (i.e., there is no full core offload in the SFP). The normal RWT water level is sufficient to provide makeup to the SFP and the RCS for more than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The licensee's FSG directs operators to fill the SFP using a batch process with the FLEX SFP makeup pump operating between 150 to 200 gpm to fill the SFP to a pre-designated elevation.

The FLEX SFP makeup pump discharges via portable hoses to one of two redundant spray headers permanently mounted on the wall of the Fuel Building with the spray nozzles oriented to spray into the SFP. The licensee stated that this strategy reduces the possibility of water losses and assures discharge nozzles are operated at optimum conditions.

3.3.3 Phase 3 During Phase 3, the licensee will continue the Phase 2 strategies to provide makeup to the SFP.

In addition, makeup will be provided to the Refueling Water Tank from the 85-acre and 45-acre station reservoirs using a FLEX temporary pipeline and pumps.

3.3.4 Staff Evaluations 3.3.4.1 Availability of Structures. Systems. and Components 3.3.4.1.1 Plant SSCs Condition 6 of NEI 12-06, Section 3.2.1.3, states that permanent plant equipment contained in structures with designs that are robust with respect to seismic events, floods, and high winds and associated missiles, are available. In addition, Section 3.2.1.6 states that the initial SFP conditions are: 1) all boundaries of the SFP are intact, including the liner, gates, transfer canals, etc., 2) although sloshing may occur during a seismic event, the initial loss of SFP inventory does not preclude access to the refueling deck around the pool and 3) SFP cooling system is intact, including attached piping.

In FIP Section 5, the licensee stated that the Phase 1 SFP cooling strategy does not require any anticipated actions. However, the licensee does establish a ventilation path early in the ELAP event to cope with temperature, humidity and condensation from evaporation or boiling of the SFP. The NRC staff reviewed the licensee's calculation on the time to boil for the SFP, and noted that this calculation and the FIP indicate that boiling begins at approximately 11.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> during a normal, non-outage situation. The staff noted that the licensee's SOE timeline in FIP Table 5 indicates that there is a 4-hour time constraint for operators to open the roll-up door to the Fuel Building truck bay as a contingency to ensure the SFP area remains habitable for personnel entry to access the alternate connection point for the SFP FLEX pump. In the FIP, Table 5 indicates that there is no permanent equipment within the Fuel Building used to support FLEX. The staff noted that Appendix B of the licensee's FSG, guideline 791S-9ZZ07, "PVNGS Extended Loss of All AC Guideline Modes 1-4," includes procedural steps to open up the Fuel Building roll-up door within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> of the ELAP declaration. The staff noted that the timing for operators to establish a vent path for the Fuel Building is well in advance of SFP boiling; thus, it is expected that operators will be capable of establishing a vent path and be able to safely access the alternate connection point for the discharge of the FLEX SFP pump if necessary.

The licensee's Phase 2 and Phase 3 SFP cooling strategy involves use of the FLEX SFP makeup pump (or NSRC supplied pump for Phase 3), with suction from the Rwr (the preferred water source), to supply water to the SFP. The licensee's strategy involves the use of primary and alternate connection points for SFP make-up/spray and for suction from the Rwr. The staff's evaluation of the robustness and availability of FLEX connection points (discharge and suction) for the FLEX pump is discussed in Section 3.7.3.1. The staff's evaluation of the robustness and availability of the Rwr for an ELAP event is discussed in Section 3.10.3.

3.3.4.1.2 Plant Instrumentation In its FIP, the licensee stated that the instrumentation for SFP level will meet the requirements of Order EA-12-051. Furthermore, the licensee stated that these instruments will have local battery power with the capability to be powered from the FLEX DGs. The NRC staff's review of the SFP level instrumentation, including the primary and back-up channels, the display to monitor the SFP water level and environmental qualifications to operate reliably for an extended period are discussed in Section 4 of this SE.

3.3.4.2 Thermal-Hydraulic Analyses In the FIP, Section 5 states that the two bounding scenarios analyzed are: (1) maximum normal operation with the heat load in the pool administratively controlled to less than 12.6E+6 British thermal units per hour (Btu/hr) and (2) the maximum normal/emergency refueling heat load of

4. 7E+ 7 Btu/hr (which includes a full core offload). The NRC staff noted that these heat loads for the SFP are consistent with those identified in UFSAR Section 9.1.3 and UFSAR Table 9.1-2.

In the FIP, Section 5.1 indicates that SFP inventory losses are due to leakages (31 gpm) and boil off (27 gpm) as documented in PVNGS Document NM1000-A00010, "Determination of the Time to Boil in the Palo Verde Spent Fuel Pools after an Earthquake." The staff noted the licensee's calculation conservatively assessed leakage through the gates and liner even though the initial conditions in Section 3.2.1.6 of NEI 12-06 states that "[a]ll boundaries of the SFP are intact, including the liner, gates, transfer canals, etc." In addition, the licensee's calculation conservatively assessed leakage from the lowest SFP piping connection, which although it is Seismic Category I and designed to survive an SSE, the licensee assumed it would break during a seismic event. This is a conservative assumption, as Section 3.2.1.6 of NEI 12-06 allows licensees to assume that uSFP cooling system is intact, including attached piping."

Therefore, the licensee conservatively determined that a SFP makeup flow rate of at least 58 gpm will maintain adequate SFP level at 10 ft. above the fuel for an ELAP occurring during normal power operation. In NEI 12-06, Section 3.2.1.6 states that the SFP heat load assumes the maximum design-basis heat load for the site as one of the initial SFP conditions. Based on the information in the FIP, the staff finds the licensee has considered the maximum design-basis SFP heat load consistent with NEI 12-06, Section 3.2.1.6.

3.3.4.3 FLEX Pumps and Water Supplies In FIP Section 5, the licensee states that the SFP cooling strategy relies on a FLEX pump to provide SFP makeup during Phase 2. In the FIP, Table 2 describes the hydraulic performance criteria for the SFP FLEX Pump as a diesel engine centrifugal pump with dual 5-inch inlets and one 5-inch outlet (all using STORZ connectors) and rated at 200 gpm at 100 psi. The NRC staff noted that the performance criteria of one of the FLEX pumps supplied from an NSRC for Phase 3 would allow the NSRC pump to fulfill the mission of the onsite SFP FLEX pump if the onsite SFP FLEX pump were to fail. The SFP makeup rate of 58 gpm and SFP spray rate of 200 gpm (without overspray) both meet the SFP makeup requirements as outlined in the previous section of this SE.

In the FIP, Section 5.1 indicates that the primary water source for the SFP FLEX strategy during Phase 2 is the RWT, which has a Technical Specification required volume in Mode 1 of 634,000 gallons and is procedurally increased to at least 720,000 gallons 30 days prior to outages.

Furthermore, the licensee indicated that makeup will be provided to the RWT from the 85-acre and 45-acre station reservoirs using a FLEX temporary pipeline and pumps. Further discussion regarding the robustness and availability of these water sources are documented in SE Section 3.10.3.

In the FIP, Section 5 states there is a primary connection point located external to the Fuel Building that is associated with a header that provides spray into the SFP and an alternate connection point located just inside the Fuel Building truck bay roll-up door that is associated with a redundant header that can also provide make-up/spray. In the FIP, Section 4.4 indicates that there is a primary and alternate connection point to allow FLEX pumps to take suction from the RWT. Further discussion regarding the robustness and availability of these discharge and suction connection points are documented in SE Section 3.7.3.1.

The NRC staff noted that NEI 12-06, Table D-3, states, in part, that the performance attributes for SFP cooling include a minimum makeup rate capable of exceeding the boil-off rate and a minimum spray rate of 200 gpm per unit to the pool or 250 gpm per unit if overspray occurs. In response to ISE Cl 3.2.2.A, by letters dated January 9, 2015, December 17, 2015, and May 26, 2015, for Units 1, 2, and 3, respectively, the licensee calculated the available NPSH for the new SFP FLEX pump to determine if the pump could achieve the necessary flow rate and spray rate.

The staff noted that this SFP FLEX pump takes suction from either the Condensate Storage Tank (CST) or the Refueling Water Tank (RWT) and discharges to one of two redundant headers that provides make-up/spray to the SFP. The licensee stated that the NPSH requirements were provided by the FLEX pump supplier as an input into the hydraulic computer model. The NPSH available for the required pump flow rate of 200 gpm is considerably higher than required and provides a substantial margin above the NPSH requirements. The staff reviewed the licensee's SFP hydraulic calculation, PVNGS Document NM1 OOO-A00032, Rev. 1, Spent Fuel Pool Cooling FLEX Pump NPSH Availability, and noted that the pump's required NPSH for 200 gpm SFP spray is approximately 11 ft. while the actual NPSH with suction from the CST and RWT is approximately 50 ft. and 42 ft, respectively. Furthermore, the staff noted, based on the pump/system curves, that the licensee's SFP FLEX pump has an actual NPSH greater than the required NPSH for 250 gpm SFP spray flow, with margin; thus, this pump can account for overspray, if required. During its audit, the licensee explained that the discharge nozzles are in a fixed position at an angle and location that was selected to ensure spray from the nozzles does not overshoot the SFP. Furthermore, the licensee explained that the ends of the nozzles are approximately three feet horizontally from the near edge of the SFP and approximately 11 feet higher than the SFP operating floor and that the stream from the nozzles will have ample velocity to cover the horizontal distance to reach the SFP. Based on the licensee's explanation for the spray nozzle positioning, the staff finds that the licensee has addressed overspray in its SFP FLEX strategy.

The NRC staff noted that the licensee's strategy and supporting calculation demonstrate the SFP FLEX pump can provide make-up/spray in excess of the SFP inventory loss rate of 58 gpm and has the capacity to provide at least 200 gpm of spray; thus, the staff finds the licensee's strategy is consistent with one of the cooling methods of NEI 12-06, Table D-3. Since the licensee did not address the other two cooling methods in Table D-3, the staff considers the licensee's approach to be an alternative method to NEI 12-06. In Section 3. 14, the staff found this to be an acceptable alternative to NEI 12-06.

3.3.4.4 Electrical Analyses The basic FLEX strategy for maintaining SFP cooling is to monitor the SFP level and provide makeup water to the SFP sufficient to maintain substantial radiation shielding for a person standing on the SFP refueling floor and provide for cooling for the spent fuel due to boil-off of the water. The licensee is not relying on any installed or supplemental electrical equipment as part of its spent fuel pool cooling strategy with the exception of the SFP level instrumentation required to meet NRC Order EA-12-051, which is described in Section 4 of this SE.

3.3.5 Conclusions Based on this evaluation, the NRC staff concludes that the licensee has developed guidance that if implemented appropriately should maintain or restore SFP cooling following an ELAP consistent with the alternative to NEI 12-06 approved in Section 3.14, and should' adequately address the requirements of the order.

3.4 Containment Function Strategies The industry guidance document, NEI 12-06, Table 3-2, provides some examples of acceptable approaches for demonstrating the baseline capability of the containment strategies to effectively maintain containment functions during all phases of an ELAP event. One such approach is for a licensee to perform an analysis demonstrating that containment pressure control is not challenged. The PVNGS units have large dry ambient-pressure containments.

The licensee performed a containment evaluation, NM1 OOO-A00042, "Palo Verde Long Term Containment Response Following an Extended Loss of AC Power, Rev. 0, which was based on the boundary conditions described in Section 2 of NEI 12-06. The calculation concludes that, even with the licensee taking no mitigating actions related to removing heat from the containment in the first 15 days following an ELAP-initiating event, the containment parameters of pressure and temperature remain well below the respective UFSAR Table 6.2.1-3 design parameters of 60 psig and 300 "F. Specifically, the containment peak pressure at the end of the 15-day period before a mitigation action is taken is approximately 10 psig, and the temperature rises to a maximum of approximately 215 °F. From its review of the evaluation, the NRC staff noted that the required actions to maintain containment integrity and required instrumentation functions have been developed, and are summarized below.

3.4.1 Phase 1 The FIP states that containment will be isolated as a result of the actuation of Engineered Safety Functions and verified by control room personnel using existing plant procedures at the onset of the ELAP. Regarding monitoring instrumentation, the FIP also states that one instrument channel train (which includes containment pressure) will be maintained and powered by essential station batteries during Phase 1 following an ELAP-initiating event.

3.4.2 Phase 2 The FIP states that once the onsite, portable 480 Vac diesel generator set is staged and functional, the batteries which are powering the containment pressure instrumentation will be recharged to maintain the monitoring function.

3.4.3 Phase 3 Although the NM1 OOO-A00042 analysis shows that, even without any active heat removal strategies from the containment, the parameters of temperature and pressure remain well below their design limits for a minimum of 15 days, eventually some action will be required to remove heat from the containment. As such, the analysis shows that by utilizing the hydrogen purge exhaust line as a vent pathway beginning 15 days after the ELAP-initiating event, the containment pressure rise is mitigated and decreasing at the end of the 30-day period of analysis. The containment temperature at the end of 30 days was calculated to be approximately 235 "F. The licensee would also be able to take recovery actions using the NSRC-supplied 4.16 kV generators to reestablish containment cooling.

3.4.4 Staff Evaluations 3.4.4.1 Availability of Structures. Systems. and Components The NEI 12-06 baseline assumptions have been established on the presumption that other than the loss of the ac power sources and normal access to the UHS, installed equipment that is designed to be robust with respect to design-basis external events is assumed to be fully available. Installed equipment that is not robust is assumed to be unavailable. Below are the baseline assumptions for the availability of SSCs for maintaining containment functions during an ELAP.

3.4.4.1.1 Plant SSCs Section 3.8.1.1.1 of the PVNGS UFSAR states that the containment consists of a right, circular cylinder which sits on a flat slab base and is topped by a hemispherical dome. It is a Category I structure constructed of reinforced concrete, pre-stressed by post-tensioned tendons in the cylinder and the dome. The slab is designed and constructed of conventionally reinforced concrete. There is a welded steel liner attached to the inside face of the concrete, and a base steel liner is installed below the floor slab. Being a Category I structure, the containment has been designed to maintain its function following a Safe Shutdown Earthquake. Additionally, Section 3.3 of the UFSAR states that Category I structures are designed to withstand extreme wind phenomena including tornado effects.

Table 6.2.1-3 of the UFSAR shows that the net free volume of the containment is 2.62 million cubic feet. The addition of mass and energy to the containment atmosphere during an ELAP event is driven by the assumed, initial leakage rate of 25 gpm per pump from the RCP seals (see Section 3.4.4.2 for details). The relatively small amount of heat and mass being added to the containment atmosphere coupled with the very large net free volume of the containment results in a slow-moving response. As stated above, the licensee's calculation shows that even with no mitigating actions taken to remove heat from the containment, the containment parameters of pressure and temperature remain well below the respective design limits of 60 psig and 300 °F for at least 15 days.

Section 6.2.5.2.2.3 of the PVNGS UFSAR states that the hydrogen purge system was designed and constructed as a non-safety system except for containment penetrations which are the same Seismic Category I penetrations used by the hydrogen recombiners. However, the containment analysis shows there is an extensive amount of time before any containment heat removal action would be required following an ELAP-initiating event and the expected arrival of offsite resources could also restore other available methods of containment heat removal.

3.4.4.1.2 Plant Instrumentation In NEI 12-06, Table 3-2 specifies that containment pressure is a key containment parameter which should be monitored by repowering the appropriate instruments. The licensee's FIP states that control room instrumentation would be available due to the coping capability of the station batteries and associated inverters in Phase 1, or the portable DGs deployed in Phase 2.

If no ac or de power was available, the FIP states that key credited plant parameters, including containment pressure, would be available using alternate methods. These alternate methods are described in the FSG guideline, 791S-9ZZ07, "PVNGS Extended Loss of All AC Guideline Modes 1-4," Appendix G.

3.4.4.2 Thermal-Hydraulic Analyses During the audit process, the NRC staff reviewed calculation NM1 OOO-A00042, "Palo Verde Long Term Containment Response Following an Extended Loss of AC Power", Rev. 0, which was based on the boundary conditions described in Section 2 of NEI 12-06. In this calculation, the licensee utilized the GOTHIC 8.0 code to model the containment response to an ELAP. The only additions of heat and mass to the containment atmosphere under ELAP conditions are the ambient heat losses from the surfaces of hot equipment and the leakage of reactor coolant from the RCP seals. Specifically, Case 3 of the calculation evaluated the containment response with an initial leakage of 25 gpm per pump from the RCP seals.

Using the input described above, the containment maximum pressure and temperature at 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> were estimated by the NRC staff to be approximately 20 psia and 185 "F and at 15 days they are approximately 25 psia and 215 °F with no operator actions taken. These values are still far below the UFSAR design parameters of 60 psig and 300 "F, so the licensee has adequately demonstrated that there is significant margin before a limit would be reached.

3.4.4.3 FLEX Pumps and Water Supplies In the FIP, Section 6.1 states that at 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> into the ELAP the pressure and temperature in the containment is estimated to be less than 20 psia and 200 °F, which is less than the design pressure and temperature of the containment building (See UFSAR Section 1.2.12.1 - design of 60 psig and 300 °F). The staff noted that this timeframe of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is adequate time for the delivery of off-site resources. In addition, the staff noted the licensee's FSG provides guidance for monitoring containment pressure to ensure that the design limit is not exceeded during the ELAP event. Thus, the staff noted that the licensee's containment integrity strategies do not rely on the use of FLEX pumps and associated water sources for maintaining containment pressure or temperature below the design limits for an extended period of time until off-site resources arrive.

3.4.4.4 Electrical Analyses The licensee performed a containment evaluation analysis based on the boundary conditions described in Section 2 of NEI 12-06. Based on the results of this analysis, the licensee determined that no action was required to ensure maintenance of containment integrity and required instrumentation function. With an ELAP initiated while PVNGS is in Modes 1-4, containment cooling is also lost for an extended period of time. Therefore, containment temperature and pressure will slowly increase. The licensee's analysis concluded that containment temperature and pressure will remain below containment design limits for more than 15 days and that essential instruments subject to the containment environment will remain functional. The NRC staff reviewed the containment evaluation, NM1000-A00042, "Palo Verde Long Term Containment Response Following an Extended Loss of AC Power", Rev. 0, and noted that after 3 days the containment temperature was still below 185 °F. Section 13.1 in the FIP stated that the threshold equipment qualification temperature for harsh environment is 230 °F. The licensee stated in the FIP that the instrumentation and components in containment credited for FLEX are qualified to 10 CFR 50.49 for LOCA and steam line break. The UFSAR indicates temperatures exceeding 300 "F and 400 "F for these events, respectively, and for LOCA the containment temperature remains above 220 "F for approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The NRC staff notes that after 3 days there is still considerable margin to the equipment qualification temperature limit. The staff concludes that the equipment inside containment is expected to remain functional for at least 3 days. The licensee would have time to receive Phase 3 equipment from an NSRC and initiate containment cooling, if needed, to maintain equipment functionality. The steps for connecting NSRC-supplied 4.16 kV generators are described in the FSG guideline, 791S-9ZZ07, "PVNGS Extended Loss of All AC Guideline Modes 1-4," Appendix U. The FIP stated that one train (A or B train) of containment pressure instrument is provided for monitoring containment pressure.

3.4.5 Conclusions Based on this evaluation, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain or restore containment functions following an ELAP event consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.5 Characterization of External Hazards Sections 4 through 9 of NEI 12-06, Revision 0, provide the methodology to identify and characterize the applicable BDBEEs for each site. In addition, NEI 12-06 provides a process to identify potential complicating factors for the protection and deployment of equipment needed for mitigation of applicable site-specific external hazards leading to an ELAP and loss of normal access to the UHS.

Characterization of the applicable hazards for a specific site includes the identification of realistic timelines for the hazard, characterization of the functional threats due to the hazard, development of a strategy for responding to events with warning, and development of a strategy for responding to events without warning.

The licensee reviewed the plant site against NEI 12-06 and determined that FLEX equipment should be protected from the following hazards: seismic and extreme high temperatures.

References to external hazards within the licensee's mitigating strategies and this safety evaluation are consistent with the guidance in NEl-12-06 and the related NRC endorsement of NEI 12-06 in JLD-ISG-2012-01. NEI 12-06 directed licensees to proceed with evaluating external hazards based on currently available information. For most licensees, this meant that the OIP used the current design basis information for hazard evaluation. Coincident with the issuance of Order EA-12-049, on March 12, 2012, the NRC staff issued a Request for Information pursuant to Title 10 of the Code of Federal Regulations Part 50, Section 50.54(f)

[Reference 19] (hereafter referred to as the 50.54(f) letter), which requested that licensees reevaluate the seismic and flooding hazards at their sites using updated hazard information and current regulatory guidance and methodologies. Due to the time needed to reevaluate the hazards, and for the NRC to review and approve them, the reevaluated hazards were generally not available until after the mitigation strategies had been developed. The NRC staff has developed a proposed rule, titled "Mitigation of Beyond-Design-Basis Events," hereafter called the MBDBE rule, which was published for comment in the Federal Register on November 13, 2015 [Reference 51 ]. The proposed MBDBE rule would make the intent of Orders EA-12-049 and EA-12-051 generically applicable to all present and future power reactor licensees, while also requiring that licensees consider the reevaluated hazard information developed in response to the 50.54(f) letter.

The NRC staff requested Commission guidance related to the relationship between the reevaluated flooding hazards provided in response to the 50.54(f) letter and the requirements for Order EA-12-049 and the MBDBE rulemaking (see COMSECY-14-0037, Integration of Mitigating Strategies for Beyond-Design-Basis External Events and the Reevaluation of Flooding Hazards" [Reference 41 ]. The Commission provided guidance in an SRM to COMSECY-14-0037 [Reference 20). The Commission approved the staffs recommendations that licensees would need to address the reevaluated flooding hazards within their mitigating strategies for BDBEEs, and that licensees may need to address some specific flooding scenarios that could significantly impact the power plant site by developing scenario-specific mitigating strategies, possibly including unconventional measures, to prevent fuel damage in reactor cores or SFPs. The NRC staff did not request that the Commission consider making a requirement for mitigating strategies capable of addressing the reevaluated flooding hazards be immediately imposed, and the Commission did not require immediate imposition. In a letter to licensees dated September 1, 2015 [Reference 35], the NRC staff informed the licensees that the implementation of mitigation strategies should continue as described in licensee's OIPs, and that the NRC safety evaluations and inspections related to Order EA-12-049 will rely on the guidance provided in JLD-ISG-2012-01, Revision 0, and the related industry guidance in NEI 12-06, Revision 0. The hazard reevaluations may also identify issues to be entered into the licensee's corrective action program consistent with the OIPs submitted in accordance with Order EA-12-049.

As discussed above, licensees are reevaluating the site seismic and flood hazards as requested in the NRC's 50.54(f) letter. After the NRC staff approves the reevaluated hazards, licensees will use this information to perform flood and seismic mitigating strategies assessments (MSAs) per the guidance in NEI 12-06, Revision 2, Appendices G and H [Reference 49]. The NRC staff endorsed Revision 2 of NEI 12-06 in JLD-ISG-2012-01, Revision 1 [Reference 52]. The licensee's MSAs will evaluate the mitigating strategies described in this safety evaluation using the revised seismic hazard information and, if necessary, make changes to the strategies or equipment. Licensees will submit the MSAs for NRC staff review.

The licensee developed its OIP for mitigation strategies by considering the guidance in NEI 12-06 and the site's design-basis hazards. Therefore, this safety evaluation makes a determination based on the licensee's OIP and FIP. The characterization of the applicable external hazards for the plant site is discussed below.

3.5.1 Seismic In its FIP, the licensee stated that seismic hazards are applicable to the site. UFSAR Sections 2.5 and 3. 7 state that the safe shutdown earthquake (SSE) seismic criteria for the site is 20 percent of the acceleration due to gravity (0.20g) peak ground acceleration (PGA). The licensee stated that the seismic analysis of all Seismic Category I structures was performed utilizing a Design Spectral Response Curve anchored at a PGA value of 0.25g. A PGA of 0.25g thus constitutes the design value for PVNGS, which bounds the 0.20g site characterization SSE (licensing basis). It should be noted that the actual seismic hazard involves a spectral graph of the acceleration versus the frequency of the motion. Peak acceleration in a certain frequency range, such as the numbers above, is often used as a shortened way to describe the hazard.

Based on the results of its reevaluated seismic hazard [Reference 22], the licensee concluded that the plant's current SSE is bounding, and therefore the plant screened out of any further seismic reviews. As documented by letter dated October 27, 2015 [Reference 40], the NRC staff agreed with the licensee's conclusion that the plant's current SSE is bounding.

The licensee has appropriately screened in this external hazard and identified the hazard levels to be evaluated.

3.5.2 Flooding In its FIP, the licensee stated that PVNGS is a dry site, as described in UFSAR Section 2.4.2.2 and does not rely on a permanently installed seawall or levee for flood protection and stated that therefore, PVNGS does not need to consider external flooding as a hazard defined in NEI 12-06, Section 6.2.1.

With regard to large internal flooding sources, the licensee replied [Reference 44] to an NRC request for additional information with the following:

PVNGS does not have any lake or cooling basin for nonsafety related cooling water systems that are capable of draining into the safety-related portions of the power block. The circulating water basin is at an elevation lower than the unit elevations. PVNGS does not have significant internal flooding concerns as a result of nonseismic system failures or from flooding as a result of gravity drainage of external bodies of water, and there is no possibility for significant groundwater intrusion into the safety related systems, structures and components (SSC) at the station. A review of design basis internal station flooding calculations for the failure of nonseismic cooling water systems confirms that the safety structures have sufficient capacity to mitigate the consequences of flooding without any AC power. APS has verified ingress and egress are available at the times needed to locations requiring access for operator action.

As the licensee's flooding reevaluation activities are completed, the licensee is expected to assess the mitigation strategies to ensure they can be implemented under the reevaluated hazard conditions as will potentially be required by the proposed Mitigation of Beyond Design Basis Events rulemaking. For this safety evaluation, the licensee is not required to consider external flooding as a hazard.

3.5.3 High Winds In NEI 12-06, Section 7 provides the NRG-endorsed screening process for evaluation of high wind hazards. This screening process considers the hazard due to hurricanes and tornadoes.

The screening for high wind hazards associated with hurricanes should be accomplished by comparing the site location to NEI 12-06, Figure 7-1 (Figure 3-1 of U.S. NRC, "Technical Basis for Regulatory Guidance on Design Basis Hurricane Wind Speeds for Nuclear Power Plants,"

NUREG/CR-7005, December, 2009; if the resulting frequency of recurrence of hurricanes with wind speeds in excess of 130 mph exceeds 1 E-6 per year, the site should address hazards due to extreme high winds associated with hurricanes.

The screening for high wind hazard associated with tornadoes should be accomplished by comparing the site location to NEI 12-06, Figure 7-2, from U.S. NRC, "Tornado Climatology of the Contiguous United States," NUREG/CR-4461, Rev. 2, February 2007; if the recommended tornado design wind speed for a 1 E-6 per year probability exceeds 130 mph, the site should address hazards due to extreme high winds associated with tornadoes.

In its FIP, regarding the determination of applicable extreme external hazards, the licensee stated that the site is located at 33° 23' North latitude and 112° 52' West longitude. NEI 12-06 Figure 7-2, Recommended Tornado Design Wind Speeds forthe 1E-6 per year Probability Level, indicates the site is not expected to experience winds exceeding 130 mph. Therefore, an assessment for high winds and tornados, including missiles produced by these events, is not applicable to PVNGS. Although the licensee did not address the impact of a hurricane in the integrated plan, the site is beyond the range of high winds from a hurricane per NEI 12-06 Figure 7-1. The NRC staff concludes that a hurricane hazard is not applicable and need not be addressed.

Therefore, high-wind hazards are not applicable to the plant site. The licensee has appropriately screened out the high wind hazard.

3.5.4 Snow. Ice, and Extreme Cold As discussed in NEI 12-06, Section 8.2.1, all sites should consider the temperature ranges and weather conditions for their site in storing and deploying their FLEX equipment consistent with normal design practices. All sites outside of Southern California, Arizona, the Gulf Coast and Florida are expected to address deployment for conditions of snow, ice, and extreme cold. All sites located north of the 35th Parallel should provide the capability to address extreme snowfall with snow removal equipment. Finally, all sites except for those within Level 1 and 2 of the maximum ice storm severity map contained in Figure 8-2 should address the impact of ice storms.

Because PVNGS is located in Arizona and is below the 35th parallel of latitude, in its FIP the licensee concludes that the snow, ice, and extreme cold hazard is not applicable to PVNGS.

The licensee has appropriately screened out the snow, ice, and extreme cold hazard.

3.5.5 Extreme Heat In the section of its FIP regarding the determination of applicable extreme external hazards, the licensee stated that, as per NEI 12-06 Section 9.2, all sites are required to consider the impact of extreme high temperatures. From the PVNGS UFSAR, Table 2.3-1, Normals, Means, and Extremes, Phoenix, Arizona, the highest average daily maximum temperature on a monthly basis is 104.8 °F and occurs in July with the record highest temperature of 116 °F occurring in both June and August. Each month from April through October has record high temperatures of 100 °F or higher. The plant site screens in for an assessment for extreme high temperature hazard.

In summary, based on the available local data and the guidance in Section 9 of NEI 12-06, the plant site does experience extreme high temperatures. The licensee has appropriately screened in the high temperature hazard and characterized the hazard in terms of expected temperatures.

3.5.6 Conclusions Based on the evaluation above, the NRC staff concludes that the licensee has developed a characterization of external hazards that is consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order in regard to the characterization of external hazards.

3.6 Planned Protection of FLEX Equipment 3.6.1 Protection from External Hazards In its FIP, the licensee described the FLEX emergency equipment storage facility (EESF) as consisting of four individually seismically isolated buildings, a separate stand-alone climate controlled building, and a canopy structure. The EESF serves all three units. All the EESF structures are co-located west of the protected area (PA) warehouse and inside of the owner-controlled area, but outside of the protected area. The NRC staff also refers to these as FLEX storage buildings.

The four seismically isolated buildings house FLEX equipment for each of the three units and an additional set of "N+1" equipment.

The separate climate controlled building is used for housing equipment, parts, and miscellaneous items which are susceptible to the outside environment, including the extreme heat hazard. This climate controlled building will also serve as the command control center for NSRC-delivered equipment post event.

The canopy area has been provided as a parking location for FLEX vehicles and debris removal equipment, such as front end loader, transportation trucks and yard truck. Deployment of the debris removal equipment and the Phase 2 FLEX equipment from the EESF is not dependent on offsite power. The building equipment doors may be manually opened.

Below are additional details on how FLEX equipment is protected from each of the applicable external hazards.

3.6.1.1 Seismic The EESF is constructed to be seismically robust using the requirements of American Society of Civil Engineers (ASCE) 7-10, "Minimum Design Loads for Buildings and Other Structures."

Trailer mounted equipment within buildings will be restrained by tie down hooks using nylon strap winches at twice the calculated load to eliminate seismic interaction. The vehicles within the canopy area are parked with at least a 6-foot separation to avoid seismic interaction.

The licensee used a seismic input from the ASCE 7-10 design analysis provisions that was lower than the SSE. To demonstrate acceptable performance of the protection and deployment functions of the EESF following a seismic event, the licensee stated during the audit process that the base shear reactions from the wind pressure loading evaluation govern the design of the building over the base shear loads induced by the reevaluated Ground Motion Response Spectra (GMRS) for Palo Verde, given in Reference 22. The licensee's evaluation concluded that the wind loading case induced reaction forces which were approximately 37% higher than the magnitude induced by the GMRS loading case. With this added design capacity, the NRC staff concludes that the FLEX storage building has adequate design margin to provide reasonable protection of the equipment and facilitate its deployment following a seismic event consistent with the reevaluated site-specific ground motion.

In its FIP. the licensee stated that an additional seismic pad, located directly northwest of the EESF, was built to aid with future facility maintenance issues, should there be a need to store equipment outside to maximize the availability of FLEX equipment. The seismic pad will be maintained indefinitely.

3.6.1.2 Flooding In its FIP, the licensee stated that the FLEX EESF finished floors are 1 foot above the predicted site flood elevation as a result of a probable maximum precipitation event.

3.6.1.3 High Winds Because PVNGS is not susceptible to high wind hazards, the FLEX equipment protection considerations of Section 7.3.1 of NEI 12-06 (separation) are not applicable. However, the licensee stated in its FIP that the FLEX EESF is designed to withstand EF-3 tornado wind speeds (excluding roofing material).

3.6.1.4 Snow. Ice. Extreme Cold and Extreme Heat Because PVNGS is not susceptible to snow, ice, and extreme cold, the four seismically isolated buildings are not temperature controlled. The separate climate controlled building is used for housing equipment, parts, and miscellaneous items which are susceptible to the outside environment, including the extreme heat hazard.

3.6.2 Reliability of FLEX Equipment Section 3.2.2 of NEI 12-06 states, in part, that in order to assure reliability and availability of the FLEX equipment, the site should have sufficient equipment to address all functions at all units on-site, plus one additional spare (i.e., an N+1 capability, where "N" is the number of units on site). It is also acceptable to have a single resource that is sized to support the required functions for multiple units at a site (e.g., a single pump capable of all water supply functions for a dual unit site). In this case, the N+1 could simply involve a second pump of equivalent capability. In addition, it is also acceptable to have multiple strategies to accomplish a function, in which case the equipment associated with each strategy does not require an additional spare.

In the FIP, Table 2, FLEX Phase 2 Equipment Providing Safety Function(s); Table 3, Other FLEX Equipment Available on Site; and Table 4, FLEX Miscellaneous Equipment/Commodities; provide a summary overview of the types and quantities of equipment needed to support the PVNGS FLEX integrated plan. Table 2 further itemizes which safety function(s) (core, containment, SFP, instrumentation, and accessibility) each component supports, as well as providing applicable specifications, operating parameters, and design characteristics, e.g.,

diesel driven, electric driven, type connections, etc.

Based on the number of portable FLEX pumps, FLEX DGs, and support equipment identified in the FIP and during the audit review, the NRC staff finds that, if implemented appropriately, the licensee's FLEX strategies include a sufficient number of portable FLEX pumps, FLEX DGs, and equipment for RCS makeup and boration, SFP makeup, and maintaining containment consistent with the N+1 recommendation in Section 3.2.2 of NEI 12-06.

3.6.3 Conclusions As discussed in Section 3.6.1.1 above, the NRC staff concludes that the licensee's seismic design of the EESF meets the requirements of Order EA-12-049. Based on this evaluation, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should protect the FLEX equipment during a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3. 7 Planned Deployment of FLEX Equipment Figure 20 in the FIP shows the paths for transportation of FLEX equipment to deployment areas. The deployment routes are engineered roads. The routes were evaluated for the seismic interaction and soil liquefaction hazards and determined to remain passable following a seismic event. Deployment routes are surveyed following an event and an appropriate route will be selected. An administrative program is in place to maintain the routes clear during normal site activities in all modes of plant operation. If equipment with safety function(s) is pre-deployed, it would be deployed in a pre-designated, seismically designed, concrete pad location at the final staging areas and restrained in 8 directions to tie-down anchors. These locations are evaluated for seismic interaction with non-seismic SSCs and at least one staging location for each strategy is free of seismic interaction. Figure 19 in the Fl P illustrates seismic pad locations.

3.7.1 Means of Deployment Table 4 in the FIP, FLEX Miscellaneous EquipmenVCommodities, lists vehicles for FLEX equipment transport and debris removal. These include two commercial trucks for towing trailers, two yard trucks for generators, three ATV four-wheel vehicles with tow bars, two mid-size debris removal loaders with forks, and four communications vehicles.

3. 7.2 Deployment Strategies In the FIP, Section 9.1 states that the deployment routes are engineered roads and were evaluated for soil liquefaction. The licensee stated it determined that the deployment routes remain passable following a seismic event as documented in PVNGS Document NM1000-A001 73, "Palo Verde Nuclear Generating Station FLEX Walk-Down Report."

With regard to FLEX equipment deployment for core cooling, Figure 19 in the FIP depicts deployment pad location of the SG makeup pump and Figure 21 depicts the approximate location of the primary and alternate suction, the flow path, and equipment utilized to facilitate this FLEX strategy.

Two egress/ingress paths are available to the TDAFW pump compartment (part of safety train A). Access can be achieved using the qualified watertight door at the 80 ft. elevation or through an access hatch at the 100 ft. elevation of the main steam support structure (MSSS) building.

Should the door at the 80 ft. elevation not be operational or blocked by debris or water accumulation as a result of non-seismic turbine building structures and/or systems failure, the FLEX installed hatch at the 100 ft. elevation of the MSSS can also be used for ventilation and access. The hatch opening is equipped with an access ladder. Access to the TDAFW pump compartment may be needed to check the status of the TDAFW pump.

The FLEX SG boundary valves, interconnecting the FLEX SG injection piping to the plant permanent AFW system, are located in the electric motor driven AFW pump compartment (part of safety train B). Access to this location is via the existing hatch at the 100 ft. elevation, which is equipped with an access ladder.

With regard to FLEX equipment deployment for RCS injection, in its FIP the licensee states that the primary RCS pump deployment and connection for each unit is located "plant south west" of the unit's fuel building, adjacent to the unit's RWT. To power the high-pressure electric motor-driven RCS injection pump, redundant Class 1 E 480 Vac receptacles are also at this location, in the yard area and easily accessible after any external events. An alternate location for the high-pressure RCS injection pump is within the auxiliary building entrance east-west corridor at ground elevation. This area was selected due to ease of access via the large rollup door which opens to the outside. Access was originally designed for deployment of the portable hydrogen recombiner during a LOCA. This location is equipped with an identical set of electrical and mechanical equipment/connections as described above for the primary location; however, no tie downs are provided at this location because this location will not be used for pre-staging. When located in the auxiliary building corridor, the FLEX pump suction is aligned to the suction line of the permanent essential charging pumps in the chemical and volume control system (CVCS).

In its FIP, the licensee stated that the SFP makeup will be initiated by deploying each unit's FLEX diesel-driven SFP makeup pump at a pre-designated pad as shown in Figure 19, next to the unit's fuel building. The primary discharge connection point is located on the outside wall of each unit's fuel building. The alternate discharge connection point is just inside the fuel building, adjacent to the rollup door.

With regard to FLEX electrical generator deployment, in its FIP the licensee stated that in Phase 2 each unit's two 480 Vac 800 kW diesel-driven generators will be moved onto a pre-designated seismically qualified pad south of each unit (approximately 200 feet from the connection boxes).

The generators will be connected using portable cables to external primary or alternate receptacle connection boxes, which are mounted on the outside wall of the control building and are permanently wired to isolation breakers in the plant. After the generators are connected and started, isolation breakers can be closed and loads added. Isolation breakers are located at the ground elevation of each unit's control building, and are easily accessible from the deployment location or control room. Each 480 Vac 800 kW generator is equipped with a set of color coded cables which connect from the deployed generators to the connection boxes. One hundred foot segments of cables are stored on easy-to-move carts. Two individual trailers house the cables for these generators. The connection box receptacles are also color coded and verified as part of design modification configuration for conductivity and phase rotation.

In its FIP, the licensee described deployment of the additional 4.16 kV "Defense-In-Depth" generators. Although not required for the initial FLEX response, the plant will have two 2 megawatt electric (MWe), 4.16 kV, generators available onsite, with permanent plant connection points, which adds safety margin to the overall FLEX philosophy. The two 4.16 kV generators are stored in the FLEX EESF and are sufficient for supplying power to one train of the UHS at one unit for events that would not result in damage to the UHS, such as an extreme heat event.

An additional 8 MWe of 4.16 kV generators can be supplied by an NSRC, resulting in 4 MWe of 4.16 kV power for each unit. The UHS for each unit is two seismically-designed spray ponds, one per safety train. Operationally, initiating shutdown cooling and spent fuel pool cooling by using these generators early in the event will eliminate the need for a significant amount of Phase 2 FLEX equipment and manpower. The defense-in-depth 4.16 kV generators can be moved onto the pre-designated seismic pad south of each unit and they can be connected to external primary or alternate switchgear receptacle boxes. After the generators are connected, an isolation switch can be closed and loads can be added. Seismically qualified manual isolation switches are located at the ground elevation of each unit's control building, and are easy to access from the generator pad location or the unit's control room. Two sets of cables plus spares per unit (total 6) are available in easy-to-deploy trailers with diesel driven cable deployment mechanism.

Figures 21 through 24 in the FIP depict further details of these and other selected deployment strategies.

3.7.3 Connection Points 3.7.3.1 Mechanical Connection Points Core Cooling Primary and Alternate SG Makeup Connection (FLEX pump discharge)

In the FIP, Section 4.4 states that the primary connection point injects into the AFW discharge piping to SG number 2. The primary FLEX piping connects in the Train B AFW pump compartment downstream of an existing AFW isolation valve (1, 2, 3 JAFBUV35). The licensee stated that the permanently installed primary FLEX pipe runs from the Train B AFW pump compartment to the condensate pipe tunnel and then exits the plant permanent structure adjacent to the CST with a 5-inch STORZ hose connection to connect to the hose from the discharge of the FLEX SG makeup pump. In the FIP, Section 4.4 states that the configuration of the alternate connection is of similar design as the primary connection. More specifically, the alternate FLEX piping connects into the AFW discharge piping to SG number 1, which is located in the Train 8 AFW pump compartment downstream of an existing AFW isolation valve (1, 2, 3 JAFBUV34). The permanently installed alternate FLEX pipe runs parallel with the primary FLEX pipe and exits the plant permanent structure adjacent to the CST with a 5-inch STORZ hose connection to connect to the hose from the discharge of the FLEX SG makeup pump. In NEI 12-06, Table D-1 states, in part, that the performance attributes for make-up with a portable pump should include primary and alternate injection points to establish capability to inject through separate divisions/trains, i.e., should not have both connections in one division/train.

Based on the flow diagram in FIP Figure 5, the staff noted that the header downstream of the primary and alternate connection points that inject into SG1 and SG2, respectively, are independent and diverse from one another. The staff noted that manipulation of isolation valves ensures that the failure of one connection point/injection path does not preclude decay heat removal with the other connection point/injection path. Thus, the staff finds the licensee is consistent with NEI 12-06, Table D-1, and the licensee has the capability of SG make-up with a portable pump through a primary and an alternate injection point which inject through separate divisions/trains due to the independence of the flow paths.

In the FIP, Section 7.1 states that mechanical FLEX permanent plant modifications were designed to the SSE plus 10 percent for added conservatism. The staff noted that these connections points tie into the existing Train B AFW discharge piping, which has been designed to Seismic Category I requirements (UFSAR Section 10.4.9). The staff noted that the primary and alternate FLEX pump discharge connection points and injection paths are robust such that at least one connection point/injection path should be available during an ELAP event, which is consistent with NEI 12-06, Section 3.2.2.

Primary and Alternate Secondary Plant Tie-in Piping (FLEX pump suction)

In the FIP, Section 4.4 states that a permanent connection to the existing 6-inch CST drain line provides the primary suction connection point to the FLEX diesel-driven SG makeup pump. The licensee added to the existing drain line a new section of piping and redundant isolation valves that terminate with a 5" STORZ hose connector. The licensee stated that the existing CST valve pit is extended to accommodate the FLEX installed piping and valves, which are located beneath grade, and fitted with a 3-inch carbon steel missile barrier.

In the FIP, Section 4.4 states that the alternate suction source to the FLEX diesel-driven SG makeup pump is composed of new piping and associated manual isolation valves that connects to the existing 8-inch CST/RMWT suction line downstream of the CST and RMWT suction check valves inside the Train B AFW pump compartment. The licensee stated that this permanently installed FLEX suction line runs from the Train B AFW pump compartment through the CST pipe tunnel and terminates with a 5-inch STORZ hose connector at the north wall of the Condensate Transfer Pump House, near the FLEX SG makeup pump staging area.

In the FIP, Section 7.1 states that mechanical FLEX permanent plant modifications were designed to the SSE plus 10 percent for added conservatism. The staff noted that the primary and alternate FLEX pump suction connection points were designed such that at least one connection point should be available during an ELAP event, which is consistent with NEI 12-06, Section 3.2.2.

RCS Inventory Control/Makeup Primary and Alternate RCS Tie-in Connection (FLEX pump discharge)

In the FIP, Section 4.4 states that the discharge from the FLEX RCS makeup pump will be piped to the primary RCS tie-in on the existing 4 inch Train A High Pressure Safety Injection system header, between the outboard containment isolation valve and the containment wall.

The primary RCS tie-in permanent piping is routed from that location through the Auxiliary Building to an external location adjacent to the RWT, where it terminates in a hose connection which will be connected to the FLEX pump discharge. The licensee stated that this flow path was selected to provide a direct injection path to the reactor core and to minimize possible intermittent component failure that may obstruct flow. In the FIP, Section 4.4 states that the alternate RCS connection is tied into the existing 4 inch Train B High Pressure Safety Injection system header and has the same design as the primary discharge connection. The alternate RCS tie-in piping is routed to the ground elevation of the Auxiliary Building east-west corridor, where it terminates in a hose connection. The licensee stated that this internal location was selected as an alternate deployment location due to its ease of access and communication with the yard area through the large roll up doors. The licensee stated that although PVNGS screens out for high wind events per NEI 12-06 this alternate location provides protection for high wind and wind-generated missiles.

In NEI 12-06, Table D-1 states, in part, that the performance attributes for make-up with a portable pump should include primary and alternate injection points to establish capability to inject through separate divisions/trains, i.e., should not have both connections in one division/train. Based on the licensee's description and associated diagrams in the FIP, the NRC staff finds the licensee is consistent with NEI 12-06, Table D-1, as the licensee has the capability of RCS make-up with a portable pump through primary and alternate injection points to inject through separate divisions/trains.

In the FIP, Section 7.1 states that mechanical FLEX permanent plant modifications were designed to the SSE plus 10 percent for added conservatism. The staff noted that the primary and alternate RCS FLEX pump discharge connection points were either designed and/or located in a safety-related structure such that at least one connection point should be available during an ELAP event, which is consistent with NEI 12-06, Section 3.2.2.

Primary and Alternate RCS Suction Piping (FLEX pump suction)

In the FIP, Section 4.4 states that the existing RWT drain line was modified to install the primary suction connection for the RCS FLEX pump using a section of pipe and an isolation valve with a 5-inch STORZ hose connector. This piping extension is located in a FLEX-added valve pit below grade and fitted with a 3-inch carbon steel missile barrier for protection against applicable tornado borne missile hazards. In the FIP, Section 4.4 states that to tie-in to the existing essential charging pump suction piping to establish an alternate suction connection from the RWT for the RCS FLEX pump a section of pipe and valves were installed at the existing hydrostatic test connection flange immediately adjacent to the hydro-connection isolation valve.

The permanently installed FLEX line runs from the hydrostatic test flange in the charging pump compartment to the adjacent hallway at the ground elevation where it terminates with an isolation valve and 5-inch STORZ hose connector. In the FIP, Section 7.1 states that mechanical FLEX permanent plant modifications were designed to the SSE plus 10 percent for added conservatism. The staff noted that the primary and alternate RCS FLEX pump suction connection points were either designed and/or located in a safety-related structure such that at least one connection point should be available during an ELAP event, which is consistent with NEI 12-06, Section 3.2.2.

SFP Inventory Control/Make-up Primary and Alternate SFP Connection (FLEX pump discharge)

In the FIP, Section 5.4 states that the design modification installed redundant headers of 4 inch seismically qualified stainless steel pipe and supports on the inside of the Fuel Building on the ground elevation (100 ft. elevation) to a location on the inside north wall of the Fuel Building, near the middle of the SFP on the 140 ft. elevation. The primary hose connection point is on one of the redundant headers that terminates in a STORZ hose connection at an outdoor location (outside the north wall of the Fuel Building) and an alternate indoor STORZ hose connection point is on the other redundant header located just inside the Fuel Building roll-up door. The licensee stated that flow directing spray nozzles which spray into the SFP are located along the Fuel Building north wall on each of the redundant headers. In the FIP, Section 7.1 states that mechanical FLEX permanent plant modifications were designed to the SSE plus 10 percent for added conservatism. The NRC staff noted that the primary and alternate SFP FLEX pump discharge connection points were designed such that at least one connection point should be available during an ELAP event, which is consistent with NEI 12-06, Section 3.2.2.

The NRC staff noted that NEI 12-06, Table D-3, states, in part, that the baseline capabilities for SFP cooling should include makeup via hoses on the refuel floor and spray capability via portable monitor nozzles from the refueling floor. The licensee's SFP cooling FLEX strategy does not use make-up hoses to the refuel floor and does not use "portable" monitor nozzles for SFP spray; thus, the licensee's strategy is an alternative to NEI 12-06. The licensee stated in the FIP that it has portable monitor nozzles available as part of the B.5.b security order, but the staff notes that they have not been integrated with the FLEX strategy. See Section 3.14 below for a discussion of this alternative to NEI 12-06.

Primary and Alternate SFP Suction Piping (FLEX pump suction)

The licensee stated in its FIP that the portable diesel-driven SFP FLEX pump will take suction from the RWT or the CST. The staff's evaluation of the robustness for these suction connection points are discussed above, and were found to be acceptable.

3.7.3.2 Electrical Connection Points FLEX Primary and Alternate 480 Vac Electrical Connections The PVNGS electrical strategy provides the capability to repower electrical loads during Phase 2 using PDGs. The licensee modified the electrical system to install electrical tie-ins to each unit's train "A" and "B" essential Class 1 E 480 Vac load centers. The licensee chose primary and alternate locations for the PDGs. The primary location connection boxes, located on the south wall of the control building, are protected against all applicable external events. The licensee selected the alternate location for connections, on the east wall of the control building, to provide maximum practical separation and protection against possible high wind events, although the high wind external event is not applicable to PVNGS under the NEI 12-06 criteria.

The external cable connections are color coded and use a standard molded locking connector consistent with NSRC equipment. Manual operator actions are required in the control building at the 100 ft. elevation (ground elevation) to align the portable generators to the breakers in the Class 1 E load centers.

Eight 480 Vac, 800 kW FLEX PDGs, will be stored onsite. Two of the FLEX PDGs will be deployed per unit and staged south of the diesel building. The FLEX PDGs are trailer mounted.

A set of dedicated color-coded cables will be stored with each PDG. The PDG connections and permanently installed plant FLEX connections are color coded to ensure correct phase rotation when placed in service. Each FLEX PDG will be electrically grounded via a flexible cable to a ground test well, which will provide an accessible ground in the staging area. These PDGs, cables, and protection devices are sized to repower key 480 Vac Class 1 E load centers. The load centers are normally isolated from the FLEX connections by use of mechanically locked open breakers. Loads will be energized manually per the licensee's FSG. There are two PDGs that are held in reserve and fulfill the NEI 12-06 guidelines for N+1 equipment.

FLEX electrical connections for the primary and alternate locations for the ac motor driven high pressure RCS injection pump (Modes 1 - 4) (Figure 22 of FIP).

The 480 Vac power for the motor-driven high pressure FLEX RCS pump is provided in two locations for each unit. The primary location is near the RWT (ground elevation, yard area just outside the western wall of the auxiliary building). The alternate location is located between the charging pump compartments and the east penetration wrap on the ground elevation of the auxiliary building east corridor. The licensee added two new redundant FLEX circuits (Train "A" and "B") which are routed from existing spare cubicles in the Class 1 E Motor Control Centers (MCCs). A breaker that the licensee added to support their mitigating strategies provides power to 100 ampere receptacles as a source of power for the FLEX RCS pump. Train isolation is achieved by newly added Class 1 E qualified disconnect switches installed adjacent to the corresponding MCC. Conduit routing and components are designed and installed to SSE plus a 1 O percent margin.

Defense-in-Depth Primary and Alternate 4.16 kV ac Electrical Connections The defense-in-depth option provides ac power to at least one of a unit's two 4.16 kV safety-related buses, which would normally be reenergized by an emergency diesel generator. This would permit the licensee to energize any desired safety-related loads, such as those needed to operate the shutdown cooling mode of the low pressure safety injection system, which can be used to cool the plant from an RCS shutdown entry condition to cold shutdown; in addition it could cool the SFP. This defense-in-depth system is also a backup to the licensee's 480 Vac FLEX strategy. The licensee stated in its FIP that it modified the PVNGS electrical distribution system by installing electrical tie-ins to each unit's Train "A" and "B", Class 1 E 4.16 kV buses that are sized for receiving power from 4.16 kV generators. At the primary location, a 4.16 kV connection box is mounted on the east wall of the diesel building. The licensee stated it is protected against all the applicable external events. That connection box is permanently wired to a manual transfer switch located close to the Train "B" 4.16 kV bus, which can be operated to energize the Train "B" bus. At the alternate location, a 4.16 kV connection box is mounted on the west wall of the diesel building. That connection box is permanently wired to a manual transfer switch located close to the Train "A" 4.16 kV bus, which can be operated to energize the Train "A" bus. The licensee stated that the alternate location would provide maximum practical separation and protection against possible high wind events, although high wind external event is not applicable to PVNGS using the NEI 12-06 criteria. The portable cable connections from the 4.16 kV generators to the connection boxes use standard NEMA connectors. The licensee stated that conduit routing and components, including transfers switches, are designed and installed to SSE plus a 10 percent margin.

3. 7.4 Accessibility and Lighting In its FIP, the licensee stated that the potential impairments to required access are: 1) doors and gates, and 2) site debris blocking personnel or equipment access. The coping strategy to maintain site accessibility through doors and gates is applicable to all phases of the FLEX coping strategies, but is essential as part of the immediate activities required during Phase 1.

These doors and gates are typically administratively controlled to maintain their function as barriers during normal operations. Following a BDBEE and subsequent ELAP event, FLEX coping strategies only require operator walkdowns for damage assessment at PVNGS, no routing of hoses and cables through barriers are required to achieve established FLEX strategies. However, the ability to open doors for ingress, egress, and ventilation is necessary.

In its FIP, the licensee stated that the control room emergency lighting is designed to provide sufficient illumination for the operators to perform the required actions in the event of a loss of essential power. The emergency lighting system has a minimum of 8-hour battery-backed power. The licensee expects the power source for these batteries will realistically provide illumination for a longer duration. This lighting illuminates automatically upon a loss of ac power. The Train "A" essential lighting will be powered by the FLEX 480 Vac, 800 kW generators to provide illumination for critical operator actions. Diesel-driven portable FLEX equipment (pumps and generator) are designed to have self-illumination and will not require an external source. Should emergency lighting fail, the standard equipment for operators includes flashlights and portable lanterns and light stands.

3.7.5 Access to Protected and Vital Areas The licensee has contingencies in place to provide access to areas required for the ELAP response if the normal access control systems are without power.

3.7.6 Fueling of FLEX Equipment In the FIP, Section 10.6 states that all non-electric-driven FLEX equipment, including vehicles and debris-removal equipment and FLEX supporting machines, have engines powered by low-sulfur diesel fuel oil. During Phase 2, safety-related diesel generator fuel oil in the seismically qualified day tanks in each unit's diesel building are used for initial fueling of FLEX diesel-powered makeup pumps and 480 Vac 800 kW generators. In addition, the licensee stated that the FLEX fuel trailers and FLEX diesel-powered pumps and generators will be stored without fuel, but all vehicles and debris-removal equipment will be stored with sufficient fuel to achieve their initial mission and thereby deploy the FLEX pumps and generators. Once the FLEX generators are deployed, they provide the means to fill the fuel trailers from the day tanks and then use the fuel trailers to fuel the FLEX pumps and generators. The licensee's time line (Fl P Table 5) indicates there is sufficient time for this fueling mission, assuming that the TDAFW pump operates successfully.

In the FIP, Section 4.4 states that a modification was performed that provides the capability to gravity drain from the diesel day tank drain line to the 104 ft. elevation within the Diesel Building.

The licensee clarified that this modification provides initial "first fill" of fuel oil for portable equipment needed for Phase 2 and that once the 480 Vac diesel generators are started and aligned with the station electrical system, the essential day tanks will be filled, as needed, from the fuel oil storage tanks by the unit's installed essential fuel oil transfer pumps.

Based on the FIP and UFSAR Table 9.5-8, the NRC staff noted that there are six diesel fuel oil storage tanks and six diesel fuel oil day tanks at the licensee's site with a combined total of approximately 504,600 gallons of fuel available. In the PVNGS UFSAR, Table 3.2-1 indicates that the diesel fuel oil day tanks are Seismic Category I components located in the Diesel Generator Building. Furthermore, the diesel storage tanks and diesel fuel oil transfer pumps are also Seismic Category I components located outside. In the PVNGS UFSAR, Section 9.5.4 indicates that the diesel fuel oil day tanks, diesel fuel oil storage tanks and diesel fuel oil transfer pumps were designed to remain functional during and after a SSE. Thus, the staff noted that it is reasonable the fuel oil contained in these tanks should be available during an ELAP event. In the FIP, Section 10.6 indicated that the NSRC and external state and national resources would provide diesel fuel oil once site inventory is exhausted. The staff noted the licensee has sufficient time to obtain fuel oil from off-site in advance of depleting available on-site fuel oil.

In the FIP, Section 10.6 states that two 500-gallon mounted fuel tanker trailers and two fuel delivery systems using diesel fuel tank trailers and trucks will be used to fuel each unit's FLEX equipment, as needed, per a proceduralized sequence. The NRC staff noted that Appendix H of the licensee's FSG, Procedure No. 791S-9ZZ07, "PVNGS Extended Loss of All AC Guideline, Modes 1-4," includes procedural steps for transferring diesel fuel oil from the fuel oil day tanks.

Furthermore, Procedure 14DP-OBD01, "PVNGS Portable FLEX Equipment Deployment,"

provides details regarding the fueling and refueling of diesel-powered FLEX equipment.

Specifically, Section 4.3 of Procedure 14DP-OBD01 provides details of the licensee's fuel management strategy. In addition, Appendix E of Procedure 14DP-OBD01 identifies Phase 2 portable diesel powered FLEX equipment, the quantity available for each piece of equipment, the fuel consumption rate, and fuel tank capacity. The staff noted that this guidance can provide a reference to operators as to the amount of time a piece of FLEX equipment can be expected to operate per tank of fuel, which assists the licensee to ensure equipment is refueled and does not run out of fuel oil. Based on the guidance provided in these procedures, the staff finds it is reasonable that diesel-powered FLEX equipment will be fueled and refueled to ensure uninterrupted operation to support the licensee's FLEX strategies.

3.7.7 Conclusions As discussed in Section 3.7.3.1 above, the NRC staff concludes that the licensee's SFP capability and connection points does not fully meet the conditions of NEI 12-06, but does meet the requirements of Order EA-12-049. The NRC staff finds that this is an acceptable alternative to NEI 12-06. Based on this evaluation, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain or restore SFP cooling following an ELAP and should adequately address the requirements of the order. In addition, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should allow deploying the FLEX equipment following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.8 Considerations in Using Offsite Resources 3.8.1 Palo Verde SAFER Plan The industry has collectively established the needed off-site capabilities to support FLEX Phase 3 equipment needs via the SAFER Team. SAFER consists of the Pooled Equipment Inventory Company (PEICo) and AREVA Inc. to provide FLEX Phase 3 management and deployment plans through contractual agreements with every commercial nuclear operating company in the United States.

There are two National SAFER Response Centers (NSRCs), located near Memphis, Tennessee and Phoenix, Arizona, established to support nuclear power plants in the event of a BDBEE.

Each NSRC holds five sets of equipment, four of which will be able to be fully deployed to the plant when requested. The fifth set allows removal of equipment from availability to conduct maintenance cycles. In addition, the plant's FLEX equipment hose and cable end fittings are standardized with the equipment supplied from the NSRC.

By letter dated September 26, 2014 [Reference 23], the NRC staff issued its assessment of the NSRCs established in response to Order EA-12-049. In its assessment, the staff concluded that SAFER has procured equipment, implemented appropriate processes to maintain the equipment, and developed plans to deliver the equipment needed to support site responses to BDBEEs, consistent with NEI 12-06 guidance; therefore, the staff concluded in its assessment that licensees can reference the SAFER program and implement their SAFER Response Plans to meet the Phase 3 requirements of Order EA-12-049.

3.8.2 Staging Areas In general, up to four staging areas for NSRC supplied Phase 3 equipment are identified in the SAFER Plans for each reactor site. These are a Primary (Area C) and an Alternate (Area D, if needed) which are offsite areas (within about 25 miles of the plant) utilized for receipt of ground transported or airlifted equipment from the NSRCs. From Staging Areas C and/or D, the SAFER team will transport the Phase 3 equipment to the on-site Staging Area B for interim staging prior to it being transported to the final location in the plant (Staging Area A) for use in Phase 3. For PVNGS, Alternate Staging Area Dis not used. Staging Area C is the Phoenix NSRC. Staging Area B is close to the EESF and near the helicopter pad. There are multiple Staging Area A's for each unit for different safety and support functions.

Use of helicopters to transport equipment from Staging Area C to Staging Area B is recognized as a potential need within the SAFER Response Plan for PVNGS and is provided for in the plan.

3.8.3 Conclusions Based on this evaluation, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should allow utilization of offsite resources following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.9 Habitability and Operations 3.9.1 Equipment Operating Conditions 3.9.1.1 Loss of Ventilation and Cooling Following a BDBEE and subsequent ELAP event, equipment providing heating, ventilation, and air conditioning (HVAC) to occupied areas and areas containing equipment used in the FLEX strategy will be lost. Per the guidance given in NEI 12-06, FLEX strategies must be capable of execution under the adverse conditions expected following a BDBEE resulting in an ELAP with loss of normal access to the ultimate heat sink.

The licensee's Phase 1 core cooling FLEX strategies rely on the TDAFW pump as the motive force for providing water to the SGs. In the FIP, Section 4.3 states that an evaluation was performed to identify key components that may be susceptible to failure because of higher than normal temperatures in the TDAFW pump compartment due to the ELAP. The licensee stated that it concluded that to prevent the temperature rise, a time dependent operator action of opening the access doors or opening the access hatch at the 100 ft. elevation of the MSSS building at about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> post ELAP will add margin to the environmental condition degradation within the TDAFW pump compartment. The NRC staff noted that PVNGS document NM1 OOO-A00001.ROOO, "Palo Verde Turbine Driven AFW Pump Room Heat Up Analysis For An Extended Loss of AC Power," indicates the TDAFW room temperature rises steadily to 120 °F 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> into the ELAP event. This calculation indicates that opening of the access doors or opening the access hatch to the MSSS will stabilize the TDAFW compartment temperatures to below 130 °F for the duration of the ELAP event. In the FIP, Section 4.4 states that a FLEX manway hatch is fitted into the existing equipment hatch area located on the MSSS 100 ft.

elevation floor and was installed to provide backup ventilation capability to the TDAFW compartment during an ELAP event. Additionally, this hatch (and added access ladder) provides a new ingress and egress path, if the existing access door is not functional and/or obstructed. The staff noted that Appendix C of the licensee's FSG, Procedure No. 791S-9ZZ07, "PVNGS Extended Loss of All AC Guideline, Modes 1-4," includes procedural steps to establish at least one ventilation path (opening access doors to the TDAFW compartment or opening the FLEX manway hatch) within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the ELAP declaration to ensure components within the room do not fail from overheating. In its FIP, the licensee stated that a control system Failure Modes Effects Analysis (FMEA) (13-NM1000-A00014, High Temperature FMEA of Palo Verde's Turbine Driven AFW Pump," Revision 0) was performed to identify key components in the control system that may be susceptible to failure as a result of higher than normal TDAFW pump compartment temperature conditions as result of HVAC loss due to an ELAP. The FMEA did not identify any components that were not rated for the maximum temperature of 130 °F whose failure would affect the operation of the TDAFW pump. Thus, the staff concludes that the licensee's strategy should provide adequate ventilation to the TDAFW compartment, such that the mechanical and electrical components in the TDAFW compartment should be available to support an ELAP event.

As noted in Section 3.4 above, the licensee has shown that the containment temperature and pressure will remain below the design qualification of the instruments and electrical equipment located in containment that are relied on for ELAP response for at least 3 days. The NRC staff notes that recovery actions using equipment supplied from an NSRC would allow the licensee to establish containment cooling. The steps for connecting NSRC-supplied 4.16 kV generators are described in the FSG guideline, 791S-9ZZ07, "PVNGS Extended Loss of All AC Guideline Modes 1-4," Appendix U.

The SG ADVs are located in the main steam support structure (MSSS), and are used for heat removal from the RCS, including the planned cooldown. The licensee stated in the FIP that the ADVs can be operated from the main control room (MCR) as long as the nitrogen gas supply lasts (typically a minimum of 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />) or can be operated locally at the ADVs, and that the MSSS will remain habitable during an ELAP. The licensee has a procedure for local manual operation of the ADVs in EOP 40EP-9E010, Appendix 18. If local manual operation is required, it can be accomplished within the licensee's timeline for the FLEX strategy.

Based on the review documented in Section 3.9.2.1 below, the control room temperature should remain below 115 °F during the ELAP event, and previous industry analyses for station blackout, which are documented in NUMARC-87-00, "Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," Rev. 1, indicate that the equipment located in the control room and needed for the ELAP response will remain functional.

The licensee performed temperature analyses for the Engineered Safeguard Feature (ESF) switchgear rooms and the de equipment rooms for the Station Blackout (SBO) condition in calculation 13-MC-HJ-0003, Control Building HVAC System (HJ) Heat Load and Equipment Adequacy Calculation, Revision 9. In that document, the licensee concluded that with a loss of HVAC, the steady state temperature in the ESF switchgear rooms would not exceed 119 °F, which is a Condition 1 area per NUMARC 87-00, with no further evaluation needed. That document also states that the equipment in the de equipment rooms is qualified to 131 °F for up to 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br />. The licensee's analysis indicates that the temperature in the de equipment rooms could exceed this value (potentially reaching 135.5 °F after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />), but the licensee notes that there are conservatisms in the analyses. The licensee concluded that there is adequate assurance that equipment in the de equipment rooms would remain functional following an ELAP. However, the licensee's procedures do not include provisions to monitor temperature and take appropriate corrective actions, so the staff could not reach the same conclusion based on the information provided by the licensee.

The licensee also evaluated the battery rooms in Appendix G to calculation 13-MC-HJ-0003, and concluded there was adequate assurance of equipment functionality during the SBO event.

The staff notes that heat loads in the safety-related battery rooms following an ELAP are minimal, and operator actions to shed loads from the station's safety-related batteries will reduce current draw and heat generated by the batteries. Heat released into the battery room will be slow due to the large mass of electrolyte, and the heat sinks in the rooms minimize the rate of temperature increase. However, the licensee's mitigating strategies rely on the batteries for an extended period (36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />) and operator actions over this time frame could affect room temperature. The licensee's evaluation does not address the expected operator actions.

internal heat loads, or heat transfer from surrounding plant areas. Further, the licensee's procedures do not include actions to monitor temperature and take appropriate corrective action. The NRC staff reviewed Technical Bulletin TB-Battery-002, "GNB Battery Ambient Temperature Effects," by Nuclear Logistics, Inc., which describes testing and analysis of the GNB type batteries used at Palo Verde. This technical bulletin provides information that supports the ability of GNB batteries to function at temperatures as high as 140 °F (higher temperatures were not evaluated). The NRC staff notes that licensees should consider the possibility of an accelerated loss of battery electrolyte when charging lead-acid batteries at high temperatures. However, the licensee did not have an analysis of the potential maximum temperatures in the battery rooms. Therefore, the staff was unable to confirm the licensee's conclusion based on the available analyses and procedures.

The staff notes that in its FIP, in Table 1, the licensee stated that the 480 Vac FLEX generators have additional capacity that can be used to power electrical loads that are not on the essential load list, such as HVAC equipment. In its FIP, the licensee stated that battery compartment exhaust fans would be started before battery charging commenced. The NRC staff notes that recovery actions using equipment supplied from an NSRC may allow the licensee to reenergize HVAC equipment in the plant or take other actions to protect plant equipment from temperature extremes. The steps for connecting NSRC-supplied 4.16 kV generators are described in the FSG guideline, 791S-9ZZ07, "PVNGS Extended Loss of All AC Guideline Modes 1-4,"

Appendix U.

Based on its review of the essential station equipment required to support the FLEX mitigation strategy, the NRC staff concludes that the equipment in the Main Control Room, TDAFW Pump Room, and Containment should perform their required functions at the expected temperatures as a result of loss of ventilation and cooling during an ELAP event. After review of the information provided by the licensee, the staff was not able to confirm this for equipment in the de Equipment Rooms or the safety-related Battery Rooms.

3.9.1.2 Loss of Heating The NRC staff noted that snow, ice and extreme cold events are not applicable to the licensee's site; thus, the effects of cold temperature events on necessary equipment to support FLEX strategies both indoors and outdoors is not applicable. Further discussion regarding the applicability of Snow, Ice, and Extreme Cold events are discussed in SE Section 3.5.4.

3.9.1.3 Hydrogen Gas Control in Vital Battery Rooms In its FIP, the licensee stated that when the 480 Vac PDGs are deployed during Phase 2, and prior to the start of the battery charging cycle, the licensee will start the battery exhaust fans in the battery compartments to eliminate build-up of hydrogen in the area. The NRC staff reviewed the summary of PVNGS Calculation 13-EC-PK-0204, "Hydrogen Generation Calculation for Class 1 E Station Batteries - GNB Model NCN-33." This calculation shows that hydrogen concentration in a battery room will remain below 2 percent at 130 hours0.0015 days <br />0.0361 hours <br />2.149471e-4 weeks <br />4.9465e-5 months <br /> after the start of the charging cycle if no ventilation is provided. This concentration is below the 4 percent explosive limit by volume and provides additional operating margin to take action to restore essential HVAC.

Based on the evaluation above, the NRC staff concludes that hydrogen accumulation in the safety-related battery rooms should not reach the combustibility limit for hydrogen (4 percent) during an ELAP event.

3.9.2 Personnel Habitability 3.9.2.1 Main Control Room In the FIP, Section 2.2 states the control room was modeled by using GOTHIC to predict a 24-hour room temperature assuming the doors were closed during the entire period and that the normal and essential air handling units have failed. Furthermore, FIP Section 13.2 indicates that GOTHIC model of the Control Room Envelope concluded that the room will not exceed 115 °F.

The licensee's habitability evaluation is documented in 13-MS-C045, "Control Room Envelope Transient Temperature After Extended Loss Of AC Power." The NRC staff noted that the licensee's evaluation conservatively assumed that all doors were closed for the entire 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period and the outside ambient temperature remained at 130 °F for the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period. The evaluation concluded that the maximum temperature 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after an ELAP event will be approximately 105 °F, which is less than the 110 °F discussed in NUMARC 87-00 for temperature tolerance for personnel. The staff noted that Appendix I of the licensee's FSG, Procedure No. 791S-9ZZ07, "PVNGS Extended Loss of All AC Guideline, Modes 1-4," includes procedural steps to open doors to the control room and to set up temporary ventilation. These procedural steps are used if habitability becomes an issue. Based on the licensee's guidance for deployment of temporary ventilation, if necessary, and the expected temperature response in the control room, the staff noted that it is reasonable that the control room will remain habitable during an ELAP event.

3.9.2.2 Spent Fuel Pool Area In the FIP, Section 5.1 states that an operator action is conservatively taken to open the large Fuel Building roll-up door to keep the building at atmospheric pressure and temperature prior to SFP boiling, which will occur approximately 11.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the initiating event. In the FIP, Section 13.2 further indicates that although the Fuel Building will be vented, there are no operator actions required within the Fuel Building and that ventilation is only meant to cool the lower elevation of the building should entry be needed.

The NRC staff noted that the sequence of events timeline in FIP Table 5 states that the licensee established a 4-hour time constraint to open the roll up door to the Fuel Building truck bay, such that the door will be opened prior to the earliest predicted spent fuel pool time to boil. In the FIP, Table 5 further indicates that this action provides ventilation and maintains accessibility to the alternate SFP FLEX pump connection point just inside the roll-up door and there is no permanent equipment within the Fuel Building that is used for FLEX. The staff noted that Appendix B of the licensee's FSG, Procedure No. 791S-9ZZ07, "PVNGS Extended Loss of All AC Guidelines," includes procedural steps to open up the Fuel Building roll up door within 3-hours of the ELAP declaration.

The staff noted that the operator action to open the roll-up door is well in advance of SFP boiling, which is discussed in SE Section 3.3; thus, the staff finds the licensee's actions support personnel habitability and access to the alternate pump discharge connection for SFP Cooling/Inventory FLEX strategies.

3.9.2.3 Other Plant Areas In the FIP, Section 4.1 indicates that the Phase 1 core cooling FLEX strategies rely on the TDAFW pump as the motive force for providing water to the SGs, which can be controlled remotely from the control room. The licensee also indicated that the atmospheric dump valves (ADV), which are located in the MSSS, are relied up on for heat removal to support the core cooling FLEX strategies and ADV controls are available in the control room for remote operation for a minimum of 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />. The NRC staff noted that operator access to the TDAFW pump and ADVs may be necessary to reset the TDAFW pump or take manual control of the ADVs once nitrogen backup has been exhausted. The staffs evaluation of the room temperatures for the TDAFW compartment/MSSS is documented in SE Section 3.9.1.1.

During its audit, the licensee stated manual operation of the ADVs is accomplished using Appendix 18, "Local ADV Operation," of procedure 40EP-9E010, "Standard Appendices," which describe the actions required to take local/manual control of the ADVs. The licensee described the operator actions to take local control of the ADV and indicated the time required is less than 15 minutes once the operator is at the ADV location. The staff finds it reasonable that personal habitability is not a concern for manual operation of the ADVs because a ventilation path is established early in the ELAP event for the MSSS, there is extended amount of time for remote operation of the ADVs, and duration required to take local control and operate the ADV is short.

3.9.3 Conclusions The NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, with a strategy to control room temperatures, should maintain or restore equipment and personnel habitability conditions following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.10 Water Sources 3.10.1 Steam Generator Make-Up Phase 1 In the FIP, Section 4.3 states that the CST provides the main source of water for plant cool-down at the initial onset of the ELAP event and into Phase 2. In the PVNGS UFSAR, Section 3.8.4.1. 7 states the CST is a reinforced concrete structure that has a Seismic Category I stainless steel wall and basemat liner with a capacity of 520,000 gallons. The licensee stated in its FIP that the normal volume is 508,000 gallons. In the PVNGS UFSAR, Section 3.5.D indicates that the CST was designed such that the tank will not be perforated by missiles generated by a tornado.

If implemented appropriately and consistent with the FIP, the licensee should have a water source available during the Phase 1 core cooling strategies for SG inventory makeup. In addition, the licensee's strategy should provide sufficient time for operators to deploy and stage Phase 2 FLEX equipment. The licensee's sequence of events timeline, as documented in FIP Table 5, shows that the CST has sufficient water inventory for approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> into the ELAP event.

Phase 2 In the FIP, Section 4.3 states that the RMWT has 445,000 gallons of water available and is a Technical Specification backup source of water to the CST. The licensee indicated that the RMWT is a Seismic Category II flat bottom cylindrical stainless steel tank. The licensee further explained that the seismic capacity of the tank was calculated as a High Confidence of Low Probability of Failure (HCLPF) value and that the HCLPF seismic capacity of the RMWT is 0.36 g, as documented in PVNGS Document NM1000-A00126, "Seismic Margin Assessment:

Evaluation of Seismic Margins of the Reactor Make-up Water," while the Design Basis SSE is 0.25 g (UFSAR Section 3.7). Therefore, the licensee concluded with a high level of confidence that the RMWT will be available after the initiating event. The NRC staff noted that in the improbable event of RMWT failure, procedural direction is included in the FSG for methods of transferring water from the RWT to the CST during FLEX Phase 2 until the water treatment system from the NSRC arrives. Further discussion of the robustness of the RWT is discussed in SE Section 3.10.2. Thus, the staff noted there are clean water tanks that either have the seismic capacity or are seismically qualified that are available to the licensee until water purification equipment arrives from the NSRC during Phase 3.

If implemented appropriately and consistent with the FIP, the licensee should have a reliable water source available during the Phase 2 reactor core cooling strategies for SG inventory makeup. The licensee's sequence of events timeline, as documented in Table 5 of its FIP, shows that a long-term water source is not required until approximately 104 hours0.0012 days <br />0.0289 hours <br />1.719577e-4 weeks <br />3.9572e-5 months <br /> into the ELAP event, if the RWMT is available. In addition, even if the RWMT is not available during the ELAP event the licensee's strategy should provide sufficient time for operators to deploy Phase 3 FLEX equipment.

Phase 3 In the FIP, Section 13.5 states that the strategy for long-term sources of water after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> are provided by two state certified, seismically designed, below ground reservoirs with a minimum 500 million gallon capacity. In the PVNGS UFSAR, Section 2.4.8.2.2 states that this makeup water is stored in two independent pelow-grade impoundments east of the power block area and are approximately 85-acres and 45-acres in surface areas. The NRC staff noted that an earthquake event will not impact the water retained in these reservoirs and they should be available to support FLEX strategies. In the FIP, Section 4.1 indicates that the NSRC will provide a boration skid and water purification equipment. The staff confirmed in Section 7 of the SAFER Response Plan (NM1 OOO-A00124, Rev. 0, "Strategic Alliance for FLEX Emergency Response (SAFER) Plan for Palo Verde Nuclear Generating Station) that a boration skid and water purification equipment will be requested from the NSRC.

If implemented appropriately and consistent with the FIP, the licensee should have an adequate source of water available during the Phase 3 core cooling.

3.10.2 Reactor Coolant System Make-Up Phase 1 The licensee does not require borated water in Phase 1, since RCS inventory makeup is not required until 35.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> as shown in FIP Table 5, Sequence of Events Timeline, Modes 1 - 4.

However, FIP Section 4.1 states that the RCS reactivity and inventory control is achieved initially by discharge of the Safety Injection Tanks (SITs) as a result of RCS depressurization. In the PVNGS UFSAR, Table 3.2-1 indicates that the SITs and associated piping and valves are located in the Containment or Auxiliary Buildings and are Seismic Category I components.

Section 3.2.3.4 above analyzes that control rod insertion alone is sufficient to maintain the core subcritical down to 360 °F in the RCS cold legs.

If implemented appropriately and consistent with the FIP, the licensee's approach should conserve RCS inventory to preclude the necessity for RCS system makeup during Phase 1.

However, the staff finds that the SITs and associated piping and valves are robust and are expected to be available during an ELAP event.

Phase 2 In the FIP, Section 4.1 states that the borated water source for RCS injection is the RWT and is sufficient to last for approximately 10 days. In the PVNGS UFSAR, Section 3.8.4.1.8 states that the RWT is a reinforced concrete structure that has a Seismic Category I stainless steel wall and basemat liner and has a rated capacity of 750,000 gallons. During operational modes 1-4 the normal volume available is approximately 675,000 gallons, with a Technical Specification required volume in Mode 1 of 634,000 gallons. In the PVNGS UFSAR, Section 3.5.D indicates that the refueling water tank was designed such that the tank will not be perforated by missiles generated by a tornado.

If implemented appropriately and consistent with the FIP, the licensee should have a sufficient source of water available during Phase 2 to maintain RCS inventory in order to maintain natural circulation cooling and control reactivity in the core.

Phase 3 In the Fl P, Section 13. 5 states that the strategy for long-term sources of water after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> are provided by two state certified, seismically designed, below ground reservoirs (85-acre and 45-acre station reservoirs) with a minimum 500 million gallon capacity. The staff's evaluation of the robustness for the 85-acre and 45-acre station reservoirs is discussed in SE Section 3.10.1.

If implemented appropriately and consistent with the FIP, the licensee should have a sufficient source of water available during Phase 3 to maintain RCS inventory.

3.10.3 Spent Fuel Pool Make-Up Phase 1 through 3 In the FIP, Section 5.3 states that the refueling water tank (RWT) is the primary source of water to replenish inventory loss and boil off from the SFP during an ELAP at power operation. In the PVNGS UFSAR, Section 3.8.4.1.8 states that the RWT is a reinforced concrete structure that has a Seismic Category I stainless steel wall and basemat liner and has a rated capacity of 750,000 gallons. During operational modes 1-4 the normal volume available is approximately 675,000 gallons, with a Technical Specification required volume in Mode 1 of 634,000 gallons.

In the PVNGS UFSAR, Section 3.5.D indicates that the RWT was designed such that the tank will not be perforated by missiles generated by a tornado.

In the Fl P, Section 13. 5 states that the strategy for long-term sources of water after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> are provided by two state certified, seismically designed, below ground reservoirs with a minimum 500 million gallon capacity. The staff's evaluation of the robustness for the 85-acre and 45-acre station reservoirs is discussed in SE Section 3.10.1.

If implemented appropriately and consistent with the FIP, the licensee should have adequate water sources available during Phases 1, 2, and 3 to maintain water level in the SFP.

3.10.4 Containment Cooling Phase 1 through 3 In the FIP, Section 6.1 states that at 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> into the ELAP the pressure and temperature in the containment is estimated to be less than 20 psia and 200 °F, which is less that the design pressure and temperature of the containment building (See UFSAR Section 1.2.12.1. The design pressure is 60 psig and the design temperature is 300 °F). Thus, the staff noted that in Phases 1, 2 or 3, no external source of water is needed for maintaining containment pressure or temperature below the design limits for an extended period of time until off-site resources arrive.

3.10.5 Conclusions Based on the evaluation above, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain satisfactory water sources following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.11 Shutdown and Refueling Analyses Order EA-12-049 requires that licensees must be capable of implementing the mitigation strategies in all modes. In general, the discussion above focuses on an ELAP occurring during power operations. This is appropriate, as plants typically operate at power for 90 percent or more of the year. When the ELAP occurs with the plant at power, the mitigation strategy initially focuses on the use of the steam-driven TDAFW pump to provide the water initially needed for decay heat removal. If the plant has been shut down and all or most of the fuel has been removed from the reactor pressure vessel (RPV) and placed in the SFP, there may be a shorter timeline to implement the makeup of water to the SFP. However, this is balanced by the fact that if immediate cooling is not required for the fuel in the RPV, the operators can concentrate on providing makeup to the SFP. The licensee's analysis shows that following a full core offload to the SFP, about 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> are available to implement makeup before boil-off results in the water level in the SFP dropping to 10 ft. above the fuel assemblies, which results in higher radiation levels on the SFP operating floor. The licensee stated in its FIP that the FSG directs operators to deploy the FLEX SFP makeup pump and initiate makeup to the SFP prior to the level dropping to 1 O ft. above the active fuel.

When a plant is in a shutdown mode in which steam is not available to operate the TDAFW pump and allow operators to release steam from the SGs (which typically occurs when the RCS has been cooled below about 300 °F), another strategy must be used for decay heat removal if there is fuel in the RPV. On September 18, 2013, NEI submitted to the NRC a position paper entitled "Shutdown/Refueling Modes" [Reference 36], which described methods to ensure plant safety in those shutdown modes. By letter dated September 30, 2013 [Reference 37], the NRC staff endorsed this position paper as a means of meeting the requirements of the order.

The position paper provides guidance to licensees for reducing shutdown risk by incorporating FLEX equipment in the shutdown risk process and procedures. Considerations in the shutdown risk assessment process include maintaining necessary FLEX equipment readily available and potentially pre-deploying or pre-staging equipment to support maintaining or restoring key safety functions in the event of a loss of shutdown cooling. The NRC staff concludes that the position paper provides an acceptable approach for demonstrating that the licensees are capable of implementing mitigating strategies in shutdown and refueling modes of operation. In its FIP, the licensee stated that it has incorporated the guidance in the NEI position paper into the shutdown risk processes and procedures.

Based on the licensee's incorporation of the guidance from the NRC-endorsed position paper into its plant programs. the NRC staff concludes that the licensee has developed guidance that.

if implemented appropriately, should maintain or restore core cooling, SFP cooling, and containment following a BDBEE in shutdown and refueling modes consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.12 Procedures and Training With regard to procedures, in its FIP the licensee stated that the inability to predict actual plant conditions that require the use of FLEX equipment makes it impossible to provide specific procedural guidance. However, the licensee has developed FLEX support guidelines (FSGs) that provide guidance that can be employed for a variety of conditions.

The FSGs were developed in accordance with plant specific analysis and industry guidance.

FSG 791S-9ZZ07, "PVNGS Extended Loss of All Site AC Guideline, Modes 1-4." and FSG 791S-9ZZ08, "PVNGS Extended Loss of All Site AC Guideline, Modes 5, 6, and Defueled," will be used to supplement (not replace) the existing procedure structure that establishes command and control for the event. Procedural interfaces have been incorporated into existing procedures such as the station blackout procedures to the extent necessary to include appropriate reference to the FSGs and provide command and control for the BDBEE ELAP.

The licensee stated in its FIP that FSG updates will be performed as necessary and administrative processes are used to evaluate changes to procedures. The FSGs are reviewed and validated by the site stakeholders to the extent possible and practical to ensure the strategies are implementable. Validation is accomplished by use of desktop discussion, simulator practices, walkthroughs, hands-on simulation of implementation, and drills.

In its FIP, the licensee stated that the PVNGS Nuclear Training Program is updated to include training on the mitigation of BDBEEs. These programs and controls are developed and have been implemented in accordance with the Systematic Approach to Training (SAT) process.

The licensee stated that initial training has been provided and periodic training will be provided to site emergency response leaders on FLEX emergency response strategies and implementing guidelines. Personnel assigned to direct the execution of mitigation strategies for BDBEEs have received the necessary training to ensure familiarity with the associated tasks, considering available job aids, instructions, and mitigating strategy time constraints. Care has been taken to not give undue weight (in comparison with other training requirements) for operator training for FLEX external event accident mitigation. The testing and evaluation of operator knowledge and skills in this area have been similarly weighted.

Where appropriate, integrated FLEX drills will be organized on a team or crew basis and conducted periodically, with time-sensitive actions to be evaluated over a period of not more than eight years. It is not required to connect/operate permanently installed equipment during these drills.

The NRC staff finds that the licensee has adequately addressed the procedures and training associated with FLEX. The procedures have been issued in accordance with NEI 12-06, Section 11.4, and a training program has been established in accordance with NEI 12-06, Section 11.6.

3.13 Maintenance and Testing of FLEX Equipment As a generic issue, NEI submitted a letter to the NRC dated October 3, 2013 [Reference 38),

which included Electric Power Research Institute (EPRI) Technical Report 3002000623, "Nuclear Maintenance Applications Center: Preventive Maintenance Basis for FLEX Equipment." By letter dated October 7, 2013 [Reference 39], the NRC endorsed the use of the EPRI report and the EPRI database as providing a useful input for licensees to use in developing their maintenance and testing programs. In its FIP, the licensee stated that it would use the EPRI Technical Report to issue preventative maintenance tasks for major FLEX equipment including the portable diesel-driven and electric motor-driven pumps and generators, including periodic functional verifications with performance tests.

Based on the above, the NRC staff finds that the licensee has adequately addressed equipment maintenance and testing activities associated with FLEX equipment because a maintenance and testing program has been established and will be maintained in accordance with NEI 12-06, Section 11.5.

3.14 Alternatives to NEI 12-06, Revision O 3.14.1 SFP Cooling Strategies In NEI 12-06, Table 3-2 and Table D-3 summarize an acceptable approach consisting of three separate capabilities for the SFP cooling strategies. This approach uses a portable injection source to provide the capability for 1) makeup via hoses on the refueling floor capable of exceeding the boil-off rate for the design basis heat load; 2) makeup via connection to spent fuel pool cooling piping or other alternate location capable of exceeding the boil-off rate for the design basis heat load; and 3) spray via portable nozzles from the refueling floor using a portable pump capable of providing a minimum of 200 gallons per minute (gpm) per unit (250 gpm if overspray occurs). During the event, the licensee selects the method to use based on plant conditions. This approach also requires a strategy to mitigate the effects of steam from the SFP, such as venting.

The licensee's SFP cooling FLEX strategy does not use make-up hoses to the refuel floor, or makeup via connection to SFP piping, or "portable" nozzles for SFP spray; thus, the licensee's strategy is an alternative to NEI 12-06. The licensee stated in its FIP that it has portable monitor nozzles available as part of the B.5.b security order, but the NRC staff notes that they have not been integrated with the FLEX strategy.

However, the NRC staff noted that the licensee's strategy involves:

Two redundant seismically qualified spray headers that provide SFP make-up and spray.

Each header has sufficient capacity to provide SFP make-up in excess of the boil-off rate and SFP spray of 200 gpm per unit to the pool, consistent with NEI 12-06.

The FLEX pump discharge connection points to these redundant headers are robust and separated to such an extent that the staff concluded that at least one connection should be available during an ELAP event.

The NRC staff finds that the licensee has a strategy to maintain or restore SFP cooling which will prevent damage to the fuel following a BDBEE, which meets the requirement of the EA 049 order. Therefore, the staff finds that the licensee's lack of make-up hoses to the refuel floor, the lack of a makeup connection to SFP piping, and the lack of "portable" nozzles for SFP spray is an acceptable alternative to NEI 12-06, as the licensee has demonstrated compliance with the order, and the staff concludes that the licensee could implement SFP make-up and spray flow.

In conclusion, the NRC staff finds that although the guidance of NEI 12-06 has not been met, if this alternative is implemented as described by the licensee, it will meet the requirements of the order.

3.15 Conclusions for Order EA-12-049 Based on the evaluations above, the NRC staff concludes that the licensee has developed guidance to maintain or restore core cooling, SFP cooling, and containment following a BDBEE which, if implemented appropriately, should adequately address the requirements of Order EA-12-049.

4.0 TECHNICAL EVALUATION

OF ORDER EA-12-051 By letter dated February 28, 2013 [Reference 24], the licensee submitted its OIP for PVNGS in response to Order EA-12-051. By letter dated June 10, 2013 [Reference 25] the NRC staff sent a Request for Additional Information (RAI) to the licensee. The licensee provided a response by letter dated July 11, 2013 [Reference 26]. By letter dated October 29, 2013 [Reference 27], the NRC staff issued an Interim Staff Evaluation (ISE) and RAI to the licensee. The licensee provided a response by letter dated February 28, 2014 [RefereAce 29]. By letter dated September 8, 2014 [Reference 17]. the NRC issued an audit report on the licensee's progress.

By letters dated August 28, 2013 [Reference 28], February 28, 2014 [Reference 29], August 28, 2014 [Reference 30], February 27, 2015 [Reference 31], and August 14, 2015 [Reference 32],

the licensee submitted status reports for the Integrated Plan. The Integrated Plan describes the strategies and guidance to be implemented by the licensee for the installation of reliable SFP level instrumentation, which will function following a BDBEE, including modifications necessary to support this implementation, pursuant to Order EA-12-051. By letter dated December 17, 2015 [Reference 45], the licensee reported that full compliance with the requirements of Order EA-12-051 was achieved.

The licensee installed a SFP level instrumentation system designed by Westinghouse. The NRC staff reviewed the vendor's SFP level instrumentation system design specifications, calculations and analyses, test plans, and test reports. The staff issued an audit report on August 18, 2014 [Reference 33].

The staff performed an onsite audit to review the implementation of SFP level instrumentation related to Order EA-12-051. The scope of the audit included verification of (a) site's seismic and environmental conditions enveloped by the equipment qualifications, (b) equipment installation met the requirements and vendor's recommendations, and (c) program features met the requirements. By letter dated September 8, 2014 [Reference 17], the NRC issued an audit report on the licensee's progress. Refer to section 2.2 above for the regulatory background for this section.

4.1 Levels of Required Monitoring of Order EA-12-051 states in part:

All licensees identified in Attachment 1 to this Order shall have a reliable indication of the water level in associated spent fuel storage pools capable of supporting identification of the following pool water level conditions by trained personnel: ( 1) level that is adequate to support operation of the normal fuel pool cooling system [Level 1 ], (2) level that is adequate to provide substantial radiation shielding for a person standing on the SFP operating deck [Level 2),

and (3) level where fuel remains covered and actions to implement make-up water addition should no longer be deferred [Level 3).

In its OIP, the licensee identified the levels of required monitoring for SFP levels. The licensee stated that for Level 1, 23 feet (ft.)-4.5 inches (in.) above the top of the fuel storage racks corresponds to an indicated instrument level of 137 ft.-6 in. (the instrument level indication is based on plant elevation) and this level represents the higher of that required for suction loss or net positive suction head (NPSH), as defined in NEI 12-02, with margin added.

In its OIP, the licensee stated that the SFP water level adequate to provide substantial radiation shielding for a person standing on the SFP operating deck is at plant elevation 124 ft. -2 in. This elevation corresponds to a SFP water surface level which is 10 ft. above the highest point of the SFP fuel rack and will ensure the dose rate at the surface of the pool does not exceed 2.5 mRem/hr.

In its OIP, the licensee stated that the plant elevation that corresponds to the highest point of the fuel rack is 114 ft.-2 in. The licensee designated Level 3 as 115 ft.-2 in. plant elevation. At this level the fuel remains covered and actions to implement make-up water addition will no longer be deferred.

By letter dated July 11, 2013 [Reference 26), the licensee also submitted a visual presentation of SFP water levels (Figure 1 in the letter). The figure marked the SFP operating floor elevation, the elevation for the three levels and the elevation for the top of the fuel racks. The elevations identified in Figure 1 are consistent with the licensee's response.

Based on the evaluation above, the NRC staff finds that the licensee's proposed Levels 1, 2 and 3 are consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2 Evaluation of Design Features Order EA-12-051 required that the SFP instrumentation (SFPI) shall include specific design features, including specifications on the instruments, arrangement, mounting, qualification, independence, power supplies, accuracy, testing, and display. Refer to Section 2.2 above for the requirements of the order in regards to the design features. Below is the staffs assessment of the design features of the SFP level instrumentation.

4.2.1 Design Features: Instruments In its OIP, the licensee stated that the SFPI will utilize fixed primary and backup guided wave radar sensors. The licensee also stated that each instrument channel will provide continuous level indication over a minimum range of 22 ft.-4.5 in., from 12 in. above the top of the fuel storage racks (Level 3) to above the low level alarm elevation (plant elevation 137 ft.-6 in.)

In its letter dated July 11, 2013, the licensee provided a sketch depicting the elevations identified as Levels 1, 2 and 3 and the minimum sensor range consistent with the licensee's response.

Based on the evaluation above, the NRC staff finds that the licensee's design, with respect to the number of channels and measurement range for its SFP, appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.2 Design Features: Arrangement In its response dated April 29, 2016 [Reference 50], the licensee stated that the primary instrument channel sensor is mounted in the northeast corner of the SFP on the east wall and the backup instrument channel sensor is mounted in the southeast corner of the SFP on the south wall. The licensee also provided a diagram, Figure 2, "Routing of Sensors Cables from Sensor Location to Display Locations" showing the routing of the cables from the SFPs, outside to the Auxiliary Building and into the Main Control Room (MCR). The licensee further explained that the Fuel and Auxiliary buildings are Seismic Category I, reinforced concrete structures and that equipment in the existing vicinity of the routing conduits are mounted to Seismic Category I or IX requirements (2/1 protection).

During the onsite audit, the NRC staff walked down the location of the SFPI sensors in the SFP, and the locations of the routing in the Auxiliary building and of the readouts and the batteries in the MCR. The staff noted that there is sufficient channel separation between the primary and back-up level instruments, sensor electronics, and routing cables to provide reasonable protection against loss of indication of SFP level due to missiles that may result from damage to the structure over the SFP.

Based on the discussion above, the NRC staff finds that, if implemented appropriately, the licensee's proposed arrangement for the SFP level instrumentation appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.3 Design Features: Mounting In its letter dated April 29, 2016 [Reference 50], the licensee stated that the mounting bracket for the sensing probe was designed according to the plant design basis for the Safe Shutdown Earthquake (SSE) and Operating Basis Earthquake Ground Motion (QBE) at the appropriate plant elevation. The licensee also stated that in order to ensure adequate design margin for the SSE and OBE events, the seismic inputs were increased by 10 percent. The licensee considered the following loads:

1-Static loads including the dead weight of the mounting bracket in addition to the weight of the level sensing instruments, pipe guard and cabling; 2-Dynamic loads including the seismic load due to excitation of the dead weight of the system in addition to the hydrodynamic effects resulting from the excitation of the spent fuel pool water.

Additionally, a response spectra analysis was performed for the seismic evaluation of the mounting bracket using the structural analysis and design software, GTSTRUDL and hydrodynamic effects on the mounting bracket were evaluated using NRC's TID-7024, "Nuclear Reactors and Earthquakes" and added to the GTSTRUDL.

In its letter dated July 11, 2013, the licensee also provided Figure 4, "Top View Base Plate Design" and Figure 5, "SFPIS Mounting Details" and explained that the bracket will be attached to the pool deck using installed anchors that will designed according to the existing plant specification for design of concrete anchors. The pedestal will be adjusted to the height of the poolside curb to ensure the SFP bracket extends over the pool horizontally. The results for the loads and load combinations used in licensee's analysis and the welded and bolted connections were evaluated and shown to be adequate.

Based on the discussion above, the NRC staff finds that the licensee's proposed mounting design appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-201 2-03, and should adequately address the requirements of the order.

4.2.4 Design Features: Qualification 4.2.4.1 Augmented Quality Process Appendix A-1 of the guidance in NEI 12 02 describes a quality assurance process for non-safety systems and equipment that is not already covered by existing quality assurance requirements.

Per JLD-ISG-2012-03, the NRC staff found the use of this quality assurance process to be an acceptable means of meeting the augmented quality requirements of Order EA 12 051.

By letter dated July 11, 2013, the licensee stated that the quality assurance measures will be selected consistent with Appendix A-1, "Quality Assurance" of NEI 12-02.

Based on the discussion above, the NRC staff finds that, if implemented appropriately, this approach appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.4.2 Instrument Channel Reliability NEI 12-02 states:

The instrument channel reliability shall be demonstrated via an appropriate combination of design, analyses, operating experience, and/or testing of channel components for the following sets of parameters, as described in the paragraphs below:

conditions in the area of instrument channel component use for all instrument components, effects of shock and vibration on instrument channel components used during any applicable event for only installed components, and seismic effects on instrument channel components used during and following a potential seismic event for only installed components.

Equipment reliability performance testing was performed to (1) demonstrate that the SFP instrumentation will not experience failures during beyond-design-basis (BOB) conditions of temperature, humidity, emissions, surge, and radiation, and (2) to verify those tests envelope the plant-specific requirements.

During the NRC audit of the Westinghouse design, the NRC staff reviewed vendor documents associated with testing conducted to demonstrate equipment reliability under BOB conditions.

The staff reviewed the test results related to environmental qualification for the coaxial cable, probe, coupler, and pool-side bracket located inside the SFP area, and outside where the level sensor electronics, sensor electronics bracket, indicators, and the electronics enclosure will be located. The staff included a summary of the SFPI environmental qualification and reliability design documents reviewed in the audit report dated August 18, 2014 [Reference 33].

The Westinghouse SFPI sensor consists of a stainless steel braided cable probe attached to a permanently installed mounting bracket anchored to the SFP deck. The probe will not be subject to shock and vibration loading conditions other than those induced by seismic motions. Seismic testing and analysis was conducted by Westinghouse, LLC. The test strategy included seismic response spectra that envelope the design basis maximum seismic loads and included applicable hydrodynamic loading that could result from conditions such as seismic-induced sloshing effects. In accordance with Westinghouse document WNA-PT-00188-GEN, the seismic adequacy of the SFPI equipment was demonstrated following the applicable guidance in Sections 7, 8, 9 and 10 of IEEE Standard 344-2001, "IEEE Recommended Practice for Seismic Qualification of Class 1 E Equipment for Nuclear Power Generating Stations". At PVNGS the active electronics components of the SFPI are firmly mounted inside NEMA-4X enclosures which are seismically qualified. These housings will be mounted to a seismically qualified wall and will not be subject to additional shock and vibration forces outside of those for seismic.

In its letter dated July 11, 2013, the licensee stated that SFPI materials and components were selected and specified by design to meet or exceed the temperature and humidity in the SFP building and other buildings during an ELAP event for the locations of sensor and system electronics. In its response dated April 29, 2016 [Reference 50], the licensee also provided a summary of the radiological and environmental conditions for the SFPI components in the SFP area and outside the SFP area. The NRC staff noted that these conditions at the site are enveloped by the design parameters of the Westinghouse SFPI.

The licensee also addressed the potential for Electromagnetic Interference (EMl)/Radio-Frequency Interference (RFI). In its response dated April 29, 2016 [Reference 50), the licensee provided the following actions to minimize the EMI interference:

1. Caution signs are posted at each location where the SFPI electronic components are mounted (the Auxiliary Building 140 ft. elevation) and the primary and backup readout module location in the MCR and the Auxiliary Building, respectively. These signs indicate the safe distance that walkie-talkies can be used.

2. Operators are briefed in general training on the susceptibility of the SFPI to EMI.

3. Design Verification Testing was performed after installation in one PVNGS unit within the Fuel Building to assess the potential for EMI impacts on essential equipment operation, such as the probe, bare guide wave cable and connectors. No EMI interference was encountered.

Based on the evaluation above, the NRC staff finds that the licensee's proposed instrument qualification process appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.5 Design Features: Independence In its letter dated July 11, 2013, the licensee stated that within the SFP area, the brackets will be mounted as close to the northeast (primary sensor) and southeast (back-up sensor) corners of the SFP as the permanent plant structures allow. By placing the brackets and probes in the corners the licensee uses the positioning as natural protection from a single event or missile disabling both channels. The licensee also stated that each channel will be installed using completely independent cabling structures, including routing of the interconnecting cable within the SFP area in separate hard-pipe conduits.

Power sources will also be routed to the electronics enclosures from electrically separated sources ensuring the loss of one train or bus will not disable both channels. In its response dated April 29, 2016 [Reference 50], the licensee stated that the primary electrical power sources for the SFPI primary and backup channels during normal operation are from two separate Class 1 E 120 Vac power panels. Both of these power panels are fed by independent Class 1 E inverters and the power supplies to the inverters are from independent Class 1 E station batteries, and their respective primary or backup chargers. In case of an extended loss of all ac power, the primary and backup instruments are powered from their respective uninterruptible power supply (UPS) for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

During the onsite audit, the NRC staff walked down the location of the SFPI sensors in the SFP, and the locations of the routing in the Auxiliary Building and of the readouts and the batteries in the MCR. The staff noted that there is sufficient channel separation between the primary and back-up level instruments, sensor electronics, and routing cables.

Based on the evaluation above, the NRC staff finds that the licensee's proposed design, with respect to instrument channel independence, appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.6 Design Features: Power Supplies In its response dated April 29, 2016 [Reference 50), the licensee stated that the primary electrical power sources for the SFPI primary and backup channels during normal operation are from two separate Class 1 E 120 Vac power panels, xEPNCD2726 (x=1, 2, or 3, to show the Unit number) and xEPNDD2826. In the event of a loss of power due to a train outage, a break-before-make transfer switch is available to switch the equipment to an alternate electrical power source. Both of these power panels are fed by independent Class 1 E inverters and the power supplies to the inverters are from independent Class 1 E station batteries, and their respective primary or backup chargers. In case of an extended loss of all ac power, the primary and backup instruments are powered from their respective uninterruptible power supply (UPS) that can last at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, allowing time for the restoration of 120 Vac.

During the vendor audit the NRC staff reviewed Westinghouse document WNA-CN-00300-GEN, Rev. 0, "Spent Fuel Pool Instrumentation System Power Consumption Calculation," and the results that demonstrated that the battery will maintain the level indication function without ac power for 101.21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> (approximately 4 days). This UPS capacity is sufficient to maintain the SFPI indication function for the stated 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> requirement in NEI 12-02. The staff documented the results for the vendor audit in the audit report dated August 18, 2014 [Reference 33].

NEI 12-02 specifies that electrical power for each channel be provided by different sources and that all channels have the capability of being connected to a source of power independent of the normal plant power systems. The NRC staff reviewed the power supply configuration and noted that upon a loss of normal power, the UPS arrangement would provide power for level indication, separate for each channel, until such time as the power is restored by portable generators provided for Order EA-12-049.

Based on the discussion above, the NRC staff finds that the licensee's proposed power supply design appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2. 7 Design Features: Accuracy Westinghouse performed the analysis to evaluate the accuracy of the SFPI. During the vendor audit the NRC staff reviewed documents, WNA-CN-00301-GEN, Rev. 0, "Spent Fuel Pool Instrumentation System Channel Accuracy Analysis," which provides the SFPI channel accuracy analysis and WNA-DS-02957-GEN, Rev. 2, "Spent Fuel Pool Instrumentation System Design Specification," which provides the required display accuracy of the level indication as within +/- 3 in. throughout the entire range. Test results in Westinghouse document EQ-QR-269, "Westinghouse Design Verification Testing Summary Report", demonstrated that the channels retained the design accuracy at the completion of each test including loss of power and subsequent restoration of power. The staff included a summary of the SFPI accuracy evaluation and documents reviewed in the audit report dated August 18, 2014.

The sensor electronics unit has electronic verification/calibration capabilities to check for correct signal output and verify correct level instrument loop operation. The electronic output verification/calibration will verify electronics are working properly using simulated probe signals.

The calibration adjustment is performed to restore level measurement accuracy within the acceptance criteria at 0 percent, 25 percent, 50 percent, 75 percent and 100 percent points of the full span.

Based on the discussion above, the NRC staff finds that the licensee's proposed instrument accuracy appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.8 Design Features: Testing In its response dated April 29, 2016 [Reference 50], the licensee explained that if the verification/calibration indicates that the instrument loop is operating out of specifications or an anomaly is observed, then a full range calibration adjustment is performed using a calibration test kit. The test consists of a replicated probe, coupler, launch plate, simulated pool liner, coax signal cable, and a movable target plate (to simulate water level). This full range calibration can be performed inside or outside the SFP area.

The licensee also stated that inspection and verification of system operation will be addressed in the nightly Control Room surveillances. The surveillance procedures included a nightly check of the system including comparison with existing level systems and guidance for required action(s) should a channel be found non-functional. Additionally, the area operators' logs will include a nightly check of the indicators located in the Auxiliary Building to verify proper operation and notification to the Control Room if the system is not functioning as expected.

The NRC staff found that the SFP level instrumentation is adequately designed to provide the capability for routine testing and calibration. By comparing the levels in the instrument channels and the maximum allowed level deviation for the instrument channel design accuracy, the operators could determine if recalibration or troubleshooting is needed. The NRC staff finds that the licensee's proposed SFP instrumentation design allows for testing consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.9 Design Features: Display In its OIP, the licensee stated that the primary system indicator will be located in the MCR and the backup system indicator will be located in an accessible location. In its response dated April 29, 2016 [Reference 50], the licensee indicated that the display location on the 140 ft. elevation of the Auxiliary Building is near the emergency plan Operations Support Center and the normal Radiological Controlled Area access point and that the environmental conditions in this area are similar to those in the MCR. The licensee further explained that the environmental conditions on the pathway to the alternate display location would be acceptable for personnel transit. The path is through seismically qualified buildings and adequate radiological shielding would be available along the expected travel path. The licensee also stated that based on a plant walk-through, the time to access the alternate display was less than five minutes. An alternate safe path has also been identified from the MCR to the alternate display location, in case the normal path becomes inaccessible.

Based on the discussion above, the NRC staff finds that the licensee's proposed location and design of the SFP instrumentation displays appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.3 Evaluation of Programmatic Controls Order EA-12-051 specified that the SFP instrumentation shall be maintained available and reliable through appropriate development and implementation programmatic controls, including training, procedures, and testing and calibration. Below is the NRG staff's assessment of the programmatic controls for the SFP instrumentation.

4.3.1 Programmatic Controls: Training Guidance document NEI 12-02 specifically addresses the use of the Systematic Approach to Training (SAT) for training personnel in the use and the provision of alternate power to the primary and backup SFP instrument channels. In its OIP, the licensee indicated that the SAT will be used to identify the population to be trained and to determine both the initial and continuing elements of the required training. The licensee also stated that training will be completed prior to placing the instrumentation in service.

Based on the discussion above, the NRC staff finds that the licensee's proposed plan to train personnel in the operation, maintenance, calibration, and surveillance of the SFP level instrumentation, including the approach to identify the population to be trained appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.3.2 Programmatic Controls: Procedures In its response dated April 29, 2016 [Reference 50], the licensee stated that normal operation of the SFPI will be addressed in procedure 400P-9PC06, "Spent Fuel Pool Operations." This procedure will include guidance for placing the level monitoring system in service and removing it from service. Abnormal operations will be addressed in Procedure 40A0-9ZZ22, "Loss of SFP Level or Cooling." Calibration and testing will be addressed in Procedure 36ST-9FH01 for Channel A and 36ST-9FH02 for Channel B. As mentioned above, the inspection and verification of system operation will be addressed in the nightly Control Room surveillances.

The licensee also indicated that it will use Westinghouse document WNA-G0-00127-GEN, "Spent Fuel Pool Instrumentation System Technical Manual", which contains instructions for installation, normal operation, abnormal response/troubleshooting, cleaning, calibration, maintenance, spare parts and special tools for the SPFI, as well as major components of the system to develop the above listed procedures as well as any additional procedure, as needed.

Based on the discussion above, the NRG staff finds that the licensee's procedure development appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.3.3 Programmatic Controls: Testing and Calibration In its letter dated July 11, 2013, the licensee stated that it will follow the NEI 12-02, Section 4.3, guidance with regard to the time periods when one or more channels may be out of service.

The licensee also stated that it will implement measures to minimize the possibility of either the primary or backup channel being out of service for any extended period by having sufficient spare components and materials onsite to enable timely repair or replacement of defective components. The licensee also stated that if a channel is non-functional, a corrective action document will be initiated and actions taken to correct the deficiency within 90 days as described in NEI 12-02.

In its response dated April 29, 2016 [Reference 50], the licensee further explained that site specific procedures define the periodicity for operator rounds to compare the primary and backup instrument channel indication to existing SFP level instrumentation to determine if more immediate action is required for calibration, maintenance or compensatory action implementation. As per the guidance in NEI 12-02, the periodic testing recommended to validate the functionality of the installed instrument channel will be performed within 60 days of a planned refueling outage with a normal allowance of 25 percent, but not more than once per 18 month period.

Based on the evaluation above, the NRC staff finds that the licensee's proposed testing and calibration plan appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.4 Conclusions for Order EA-12-051 In its letter dated December 17, 2015 [Reference 45], the licensee stated that it had met the requirements of Order EA-12-051 by following the guidelines of NEI 12-02, as endorsed by JLD-ISG-2012-03. In the evaluation above, the NRC staff finds that, if implemented appropriately, the licensee has conformed to the guidance in NEI 12-02, as endorsed by JLD-ISG-2012-03. In addition, the NRC staff concludes that if the SFP level instrumentation is installed at Palo Verde according to the licensee's proposed design, it should adequately address the requirements of Order EA-12-051.

5.0 CONCLUSION

In August 2013 the NRC staff started audits of the licensee's progress on Orders EA-12-049 and EA-12-051. The staff conducted an onsite audit in April 2014 (Reference 17]. The licensee reached its final compliance date for Orders EA-12-049 and EA-12-051 on November 15, 2015, and has declared that all three reactors are in compliance with the orders. The purpose of this safety evaluation is to document the strategies and implementation features that the licensee has committed to. Based on the evaluations above, the NRC staff concludes that the licensee has developed guidance and proposed designs that if implemented appropriately should adequately address the requirements of Orders EA-12-049 and EA-12-051. The NRC staff will conduct an onsite inspection to verify that the licensee has implemented the strategies and equipment to demonstrate compliance with the orders.

6.0 REFERENCES

1.

SECY-11-0093, "Recommendations for Enhancing Reactor Safety in the 21 51 Century, the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident,

July 12, 2011 (ADAMS Accession No. ML11186A950)

2.

SECY-12-0025, "Proposed Orders and Requests for Information in Response to Lessons Learned from Japan's March 11, 2011, Great Tohoku Earthquake and Tsunami," February 17, 2012 (ADAMS Accession No. ML12039A103)

3.

SRM-SECY-12-0025, "Staff Requirements - SECY-12-0025 - Proposed Orders and Requests for Information in Response to Lessons Learned from Japan's March 11,

2011, Great Tohoku Earthquake and Tsunami," March 9, 2012 (ADAMS Accession No. ML120690347)

4.

Order EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events," March 12, 2012 (ADAMS Accession No. ML12054A736)

5.

Order EA-12-051, "Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Instrumentation," March 12, 2012 (ADAMS Accession No. ML12054A679)

6.

Nuclear Energy Institute document NEI 12-06, "Diverse and Flexible Coping Strategies (FLEX) Implementation Guide," Revision 0, August 21, 2012 (ADAMS Accession No. ML12242A378)

7.

JLD-ISG-2012-01, "Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events," August 29, 2012 (ADAMS Accession No. ML12229A174)

8.

Nuclear Energy Institute document NEI 12-02, "Industry Guidance for Compliance with NRC Order EA-12-051, To Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation," Revision 1, August 24, 2012 (ADAMS Accession No. ML12240A307)

9.

JLD-ISG-2012-03, "Compliance with Order EA-12-051, Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Instrumentation," August 29, 2012 (ADAMS Accession No. ML12221A339)

10.

APS Letter 102-06670, Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3, "APS Overall Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049)," February 28, 2013 (ADAMS Accession No. ML130700342) 11.

APS Letter 102-06758, PVNGS, Units 1, 2, and 3, "APS First 6-Month Status Report on the PVNGS Overall Integrated Plan for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049)," August 28, 2013 (ADAMS Accession No. ML13246A007)

12.

APS Letter 102-06840, PVNGS, Units 1, 2, and 3, "Palo Verde, Units 1, 2, and 3, Second 6-Month Status Report on the PVNGS Overall Integrated Plan for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049),"

February 28, 2014 (ADAMS Accession No. ML14066A036)

13.

APS Letter 102-06932, PVNGS, Units 1, 2, and 3, "Palo Verde Third 6-Month Status Report on the PVNGS Overall Integrated Plan for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049)," August 28, 2014 (ADAMS Accession No. ML14246A211)

14.

APS Letter 102-07005, PVNGS, Units 1, 2, and 3, "Palo Verde, Units 1, 2, and 2, APS Fourth 6-Month Status Report on the PVNGS Overall Integrated Plan for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049),"

February 27, 2015 (ADAMS Accession No. ML15065A032)

15.

Letter from Jack R. Davis (NRC) to All Operating Reactor Licensees and Holders of Construction Permits, "Nuclear Regulatory Commission Audits of Licensee Responses to Mitigation Strategies Order EA-12-049," August 28, 2013 (ADAMS Accession No. ML13234A503)

16.

Letter from Jeremy S. Bowen (NRC) to Randall K. Edington (APS), "Palo Verde, Units 1, 2, and 3 - Interim Staff Evaluation Relating to Overall Integrated Plan in Response to Order EA-12-049 - Mitigation Strategies," November 25, 2013 (ADAMS Accession No. ML13308C153)

17.

Letter from John P. Beska (NRC) to Randall K. Edington (APS), "Palo Verde Nuclear Generating Station Units 1, 2, and 3 - Report for the Audit Regarding Implementation of Mitigating Strategies and Reliable Spent Fuel Pool Instrumentation Related to Orders EA-12-049 and EA-12-051," September 8, 2014 (ADAMS Accession No. ML14239A181)

18.

APS Letter 102-07159, Palo Verde, Units 1, 2, and 3, " Final Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049)," December 24, 2015 (ADAMS Accession No. ML15364A034)

19.

U.S. Nuclear Regulatory Commission, "Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendations 2.1, 2.3, and 9.3, of the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident," March 12, 2012, (ADAMS Accession No. ML12053A340)

20.

SRM-COMSECY-14-0037, "Staff Requirements -COMSECY-14-0037 - Integration of Mitigating Strategies For Beyond-Design-Basis External Events and the Reevaluation of Flooding Hazards," March 30, 2015, (ADAMS Accession No. ML15089A236) 21.

APS Letter 102-06967, Palo Verde, Units 1, 2, and 3, "Flood Hazard Reevaluation Report," December 12, 2014 (ADAMS Accession No. ML14350A466)

22.

APS Letter 102-07010, Palo Verde, Units 1, 2, and 3, "Seismic Hazard and Screening Report," March 10, 2015 (ADAMS Accession No. ML15076A073)

23.

Letter from Jack R. Davis (NRC) to Joseph E. Pollock (NEI), "Staff Assessment of National SAFER Response Centers Established In Response to Order EA-12-049,"

September 26, 2014 (ADAMS Accession No. ML14265A107)

24.

APS Letter 102-06669, Palo Verde, Units 1, 2, and 3, "APS Overall Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Level Instrumentation (Order Number EA-12-051)," February 28, 2013 (ADAMS Accession No. ML13070A077)

25.

Letter from Jennivine K. Rankin (NRC) to APS, Palo Verde Nuclear Generating Station, Units 1, 2, and 3 - Request for Additional Information Regarding Overall Integrated Plan in Response to Order EA-12-051, Reliable Spent Fuel Pool Instrumentation," June 10, 2013 (ADAMS Accession No. ML13157A065)

26.

APS Letter 102-06728, Palo Verde, Units 1, 2, and 3, uResponse to Request for Additional Information for Overall Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Level Instrumentation (Order Number EA-12-051)," July 11, 2013 (ADAMS Accession No. ML13199A033)

27.

Letter from Jennivine K. Rankin (NRC) to Arizona Public Service, Palo Verde, Units 1, 2, and 3 - Interim Staff Evaluation and Request for Additional Information Regarding the Overall Integrated Plan for Implementation of Order EA-12-051, Reliable Spent Fuel Pool Instrumentation, October 29, 2013 (ADAMS Accession No. ML13296A006)

28.

APS Letter 102-06759, Palo Verde, Units 1, 2, and 3, " First 6-Month Status Report on the PVNGS Overall Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Level Instrumentation (Order Number EA-12-051)," August 28, 2013 (ADAMS Accession No. ML13246A008)

29.

APS Letter 102-06841, Palo Verde, Units 1, 2, and 3, "APS Second 6-Month Status Report on the PVNGS Overall Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Level Instrumentation (Order Number EA-12-051)," February 28, 2014 (ADAMS Accession No. ML14065A039)

30.

APS Letter 102-06933, Palo Verde, Units 1, 2, and 3, "Third 6-Month Status Report on the PVNGS Overall Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Level Instrumentation (Order Number EA-12-051)," August 28, 2014 (ADAMS Accession No. ML14246A210) 31.

APS Letter 102-07006, Palo Verde, Units 1, 2, and 3, ",APS Fourth 6-Month Status Report on the PVNGS Overall Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Level Instrumentation (Order Number EA-12-051)," February 27, 2015 (ADAMS Accession No. ML15065A033)

32.

APS Letter 102-07092, Palo Verde, Units 1, 2, and 3, "Fifth 6-Month Status Report on the PVNGS Overall Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Level Instrumentation (Order Number EA-12-051)," August 14, 2015 (ADAMS Accession No. ML15232A027)

33.

Letter from Jason Paige (NRC) to Joseph W. Shea (TVA), Watts Bar Nuclear Plant, Units 1 and 2, Report for the Westinghouse Audit in Support of Reliable Spent Fuel Instrumentation Related to Order EA-12-051, August 18, 2014 (ADAMS Accession No. ML14211A346)

34.

NRC Office of Nuclear Reactor Regulation Office Instruction LIC-111, Regulatory Audits, December 16, 2008 (ADAMS Accession No. ML082900195).

35.

Letter from William Dean (NRC) to Power Reactor Licensees, "Coordination of Requests for Information Regarding Flooding Hazard Reevaluations and Mitigating Strategies for Beyond-Design Bases External Events," September 1, 2015 (ADAMS Accession No. ML15174A257).

36.

NEI Position Paper: "Shutdown/Refueling Modes", September 18, 2013 (ADAMS Accession No. ML13273A514)

37.

Letter from Jack R. Davis (NRC) to Joseph E. Pollock (NEI), regarding NRC endorsement of NEI Position Paper: "Shutdown/Refueling Modes", September 30, 2013 (ADAMS Accession No. ML13267A382)

38.

Letter from Nicholas Pappas (NEI) to Jack R. Davis (NRC) regarding FLEX Equipment Maintenance and Testing, October 3, 2013 (ADAMS Accession No. ML13276A573)

39.

Letter from Jack R. Davis (NRC) to Joseph E. Pollock (NEI), regarding NRC endorsement of the use of the EPRI FLEX equipment maintenance report, October 7.

2013 (ADAMS Accession No. ML13276A224)

40.

Letter from William M. Dean (NRC) to Applicable Power Reactor Licensees, "Final Determination of Licensee Seismic Probabilistic Risk Assessments Under the Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f)

Regarding Recommendation 2.1 "Seismic" of the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident," October 27, 2015 (ADAMS Accession No. ML15194A015) 41.

COMSECY-14-0037, "Integration of Mitigating Strategies for Beyond-Design-Basis External Events and the Reevaluation of Flooding Hazards," dated November 21, 2014 (ADAMS Accession No. ML14309A256)

42.

APS Letter 102-07091, Palo Verde, Units 1, 2, and 3, "APS Fifth 6-Month Status Report on the PVNGS Overall Integrated Plan for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049)," August 14, 2015 (ADAMS Accession No. ML15232A028)

43.

Letter from Jennivine K. Rankin (NRC) to APS, Palo Verde, Units 1, 2, and 3 -

Redacted, Request for Additional Information Regarding Overall Integrated Plan in Response to Commission Order EA-12-049 Modifying License with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events," June 20, 2013 (ADAMS Accession No. ML13161A265)

44.

Letter from D. C. Mims (APS) to NRC, "Palo Verde, Units 1, 2, and 3, Response to Request for Additional Information for the PVNGS Overall Integrated Plan in Response to the March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA 049)," July 18, 2013 (ADAMS Accession Nos. ML13206A006 and ML13206A007).

45.

APS Letter 102-07157, Palo Verde, Units 1, 2, and 3, "Notification of Full Compliance With NRC Orders EA-12-049 and EA-12-051 for Unit 2," December 17, 2015 (ADAMS Accession No. ML15351A449)

46.

Letter from Juan F. Uribe (NRC) to APS, Palo Verde Nuclear Generating Station, Units 1, 2, and 3 - "Correction to Interim Staff Response to Reevaluated Flood Hazards Submitted in Response to 10 CFR 50.54(f) Information Request - Flood-Causing Mechanism Reevaluation," October 8, 2015 (ADAMS Accession No. ML15280A022)

47.

Palo Verde Nuclear Generating Station, Units 1, 2, and 3, Updated Final Safety Analysis Report, Revision 16, June 2011.

48.

COMSECY-15-0019, "Closure Plan for the Reevaluation of Flooding Hazards for Operating Nuclear Power Plants, June 30, 2015, (ADAMS Accession No. ML15153A104)

49.

Nuclear Energy Institute document NEI 12-06, "Diverse and Flexible Coping Strategies (FLEX) Implementation Guide," Revision 2, December 31, 2015 (ADAMS Accession No. ML16005A625)

50.

APS Letter 102-07248, Palo Verde, Units 1, 2, and 3, "APS Response to Request for Additional Information Regarding Overall Integrated Plan for Implementation of Order EA-12-051, Reliable Spent Fuel Pool Instrumentation," April 29, 2016 (ADAMS Accession No. ML16155A084) 51.

U.S. Nuclear Regulatory Commission, "Mitigation of Beyond-Design-Basis Events,

Federal Register, Vol. 80, No. 219, November 13, 2015, pp. 70610-70647.

52.

JLD-ISG-2012-01, "Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events," Revision 1, January 22, 2012 (ADAMS Accession No. ML15357A163)

Principal Contributors:

Date:

S. Sun J. Lehning P. Sahay B. Titus 0. Yee C. Roque-Cruz J. Beska July 20, 2016

By letter dated February 28, 2013 (ADAMS Accession No. ML13070A077), APS submitted its OIP for Palo Verde in response to Order EA-12-051. At six month intervals following the submittal of the OIP, the licensee submitted reports on its progress in complying with Order EA-12-051. These reports were required by the order, and are listed in the enclosed safety evaluation. By letter dated March 26, 2014 (ADAMS Accession No. ML14083A620), the NRC notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-051 in accordance with NRC NRR Office Instruction LIC-111, similar to the process used for Order EA-12-049. By letters dated October 29, 2013 (ADAMS Accession No. ML13296A006), and September 8, 2014 (ADAMS Accession No. ML14239A181 ), the NRC staff issued an ISE and audit report, respectively, on the licensee's progress. By letter dated December 17, 2015 (ADAMS Accession No. ML15351A449), APS submitted a compliance letter in response to Order EA-12-051. The compliance letter stated that the licensee had achieved full compliance with Order EA-12-051.

The enclosed safety evaluation provides the results of the NRC staff's review of APS' strategies for Palo Verde. The intent of the safety evaluation is to inform APS on whether or not its integrated plans, if implemented as described, will adequately address the requirements of Orders EA-12-049 and EA-12-051. The staff will evaluate implementation of the plans through inspection, using Temporary Instruction 191, "Implementation of Mitigation Strategies and Spent Fuel Pool Instrumentation Orders and Emergency Preparedness Communications/Staffing/

Multi-Unit Dose Assessment Plans" (ADAMS Accession No. ML14273A444). This inspection will be conducted in accordance with the NRC's inspection schedule for the plant.

If you have any questions, please contact John Boska, Orders Management Branch, Palo Verde Project Manager, at 301-415-2901 or at John.Boska@nrc.gov.

Docket Nos.: 50-528, 50-529, and 50-530

Enclosure:

Safety Evaluation cc w/encl: Distribution via Listserv DISTRIBUTION:

PUBLIC JLD R/F RidsNrrDorllpl4-1 Resource RidsNrrLASLent Resource RidsAcrsAcnw_MailCTR Resource ADAMS Accession No. ML16088A261 OFFICE NRR/JLD/JOMB/PM NRR/JLD/LA NAME JBoska Slent DATE 03/30/2016 03/30/2016 Sincerely, IRA/

Mandy K. Halter, Acting Chief Orders Management Branch Japan Lessons-Learned Division Office of Nuclear Reactor Regulation RidsRgn4MailCenter Resource JBoska, NRR/JLD RidsNrrPMPaloVerde Resource NRR/JLD/JHMB/BC*

MS hams 04/25/2016 "via email NRR/JLO/JERB/BC*

SBailey 06/23/2016 OFFICE NRR/JLO/JCBB/BC*

NRR/JLD/JOMB/BC(A)

NAME JQuichocho MHalter DATE 04/13/2016 07/20/2016 OFFICIAL AGENCY RECORD