ML16138A828

Safety Evaluation Supporting Amends 220,220 & 217 to Licenses DPR-38,DPR-47 & DPR-55,respectively

ML16138A828
Person / Time
Site:	Oconee
Issue date:	01/02/1997
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML16138A827	List: ML16138A825 ML16138A828
References
NUDOCS 9701060135
Download: ML16138A828 (20)

Text

otREG UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO.220

-TO FACILITY OPERATING LICENSE DPR-38, AMENDMENT NO. 220 TO FACILITY OPERATING LICENSE DPR-47, AND AMENDMENT NO. 217 TO FACILITY OPERATING LICENSE DPR-55 DUKE POWER COMPANY OCONEE NUCLEAR STATION, UNITS 1. 2. AND 3 DOCKET NOS. 50-269, 50-270, AND 50-287

1.0 INTRODUCTION

By letter dated December 11, 1996, as supplemented by letters dated December 17, 19, and 26, 1996, Duke Power Company (the licensee) proposed a change to the Updated Final Safety Analysis Report (UFSAR) for the Oconee Nuclear Station, Units 1, 2, and 3. The requested changes would add the following paragraph to page 14-7 of the UFSAR:

A one-time emergency power ES [engineered safeguards] functional test which involves the three Oconee units during shutdown conditions has been evaluated. The scope of the test is described in Duke Letters to the NRC dated December 11, 17, 19, and 26, 1996. This test will verify certain design features of the emergency power system in an integrated fashion.

Oconee Unit 3 will be defueled and Oconee Units 1 and 2 will be at cold shutdown with fuel in the reactor core during the performance of the test.

The additional information supplied by the supplemental letters dated December 17, 19, and 26, 1996, did not change the original proposed no significant hazards consideration.

2.0 BACKGROUND

At a meeting on September 19, 1996, the licensee committed to perform a one time emergency power engineered safeguards (ES) functional test in late 1998 or early 1999. This test was conceptually described during the meeting and in a letter to the NRC dated October 31, 1996.

When all three Oconee units were shut down to perform piping inspections on the secondary system, the NRC requested, in a letter dated October 18, 1996, that the licensee determined the possibility of performing the emergency power ES functional test at this time. In the October 31, 1996, letter, the licensee committed to perform the one-time emergency power ES functional test provided the test development team concluded that the performance of the test was feasible.

9701060135 970102 PDR ADOCK 05000269 P

PDRj

-2 By letter dated November 21, 1996, the licensee indicated that the one-time emergency power ES functional test would be performed during the current three-unit outage.

Consideration was given to removal of the fuel from the Unit I and 2 feactor vessels prior to the performance of the test. However, insufficient storage capacity exists to offload both the Unit I and 2 cores into the spent fuel pools. Therefore, it is not possible to conduct the tests with all three units defueled. In addition, the licensee considered the possibility of removing the reactor vessel head and flooding the fuel transfer canal prior to the test. Because of the redundant and diverse means of DHR provided by the two trains of LPI and natural circulation of the RCS through the steam generators, removal of the reactor vessel head and flooding of the transfer canal is not necessary. The loss of DHR thermal hydraulic analysis indicates that adequate time is available to restore LPI to service if a problem occurred during the test. Also, removal of decay heat from Units 1 and 2 using natural circulation can be established without power from the main feeder busses.

3.0 DISCUSSION AND EVALUATION The current Oconee licensing basis indicates that pre-operational tests were performed and periodic tests are performed on the emergency power system utilizing a single Oconee unit load. In contrast, the planned emergency power ES functional test consists of six individual parts that are designed to demonstrate various loading configurations of the Oconee emergency power system. Since the proposed one-time emergency power ES functional test procedure involves safety equipment on all three Oconee units the test procedure is of a scope that has not been previously described in the licensing basis. The licensee, therefore, determined that there may be a marginal increase in the possibility of a loss of power as compared to the other emergency power tests currently within the licensing basis. This led to the conclusion that the test may involve an unreviewed safety question (USQ) that requires prior NRC approval of the test in accordance with 10 CFR 50.90.

Chapter 8.3.1.1.6 of the Oconee UFSAR describes the tests and inspections that are routinely performed on the Oconee emergency power system. These tests and inspections are performed on an individual Oconee unit basis rather than simultaneously on all three Oconee units.

In addition, Chapter 14.2 of the Oconee UFSAR outlines the preoperational tests that were performed on Oconee prior to initial fuel loading. This chapter describes an engineered safeguards actuation system test that was performed to assure actuation and proper operation of the engineered safeguards system. These preoperational tests were successfully performed on each individual Oconee unit. However, they did not include any impacts from a concurrent three-unit test.

Finally, the periodic surveillances contained in the Oconee Technical Specifications do not include any tests that load all three Oconee units on Keowee. The Oconee Technical Specifications include surveillances that test the circuitry and equipment in the proposed one-time emergency power ES functional test. However, the tests utilize an overlapping testing

-3 methodology to ensure that the Oconee emergency power system can perform its intended safety function.

Since there may be a marginal increase in the probability of a loss of power as compared to the other emergency power tests in the above paragrapt, the licensee submitted the change to UFSAR Chapter 14 to include the one-time emergency power ES functional test.

3.1 Test Overview The electrical portions of this integrated test involve six distinct parts (Tests 1 through 6), which are described below. The first two parts involve loss of offsite power (LOOP) only scenarios. The remaining four parts include simulated loss-of-coolant-accident (LOCA)/LOOP combinations. The Oconee licensing basis is for a LOCA on one Oconee unit concurrent with a LOOP that affects the three Oconee units.

Under these conditions, the emergency electrical power systems must satisfy the LOCA loads on one Oconee unit plus the hot shutdown loads of the other two Oconee units.

For the LOOP/LOCA scenarios, the affected mechanical safety systems and components will operate as described in the UFSAR; i.e., low pressure service water (LPSW) pumps will start, high and low pressure injection pumps will start, all three reactor building cooling units (RBCUs) will start or switch to low speed, both reactor building spray (RBS) pumps will start, the reactor building spray system will be recirculated rather than released into the reactor building, the penetration room ventilation (PRVS) will start, and containment isolation will occur. In addition, the motor-driven emergency feedwater pumps will start as a result of the loss of power.

Emergency core cooling system injection flow will be provided from the borated water storage tank (BWST) to the defueled reactor vessel and into the partially filled transfer canal.

The Oconee Unit 3 spent fuel pool (SFP) will be isolated from the transfer canal.

In all parts of this test, a special Oconee procedure has been written that addresses the test and restarting of additional loads (condenser circulating water (CCW), SFP cooling, heating, ventilation, and air conditioning (HVAC), etc.). It also includes contingency actions in the event the planned electrical transfer fails.

Prior to and following the performance of each of the six portions of the test, pre-test and post-test briefings will be conducted. The post-test briefings will assess the test results with respect to the acceptance criteria. If it is necessary to repeat a portion of the test, the status of the Oconee units will be evaluated to determine is a retest can be conducted safely. The licensee will not perform a portion of the test more than three times without reviewing the test plan with the NRC staff and obtaining NRC approval.

3.2 Test Description Test #1 Three Oconee LOOP Units Loading on the Keowee Underground Path Test I will verify the ability of the Keowee underground power path and unit to handle block loading and unloading. This scenario represents the worst

-4 one-time load the system should see; i.e., the LOOP loads of three Oconee units loading at the same time.

Initially, all three Oconee units will be aligned to their startup transformers with selected loads operating to simulate hot shutdown conditions. In addition, the Keowee units willabe started from standstill in this part of the test.

All three startup transformers will be deenergized simultaneously with a Keowee emergency start actuation to simulate the LOOP. After approximately 21 seconds, all Oconee units will load shed. At approximately 31 seconds, all Oconee units will block load onto the Keowee underground unit, which will have had time to reach rated speed and voltage. After successful loading on the underground is demonstrated, dead bus transfers back to the unit startup transformers will be performed, one Oconee unit at a time.

Test #2 Three Ocone4 LOOP Units Loading on the Keowee Overhead Path After Keowee Load Rejection and Switchyard Isolation Test 2 will verify the ability of the Keowee overhead power path and unit to handle block loading following a maximum permissible load rejection. Again, this LOOP scenario represents the worst one-time load the system should see; i.e., the LOOP loads of the three Oconee units loading at the same time (t = approximately 20 seconds). All three Oconee units will initially be aligned to their startup transformers with selected loads operating to simulate hot shutdown conditions. The Keowee overhead unit will be generating to the grid at maximum permissible load. In addition, the Keowee underground unit will initially be running in standby at rated speed with no load. A switchyard isolation will be initiated, resulting in all three startup transformers being deenergized at the same time.

Both Keowee units will get an emergency start signal, and the overhead Keowee unit will load reject.

Once the Keowee overhead unit's speed has decreased to less than 110 percent rated (at approximately 20 seconds) all Oconee units will block load onto the Keowee overhead pathway through their startup transformers. After successful loading is demonstrated, the overhead Keowee unit will be synchronized back to the system grid via power circuit breaker (PCB)-8. The Oconee loads will be transferred to the system grid through a live bus transfer. The Keowee unit can then be shut down and the switchyard returned to normal alignment.

Test #3 Block Loading of One Oconee Unit's LOCA Loads and One Oconee Unit's LOOP Loads Onto an Accelerating (i.e., at Reduced Voltage and Frequency)

Keowee Underground Unit Test 3 will verify the ability of the Keowee underground power path and unit to handle block loading of the Oconee Unit 3 LOCA loads plus Oconee Unit I hot shutdown loads while accelerating. This situation represents a single failure where a large unscheduled load starts with the LOCA/LOOP loads. The Oconee Unit 1 hot shutdown loads will represent this large unscheduled load. Oconee Unit I will have ES placed in test to simulate the LOCA timing to the emergency power switching logic (EPSL). At the same time, the startup transformers on both Oconee Units 1 and 3 will be deenergized and Oconee Unit 3 will have ES channels 1 through 8 actuated. Both Keowee units will start and accelerate to rated speed and voltage. This scenario will block load the Oconee Unit 1 and Unit 3 loads to the underground unit at approximately 11 seconds.

I,

-5 Oconee Unit 2 will b unaffected by this portion of the test. At the conclusion of this test segment, additional loads will be restarted, emergency core cooling system (ECCS) flow will be terminated, and dead bus transfers back to the respective Oconee startup transformers will be performed.

Test #4 Block Loading of One Oconee Unit's LOCA Loads and One Oconee Unit's LOOP Loads Onto a Load Rejected Keowee Underground Unit For Test 4, the same basic sequence described in Test 3 will be performed with the major difference being that the Keowee underground unit will be generating to the system grid at maximum permissible load at the onset of the simulated LOCA/LOOP events. In addition, the overhead Keowee unit will be generating at a low level of 0 -

10 MW. The Keowee units will load reject upon receiving the emergency start signal.

At approximately 20 seconds from the event initiation, the Oconee Unit 3 LOCA loads and Oconee Unit 1 LOOP loads will block load onto the inderground Keowee unit. Oconee Unit 2 will not be affected by this portion of the test. At the conclusion of this test segment, enclosures are provided to restart additional loads, terminate ECCS flow, and perform dead bus trarsfers back to the respective Oconee startup transformers.

Test #5 Block Loading of a LOCA/LOOP Oconee Unit Followed by Block Loading of Two Oconee LOOP Units on a Load Rejected Keowee Underground Unit For Test 5, initially all three Oconee units will be aligned to their respective startup transformers and the Keowee unit aligned to the underground path will be generating to the system grid at maximum permissible load. The Keowee overhead unit will be generating at a low level of 0 -

10 MW. Startup transformers for Oconee Units 1, 2, and 3 will be deenergized and Oconee Unit 3 will have ES channels 1 through 8 actuated to simulate a LOCA/LOOP event. At this time, the Keowee units load reject while the underground breaker opens and then recloses to power the standby bus, which subsequently supplies power to the main feeder busses.

For Oconee Units 1 and 2, which are affected only by the simulated LOOP, the Keowee overhead path would normally supply their power. However, for this test scenario, a failure of the overhead path will be simulated on the Oconee LOOP units. Since there is no ES signal present on Oconee Units 1 and 2, the respective main feeder bus monitor panels begin a 20-second time-out. Load shed occurs at approximately 21 seconds and, after a total of approximately 31 seconds, both Oconee LOOP units will be switched to and fed from the underground path.

At the conclusion of this test segment, the Oconee unit startup transformers will be reenergized and the Keowee underground unit will be block unloaded one Oconee unit at a time via dead bus transfers. Tests 5 and 6 represent the greatest total electrical demand to be placed on the emergency power system, but not the greatest single one-time demand because the loads are staggered; i.e., LOCA followed by LOOP.

Test #6 Block Loading of a LOCA/LOOP Oconee Unit Followed by Block Loading of Two Oconee LOOP Units on a Lee Gas Turbine

-6 The LOCA/LOOP simulation of Test 5 will be repeated using an operating Lee Gas Turbine to power the standby bus as the emergency power source. The startup transformers for each Oconee unit will be deenergized and Oconee Unit 3 will have ES channels 1 through 8 actuated to simulate a LOCA/LOOP event. In approximately 1 second, a load shed will occur on Oconee Unit 3. At 4 approximately 11 seconds, the standby breaker close initiator allows Oconee Unit 3 to block load onto the Lee Gas Turbine. Since there is no ES signal present on Oconee Units 1 and 2, they are affected only by the simulated LOOP.

The main feeder bus monitor panels for Oconee Units 1 and 2 begin a 20-second time-out. Load shed occurs at approximately 21 seconds. After a total of approximately 31 seconds, both Oconee LOOP units will be switched to and fed from the Lee Gas Turbine. At the conclusion of this test segment, the Oconee startup transformers will be reenergized, additional loads will be recovered, and the Lee Gas Turbine unit will be block unloaded via dead bus transfers.

3.3 Safety Analysis During the Keowee loading part of this test, a Lee Gas Turbine will be running in standby and energizing CT-5 through a dedicated 100kV line.

Likewise, during the Lee Gas Turbine loading, the Keowee units will also be available.

The availability of the additional power sources is provided as a conservative measure to ensure.that redundant and diverse power sources are available should they be needed.

In addition, the Standby Shutdown Facility (SSF) will be available during the performance of the test. Provisions are also made in the procedure to recover additional loads (CCW, SFP cooling, HVAC, etc.) after each test phase. The electrical power and mechanical safety systems for all three Oconee units will be placed in various alignments during the performance of this test. The potential effects and concerns as well as precautions and compensatory actions to be taken have been evaluated.

One of the main purposes of the Oconee emergency power system is to supply a reliable source of emergency power during a design basis event (DBE).

The Keowee emergency start logic at Oconee is designed to send a signal to the start circuitry of both Keowee hydro units in the event the normal and startup power sources are not available and/or an engineered safeguards signal is present. Both Keowee units are started automatically and run in standby under any of the following three conditions: (1) undervoltage signals from both main feeder busses; (2) the presence of an ES signal; or (3) a signal from the external grid trouble protection system. The Keowee units are designed to achieve rated speed and voltage within 23 seconds of receipt of an emergency start signal.

If the Keowee units are already supplying power to the grid when an emergency start signal is received, they will separate from the Duke grid and run in standby until needed. The emergency power supply from Keowee will remain available throughout the performance of this test.

The emergency power system can receive power from the various available sources. The maximum electrical emergency power needed is equivalent to the LOCA loads of one Oconee unit plus the hot shutdown loads of the other two Oconee units. This load is within the capabilities of the available generators; i.e., Keowee units and the Lee combustion turbines, and the

-7 associated pathways (including cables) with the limiting factor being the respective transformers (CT-4 and CT-5), which are rated at 22.4 MVA.

Portions of this test place the Oconee units in an alignment that essentially removes the preferred offsite power source from the startup transformers. The overhead path from Keowee would, however, continue to be automatically available through the startup transformers.

The degraded grid protection system (DGPS) monitors the supply voltage on the yellow bus and is one of two systems that provides a switchyard isolate function. The external grid trouble protection system (EGTPS) can also initiate the switchyard isolate signal.

Switchyard isolation is a feature of the Oconee electrical system that isolates the switchyard yellow bus from the offsite loads during periods of grid disturbances. Switchyard isolation is accomplished by opening and closing selected switchyard PCBs to isolate the 230kV switchyard yellow bus from the grid. It also provides an automatic path from one of the Keowee units to the three Oconee startup transformers through the isolated yellow bus.

The DGPS will initiate a switchyard isolation upon receipt of a Channel 1 or 2 ES signal in any of the three Oconee units in conjunction with an undervoltage signal sustained for more than 9 seconds on any two out of the three phases on the yellow bus. For the purposes of this test, both the red and yellow busses will remain energized with power being isolated only to the Oconee units' startup transformers during all parts of this procedure except Test 2 described above).

For Test 2, the switchyard isolate function will be actuated. The red bus will remain available and energize the normal transformer through a backcharged main step-up transformer. The yellow bus will be isolated and the Oconee loads will be reenergized by Keowee on the overhead path. The switchyard isolation function is routinely tested at Oconee. The DGPS and EGTPS will remain in service and will not be adversely affected by this test.

Each control room will have an Operations Senior Reactor Operator and two Reactor Operators dedicated to the performance of the test. The licensed operators involved with the test will receive classroom and simulator training on the test procedure. During the classroom training, the Emergency Power Engineered Safeguards Functional Test Procedure, TT/O/A/0610/025, will be covered in enough detail to ensure that the operators are familiar with the anticipated actions to be performed and the objectives to be achieved by the successful completion of the test. The simulator will be used to give the operators involved with the test actual hands-on experience for performance of the procedure under simulated operating conditions. In addition, the non licensed operators involved with the test will receive an on-shift review of specified tasks by their supervision in preparation for the test.

The Oconee units have been shut down for greater than 60 days and the decay heat loads are relatively low. Additionally, the vessel head will be removed and nuclear fuel will not be in the core on Oconee Unit 3 when ECCS injection occurs. This arrangement precludes any potential for low temperature overpressurization (LTOP) event or fuel assembly/control rod lift.

-8 On Oconee Units 1 and 2 there will be: (1) no ECCS injection into the reactor coolant system (RCS), thus removing the potential for boron dilution; (2) no control rod movement; and (3) no core configuration changes. The intentional and controlled interruption of power to the Oconee units' auxiliaries, including decay heat removal (DHR) systems, for short periods of timewill have a small effect on plant RCS temperature, pressure, and level.

Thus, there are no shutdown margin or reactivity management concerns on any unit.

Calculations using the test configuration, actual core data, and no operator action (except for opening the atmospheric dump valves) for Oconee Units 1 and 2 indicate that core boiling will not occur. Based on predicted heat transfer to the two steam generators, the peak temperature will be approximately 220OF at approximately 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. Since the RCS will be pressurized by a nitrogen bubble dutifig the test, the reactor coolant will not boil at 220"F. In addition, there is no concern of any significant RCS temperature increase on Oconee Units 1 and 2 during the brief periods of time when DHR is interrupted.

Conversely, the Oconee Unit 3 RCS temperature will be monitored to ensure it does not decrease below 55*F.

The Oconee Unit 3 core will be in the spent fuel pool (SFP), and the licensee calculates that the time to boil for the SFP in the event of continued loss of cooling is approximately 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

For the Oconee Units 1 and 2 SFP, the time to boil is even longer (approximately 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />).

The relatively long times to boiling, in conjunction with the contingency plans in the procedures, provide defense in depth to ensure that heat removal capability is available in a timely manner. These measures include placing the steam generators on Oconee Units 1 and 2 in reduced wet layup condition so that natural circulation can be initiated. The steam generators can be steamed using atmospheric dump valves to remove decay heat, if necessary.

Adequate time is available to manually operate the atmospheric dump valves to remove decay heat. The SSF, which will not be affected by the test, will be available to add inventory to the steam generators for long-term cooling. The licensee calculated that the operators have 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> to open the atmospheric dump valves and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to add water to the steam generators.

Approximately 31 seconds after the LOOP or LOCA initiation, all Oconee units will be repowered by the selected emergency power source.

For this test, all Oconee units are shut down with relatively low decay heat loads.

Additionally, the switchyard will remain energized and available, and can quickly be reconnected to the plant at any time. A single Keowee unit or Lee Gas Turbine supplying power through its respective transformer (CT-4 or CT-5, respectively) is designed to provide adequate power to supply one Oconee unit's LOCA loads and the other two Oconee units' hot shutdown loads.

Sufficient loads will be provided by running various systems to simulate hot shutdown conditions on Oconee Units 1 and 2 during all tests, and on Oconee Unit 3 for Tests 1 and 2.

If there is a loss of normal power sources, the engineered safeguards functions will be powered by a Keowee unit that will start up and accelerate to full speed within 23 seconds. The loading of the LOCA loads will occur at less than 100 percent voltage and frequency. This reflects the design basis that the Keowee hydro units come up to rated speed, injection system valves

-9 start stroking, and pumps begin operating before rated voltage and 60 Hertz frequency are achieved. The routinely performed EPSL functional test starts certain loads under these reduced voltage and frequency conditions.

The safety analysis previously discussed indicates that the one-time qmergency power ES functional test procedure provides assurance that adequate power sources are available during the performance of the test. In addition, the test procedure addresses the potential for loss of decay heat removal and compensatory actions should decay heat removal be lost. The licensee has determined that performance of the one-time emergency power ES functional test will not present an undue risk to public health.and safety.

3.4 Shutdown Risk Assessment In addition to the safety analysis previously discussed, the licensee performed an independent shutdown risk assessment for the one-time emergency power ES functional test. This assessment, performed in accordance with site directives for the Shutdown Protection Plan, addressed the following shutdown risk key safety functions:

3.4.1 Decay Heat Removal 3.4.1.1 Oconee Units 1 and 2 Oconee Units 1 and 2 have fuel in the core and have been shut down for greater than 60 days and decay heat is correspondingly low.

For the test, RCS temperature will be less than or equal to 100'F. During the test, for both Oconee Units 1 and 2, the RCS will be intact and full with a nitrogen bubble in the pressurizer (pressure will be less than 50 psig).

The secondary side of the steam generators will be filled to approximately 75 percent operating range. The motor driven emergency feedwater pumps will be running in recirculation mode to the upper surge tank. Each Oconee unit's low pressure injection (LPI) system will be in the normal decay heat removal mode with one train in operation using one of the ES pumps. The remaining ES train, along with the non-ES pump ("C"), will be in standby.

The LPSW system will be in service, with two pumps providing flow to various components, including all the decay heat coolers on the two units. The CCW system, which provides water to the LPSW suction header, will be in service with at least three pumps operating per Oconee unit.

When power is transferred by the test scenarios, the components providing DHR will initially lose power. The CCW system will align for gravity flow to assure a suction supply to the LPSW system. The operating LPSW and LPI pumps will be reenergized in approximately 11 to 31 seconds, depending on the scenario. This will restore full DHR with no operator action. If the power transfer does not occur properly, contingency plans and abnormal procedures provide guidance to restore power from another source. If power is restored, but the previously operating components are unavailable, the redundant:

component will be available for operation. These redundant components will not be challenged or exposed to the transients of the transfer test, and will only be placed in service as necessary.

-10 Other contingencies for loss of DHR include:

1. Use of the motor driven emergency feedwater (MDEFW) pumps to feed the steam generators. They can be cross-connected to another unit if one has power but the other does not.

2. Use of the SSF auxiliary service water pump to feed the steam generators, which can be powered by the SSF diesel, if necessary.

Calculations using the test configuration, actual core data, and no operator action (except for opening the atmospheric dump valves) for Oconee Units 1 and 2 indicate that core boiling will not occur. Based on the predicted steam generator beat transfer, the peak temperature will be approximately 220*F at approximately 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. Since the RCS will be pressurized by a nitrogen bubble during the tes), the reactor coolant will not boil at 220F.

Since the test will result in brief interruptions of decay heat removal (DHR) to Units 1 and 2, the licensee has analyzed the consequences of this condition and performed a thermal-hydraulic analysis using methods that have been previously approved by the NRC staff as described in the Duke Topical Report DPC-NE-3000. The analysis determined the plant response in the event that decay heat removal by the low pressure injection system cannot be restored for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The initial conditions and results are described in the December 17, 1996, submittal.

The reactor coolant system temperature and pressure gradually increase until the secondary side reaches saturation.

Since the steam generators provide sufficient DHR, the primary side stabilizes at approximately 2200F, with reactor coolant system pressure remaining below 130 psig. Therefore, no voiding in the reactor coolant system is expected and the reactor coolant system is greater than 100F subcooled. Pressurizer level is not predicted to be a problem under this condition. Steam generator pressure increases a few psi once the generators reach saturation and steaming through the atmospheric dump valves is initiated. The licensee's analysis has determined that at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are available before feedwater addition to the steam generators must be initiated or decay heat removal using LPI must be restored. Thus, ample time is available to prevent the onset of boiling in the primary system.

Since the peak reactor coolant system pressure is less that 130 psig, a large margin exists to the power operated relief valve (PORV) lift setpoint of 475 psig. Therefore, the PORVs are not expected to be challenged.

3.4.1.2 Oconee Unit 3 Oconee Unit 3 will be defueled during this test.

3.4.2 Spent Fuel Pool Cooling Spent fuel pool (SFP) cooling pumps and the associated recirculating cooling water pumps will lose power during each test scenario. The power will be restored by the test procedure in a timely manner.

The licensee has performed a revised analysis of the time to boil.

Assuming an initial temperature of 100 0F for the Units 1 and 2, the SFP will begin

11 boiling at approxima ely 103 hours0.00119 days <br />0.0286 hours <br />1.703042e-4 weeks <br />3.91915e-5 months <br /> and the Unit 3 SFP at 31 hours3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br />. At an initial temperature df 110 0 F, the time is approximately 94 and 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br />, respectively. Existing procedures provide contingency guidance for loss of SFP cooling scenarios.

3.4.3 RCS Inventory Control 3.4.3.1 Oconee Units 1 and 2 During the test, both Oconee units will have the RCS intact and full with a nitrogen bubble in the pressurizer. The High Pressure Injection (HPI) system on each Oconee unit will have two pumps operating, but they will be isolated so that only the minimum flow recirculation path will be in use. There will be no seal injection, normal makeup, emergency makeup, or letdown flows. The emergency makeup valves will be closed and deenergized and the PORV will be set to its shutdown sitpoint for LTOP protection. Pressurizer and letdown storage tank levels will be monitored to assure that no significant leakage exists that could slo ly fill the pressurizer and increase RCS pressure over the duration of the test.

When the power is transferred during the test scenarios, the HPI pumps will initially lose power. The operating HPI pumps will be reenergized in approximately 11 to 31 seconds, depending on the scenario. Following a LOOP, these two pumps are restarted automatically. In this test, the pumps provide electrical load. As soon as operators verify that the pumps started as expected, the pumps will be shut down in accordance with the test procedure.

There are no valves in the HPI, LPI, or RCS systems that are expected to open during this test. Therefore, there are no flow paths created to either drain or fill the RCS.

RCS inventory should not change. RCS temperature is also not expected to significantly change. Since power will be interrupted to the LPI pumps, there will be a loss of DHR. But, as described above, power will be restored in approximately 11 to 31 seconds and no temperature increase should occur. Due to the relatively low decay heat loads, even an extended loss of DHR will not result in a significant temperature rise.

Similarly, the MDEFW pumps will be running in recirculation, and will not supply flow to the steam generators. Therefore, the loss and resumption of emergency feedwater pumps will not cause a heatup or cooldown of the RCS, and RCS water volume will not change due to temperature/density changes. The calculated volume increase due to heat up would increase pressurizer level from 100 to approximately 225 inches.

Since the temperatures of the RCS and the potential cooling sources are near ambient, no nil-ductility or thermal shock limits should be challenged.

Additionally, the PORVs will remain operable throughout the test.

In the event that a significant RCS inventory loss were to occur during the test, the LPI system would be used to make up to the RCS upon restoration of power. If LPI was the source of the leak and had to be isolated, the HPI system could be realigned to maintain RCS inventory.

12 Should RCS inventory be lost, there will be two LPI pumps that will remain isolated for the electrical transients that can be put into service to mitigate any effects of a loss of inventory.

3.4.3.2 Oconee Unit 3 This test will be conducted with Oconee Unit 3 defueled and the reactor vessel head removed. The RCS will be filled slightly above the vessel flange level such that the fuel transfer canal will be partially filled. During the LOCA scenarios, the Oconee Unit 3 LPI and HPI systems will receive Engineered Safeguards signals and will pump water from the BWST into the reactor vessel and the fuel transfer canal.

This will simulate a large break LOCA and will provide useful data to assess the LPI and HPI systems hydraulic models.

The SFP will be isolated from the transfer canal and the BWST such that SFP level cannot be affected. This will be similar to lineups used for routine filling and draining of the canal.

3.4.4 Power Availability No power transfer will result in a loss of power for more than approximately 31 seconds. This entire test is intended to demonstrate design features to assure power availability for design basis events. The emergency power switching logic is tested on each Oconee unit on a refueling basis. The principal difference between this test and other tests performed periodically is that this test will load all three units on a Keowee unit or Lee Gas Turbine. In addition, some scenarios will subject the underground feeder to more load than prior tests.

This test will come closer to the limits of the design basis than prior tests.

During the performance of the test, it is conceivable that some components may fail due to previously undetected defects. The test procedure contains many provisions to address this potential:

1. The test has been identified as an infrequently performed test or evolution, thereby requiring enhanced management oversight in accordance with existing site procedures.

2. The test will contain contingency plans for various potential problems and will reference existing procedures and other compensatory action guidance where appropriate.

3. The test will employ the defense in depth concept. Test prerequisites and conditions will comply with a Site Directive that establishes the Shutdown Protection Plan. Therefore, the availability of redundant trains, alternate systems, and mitigation equipment will be maximized. A number of system and/or component experts, craft technicians, and support personnel will be available to respond and diagnose any failures and restore any key safety function that might be lost due to a failure.

13 Throughout the entire test, even during transfers, AC power will be available either automatically or with minor operator action from all of the following sources:

1. Switchyard to each Oconee unit's main feeder busses via the'normal source (backcharged main auxiliary transformer).

2. Switchyard to each Oconee unit's main feeder busses via the startup transformer (CT-1, CT-2, CT-3).

3. Keowee to each Oconee unit's main feeder busses via the startup transformer (CT-1, CT-2, CT-3).

4. Keowee to each Oconee unit's main feeder busses via the standby transformer (CT-4) and the standby busses.

5. Lee Gas Turbine to each Oconee unit's main feeder busses via a dedicated 100kV line and the standby busses. A Lee Gas Turbine will be running in standby during each part of the emergency power ES functional test.

It is also noted that, unlike most plants, each main feeder bus can supply all trains of the Oconee unit systems. Therefore, failure of one feeder breaker to a main feeder bus does not result in the corresponding loss of safety loads.

3.4.5 Reactivity Control 3.4.5.1 Oconee Units 1 and 2 As stated previously under "Inventory Control," there are no valves in the HPI, LPI, or RCS systems that are expected to open during this test.

Therefore, there are no flow paths created to either drain or fill the RCS.

RCS inventory should not change. Even if RCS inventory was reduced, the sources of makeup are those normally available and are borated adequately to permit use without decreasing the shutdown margin. The control rods are fully inserted and will not be manipulated during this test. No significant RCS temperature changes are expected that could reduce shutdown margin.

Therefore, no reactivity changes are expected.

3.4.5.2 Oconee Unit 3 As stated previously, there will be no fuel in the core during this test. The water being injected into the reactor vessel and fuel transfer canal will flow from the borated water storage tank (BWST), which is normally used to fill the canal for refueling. Sometime after the test is completed, the fuel transfer canal will be filled for refueling. The boron concentration will be sampled and. refueling requirements will be confirmed by the normal refueling procedure prior to final alignment for fuel handling. Therefore, no reactivity changes are expected as a result of this test.

14 3.4.6 Spent Fuel Pools No fuel handling activities will be performed during this test. The SFP will be isolated from the fuel transfer canal and the BWST such that SFP ltvel cannot be affected. This will be similar to lineups used for routine filling and draining of the fuel transfer canal.

Since the SFP will not be drained or filled during the test, boron dilution is not a concern.

3.4.7 Containment This test will have no adverse impact on containment closure for any of the three Oconee units. The test will be conducted with the equipment hatch on each Oconeeunit closed.

All reactor building penetrations will be intact or adequate contingencies will be in place to provide closure prior to core boiling in the event of an extended loss of DHR. No maintenance is currently scheduled on the fueled units that would breach a reactor building penetration during the test. However, containment integrity as defined in the Oconee Technical Specifications, is not required and will not be established during the test.

The Shutdown Protection Plan and associated Operating Procedures provide guidance on containment closure and contingency provisions for restoring containment closure if necessary.

LOCA scenarios will result in Oconee Unit 3 containment isolation valves being aligned in their non-ES positions and then moving to their ES (closed) positions. Since there is no fuel in the reactor building, containment integrity is not required. Therefore, no contingency plans are needed in the event component failures prevent containment integrity from being established.

3.4.8 Fire Protection Fire Protection requirements of the Oconee Technical Specifications are applicable at all times. During the transfers, power will be interrupted to the HPSW pumps, including the jockey pump. The test procedure contains provisions for restoring power to the pumps in a timely manner. While the pumps are without power, the elevated water storage tank (EWST) will contain inventory to supply the HPSW system for a period of time. Compensatory actions for loss of fire detection systems will be taken or confirmed as part of this test.

3.4.9 Emergency Plan Considerations The licensee reviewed test scenarios for interaction with the Emergency Plan in the extremely unlikely event that an incident occurs. The following items were considered as "worst case" possibilities (all would require multiple failures):

a) If the red and yellow switchyard busses are lost for greater than 15 minutes, the Emergency Plan requires that an UNUSUAL EVENT be declared.

15 b) If both main feeder busses on one Oconee unit remain deenergized greater than 15 minutes, the Emergency Plan requires that an ALERT be declared.

c) If Decay Heat Removal is lost such that RCS temperature has, or is projected to, exceeded 200*F prior to restoration, the Emergency Plan requires that an ALERT be declared.

d) If a fire exists for greater than 15 minutes, the Emergency Plan requires that an ALERT be declared.

e) If a fire (or explosion) damages a component in a system that performs a shutdown risk key safety function, the Emergency Plan requires that an ALERT be declared.

3.4.10 Instrumentation Instrumentation that is important to the operators during shutdown conditions receives power from batteries through inverters. During the test, the battery chargers will momentarily lose power. Once the emergency power system energizes the main feeder busses, the battery chargers will be reenergized.

Thus, the instrumentation will remain available to the operators during the test.

3.4.11 Equipment Availability 3.4.11.1 Low Pressure Injection System For Unit 1, any one of the three LPI pumps is capable of providing adequate DHR, and all three will be available prior to initiating the test. One LPI pump will in service at the beginning of each power transfer and will restart from the emergency power source.

For Unit 2, the configuration is the same except that the LPI pump that is in service will not lose power during Test #3 and Test #4 previously described.

Should any Unit 1 or 2 pump that is providing DHR fail during the power transient, the redundant pumps can be restarted by operator actions from the control room, as described in the test procedure. The LPI system can be used as a makeup source with the operation of one valve located outside the control room and outside the reactor building.

3.4.11.2 High Pressure Injection (HPI) System The HPI pumps are isolated from the RCS due to Low Temperature Overpressure Protection (LTOP) concerns whenever the RCS is intact and less than 3250F.

HPI, however, would be available as a backup makeup source in the event of an RCS leak. Guidance is provided for the use of HPI as a makeup source in the Loss of Decay Heat Removal Abnormal Procedure. Operation of four valves outside the control room will be necessary to align the HPI system to the RCS.

They are located outside the reactor building and are easily accessible.

16 3.4.11.3 Low Pressure Service Water (LPSW) System There are three LPSW pumps for the shared Units 1 and 2 LPSW system. Any one of the three pumps provides all of the service water flow necessary for DHR on both Units I and 2. During Tests 1, 2, 5, and 6 described above, any two of the three LPSW pumps will be operating prior to the power transfer and will restart after the power transfer. If both of these pumps should fail to start, the third LPSW pump can be restarted and provide sufficient flow for DHR on both Units I and 2.

During Tests 3 and 4 described above, one of the two operating LPSW pumps will be powered from Unit 2 and will not be affected by the power transfer.

3.4.11.4 Spent Fuel Pool (SFP) Cooling, Recirculating Cooling Water (RCW)

Pumps For the Units 1 and 2 SFP, three spent fuel cooling (SFC) pumps and four RCW pumps will be available for DHR. During Tests 1, 2, 5, and 6 previously described, the Units 1 and 2 SFC Systems will lose power. The SPC and RCW pumps do not automatically restart when power is restored to the main feeder busses. However, boiling is not expected to occur in the SFP for approximately 103 hours0.00119 days <br />0.0286 hours <br />1.703042e-4 weeks <br />3.91915e-5 months <br /> following loss of DHR. Therefore, considerable time is available for the operators to manually restart the pumps once a stable power source is supplying the main feeder busses. Provisions for this is included in the test procedure.

During Tests 3 and 4, one of the three SFC pumps and two of the four RCW pumps will not lose power since these pumps are powered from the Unit 2 main feeder busses.

For the Unit 3 SFP, three SFC pumps, two RCW pumps, and two condenser circulating water (CCW) booster pumps will be available for DHR. During Tests 1 and 2, all three SFC pumps and the four support pumps (two RCW and two CCW booster pumps) will lose power during the power transfer. These pumps will not automatically restart. The operators will be directed to restart them per the test procedure once a stable source of power is supplying the main feeder busses. Approximately 31 hours3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br /> will be available to perform this function prior to the initiation of boiling in the Unit 3 SFP.

During Tests 3, 4, 5, and 6, two of the three SFC pumps will have jumpers installed so they automatically restart when power is restored to the Unit 3 main feeder busses. These pumps will be started to ensure emergency power loads during the test will be comparable to the loads during a design basis accident. Should these two SFC pumps fail to restart during the power transfer transient, the third SFC pump would be available to provide spent fuel cooling. The operators would be instructed to restart this pump and its support pumps in accordance with the test procedure.

3.4.11.5 Compressed Air System Performance of the test does not interrupt power to the primary (normally operating) air compressor since its power supply is not affected by the test.

Therefore, loss of instrument air is not likely. The backup compressors, which are only run when the primary compressor is shut down, will lose power

-17 for a brief period (less than one hour). If the primary compressor is lost during this time, the backup diesel air compressor can be quickly started to supply compressed air, an evolution that is included in the routine operator training program. In addition, the licensee has determined that should instrument air be lost, no pneumatic boundary valves would operate thdt would cause a loss of RCS inventory or inadvertent injection into the RCS on the fueled units.

3.5 Summary Based on the information supplied by the licensee and a review of the appropriate sections of the Oconee Updated Final Safety Analysis Report, the staff has determined that adequate levels of defense in depth will be in place for all of the key safety functions, including containment integrity. In addition, contingency plans are in place to mitigate the potential risk associated with the performance of the one-time emergency power ES functional test. Therefore, the staff has determined-that the unreviewed safety question analysis and change to the Oconee UFSAR are acceptable.

4.0 EXIGENT CIRCUMSTANCES

The staff has reviewed the licensee's proposed amendments and finds (1) that exigent circumstances exist, as provided for in 10 CFR 50.91(a)(6), in that the licensee and the Commission must act quickly and that time does not permit the Commission to publish a Federal Register notice allowing 30 days for prior public comment, and (2) that the licensee has not failed to use its best efforts to make a timely application and avoid creating the exigent circumstance. The Commission noticed the licensee's December 11, 1996, application for amendments in the Federal Register on December 18, 1996 (61 FR 66699), at which time the Commission made a proposed finding that the amendments involved no significant hazards condition and there has been no public comment in response to the notice. Supplemental letters dated December 17, 19, and 26, 1996, did not affect the information supplied in the notice.

5.0 FINAL NO SIGNIFICANT HAZARDS CONSIDERATION

DETERMINATION The Commission's regulations in 10 CFR 50.92 state that the Commission may make a final determination that a license amendment involves no significant hazards considerations, if operation of the facility, in accordance with the amendment would not (1) involve a significant increase in the probability or consequences of an accident previously evaluated; (2) create the possibility of a new or different kind of accident from any accident previously evaluated; or (3) involve a significant reduction in a margin of safety.

The amendments have been evaluated against the three standards in 10 CFR 50.92(c). In its analysis of the issue of no significant hazards consideration, as required by 10 CFR 50.91(a), the licensee has provided the following statement with which the staff concurs:

1. Involve a significant increase in the probability or consequences of an accident previously evaluated?

18 No. For this test all three Oconee units will already be in a shutdown condition, thus there is no chance of an Oconee unit trip, LOCA/LOOP [Loss of Coolant Accident/Loss of Offsite Power] scenarios and most UFSAR analyzed accident scenarios. The UFSAR [Updated Final Safety Analysis Report] Loss of Electric Power accidebit assumes two types of events: (1) Loss of load and (2) Loss of all system and station power. Since all three Oconee units are shutdown during performance of this test, an Oconee unit trip cannot occur.

Nothing associated with this test will result in a significant increase in the likelihood of a loss of all system and station power since both Keowee units and the switchyard will remain available.

In addition, the gas turbine at Lee Steam station will be available and the SSF diesel will be operable. The loss of all station power accident analysis assumptions are still valid. Additionally, since the switchyard will remain energized and available, offsite power can quickly be reconnected to the plant.

The Keowee units provide the main source of emergency power for the Oconee units, but they are not accident initiators. This test has no adverse impact on the ability of the Keowee units to satisfy their design requirements of achieving rated speed and voltage within 23 seconds of receipt of an emergency start signal.

Although not a design basis accident, a hypothetical station blackout condition where all offsite power and the Keowee units are lost is described in the UFSAR. As detailed above, this test will not deenergize the switchyard or remove the Keowee units. Thus, emergency power systems will remain available, as well as the SSF

[Standby Shutdown Facility] diesel, and there is no significant increase in likelihood of a station blackout. The probability of an accident evaluated in the FSAR (LOOP, LOCA, and LOCA/LOOP) will not be significantly increased beyond what has already been evaluated under Technical Specifications.

Calculations using the test configuration, actual core data, and no operator action (except for opening the atmospheric dump valves) for Oconee Units 1 and 2 indicate that core boiling will not occur.

Based on the predicted steam generator heat transfer, the peak temperature will be approximately 220*F at approximately 13.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

Since the RCS [Reactor Coolant System] will be pressurized by a nitrogen or steam bubble during the test, the reactor coolant will not boil at 220 0F. Core uncovery and possible fuel damage is not considered a concern during the performance of this test. In addition, there is no concern of any significant RCS temperature increase on Oconee Units 1 and 2 during the short periods when DHR

[Decay Heat Removal] is interrupted. Fuel will be removed from the Oconee Unit 3 core during performance of this test. There is no adverse impact on containment integrity, radiological release pathways, fuel design, filtration systems, main steam relief valve setpoints, or radwaste systems.

Therefore, based on this analysis and the information presented in, the probability or consequences of an accident

19 previously evaluated will not be significantly increased by the proposed test.

2. Create the possibility of a new or different kind of accident from the accidents previously evaluated?

No. The emergency power system will remain operable and available to mitigate accidents. All three Oconee units will already be in a shutdown condition, so there is no risk of an Oconee unit trip, challenge to the reactor protective system (RPS), LOCA/LOOP scenarios, and most UFSAR analyzed accident scenarios. Since the Oconee units have been shutdown for greater than 60 days, the decay heat loads are relatively low. Additionally, on Oconee Unit 3, the vessel head will be removed and fuel will not be in the core when ECCS [Emergency Core Cooling System) injection occurs. This arrangement precludes any potential fuel assembly/control rod lift or reactivity management concerns.

Preplanning, use of dedicated operators, and independent verification will be employed during critical test phases involving manual manipulation of the 'S' and 'E' breakers. A dedicated technician in contact with the control room will be stationed at the affected cabinet ready to close the appropriate switches to re enable the normal source. These precautions ensure AC power sources are not paralleled. Therefore, based on this analysis and the supporting information in Attachment 2, no new failure modes or credible accident scenarios are postulated.

3. Involve a significant reduction in a margin of safety?

No. No function of any safety related emergency power system/component will be adversely affected or degraded as a result of this test. No safety parameters, setpoints, or design limits are adversely affected. For this test, all three Oconee units will be in a shutdown condition, so there is no risk of an Oconee unit trip, challenge to the reactor protective system (RPS), LOCA/LOOP scenarios, and most UFSAR analyzed accident scenarios. Strictly per the Technical Specifications, ECCS and auxiliary power systems are not required with RCS temperature less than 200*F. However, both the emergency power and DHR systems will remain operable during the test. Decay heat removal will only be briefly interrupted during the simulated LOOP portions of the test. Since the Oconee units have been shutdown for greater than 60 days, the decay heat loads are relatively low, and compensatory measures are in place to ensure heat removal capability can be regained in a timely manner.

Additionally, the vessel head will be removed and fuel will not be in the core on Oconee Unit 3 when ECCS injection occurs. There is no adverse impact to the fuel, cladding, RCS, or required containment systems. Therefore, based on this analysis and the supporting information in Attachment 2, the margin of safety is not significantly reduced as a result of this test.

20 Based on the above consideration, including its safety evaluation delineated above, the staff concludes that the amendments meet the standards set forth in 10 CFR 50.92 for no significant hazards consideration. Therefore, the staff has made a final determination that the proposed amendments involve no significant hazards consideration.

6.0 STATE CONSULTATION

In accordance with the Commission's regulations, the South Carolina State official was notified of the proposed issuance of the amendments. The State official had no comments.

7.0 ENVIRONMENTAL CONSIDERATION

The amendments change requirements with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has made a final finding that the amendments involve no significant hazards consideration. Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

8.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that:

(1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors: J. Lazevnick C. Jackson W. LeFave D. LaBarge Date: January 2, 1997