ML16340A009

Safety Evaluation Regarding Implementation of Mitigation Strategies and Reliable Spent Fuel Pool Instrumentation Related to Orders EA-12-049 and EA-12-051

ML16340A009
Person / Time
Site:	Sequoyah
Issue date:	03/09/2017
From:	Boska J Japan Lessons-Learned Division
To:	Gerry Powell South Texas
Valentin M, NRR/JLD 415-2864
References
CAC MF0825, CAC MF0826, CAC MF0827, CAC MF0828, EA-12-049, EA-12-051
Download: ML16340A009 (90)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 Mr. G. T. Powell Executive Vice President and CNO STP Nuclear Operating Company South Texas Project Electric Generating Station P.O. Box 289 Wadsworth. TX 77483 March 9, 2017

SUBJECT:

SOUTH TEXAS PROJECT, UNITS 1AND2-SAFETY EVALUATION REGARDING IMPLEMENTATION OF MITIGATING STRATEGIES AND RELIABLE SPENT FUEL POOL INSTRUMENTATION RELATED TO ORDERS EA-12-049 AND EA-12-051 (CAC NOS. MF0825, MF0826, MF0827, AND MF0828)

Dear Mr. Powell:

On March 12, 2012, the U.S. Nuclear Regulatory Commission (NRG) issued Order EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design-Basis External Events" and Order EA-12-051, "Order Modifying Licenses With Regard To Reliable Spent Fuel Pool Instrumentation," (Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML12054A736 and ML12054A679, respectively). The orders require holders of operating reactor licenses and construction permits issued under Title 1 O of the Code of Federal Regulations Part 50 to modify the plants to provide additional capabilities and defense-in-depth for responding to beyond-design-basis external events, and to submit for review Overall Integrated Plans (OIPs) that describe how compliance with the requirements of Attachment 2 of each order will be achieved.

By letter dated February 28, 2013 (ADAMS Accession No. ML13070A011 ), South Texas Project Nuclear Operating Company (STPNOC, the licensee) submitted its OIP for South Texas Project, Units 1 and 2 (STP) in response to Order EA-12-049. At six month intervals following the submittal of the OIP, the licensee submitted reports on its progress in complying with Order EA-12-049. These reports were required by the order, and are listed in the attached safety evaluation. By letter dated August 28, 2013 (ADAMS Accession No. ML13234A503), the NRG notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-049 in accordance with NRG Office of Nuclear Reactor Regulation (NRR) Office Instruction LIC-111, "Regulatory Audits" (ADAMS Accession No. ML082900195).

By letters dated January 29, 2014 (ADAMS Accession No. ML13339A736), and May 6, 2015 (ADAMS Accession No. ML15111A465), the NRG issued an Interim Staff Evaluation (ISE) and audit report, respectively, on the licensee's progress. By letter dated February 17, 2016 (ADAMS Accession No. ML16067A088), STPNOC submitted a compliance letter and Final Integrated Plan (FIP) in response to Order EA-12-049. The compliance letter stated that the licensee had achieved full compliance with Order EA-12-049.

By letter dated February 28, 2013 (ADAMS Accession No. ML13070A006), STPNOC submitted its OIP for STP in response to Order EA-12-051. At six month intervals following the submittal

of the OIP, the licensee submitted reports on its progress in complying with Order EA-12-051.

These reports were required by the order, and are listed in the attached safety evaluation. By letters dated September 19, 2013 (ADAMS Accession No. ML13254A210), and May 6, 2015 (ADAMS Accession No. ML15111A465), the NRC staff issued an ISE and audit report, respectively, on the licensee's progress. By letter dated March 26, 2014 (ADAMS Accession No. ML14083A620), the NRC notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-051 in accordance with NRC NRA Office Instruction LIC-111, similar to the process used for Order EA-12-049. By letter dated January 19, 2016 (ADAMS Accession No. ML16043A355), STPNOC submitted a compliance letter in response to Order EA-12-051. The compliance letter stated that the licensee had achieved full compliance with Order EA-12-051.

The enclosed safety evaluation provides the results of the NRC staff's review of STPNOC's strategies for STP. The intent of the safety evaluation is to inform STPNOC on whether or not its integrated plans, if implemented as described, provide a reasonable path for compliance with Orders EA-12-049 and EA-12-051. The staff will evaluate implementation of the plans through inspection, using Temporary Instruction 191, "Implementation of Mitigation Strategies and Spent Fuel Pool Instrumentation Orders and Emergency Preparedness Communications/Staffing/

Multi-Unit Dose Assessment Plans" (ADAMS Accession No. ML15257A188). This inspection will be conducted in accordance with the NRC's inspection schedule for the plant.

If you have any questions, please contact Milton Valentin, Orders Management Branch, STP Project Manager, at 301-415-2864 or at Milton.Valentin-Olmeda@nrc.gov.

Docket Nos.: 50-498 and 50-499

Enclosure:

Safety Evaluation cc w/encl: Distribution via Listserv Sincerely,

~;:~Chief Orders Management Branch Japan Lessons-Learned Division Office of Nuclear Reactor Regulation

1.0 2.0 2.1 2.2 3.0 3.1 3.2 3.2.1 3.2.1.1 3.2.1.1.1 3.2.1.1.2 3.2.1.1.3 3.2.1.2 3.2.1.2.1 3.2.1.2.2 3.2.1.2.3 3.2.2 3.2.3 3.2.3.1 3.2.3.1.1 3.2.3.1.2 3.2.3.2 3.2.3.3 3.2.3.4 3.2.3.5 3.2.3.6 3.2.4 3.3 3.3.1 3.3.2 3.3.3 3.3.4 3.3.4.1 3.3.4.1.1 3.3.4.1.2 3.3.4.2 3.3.4.3 3.3.4.4 TABLE OF CONTENTS INTRODUCTION REGULATORY EVALUATION Order EA-12-049 Order EA-12-051 TECHNICAL EVALUATION OF ORDER EA-12-049 Overall Mitigation Strategy Reactor Core Cooling Strategies Core Cooling Strategy and RCS Makeup Core Cooling Strategy Phase 1 Phase 2 Phase 3 RCS Makeup Strategy Phase 1 Phase 2 Phase 3 Variations to Core Cooling Strategy for Flooding Event Staff Evaluations Availability of Structures, Systems, and Components Plant SSCs Plant Instrumentation Thermal-Hydraulic Analyses Reactor Coolant Pump Seals Shutdown Margin Analyses FLEX Pumps and Water Supplies Electrical Analyses Conclusions Spent Fuel Pool Cooling Strategies Phase 1 Phase 2 Phase 3 Staff Evaluations Availability of Structures, Systems, and Components Plant SSCs Plant Instrumentation Thermal-Hydraulic Analyses FLEX Pumps and Water Supplies Electrical Analyses

3.3.5 3.4 3.4.1 3.4.2 3.4.3 3.4.4 3.4.4.1 3.4.4.1.1 3.4.4.1.2 3.4.4.2 3.4.4.3 3.4.4.4 3.4.5 3.5 3.5.1 3.5.2 3.5.3 3.5.4 3.5.5 3.5.6 3.6 3.6.1 3.6.1.1 3.6.1.2 3.6.1.3 3.6.1.4 3.6.2 3.6.3 3.7 3.7.1 3.7.2 3.7.3 3.7.3.1 3.7.3.2 3.7.4 3.7.5 3.7.6 3.7.7 3.8 3.8.1 3.8.2 3.8.3 Conclusions Containment Function Strategies Phase 1 Phase 2 Phase 3 Staff Evaluations Availability of Structures, Systems, and Components Plant SSCs Plant Instrumentation Thermal-Hydraulic Analyses FLEX Pumps and Water Supplies Electrical Analyses Conclusions Characterization of External Hazards Seismic Flooding High Winds Snow, Ice, and Extreme Cold Extreme Heat Conclusions Planned Protection of FLEX Equipment Protection from External Hazards Seismic Flooding High Winds Snow, Ice, Extreme Cold, and Extreme Heat Reliability of FLEX Equipment Conclusions Planned Deployment of FLEX Equipment Means of Deployment Deployment Strategies FLEX Connection Points Mechanical Connection Points Electrical Connection Points Accessibility and Lighting Access to Protected and Vital Areas Fueling of FLEX Equipment Conclusions Considerations in Using Offsite Resources South Texas Project SAFER Plan Staging Areas Conclusions

3.9 3.9.1 3.9.1.1 3.9.1.2 3.9.1.3 3.9.2 3.9.2.1 3.9.2.2 3.9.2.3 3.9.3 3.10 3.10.1 3.10.2 3.10.3 3.10.4 3.10.5 3.11 3.12 3.13 3.14 3.15 4.0 4.1 4.2 4.2.1 4.2.2 4.2.3 4.2.4 4.2.4.1 4.2.4.2 4.2.5 4.2.6 4.2.7 4.2.8 4.2.9 4.3 4.3.1 4.3.2 4.3.3 Habitability and Operations Equipment Operating Conditions Loss of Ventilation and Cooling Loss of Heating Hydrogen Gas Accumulation in Vital Battery Rooms Personnel Habitability Main Control Room Spent Fuel Pool Area Other Plant Areas Conclusions Water Sources Steam Generator Make-Up Reactor Coolant System Make-Up Spent Fuel Pool Make-Up Containment Cooling Conclusions Shutdown and Refueling Analyses Procedures and Training Maintenance and Testing of FLEX Equipment Alternatives to NEI 12-06, Revision O Conclusions for Order EA-12-049 TECHNICAL EVALUATION OF ORDER EA-12-051 Levels of Required Monitoring Evaluation of Design Features Design Features: Instruments Design Features: Arrangement Design Features: Mounting Design Features: Qualification Augmented Quality Process Instrument Channel Reliability Design Features: Independence Design Features: Power Supplies Design Features: Accuracy Design Features: Testing Design Features: Display Evaluation of Programmatic Controls Programmatic Controls: Training Programmatic Controls: Procedures Programmatic Controls: Testing and Calibration 4.4 Conclusions for Order EA-12-051

5.0 CONCLUSION

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO ORDERS EA-12-049 AND EA-12-051 SOUTH TEXAS PROJECT NUCLEAR OPERATING COMPANY

1.0 INTRODUCTION

SOUTH TEXAS PROJECT, UNITS 1 AND 2 DOCKET NOS. 50-498 AND 50-499 The earthquake and tsunami at the Fukushima Dai-ichi nuclear power plant in March 2011 highlighted the possibility that extreme natural phenomena could challenge the prevention, mitigation and emergency preparedness defense-in-depth layers already in place in nuclear power plants in the United States. At Fukushima, limitations in time and unpredictable conditions associated with the accident significantly challenged attempts by the responders to preclude core damage and containment failure. During the events in Fukushima, the challenges faced by the operators were beyond any faced previously at a commercial nuclear reactor and beyond the anticipated design-basis of the plants. The U.S. Nuclear Regulatory Commission (NRC) determined that additional requirements needed to be imposed at U.S. commercial power reactors to mitigate such beyond-design-basis external events (BDBEEs).

On March 12, 2012, the NRC issued Order EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events" (Agencywide Documents Access and Management System (ADAMS) Accession No. ML12054A736). This order directed licensees to develop, implement, and maintain guidance and strategies to maintain or restore core cooling, containment, and spent fuel pool (SFP) cooling capabilities in the event of a BDBEE. Order EA-12-049 applies to all power reactor licensees and all holders of construction permits for power reactors.

On March 12, 2012, the NRC also issued Order EA-12-051, "Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Instrumentation" (ADAMS Accession No. ML12054A679).

This order directed licensees to install reliable SFP level instrumentation with a primary channel and a backup channel, and with independent power supplies that are independent of the plant alternating current (ac) and direct current (de) power distribution systems. Order EA-12-051 applies to all power reactor licensees and all holders of construction permits for power reactors.

2.0 REGULATORY EVALUATION

Following the events at the Fukushima Dai-ichi nuclear power plant on March 11, 2011, the NRC established a senior-level agency task force referred to as the Near-Term Task Force (NTTF). The NTTF was tasked with conducting a systematic and methodical review of the NRC Enclosure regulations and processes and determining if the agency should make additional improvements to these programs in light of the events at Fukushima Dai-ichi. As a result of this review, the NTTF developed a comprehensive set of recommendations, documented in SECY-11-0093, "Near-Term Report and Recommendations for Agency Actions Following the Events in Japan,"

dated July 12, 2011 (ADAMS Accession No. ML11186A950). Following interactions with stakeholders, these recommendations were enhanced by the NRC staff and presented to the Commission.

On February 17, 2012, the NRC staff provided SECY-12-0025, "Proposed Orders and Requests for Information in Response to Lessons Learned from Japan's March 11, 2011, Great Tohoku Earthquake and Tsunami," (ADAMS Accession No. ML12039A103) to the Commission. This paper included a proposal to order licensees to implement enhanced BDBEE mitigation strategies. As directed by staff requirements memorandum SRM-SECY-12-0025 (ADAMS Accession No. ML120690347), the NRC staff issued Orders EA-12-049 and EA-12-051.

2.1 Order EA-12-049 Order EA-12-049, Attachment 2, (ADAMS Accession No. ML12054A736) requires that operating power reactor licensees and construction permit holders use a three-phase approach for mitigating BDBEEs. The initial phase requires the use of installed equipment and resources to maintain or restore core cooling, containment and SFP cooling capabilities. The transition phase requires providing sufficient, portable, onsite equipment and consumables to maintain or restore these functions until they can be accomplished with resources brought from off site. The final phase requires obtaining sufficient offsite resources to sustain those functions indefinitely.

Specific requirements of the order are listed below:

1) Licensees or construction permit (CP) holders shall develop, implement, and maintain guidance and strategies to maintain or restore core cooling, containment, and SFP cooling capabilities following a beyond-design-basis external event.

2) These strategies must be capable of mitigating a simultaneous loss of all ac power and loss of normal access to the ultimate heat sink (UHS) and have adequate capacity to address challenges to core cooling, containment, and SFP cooling capabilities at all units on a site subject to this Order.

3) Licensees or CP holders must provide reasonable protection for the associated equipment from external events. Such protection must demonstrate that there is adequate capacity to address challenges to core cooling, containment, and SFP cooling capabilities at all units on a site subject to this Order.

4) Licensees or CP holders must be capable of implementing the strategies in all modes of operation.

5) Full compliance shall include procedures, guidance, training, and acquisition, staging, or installing of equipment needed for the strategies.

On August 21, 2012, following several submittals and discussions in public meetings with NRC staff, the Nuclear Energy Institute (NEI) submitted document NEI 12-06, "Diverse and Flexible Coping Strategies (FLEX) Implementation Guide," Revision O (ADAMS Accession No. ML12242A378) to the NRC to provide specifications for an industry-developed methodology for the development, implementation, and maintenance of guidance and strategies in response to the Mitigation Strategies Order. The NRC staff reviewed NEI 12-06 and on August 29, 2012, issued its final version of Japan Lessons-Learned Directorate (JLD) Interim Staff Guidance (ISG) JLD-ISG-2012-01, "Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events" (ADAMS Accession No. ML12229A174), endorsing NEI 12-06, Revision 0, with comments, as an acceptable means of meeting the requirements of Order EA-12-049, and published a notice of its availability in the Federal Register (77 FR 55230).

2.2 Order EA-12-051 Order EA-12-051, Attachment 2, (ADAMS Accession No. ML12054A679) requires that operating power reactor licensees and construction permit holders install reliable SFP level instrumentation. Specific requirements of the order are listed below:

All licensees identified in Attachment 1 to the order shall have a reliable indication of the water level in associated spent fuel storage pools capable of supporting identification of the following pool water level conditions by trained personnel: (1) level that is adequate to support operation of the normal fuel pool cooling system, (2) level that is adequate to provide substantial radiation shielding for a person standing on the spent fuel pool operating deck, and (3) level where fuel remains covered and actions to implement make-up water addition should no longer be deferred.

1. The spent fuel pool level instrumentation shall include the following design features:

1.1 Instruments

The instrumentation shall consist of a permanent, fixed primary instrument channel and a backup instrument channel. The backup instrument channel may be fixed or portable. Portable instruments shall have capabilities that enhance the ability of trained personnel to monitor spent fuel pool water level under conditions that restrict direct personnel access to the pool, such as partial structural damage, high radiation levels, or heat and humidity from a boiling pool.

1.2 Arrangement: The spent fuel pool level instrument channels shall be arranged in a manner that provides reasonable protection of the level indication function against missiles that may result from damage to the structure over the spent fuel pool. This protection may be provided by locating the primary instrument channel and fixed portions of the backup instrument channel, if applicable, to maintain instrument channel separation within the spent fuel pool area, and to utilize inherent shielding from missiles provided by existing recesses and corners in the spent fuel pool structure.

1.3 Mounting

Installed instrument channel equipment within the spent fuel pool shall be mounted to retain its design configuration during and following the maximum seismic ground motion considered in the design of the spent fuel pool structure.

1.4 Qualification

The primary and backup instrument channels shall be reliable at temperature, humidity, and radiation levels consistent with the spent fuel pool water at saturation conditions for an extended period.

This reliability shall be established through use of an augmented quality assurance process (e.g., a process similar to that applied to the site fire protection program).

1.5 Independence

The primary instrument channel shall be independent of the backup instrument channel.

1.6 Power supplies: Permanently installed instrumentation channels shall each be powered by a separate power supply. Permanently installed and portable instrumentation channels shall provide for power connections from sources independent of the plant ac and de power distribution systems, such as portable generators or replaceable batteries. Onsite generators used as an alternate power source and replaceable batteries used for instrument channel power shall have sufficient capacity to maintain the level indication function until offsite resource availability is reasonably assured.

1. 7 Accuracy: The instrument channels shall maintain their designed accuracy following a power interruption or change in power source without recalibration.

1.8 Testing

The instrument channel design shall provide for routine testing and calibration.

1.9 Display: Trained personnel shall be able to monitor the spent fuel pool water level from the control room, alternate shutdown panel, or other appropriate and accessible location. The display shall provide on-demand or continuous indication of spent fuel pool water level.

2. The spent fuel pool instrumentation shall be maintained available and reliable through appropriate development and implementation of the following programs:

2.1 Training

Personnel shall be trained in the use and the provision of alternate power to the primary and backup instrument channels.

2.2 Procedures

Procedures shall be established and maintained for the testing, calibration, and use of the primary and backup spent fuel pool instrument channels.

2.3 Testing and Calibration: Processes shall be established and maintained for scheduling and implementing necessary testing and calibration of the primary and backup spent fuel pool level instrument channels to maintain the instrument channels at the design accuracy.

On August 24, 2012, following several NEI submittals and discussions in public meetings with NRC staff, the NEI submitted document NEI 12-02, "Industry Guidance for Compliance With NRC Order EA-12-051, To Modify Licenses With Regard to Reliable Spent Fuel Pool Instrumentation," Revision 1 (ADAMS Accession No. ML12240A307) to the NRC to provide specifications for an industry-developed methodology for compliance with Order EA-12-051. On August 29, 2012, the NRC staff issued its final version of JLD-ISG-2012-03, "Compliance with Order EA-12-051, Reliable Spent Fuel Pool Instrumentation" (ADAMS Accession No. ML12221A339), endorsing NEI 12-02, Revision 1, as an acceptable means of meeting the requirements of Order EA-12-051 with certain clarifications and exceptions, and published a notice of its availability in the Federal Register (77 FR 55232).

3.0 TECHNICAL EVALUATION

OF ORDER EA-12-049 By letter dated February 28, 2013 (ADAMS Accession No. ML13070A011 ), South Texas Project Nuclear Operating Company (STPNOC, the licensee) submitted an Overall Integrated Plan (OIP) for South Texas Project, Units 1 and 2, (STP, South Texas) in response to Order EA 049.

By letters dated August 26, 2013 (ADAMS Accession No. ML13249A060), February 27, 2014 (ADAMS Accession No. ML14073A458), August 27, 2014 (ADAMS Accession No. ML14251A029), February 26, 2015 (ADAMS Accession No. ML15075A019), and August 26, 2015 (ADAMS Accession No. ML15251A208), the licensee submitted six-month updates to the OIP. By letter dated August 28, 2013 (ADAMS Accession No. ML13234A503), the NRC notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-049 in accordance with NRC Office of Nuclear Reactor Regulation (NRR) Office Instruction LIC-111, "Regulatory Audits" (ADAMS Accession No. ML082900195).

By letters dated January 29, 2014 (ADAMS Accession No. ML13339A736), and May 6, 2015 (ADAMS Accession No. ML15111A465), the NRG issued an Interim Staff Evaluation (ISE) and an audit report on the licensee's progress.

By letter dated February 17, 2016 (ADAMS Accession No. ML16067A088), the licensee reported that full compliance with the requirements of Order EA-12-049 was achieved, and submitted a Final Integrated Plan (FIP). By letter dated February 20, 2017 (ADAMS Accession No. ML17062A303), the licensee provided a supplement to the FIP.

3.1 Overall Mitigation Strategy to Order EA-12-049 describes the three-phase approach required for mitigating BDBEEs in order to maintain or restore core cooling, containment and SFP cooling capabilities.

The phases consist of an initial phase (Phase 1) using installed equipment and resources, followed by a transition phase (Phase 2) in which portable onsite equipment is placed in service, and a final phase (Phase 3) in which offsite resources may be placed in service. The timing of when to transition to the next phase is determined by plant-specific analyses.

While the initiating event is undefined, it is assumed to result in an extended loss of ac power (ELAP) with loss of normal access to the UHS. Thus, the ELAP with loss of normal access to the UHS is used as a surrogate for a BDBEE. The initial conditions and assumptions for the analyses are stated in NEI 12-06, Section 3.2.1, and include the following:

1. The reactor is assumed to have safely shut down with all rods inserted (subcritical).

2. The de power supplied by the plant batteries is initially available, as is the ac power from inverters supplied by those batteries; however, over time the batteries may be depleted.

3. There is no core damage initially.

4. There is no assumption of any concurrent event.

5. Because the loss of ac power presupposes random failures of safety-related equipment (emergency power sources), there is no requirement to consider further random failures.

Both units at STP are Westinghouse pressurized-water reactors (PWRs) with dry ambient pressure containments. The FIP describes the licensee's three-phase approach to mitigate a postulated ELAP event. The strategy is somewhat different during the flood event, although the initial actions are similar.

At the onset of an analyzed ELAP event, both reactors are assumed to trip from full power. The reactor coolant pumps (RCPs) coast down and flow in the reactor coolant system (RCS) transitions to natural circulation. Operators will take prompt actions to minimize RCS inventory losses by ensuring isolation of potential RCS letdown paths. Decay heat is initially removed by steaming from the steam generators (SGs) through the main steam safety valves, and makeup to the SGs is initially provided by each unit's turbine-driven auxiliary feedwater (TDAFW) pump taking suction from its auxiliary feedwater storage tank (AFWST). By 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> into the event, operators would begin a controlled cooldown and depressurization of the RCS by manually operating the SG power-operated relief valves (PORVs). An RCS cooldown and depressurization at less than 100 °F [degrees Fahrenheit] per hour will bring the units to a SG pressure of approximately 405 pounds per square inch gauge (psig) within 2 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> from the start of the event. Once RCS pressure decreases below the pressure of the nitrogen cover gas in the safety injection accumulators, the accumulators will passively inject borated water into the RCS. Holding SG pressure greater than 405 psig is intended to prevent excessive accumulator injection to the point where the nitrogen cover gas would be injected into the RCS.

The SGs are subsequently maintained at 405 psig while the operators prepare the FLEX diesel generators (DGs), which are pre-staged on the roof of the mechanical auxiliary building (MAB) of each unit, to power FLEX pumps and other equipment in Phase 2.

Following this initial cooldown, the licensee plans an additional depressurization of the SGs in order to further reduce RCS temperature and pressure. The accumulators will be isolated prior to this extended depressurization to prevent injection of nitrogen into the RCS. Power to the valves isolating the accumulators from the RCS is provided by the FLEX DGs. The FLEX SG makeup pumps are aligned to ensure that feedwater is available in the event that SG pressure decreases to the point that operation of the TDAFW pumps can no longer be sustained. The SG PORVs are opened further to start the additional depressurization of the SGs.

The water source for each TDAFW pump is initially from the AFWST at each unit. The licensee stated that an AFWST contains sufficient inventory for a minimum of 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> of RCS decay heat removal. Prior to emptying the AFWSTs, the operators will place one of the trailer-mounted diesel-driven (TMDD) pumps in service to refill the AFWSTs from the cleanest available water source. If clean water sources for refilling the AWFSTs are unavailable or depleted, the TMDD pump can be aligned to feed raw water from the essential cooling pond (ECP) or circulating water system to the suction of the TDAFW or SG FLEX makeup pumps.

Provided that the SGs have been depressurized sufficiently, the SGs can also be filled directly using the portable TMDD pumps via one of the two main feedwater lines.

During a flood event, the TMDD pumps cannot be deployed to refill the AFWSTs or the refueling water storage tanks (RWSTs) until the flood waters recede. Therefore, in a flood event, the AFWSTs will be refilled using water contained in the condensate deaerators (DA). The licensee stated that this should extend the capacity of the AFWSTs as the water source for decay heat removal from 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> to 47 hours5.439815e-4 days <br />0.0131 hours <br />7.771164e-5 weeks <br />1.78835e-5 months <br />. At that time the licensee concluded that the flood water level on site should decrease such that deployment of the TMDD pumps and other equipment would be possible.

Within the first hour of the event, de bus load stripping will be initiated to ensure safety-related battery life is extended to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Prior to battery depletion, one of the two pre-staged FLEX DGs will be connected to power the battery chargers and the FLEX pumps used in the Phase 2 mitigating strategies.

The primary strategy for RCS makeup and boron addition is to use the positive displacement pump (PDP) in each unit's chemical and volume control system (CVCS) to replenish the inventory in the RCS. Approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> into the event, the installed CVCS PDP can be placed into service with power supplied by the FLEX DG. The PDP would be aligned to take suction from either the RWST or the boric acid tanks (BATs). A pre-staged, motor driven FLEX pump serves as a backup for the RCS makeup. This FLEX pump is powered by the FLEX DG and would be aligned to take suction from the RWST.

The National Strategic Alliance of FLEX Emergency Response (SAFER) Response Centers (NSRCs) will provide additional equipment to supplement and backup the onsite FLEX equipment.

Each unit at STP has an SFP located in its respective fuel handling building. The SFPs will initially heat up due to the unavailability of the normal cooling system. Once bulk boiling starts in the SFP, the water level in the SFP would gradually diminish. The licensee would initiate makeup water by the existing reactor makeup water (RMW) pumps drawing from the reactor makeup water storage tanks (RMWSTs) and discharging into the pools through existing piping.

An alternate approach is available using a FLEX SFP makeup pump pre-staged in the "Train B" safety injection pump bay. The FLEX SFP makeup pumps would use water from their associated RWSTs and discharge into the pools using a combination of existing piping and hoses. The hoses would be placed directly over the edges of the pools or connected to spray nozzles. Both the RMW pumps and the FLEX SFP makeup pumps are powered by the FLEX DGs. Ventilation of steam generated from SFP boiling is accomplished by opening doors to establish a natural circulation path.

The licensee stated that no specific coping strategies are required to maintain the containment pressure and temperature below design limits during Phases 1, 2 and 3. Should an unexpected increase in containment pressure or temperature occur, the containment could be vented or cooled using installed equipment supported by generators supplied by the NSRC.

Below are specific details on the licensee's strategies to restore or maintain core cooling, containment, and SFP cooling capabilities in the event of a BDBEE, and the results of the staff's review of these strategies. The NRC staff evaluated the licensee's strategies against the endorsed guidance in NEI 12-06, Revision 0.

3.2 Reactor Core Cooling Strategies In accordance with Order EA-12-049, licensees are required to maintain or restore cooling to the reactor core in the event of an ELAP concurrent with a loss of normal access to the UHS.

Although the ELAP results in an immediate trip of the reactor, sufficient core cooling must be provided to account for fission product decay and other sources of residual heat. Consistent with endorsed guidance from NEI 12-06, Phase 1 of the licensee's core cooling strategy credits installed equipment (other than that presumed lost to the ELAP concurrent with loss of normal access to the UHS event) that is robust in accordance with the guidance in NEI 12-06. In Phase 2, robust installed equipment is supplemented by onsite FLEX equipment, which is used to cool the core either directly (e.g., pumps and hoses) or indirectly (e.g., FLEX electrical generators and cables repowering robust installed equipment). The equipment available onsite for Phases 1 and 2 is further supplemented in Phase 3 by equipment transported from the NSRCs.

To adequately cool the reactor core under ELAP conditions, two fundamental physical requirements exist: (1) a heat sink is necessary to accept the heat transferred from the reactor core to coolant in the RCS and (2) sufficient RCS inventory is necessary to transport heat from the reactor core to the heat sink via natural circulation. Furthermore, inasmuch as heat removal requirements for the ELAP event consider only residual heat, the RCS inventory should be replenished with borated coolant in order to maintain the reactor in a subcritical condition as the RCS is cooled and depressurized.

As reviewed in this section, the licensee's core cooling analysis for the ELAP concurrent with the loss of normal access to the UHS event presumes that, per endorsed guidance from NEI 12-06, both units would have been operating at full power prior to the event. Therefore, the SGs may be credited as the heat sink for core cooling during the ELAP concurrent with the loss of normal access to the UHS event. Maintenance of sufficient RCS inventory, despite ongoing system leakage expected under ELAP conditions, is accomplished through a combination of installed systems and FLEX equipment. The specific means used by the licensee to accomplish adequate core cooling during the ELAP concurrent with the loss of normal access to the UHS event are discussed in further detail below. The licensee's strategy for ensuring compliance with Order EA-12-049 for conditions where one or more units are shut down or being refueled is reviewed separately in Section 3.11 of this evaluation.

3.2.1 Core Cooling Strategy and RCS Makeup 3.2.1.1 Core Cooling Strategy 3.2.1.1.1 Phase 1 Per the analyzed ELAP event sequence described in the FIP, when power is lost, the reactor trips and the plant will temporarily stabilize at no-load RCS temperature and pressure conditions. As the RCPs coast down following the loss of power, natural circulation will develop in the RCS, with the SGs serving as a heat sink for core decay heat and other residual heat.

Initially, main steam safety valves (MSSVs) would lift to relieve pressure, releasing steam generated by residual heat from the reactor. Considering the MSSV minimum lift setpoint applicable to STP (1,285 psig), the licensee stated that the maximum post-trip RCS cold-leg temperature for the analyzed ELAP event could be up to 582 °F.

The TDAFW pump should automatically start to maintain SG water level. To compensate for inventory losses due to steaming, the TDAFW pump would provide auxiliary feedwater flow from the AFWST, its normal suction source. Each TDAFW pump is initially aligned to feed one of the four SGs per unit (i.e., the same SG from which its turbine draws steam). Upon recognition of a loss 'of all alternating current power, operators would commence implementation of Procedure OPOP05-EO-ECOO, "Loss of ALL AC Power." The staff reviewed Revision 26 of the procedure.

Per procedure, personnel would be dispatched locally to re-align AFW flow to all SGs to allow for a symmetric cooldown. The licensee's FIP indicated that this action should be accomplished within 40 minutes. According to the licensee, under analyzed ELAP event conditions, this action should prevent overfill of the SG supplied by the TDAFW pump and further prevent the three initially unfed generators from experiencing dryout. Following realignment, operators would continue to manually control the flowrate of the TDAFW pump locally.

As described in the licensee's FIP, the analyzed ELAP event would result in the SG PORVs failing closed. In response, operators would be directed to restore power to the SG PORV control circuitry to allow operation of the SG PORVs from the control room. With control power restored, the SG PORVs would be opened to reduce SG pressure to between 1, 130 and 1, 190 psig, such that further lifting of the MSSVs would not occur. Maintaining SG pressure near the center of this control band would result in an RCS cold leg temperature of approximately 565 °F.

Local manual operation of SG PORVs may be used as a backup method of control if remote operation from the control room cannot be accomplished, or after hydraulic pressure is depleted.

An additional RCS cooldown and depressurization would be initiated using the SG PORVs by 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> into the ELAP event. The cooldown would proceed at a rate less than 100 °F/hr and terminate at a minimum SG pressure of 405 psig. This SG pressure should correspond to an RCS cold-leg temperature of approximately 450 °F. The licensee performed calculations to determine that a SG pressure of 405 psig should result in an RCS pressure high enough to prevent the nitrogen cover gas in the safety injection accumulators from entering the RCS. The NRC staff audited the licensee's calculations and found the results to be reasonable for the analyzed ELAP event.

3.2.1.1.2 Phase 2 In Phase 2, core cooling would initially continue using the same strategy as used for Phase 1.

However, the supplement letter to the licensee's FIP (ADAMS Accession No. ML17062A303) states that, by 8.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> into the event, plant operators would initiate an extended RCS cooldown such that the RCS cold leg temperature would be maintained below 360 °F within 1 o hours following the ELAP event. An extended cooldown to this temperature range would help maintain the integrity of the RCP seals. As discussed in Section 3.2.3.3 of this evaluation, the potential exists for RCP seals to experience material degradation resulting from hydrothermal corrosion of the ceramic material used to fabricate the first-stage seal faceplates. The cooldown to a cold leg temperature below 360 °F would reduce the RCP seal temperature below the threshold at which the hydrothermal corrosion reaction can effectively proceed.

Prior to performing the additional Phase 2 cooldown and depressurization, actions would be taken to establish FLEX SG makeup pumps and isolate the safety injection accumulators.

These actions should be completed by 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> into the event such that the Phase 2 cooldown can proceed. A transition to FLEX equipment for SG makeup at this juncture may be necessary because the extended RCS cooldown could reduce SG pressures to the point that they approach, or fall below, the minimum pressure recommended for TDAFW pump operation. The FLEX SG makeup pumps would take suction from the AFWST and inject into the AFW discharge cross-connect piping. As shown in the licensee's FIP, the FLEX SG makeup pumps have been installed inside the isolation valve cubicle in each unit in the C-train and B-train bays.

However, the suction and discharge connections are flanged off and would need to be connected to installed piping with a temporary hose or spool piece in the event of an ELAP.

When operators transition the core cooling function to FLEX equipment, one of the two FLEX SG makeup pumps would be started and aligned to feed all SGs before securing the TDAFWP.

The licensee calculated that the AFWST should provide a sufficient source of AFW for at least 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> of decay heat removal during the analyzed ELAP event. As such, makeup to the AFWST should not be required until Phase 3 equipment has begun to arrive onsite. As required, either a TMDD pump or an NSRC-supplied pump could be used to refill the AFWST using water from the ECP (or from a preferred source of cleaner water if available).

Alternatively, the licensee stated that the portable TMDD pumps could be used to fill the SGs directly, once they have been sufficiently depressurized. Per the FIP, the rated flow of the TMDD pumps exceeds 1,000 gallons per minute (gpm) at 175 psig. The TMDD pumps can take water from multiple sources including outside water tanks, the ECP, or underground circulating water piping. If operators desire to use the TMDD pumps to provide SG makeup, they would connect the pumps to one of two main feedwater lines. Two FLEX TMDD pumps are stored in the FLEX storage buildings, and the licensee's FIP notes that a third pump and a hose trailer are stored inside the protected area. As discussed in Section 3.2.2 of this evaluation, because flooding could delay implementation of the TMDD pumps, the licensee's strategy for refilling the AFWST during the analyzed flooding event would rely on inventory from the condensate deaerator until floodwaters recede.

3.2.1.1.3 Phase 3 The licensee stated that it would continue cooling the RCS in Phase 3 using the strategy described above for Phase 2. The licensee's FIP states that the initial delivery of Phase 3 equipment to the site will occur within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of notification of an ELAP event. In particular, the NSRC will provide backup low-pressure, medium-flow pumps that can be used to provide makeup flow to the SGs. The NSRC will also provide 4.16-kV combustion turbine generators and AC distribution centers that can be used to repower motor-driven AFW pumps, as well as other equipment located on the same electrical bus. The licensee did not request water purification equipment from the NSRC. Instead, the licensee calculated that raw water could be used for at least one year prior to unacceptably fouling the steam generators. As discussed in Section 3.2.2.2 of the FIP, the licensee provided a list of various water sources that would take precedence over the ECP, which is listed as the last resort for supplying makeup water to the SGs if the other water sources are unavailable. The operators will be directed by FSGs to identify and supply makeup water from the surviving cleaner water sources for SG makeup prior to using the ECP. The NRC staff concluded that the diverse locations of the water sources on site with higher quality available would delay the use of raw water for core cooling through the SGs. The ECPs would however provide at least additional inventory to continue core cooling throughout Phase 3 until additional higher quality water is made available for makeup.

3.2.1.2 RCS Makeup Strategy 3.2.1.2.1 Phase 1 Under ELAP conditions, RCS inventory would tend to diminish gradually due to leakage through reactor coolant pump (RCP) seals and other leakage points. Furthermore, implementing the RCS cooldown strategy prescribed in the licensee's ELAP mitigation procedures would result in a significant contraction of the RCS inventory, to the extent that the pressurizer would drain and a vapor void would form in the upper head of the reactor vessel. Despite the presence of upper head voiding, natural circulation flow should continue in the RCS for the analyzed ELAP event.

As typical of operating PWRs, prior to implementing the Phase 2 FLEX strategy, STP does not have a fully robust capability for active RCS makeup in a beyond-design-basis ELAP event.

However, the licensee determined that sufficient reactor coolant inventory would be available throughout Phase 1 to support heat transfer to the SGs via natural circulation without crediting active injection of RCS makeup.

To minimize the loss of RCS inventory, the licensee's procedure for mitigating a loss of all ac power (i.e., OPOP05-EO-ECOO) directs isolation of RCS letdown pathways. Even after closure of isolable connections, some loss of RCS inventory would be expected to continue via RCP seal leakage as well as operational leakage. Passive injection from the safety injection accumulators would occur as operators depressurize the RCS below the nitrogen cover gas pressure, which should help offset ongoing RCS leakage and cooldown-induced RCS inventory contraction. As discussed further in Section 3.2.3.2 of this evaluation, the licensee's analysis determined that the plant should be capable of maintaining natural circulation flow without experiencing two-phase flow at the RCP seal inlets or transitioning to reflux cooling in the RCS for at least 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> following the analyzed ELAP event.

In addition to providing inventory to the RCS, passive injection from the safety injection accumulators would result in the addition of boron. According to the NEI 12-06 guidance, sufficient shutdown margin should be available to maintain the reactor adequately shut down during Phase 1, considering the planned cooldown profile.

3.2.1.2.2 Phase 2 As described above, by 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> into the event, an extended RCS cooldown will begin from a SG pressure of 405 psig and terminate once an RCS cold leg temperature of 360 °F is reached.

Per STPNOC's FIP, RCS makeup will be established within 1 O hours of the initiation of the ELAP event. The RCS makeup will be provided using either an installed PDP in the eves or via a FLEX RCS makeup pump.

The licensee's primary approach for providing RCS makeup would be to rely on a FLEX DG to repower the permanently installed CVCS PDP, which would take suction from the BATs or the RWST and discharge to the CVCS charging line. According to the licensee's FIP, the CVCS PDP can supply a flow of 35 gpm at a pressure of up to 3, 100 psig. The complement of eves pumps at STP consists of two centrifugal charging pumps and one PDP for each unit. Since the licensee's strategy for repowering equipment only applies to the PDP, FLEX equipment is used to provide a backup method of RCS makeup. During the audit, the licensee confirmed that no additional supporting systems (e.g., to supply cooling for bearings or lubricating oil) are required for the CVCS PDP to function under ELAP conditions.

The licensee's backup strategy for providing RCS makeup is to use a FLEX RCS makeup pump that can provide a flow of 70 gpm at 700 psig. The FLEX RCS makeup pump would draw suction from the RWST and inject into the RCS via the SI line. As shown in the licensee's FIP, the FLEX RCS makeup pump is installed in the Train 'A' SI pump bay, but its suction and discharge piping is flanged off and would need to be connected with a temporary hose or spool piece prior to use.

The provision of these two pumps allows diverse means for injecting RCS makeup during the ELAP event. However, as discussed further in Section 3.14.4 of this report, the licensee's approach of using installed pumps constitutes an alternative to the guidance in NEI 12-06.

3.2.1.2.3 Phase 3 The licensee stated that it would continue to provide RCS makeup in Phase 3 using the strategy described above for Phase 2. The licensee's FIP states that the initial delivery of Phase 3 equipment to the site will occur within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of notification of an ELAP event. In particular, the NSRC will provide high-pressure injection pumps as a backup means for providing RCS makeup. The licensee did not request mobile boration units from the NSRC. Instead, the licensee demonstrated that it has an onsite supply of purified, borated coolant that is sufficient to last for multiple days under analyzed ELAP conditions. Provided that the licensee completes its extended cooldown by 1 O hours into the event (as discussed further in Section 3.2.3.3 of this evaluation), the NRG staff estimated that the licensee's onsite supply of borated coolant should last approximately 1 O days, which provides the licensee sufficient time to locate additional sources of borated water.

3.2.2 Variations to Core Cooling Strategy for Flooding Event The limiting flooding event would significantly impede and even temporarily preclude the movement of personnel and equipment around the STP site. As a result, the FLEX equipment necessary for mitigation of the flooding event is installed or staged inside plant buildings. In addition, the licensee stated that the two units at STP are separated by over 600 feet (ft.), such that movement of personnel and equipment between units may be precluded. For this reason, as specified in the licensee's FIP, the licensee made the determination to provide redundant equipment (i.e., N+ 1) on a per-unit, rather than a site-wide, basis.

During the limiting flooding event, the floodwaters onsite would delay deployment of the FLEX TMDD pumps that are used to refill the AFWSTs with water from the ECP (or cleaner available water source). To support continuous makeup to the SGs in this scenario, the licensee plans to gravity-feed the inventory of the condensate DA to the AFWST. To accomplish this, operators would use hoses to connect the DA FLEX feedwater isolation valve to the auxiliary feedwater pump recirculation test drain line valve. The licensee would then vent the DA, allowing at least 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> of venting time to reduce DA pressure and temperature to atmospheric saturation conditions before draining the remaining liquid to the AFWST. The licensee performed analysis to determine the inventory lost from the DA due to liquid vaporization during the venting procedure. The licensee stated that inventory transfer would increase SG makeup by 148,000 gallons and extend the AFWST's capacity for providing SG makeup from 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> to 47 hours5.439815e-4 days <br />0.0131 hours <br />7.771164e-5 weeks <br />1.78835e-5 months <br /> in the analyzed ELAP event. The licensee concluded that the analyzed flooding event should have receded by this time, such that the FLEX TMDD pumps could then be used to supply water from the ECP (or other available source of cleaner water) to the SGs. However, the licensee further noted that the additional inventory present in the SGs would be sufficient to avoid SG dryout for an additional 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> for the analyzed ELAP event.

3.2.3 Staff Evaluations 3.2.3.1 Availability of Structures, Systems, and Components (SSCs)

Guidance document NEI 12-06 provides baseline assumptions presuming that, other than the loss of the ac power sources and loss of normal access to the UHS, installed equipment that is designed to be robust with respect to design-basis external events is assumed to be fully available. Installed equipment that is not robust is assumed to be unavailable. The baseline assumptions for the availability of SSCs for core cooling during an ELAP caused by a BDBEE are provided in the following subsections.

3.2.3.1.1 Plant SSCs Core Cooling The licensee provided descriptions in its FIP for the permanent plant SSCs to be used to support core cooling for Phase 1 and 2. The licensee described the TDAFW pumps, which are used to supply feedwater to the SGs during Phase 1, as being located in the isolation valve cubicles (IVCs) and protected from all applicable external hazards. The TDAFW pumps (one for each Unit) are safety-related, missile protected and seismically robust pumps. The TDAFW pumps automatically start and deliver AFW flow to the D-Train SG. Two de-powered steam supply valves supply steam to the TDAFW pump turbine. The licensee also described in the FIP the SG PORVs, which are safety-related and seismically robust valves. The SG PORVs are also located near the IVCs, and are protected from all applicable external hazards.

Based on the design and locations of the TDAFW pump, SG PORVs, the AFWST, and the diverse water sources as described in the FIP, the plant SSCs and water sources should be available to support core cooling during an ELAP caused by a BDBEE, consistent with Condition 4 of NEI 12-06, Section 3.2.1.3.

RCS Inventory Control The licensee described in its FIP that the CVCS PDP is used to provide RCS makeup after the ELAP condition has been declared. The CVCS PDPs (one in each Unit) take suction from either the RWST or BATs. The CVCS PDPs are found in the Unit's MAB, which is a Seismic Category 1 structure and is protected from all applicable external hazards. The CVCS PDPs are powered by the pre-staged FLEX DGs to a separate power distribution panel.

Based on the design and availability of the CVCS PDPs and its power source, as described in the FIP, a borated water source should be available to support RCS inventory control during an ELAP caused by a BDBEE, consistent with Condition 3 of NEI 12-06, Section 3.2.1.3.

3.2.3.1.2 Plant Instrumentation According to the licensee's FIP, the following key parameters are credited and available in the MCR, for all phases of reactor core cooling and makeup strategy:

Auxiliary Feedwater Flowrate SG Wide-range Water Level SG Pressure RCS Wide-range Hot-leg and Cold-leg Temperature RCS wide-range pressure Core Exit Thermocouple Temperature AFWST Level Pressurizer Level Reactor Vessel Water Level Excore Nuclear Instruments The instrumentation available to support the licensee's strategies for core cooling and RCS inventory during the ELAP event is generally consistent with, and in some cases exceeds, the recommendations specified in the endorsed guidance of NEI 12-06. As a result, the NRC staff considered the intent of the endorsed guidance to be satisfied.

Instructions in FLEX Support Guideline (FSG) 7, "Loss of Vital Instruments or Control Power,"

Revision 1, and FSG-20, "Alternate OOPS Parameter Monitoring," Revision 1, address obtaining critical parameters locally in the unlikely event that instrument power is unavailable. In addition, the licensee stated that FLEX equipment is provided with local instrumentation needed for operation.

3.2.3.2 Thermal-Hydraulic Analyses As described in the FIP, the mitigating strategy for STP is based on plant-specific analysis with the RETRAN-30 thermal-hydraulic code. The RETRAN-30 code and corresponding evaluation model were not assessed under the NRC staff's audit review of generic analytical methods for demonstrating compliance with Order EA-12-049. However, the generic NOTRUMP-based analytical modeling effort for Westinghouse PWRs developed by the PWROG, and the corresponding generic review conducted by the NRC staff, provide insight into the ELAP behavior expected for STP. As described in the FIP, plant-specific differences between STP and the generic reference plant motivated the licensee to base its strategy on additional simulations with RETRAN-30. Therefore, the adequacy of the RETRAN-30 code's capability to simulate the analyzed ELAP event for STP was considered during the NRC staff's audit of STP's mitigating strategies.

The RETRAN-30 code is an industry-developed, best-estimate thermal-hydraulic code for the analysis of transients at light-water reactors. Initial development on the RETRAN code family began in the mid-1970s and was based on the NRG-sponsored RELAP4/MOD3 code.

Significant development during the 1980s and 1990s led to the release of code versions which contained improved modeling capabilities (e.g., consideration of non-equilibrium two-phase flow and three-dimensional neutron kinetics). The RETRAN-30 code was developed in the 1990s and submitted to the NRC staff for review in 1998 as part of an evaluation model for performing design-basis safety analysis for analyzed events other than the loss-of-coolant accident (LOCA). Of particular interest to the ELAP event, RETRAN-30 expands upon the original three-field-equation homogeneous equilibrium model formulation, including options for four-and five-equation models that permit simulation of unequal phase velocities and temperatures (five-equation model only). In 2001, the NRC staff issued a safety evaluation (SE) for the RETRAN-30-based non-LOCA evaluation model, which contained a number of limitations and conditions on its application.

The PWR non-LOCA transients, for which application of the RETRAN-30-based evaluation model discussed above has been found acceptable by the NRC staff, primarily involve single-phase flow. In contrast, the beyond-design-basis ELAP event involves the potential for separated two-phase flow in a stratified RCS. As a result, the NRC staff concluded that application of the approved RETRAN-30 non-LOCA transient evaluation model to the ELAP event is beyond the scope of the NRC staff's previous review. Therefore, in support of its review of STP's mitigating strategy, the NRC staff requested that the licensee provide justification for applying the RETRAN-30 code to the analyzed ELAP event by (1) justifying the suitability of the key models of the RETRAN-30 code for simulating the ELAP event, (2) addressing the compliance of the ELAP evaluation model with applicable portions of the RETRAN-30 non-LOCA transient topical report and corresponding NRC staff SE, including applicable limitations and conditions, and (3) benchmarking the results of the RETRAN-30 ELAP simulations against suitable experimental data or other thermal-hydraulic codes with more-sophisticated two-phase flow models and more extensive validation in this regime.

In response to the NRC staff's request, the licensee submitted a white paper, "White Paper Demonstrating The Applicability Of The RETRAN-30 Code For Analysis Of The ELAP," dated August 21, 2014, addressing the applicability of the RETRAN-30 code for simulating the analyzed ELAP event at STP. The white paper addressed the NRC staff's information request and provided comparative calculations for the analyzed ELAP event at STP using similar input decks for the RETRAN-30 and RELAP5/M003.3 codes. Relevant aspects of the NRC staff's audit review of the white paper are discussed below:

The NRC staff's audit focused especially on the RETRAN-30 code models associated with the prediction of two-phase flow phenomena. In particular, the NRC staff observed that the licensee had performed the white paper calculations using the simplified 4-equation model, which augments the homogeneous equilibrium model by allowing for slip between the liquid and vapor phases. However, when both phases are present, thermal equilibrium is enforced, which influences the prediction of a number of phenomena that affect the ELAP event progression, including subcooled boiling and condensation. The NRC staff recognized the limitations associated with the use of the four-equation model for the two-phase flow conditions that may develop during later stages of the ELAP event. The NRC staff's audit review also noted that validation for the applicable drift-flux correlation in RETRAN-30 is incomplete for larger diameter RCS loop piping and plenums. Unlike typical PWR non-LOCA events, significant two-phase flow may be present in these large-diameter pipes and components during the later stages of an analyzed ELAP event. Furthermore, the NRC staff did not find the justification provided for not implementing the stacked bubble rise model in the STP simulations to be convincing (however, Revision 1 of the final calculations included limited implementation of this model). For the purpose of the STP audit, the NRC staff ultimately resolved to assess the impacts of the simplified two-phase flow modeling approach in its review of the benchmarking of the RETRAN-30 code predictions against those of the more-sophisticated models in RELAP5/M003.3.

The NRC staff observed that the boron-tracking model in RETRAN-30 was activated for the simulations in STP's white paper. Artificial numerical diffusiveness associated with the solute transport models in RETRAN-30 precludes the NRC staff from having confidence in its time-dependent prediction of the boron concentration in the RCS.

Instead, the NRC staff considered it appropriate to apply a 1-hour delay to the actual time at which boron would be added to the RCS, provided that sufficient natural circulation flow is present in the RCS, per the conditions imposed in the NRC staff's endorsement letter for the PWROG's boric acid mixing white paper (see Section 3.2.3.4 of this evaluation).

At the time when the white paper benchmarking calculations were performed, results from the PWROG's program to determine leakage rates for Westinghouse RCP seals under ELAP conditions were not available. Therefore, the white paper calculations relied upon an approximation of the expected seal leakage rate determined according to the choked flow models in the RELAP5/M003.3 code. For the purpose of comparison, the RELAP5/M003.3 seal leakage boundary condition was imposed into the RETRAN-30 calculation, rather than calculated. Although a reasonable estimate of the RCP seal leakage is sufficient for code-comparison purposes, the NRC staff concluded that the final calculations should consider a revised seal leakage rate boundary condition that appropriately reflects the best knowledge available. The output of the decay heat model used in the RETRAN-3D simulations appeared comparable to tabulated decay heat values in Table 6.2.1.3-6 of the STP Updated Final Safety Analysis Report (UFSAR) that had been calculated according to the 1979 version of the American Nuclear Society (ANS) 5.1 standard using a 2-sigma uncertainty allowance. In particular, for the time period over which the RETRAN-3D simulations were performed (i.e., 80,000 seconds, or approximately 22.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />), the RETRAN-3D output was slightly conservative relative to the values in the UFSAR.

The white paper provided in tabular form a list of the conditions and limitations specified in the NRC staff's SE on the RETRAN-3D non-LOCA evaluation model, as well as a justification that the present application of RETRAN-3D to the analyzed ELAP event for STP is compliant with the specified conditions. Due to significant differences in the nature of non-LOCA transients as compared to the beyond-design-basis ELAP event, and further considering the specific models activated in the ELAP analysis for STP, not all of the limitations and conditions from the NRC staff's SE for the RETRAN-3D non-LOCA evaluation model were found directly applicable to STP's ELAP analysis. The NRC staff's audit concluded that the intent of the applicable limitations and conditions was generally followed in the modeling of the beyond-design-basis ELAP event for STP, and did not identify additional deviations that would reduce confidence in the calculated results.

Similarly to its review of other codes used to analyze the ELAP event for PWRs (e.g.,

NOTRUMP, CENTS), the NRC staff questioned whether the RETRAN-3D code would provide reliable coping time predictions in the reflux cooling phase of the event because of challenges associated with modeling complex phenomena that could occur in this phase, including boric acid dilution in the intermediate leg loop seals, two-phase leakage through RCP seals, and primary-to-secondary heat transfer with two-phase flow in the RCS. In the Core Cooling Position Paper, provided in a letter dated January 30, 2013 (ADAMS Accession No. ML13042A010), the PWR Owners Group (PW ROG) recommended that the reflux or boiler-condenser cooling phase be avoided because of uncertainties in operators' ability to control natural circulation following reflux cooling and the impact of diluted pockets of water on criticality. Due to the challenge of resolving the above issues within the compliance schedule specified in Order EA-12-049, the NRC staff requested that PWR licensees provide makeup to the RCS prior to entering the reflux or boiler-condenser cooling phase of an ELAP, such that reliance on thermal-hydraulic code predictions during this phase of the event would not be necessary.

Accordingly, the allowable ELAP coping time prior to providing makeup to the RCS is limited to the duration over which the flow in the RCS remains in natural circulation, prior to the point where continued inventory loss results in a transition to the reflux or boiler-condenser cooling mode. In PWRs with inverted U-tube SGs, the reflux cooling mode is said to exist when vapor boiled off from the reactor core flows out the saturated, stratified hot legs and condenses on the SG tubes, with a fraction of the condensate subsequently draining back into the reactor vessel through the hot legs in countercurrent fashion. Quantitatively, STP has proposed using the same criterion for identifying the threshold for entry into reflux cooling as described in the PWROG-sponsored technical report PWROG-14064-P, Revision 0, "Application of NOTRUMP Code Results for Westinghouse Designed PWRs in Extended Loss of AC Power Circumstances," namely, the point at which the one-hour centered time-average of the flow quality passing over the SG tubes' U-bend exceeds one-tenth (0.1). As discussed further in Section 3.2.3.4 of this evaluation, a second metric for ensuring adequate coping time is associated with maintaining sufficient natural circulation flow in the RCS to support adequate mixing of boric acid. Based upon its audit of the licensee's analysis, the NRC staff considered the flow quality criterion of 0.1 to be appropriate for determining the threshold for entering reflux cooling in the RETRAN-3D analysis performed for STP. In any event, this criterion proved to be less limiting than the criterion for RCP seal inlet uncovery.

The PWROG-sponsored report WCAP-17601-P, "Reactor Coolant System Response to the Extended Loss of AC Power Event for Westinghouse, CE and B&W NSSS Designs,"

states that the seal package of the Westinghouse Model 1 OOA RCPs installed at STP is elevated several ft. above the centerline of the RCS cold leg. This characteristic is unique among domestic Westinghouse PWRs. As such, the existence of two-phase flow upstream of the RCP seals during an ELAP event was recognized as potentially occurring prior to the onset of reflux cooling. Subsequent thermal-hydraulic code calculations confirmed this expectation. The existence of two-phase flow at the inlet to the RCPs became a concern during the review because this condition had not been examined in previous RCP seal testing known to the NRC staff. Direct evidence was not available to confirm whether the RCP seal would behave in a stable manner under two-phase or single-phase vapor flow. Therefore the NRC staff concluded that, in the absence of evidence regarding Westinghouse RCP seal stability and long-term performance under two-phase or single-phase vapor inlet conditions, FLEX RCS makeup should be established prior to the uncovery of the RCP seal inlet.

The white paper provided comparative calculations for the analyzed ELAP event at STP using both the RETRAN-3D and RELAP5/MOD3.3 codes and similar input decks. As noted above, a placeholder boundary condition for seal leakage was assumed (similar in magnitude to that considered in WCAP-17601-P) for the purpose of completing the comparative calculations. As a result, while the specific times listed in the table below lack absolute significance, valid relative comparisons indicate that the RETRAN-3D code predicted key transition times for the STP ELAP event as occurring earlier than RELAP5/MOD3.3. The NRC staff further observed that reasonably good agreement exists regarding the codes' predictions for the first two transition times, which occur earlier in the event when single-phase flow phenomena dominate. However, as the ELAP event continues to progress into two-phase reflux cooling in the absence of RCS makeup, substantial divergence becomes evident. A detailed review of the cause of the divergence was not performed during the audit, and the underlying technical basis is not completely clear. Nevertheless, such divergence is not surprising, as discussed above, in light of the simplified two-phase flow modeling applied in the RETRAN-3D analysis.

RETRAN-30 RELAP5/MOD3.3 Time of RCP Seal Inlet Uncovery (hrs) 13.1 13.5 Time of RCS Loop Flow Decreasing Below 15.7 16.5 Single-Phase Natural Circulation Flow Rate (hrs)

Time of Reflux Cooling Entry (hrs) 17.9 24.9 Based upon its audit of the RETRAN-30 white paper, the NRC staff observed that simplifications in the modeling of two-phase flow phenomena in STP's RETRAN-30-based evaluation model may have significantly impacted its capability to predict the timing of reflux cooling. However, the predictive deviations observed with respect to the RELAP5/M003.3 code were in the conservative direction for the simulation performed for STP. Considering this information, the NRC staff concluded that, for STP, the RETRAN-30-based evaluation model could likely provide (1) a reasonable estimate of the time to seal inlet uncovery, which should occur for a Model 100 RCP with RCS natural circulation being dominated by single-phase flow phenomena, and (2) a conservative estimate of the time to reflux cooling, which should occur after the prediction of two-phase flow phenomena become dominant. Based on the limited review completed during the audit, the NRC staff considered this a plant-specific conclusion applicable solely to STP. In particular, causes of the discrepancies observed in the code comparison were not definitively identified such that a general conclusion could be made concerning the generic application of RETRAN-30 to the analyzed ELAP event for other reactors.

To address the NRC staff's concerns regarding the analytical modeling of RCP seal leakage, subsequent to completing the comparative analysis described in the white paper, the licensee conducted a final RETRAN-30 analysis of the ELAP event for STP. This analysis included a seal leakage boundary condition which reflected the final leakage rates determined by the PW ROG for a Westinghouse-style RCP seal for the applicable seal leakoff line configuration.

Two scenarios were included, which simulated the plant response to an ELAP event with and without implementation of the planned FLEX strategy. As a simplification, the licensee conservatively assumed a FLEX RCS injection capacity of 35 gpm at 700 psig. This injection capacity represents a conservative, and in reality mutually exclusive, combination of the primary (35 gpm at 3, 100 psig) and backup (70 gpm at 700 psig) FLEX RCS injection pumps. The licensee's calculation predicted that, in the absence of RCS makeup, RCP seal uncovery would first occur at 11.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> into the event, and entry into reflux cooling would first occur at 15.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> into the event. The analysis case that included FLEX RCS makeup per the licensee's mitigating strategy reflected successful mitigation of the ELAP event.

These analyses were reviewed by the staff during the audit process. The NRC staff made the following key observations:

Following accumulator isolation, the final analysis modeled the SGs being depressurized from approximately 420 psia [absolute pressure] to approximately 110 psia between 10 and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> into the event, with the SG PORVs then being gradually incremented to the full open position over the course of the next 1 O hours. Complete SG depressurization by 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> into the event is inconsistent with the licensee's emergency procedures, which call for depressurization of the SGs to be terminated such that RCS cold leg temperature remains at approximately 360 °F. The additional RCS cooldown modeled in the simulations (with accumulators isolated) resulted in several major effects, including (1) a reduction in the predicted time to reflux cooling, (2) overestimation of the free volume available in the RCS to accommodate the injection of borated coolant, and (3) overestimation of the cooldown-induced core reactivity increase. The second and third issues are discussed further in Section 3.2.3.4 of this evaluation.

The PWROG's seal leakage rates did not consider the potential for RCP seal hydrothermal corrosion. As discussed further in Section 3.2.3.3 of this evaluation, degradation due to hydrothermal corrosion can increase the RCP seal leakage rate, thereby decreasing the available time to cope with an ELAP event. Because the licensee's calculated coping times did not include the hydrothermal corrosion phenomenon, the NRC staff could not directly credit these times as being acceptable.

Rather, as discussed in Section 3.2.3.3, the NRC staff performed confirmatory RCS inventory balance calculations to determine an appropriate coping time for STP, prior to which, RCS makeup should be established.

The licensee specified accumulator parameters (i.e., pressure, water level) conservatively, rather than on a best-estimate basis. Biasing the calculation toward minimum accumulator injection adds conservatism (e.g., on the order of one hour) to the coping times predicted by the licensee.

Several instances of unexpected behavior were observed in the licensee's RETRAN-30 code results. For instance, the RCS subcooling margin was reported as a negative value in one plot. In another, the RCS flow was reported as not being in the reflux mode, despite the existence of a downcomer liquid level well below the cold leg minimum elevation. The licensee's final calculation report also discussed difficulties in achieving a stable numerical solution, which resulted in the need to deactivate momentum flux at several locations in the input deck. Such difficulties in simulating the slow-moving ELAP transient reinforce perceived limitations in the capabilities of STP's RETRAN-30-based evaluation model for predicting two-phase flow phenomena.

Based on the evaluation above, the NRC staff concluded that the licensee's analytical approach using the RETRAN-30 code should provide a reasonable estimate of the time to uncover the seal inlet of the Model 100 RCPs installed at STP during the analyzed ELAP event. The NRC staff noted, in particular for STP, that the time to RCP seal uncovery was the limiting criterion for setting the time to establish FLEX RCS makeup. Furthermore, although the time to reflux cooling for STP did not appear to be predicted realistically, the NRC staff observed that the RETRAN-30 evaluation model predicted this time conservatively relative to a thermal-hydraulic code with more-sophisticated two-phase flow models (i.e., RELAP5/M003.3). Finally, because the RCP seal leakage boundary condition examined in the licensee's thermal-hydraulic analysis did not account for hydrothermal corrosion, the NRC staff did not consider the licensee's calculated results as directly applicable to the analyzed ELAP event. The expected impact of hydrothermal corrosion on these results is addressed in the following section of this evaluation.

3.2.3.3 Reactor Coolant Pump Seals Leakage from RCP seals is among the most significant factors in determining the duration that a pressurized-water reactor can cope with an ELAP event prior to initiating RCS makeup. An ELAP event would interrupt cooling to the RCP seals, potentially resulting in increased leakage and the failure of elastomeric o-rings and other components, which could further increase the leakage rate. As discussed above, as long as adequate inventory is maintained in the RCS, natural circulation can effectively transfer residual heat from the reactor core to the SGs and limit local imbalances in boric acid concentration. Along with cooldown-induced contraction of the RCS inventory, cumulative leakage from RCP seals governs the duration over which natural circulation can be maintained in the RCS. Furthermore, the seal leakage rate at the depressurized condition can be a controlling factor in determining the flow capacity requirement for FLEX pumps to offset ongoing RCS leakage and recover adequate system inventory.

The Model 100 RCPs at STP originally used standard three-stage Westinghouse seal packages. The original seals have been replaced with an equivalent Westinghouse-style RCP seal supplied by AREVA. Recent assessments of RCP seal leakage behavior under ELAP conditions by industry analysts and NRC staff identified several issues with the original treatment of seal leakage from standard Westinghouse-designed seal packages. These issues are documented in the Westinghouse Nuclear Safety Advisory Letter (NSAL) 14-1, dated February 10, 2014. The NSAL 14-1 document states that (1) the initial post-trip leakage rate of 21 gpm does not apply to all Westinghouse pressurized-water reactors due to variation in seal leakoff line hydraulic configurations; (2) according to test data, seal leakage does not appear to decrease with pressure as rapidly as predicted by the analysis in WCAP-17601-P; and (3) some reactors (including STP) may experience post-trip cold leg temperatures in excess of 550 °F, depending on the lowest main steam safety valve lift setpoint. To address these issues, the PWROG performed additional analytical calculations using Westinghouse's seal leakage model (i.e., ITCH SEAL). These calculations included (1) benchmarking calculations against available test data and (2) additional generic calculations for several groups of plants (categorized by similarity of first-stage seal leakoff line design) to determine the maximum leakage rates, as well as the maximum pressures that may be experienced in the first-stage seal leakoff line piping.

In support of beyond-design-basis mitigating strategy reviews, the NRC staff performed an audit of the PWROG's generic effort to determine the expected seal leakage rates for Westinghouse RCPs under loss-of-seal-cooling conditions. A key audit issue was the capability of Westinghouse's ITCHSEAL code to reproduce measured seal leakage rates under representative conditions. Considering known testing and operational events according to their applicability to the thermal-hydraulic conditions associated with the analyzed ELAP event, the benchmarking effort focused on comparisons of ITCHSEAL simulations to data from WCAP-10541-P, "Reactor Coolant Pump Seal Performance Following a Loss of All AC Power, which documents an RCP seal leakage test performed in the mid-1980s at Electricite de France's Montereau facility. Comparisons of analytical results to the Montereau data indicated that, while the ITCHSEAL code could not simultaneously obtain good agreement with respect to RCS pressure, the leakage rate simulated by ITCHSEAL <:;ould be tuned to reproduce the measured seal leakage rate data. Subsequent to the benchmarking effort, data from an additional RCP seal leakage test at the Montereau facility that had not been documented in WCAP-10541-P was brought to the staff's attention. The leakage rate during this test was significantly higher than that of the test in WCAP-10541-P that had been used to benchmark the ITCH SEAL code.

However, conservative margin was identified in the ITCHSEAL analyses (e.g., PWROG-14015-P, "No. 1 Seal Flow Rate for Westinghouse Reactor Coolant Pumps Following Loss of All AC Power, Task 2: Determine Seal Flow Rates," and PWROG-14027-P, "No. 1 Seal Flow Rate for Westinghouse Reactor Coolant Pumps Following Loss of All AC Power, Task 3: Evaluations of Revised Seal Flow Rate on Time to Enter Reflux Cooling and Time at which the Core Uncovers"), which the staff expects should offset the potential for increased leakage rates observed in the additional Montereau test.

In conjunction with the revised seal leakage analysis that Westinghouse performed for the first-stage seal, as described above, the PWROG's generic effort also sought to demonstrate that the second-stage seal would remain fully closed during an ELAP event. If the second-stage seal were to open, additional leakage past the second-stage seal could add to the first-stage seal leakoff line flow that has been considered in the licensee's evaluation. Previous calculations documented in WCAP-10541-P indicated that second-stage seal closure could be maintained under the set of station blackout conditions and associated assumptions analyzed therein. Recent calculations performed by Westinghouse and AREVA in support of PWR licensees' mitigating strategies indicated that both vendors also expected the second-stage seals essentially to remain closed throughout the ELAP event, even when the RCS is cooled down and depressurized in accordance with a typical mitigating strategy. Contrary to these analytical calculations, two recent RCP seal leakage tests performed as part of AREVA's seal development program (discussed further below) have indicated that the second-stage seals could open and remain open under ELAP conditions. This unexpected phenomenon occurred near the end of the tests and could not be fully understood and evaluated by the vendors or NRC staff, based upon the limited data available. While considering these limitations, the staff observed that the opening of the second-stage seal did not appear to result in an increase of the total rate of leakage measured during the two AREVA tests.

On March 3, 2015, Westinghouse issued Technical Bulletin (TB) 15-1, "Reactor Coolant System Temperature and Pressure Limits for the No. 2 Reactor Coolant Pump Seal." Through TB 15-1, Westinghouse communicated to potentially affected customers that long-term integrity of Westinghouse-designed second-stage RCP seals could not be supported by the available analysis, and recommended that affected plants execute an extended cooldown of the RCS to less than 350 °F and 400 psig by 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> into the ELAP event. In particular, second-stage seal integrity appears necessary to ensure that leakage from Westinghouse-designed RCP seals can be limited to a rate that can be offset by the FLEX equipment typically available for RCS injection under ELAP conditions. According to the strategy submitted in the licensee's FIP, within approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of event initiation, STP should comply with the temperature and pressure values recommended in TB 15-1.

In addition, the NRC staff audited information associated with the recent RCP seal leakage testing performed by AREVA, which showed a gradual increase in the measured first-stage seal leakage rate. Post-test inspection and analysis linked this leakage increase to hydrothermal corrosion {likely assisted by flow erosion) of the silicon nitride ceramic used to fabricate the first-stage seal faceplates currently in operation in Westinghouse-designed RCP seals. This specific material degradation phenomenon would not have been present in the Montereau testing because that test article's faceplates were fabricated from aluminum oxide (consistent with the seals of actual Westinghouse-designed RCPs of that era). However, hydrothermal corrosion of silicon nitride became an audit focus area because the test data indicates that the long-term seal leakage rate could exceed the values assumed in licensees' analyses. Academic research reviewed by the industry and NRC staff associated with this general phenomenon indicates that the corrosion rate is temperature dependent and thus could be terminated by cooling down the RCS sufficiently.

From the limited information available regarding the recent AREVA tests, as well as several sensitivity calculations performed by the NRC staff during the audit, the NRC staff concluded that ( 1) the leakage rate for silicon-nitride RCP seals may be lower initially than analytically predicted by the PWROG's generic analysis using ITCHSEAL, (2) in general, the RCP seal leakage rates during Phase 2 and/or Phase 3 of the ELAP event may increase beyond the long-term rate predicted analytically by the PWROG, and (3) certain aspects of the seal behavior observed in the AREVA tests did not appear consistent with the expected behavior based on models and theory that formed the basis for the WCAP and PW ROG reports discussed above.

The NRC staff considered the above information from its generic review of Westinghouse-designed RCP seals in reviewing the RCP seal leakage rates assumed for STP. The PWROG's program to determine the expected leakage rate from Westinghouse RCP seals had classified participating plants into generic analysis categories on the basis of characteristic features of their leakoff lines. Although the hydraulic characteristics of the STP leakoff line were within the range considered applicable for Category 1, in light of its unique cooldown profile for the analyzed ELAP event, an STP-specific Category 6 was defined. Because Category 6 consisted of a single plant, this analysis case included increased plant-specific detail regarding the actual leakoff line configuration. In its thermal-hydraulic analysis, the licensee defined the RCP seal leakage rate boundary condition to be the maximum value at any given pressure from Categories 1 and 6. During the audit, the licensee confirmed that the PWROG's analytical assumptions used in the leakage rate calculations for Category 6 were representative of STP.

The licensee further confirmed during the audit that the piping and components in the first-stage seal leakoff line, up to and including the flow orifice, are capable of withstanding pressures up to the RCS design pressure (i.e., 2,500 psia). The licensee, however, did not characterize the capability of piping and components in the leakoff line downstream of the flow orifice to maintain their integrity in response to the transient pressure and temperature conditions expected downstream of the flow orifice. In this regard, the NRC staff noted that the leakoff line flow orifice may unchoke during the extended SG depressurization that, according to the licensee's original cooldown profile, targeted a final RCS hot leg temperature below 315 °F. As a result, due to the undetermined potential for rupture of the piping or components in the leakoff line downstream of the flow orifice (i.e., particularly during the initial pressurization transient), the NRC staff concluded that the expected RCP seal leakage rates during the ELAP following the extended RCS depressurization should consider the impact of a potential rupture on the (unchoked) flow rate through the leakoff line.

Achieving the seal leakage rates determined in the PWROG program depends upon the integrity of the elastomeric o-rings used to seal secondary gaps in the RCP seal pressure boundary. Should o-ring failures occur during the analyzed ELAP event, then the RCP seal leakage rate would generally be expected to increase, with the magnitude dependent upon the specific failure location and mechanism. The performance of the RCP seal o-rings was an open item at the conclusion of STP's onsite audit. In its FIP, the licensee responded to the open item by stating that Westinghouse has documented that RCP seal o-rings can withstand temperatures of 583 °F for periods longer than 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />. However, the NRC staff understood that the RCP seals and at least some o-rings currently installed at STP were manufactured by AREVA; thus, these AREVA-manufactured o-rings were not within the scope of the information referenced in the FIP. After considering additional information provided by AREVA on this topic, the NRC staff pursued several questions regarding the scaling of the tests used by AREVA to demonstrate adequate endurance of its o-rings. Ultimately, the staff's audit review concluded that these test scaling questions are addressed for the analyzed ELAP event for STP due to (1) the presence of sufficient compensating conservatisms in the o-ring testing conducted by AREVA and (2) the timely implementation of an RCS cooldown at STP.

As noted previously, the licensee's calculations to justify that its mitigating strategy would be capable of providing adequate RCS makeup to compensate for volumetric contraction and ongoing system leakage during an analyzed ELAP event did not account for the potential for hydrothermal corrosion to increase seal leakage, as was demonstrated during recent tests performed by AREVA. As a result, the NRC staff did not have confidence in the specific times calculated by STP for items in the sequence of events that are strongly correlated with RCP seal leakage - for example, the times to RCP seal inlet uncovery (11.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />) and reflux cooling (15.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />). To estimate the impact to these times with the hydrothermal corrosion phenomenon explicitly considered according to the best information currently available, the NRC staff performed confirmatory calculations during the audit. The NRC staff's confirmatory calculations indicated that long-term increases in leakage due to hydrothermal corrosion would not be expected to significantly affect the time to RCP seal inlet uncovery (11.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />).

However, the predicted time of entry into reflux cooling (12.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />) was markedly reduced.

These times both exceed the time at which FLEX RCS injection would be initiated per the licensee's mitigating strategy (1 O hours). Nevertheless, in the circumstance that FLEX RCS injection were provided by the 35-gpm CVCS PDP, based upon the RCS cooldown profile described in the FIP (the profile was subsequently revised), the NRC staff expects that the total RCS leakage rate would eventually exceed the available FLEX injection capacity. As a result, though FLEX RCS injection flow from the CVCS PDP would extend the times to seal inlet uncovery and reflux cooling, the capacity of this pump would ultimately be insufficient to assure that the gradual loss of RCS inventory can be arrested such that the analyzed ELAP event would be successfully mitigated (using the original cooldown profile).

Apropos of this adverse long-term RCS mass flow imbalance, the licensee's FIP states that conducting an extended depressurization of the SGs should reduce the reactor pressure sufficiently to allow the relief valve in the RCP first-stage seal leakoff line to reseat. According to the licensee, the expected time at which the relief valve would reseat is approximately 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> into the event. Should this valve reclose, the licensee argued that RCP seal leakage would essentially be terminated, thereby reducing RCS leakage well below the capacity of either the primary or alternate FLEX RCS injection strategies. However, for the reasons below, the NRC staff did not agree with the licensee's position that the leakoff line relief valve will reclose during the analyzed ELAP event and terminate all RCP seal leakage:

Insufficient basis was presented to support the conclusion that the relief valve would not experience consequential failure as a result of potential exposure to conditions beyond its designed operating range. For example, the relief valve has a lift setpoint of approximately 150 psig; whereas, during the ELAP event, the RCP first-stage seal cavity would experience a severe transient condition with pressures potentially in the vicinity of 2,000 psig. Although judgment indicates that this peak pressure would be attenuated somewhat by the leakoff line flow orifice, nevertheless, the relief valve would be exposed to a significant transient. Subsequently, the relief valve would continue to be exposed to high pressures and temperatures and may be cycled repeatedly by two-phase flow over a period of 10-15 hours prior to the extended RCS depressurization. The capability of leakoff line relief valves to reclose after these severe duty conditions was not addressed in the PWROG's generic seal leakage program, nor was sufficient plant-specific information provided during the NRC staff's audit of STP to address the issue.

The licensee's prediction of the timing of relief valve reclosure was not adequately justified. The RCS pressure as a function of time depends on, not only the SG pressure, but a number of other factors, including the rate of heat losses (especially from the reactor vessel upper head), the rates of RCS leakage and venting, and the rate of FLEX injection. The licensee's analytical results considered a limited subset of the possible combination of variables, which did not provide sufficient information to understand the range of conditions that may be expected in an analyzed ELAP event. As a result, even if the relief valve were capable of reclosing, it is unclear that STP would not experience pump suction inlet uncovery or reflux cooling prior to the relief valve reseating.

As noted above, although the licensee provided sufficient basis during the audit to support the conclusion that piping and components in the first-stage seal leakoff line up to and including the flow orifice would not experience a loss of integrity during an analyzed ELAP event, analogous information was not provided or reviewed regarding the piping and components downstream of the flow orifice. In order to terminate RCP seal leakage the integrity of this piping must also be assured; otherwise, regardless of the position of the relief valve, leakoff flow from the first-stage seal may continue, flowing directly into containment through the ruptured leakoff line.

Following additional audit discussions with the NRC staff, the licensee submitted a supplement to its FIP (ADAMS Accession No. ML17062A303) that committed to implement an RCS cooldown within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of the initiation of the ELAP event to decrease the RCS cold leg temperature below 360 °F within 1 O hours of the initiation of the ELAP event. In light of the concerns identified above regarding the licensee's capability to provide sufficient RCS makeup to compensate for the expected rate of RCP seal leakage, the NRC staff performed confirmatory RCS inventory balance calculations which assumed that an RCS cooldown sufficient to decrease the cold leg temperature below 360 °F is completed by 1 O hours into the analyzed ELAP event. In this case, the NRC staff's confirmatory calculations concluded that, even if the first-stage leakoff line relief valve does not reseat, the overall RCS inventory balance for the analyzed ELAP event could be stabilized, such that both RCP seal inlet uncovery and reflux cooling could be avoided.

Therefore, based upon the discussion above, the NRC staff concludes that the licensee should have sufficient RCS makeup capacity to compensate for the expected rate of RCP seal leakage for the analyzed ELAP event.

3.2.3.4 Shutdown Margin Analyses In an analyzed ELAP event, the loss of electrical power to control rod drive mechanisms is assumed to result in an immediate reactor trip with the full insertion of all control rods into the core. The insertion of the control rods provides sufficient negative reactivity to achieve subcriticality at post-trip conditions. However, as the ELAP event progresses, the shutdown margin for PWRs is typically affected by several primary factors:

the cooldown of the RCS and fuel rods adds positive reactivity the concentration of xenon-135, which (according to the core operating history assumed in NEI 12-06) would o

initially increase above its equilibrium value following reactor trip, thereby adding negative reactivity o

peak at roughly 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> post-trip and subsequently decay away gradually, thereby adding positive reactivity the passive injection of borated makeup from nitrogen-pressurized accumulators due to the depressurization of the RCS, which adds negative reactivity At some point following the cooldown of the RCS, PWR licensees' mitigating strategies generally require active injection of borated coolant via FLEX equipment. In many cases, boration would become necessary to offset the gradual positive reactivity addition associated with the decay of xenon-135; but, in any event, borated makeup would eventually be required to offset ongoing RCS leakage. The necessary timing and volume of borated makeup depend on the particular magnitudes of the above factors for individual reactors.

The specific values for these and other factors that could influence the core reactivity balance that are assumed in the licensee's current calculations could be affected by future changes to the core design. However, NEI 12-06, Section 11.8 states that "[e]xisting plant configuration control procedures will be modified to ensure that changes to the plant design... will not adversely impact the approved FLEX strategies." Inasmuch as changes to the core design are changes to the plant design, the staff expects that any core design changes, such as those considered in a core reload analysis, will be evaluated to determine that they do not adversely impact the approved FLEX strategies, especially the analyses which demonstrate that recriticality will not occur during a FLEX RCS cooldown. The licensee's FIP indicates that STP performs cycle-specific analysis to determine boron requirements as a function of RCS temperature at different times in the operating cycle. The licensee stated that the generation of these boration curves, which are part of the STP reload SE process, would be used to ensure that the reactor core would maintain adequate shutdown margin throughout the analyzed ELAP event for future operating cycles. The licensee stated during the audit that the reactivity impact associated with the abandoned control rod assembly in core position D-6 at Unit 1 has been accounted for in determining the required shutdown margin for the ELAP event.

The NRC staff requested that the industry provide additional information to justify that borated makeup would adequately mix with the RCS volume under natural circulation conditions potentially involving two-phase flow. In response, the PWROG submitted a position paper, dated August 15, 2013 (withheld from public disclosure due to proprietary content), which provided test data regarding boric acid mixing under single-phase natural circulation conditions and outlined applicability conditions intended to ensure that boric acid addition and mixing during an ELAP event would occur under conditions similar to those for which boric acid mixing data is available. By letter dated January 8, 2014 (ADAMS Accession No. ML13276A183), the NRC staff endorsed the above position paper with three conditions:

The required timing and quantity of borated makeup should consider conditions with no RCS leakage and with the highest applicable leakage rate.

Adequate borated makeup should be provided either (1) prior to the RCS natural circulation flow decreasing below the flow rate corresponding to single-phase natural circulation, or (2) if provided later, then the negative reactivity from the injected boric acid should not be credited until one hour after the flow rate in the RCS has been restored and maintained above the flow rate corresponding to single-phase natural circulation.

A delay period adequate to allow the injected boric acid solution to mix with the RCS inventory should be accounted for when determining the required timing for borated makeup. Provided that the flow in all loops is greater than or equal to the corresponding single-phase natural circulation flow rate, a mixing delay period of one hour is considered appropriate.

During the audit review, the licensee affirmed that STP will comply with the August 15, 2013, position paper on boric acid mixing, including the conditions imposed in the staff's corresponding endorsement letter. The NRC staff's audit review agreed that the second and third conditions should be satisfied by the licensee's mitigating strategy, since the licensee would initiate FLEX RCS makeup prior to RCS flow decreasing below the single-phase natural circulation flow rate, and the licensee's plan for initiating RCS makeup would allow a one-hour delay period for boric acid mixing.

However, the licensee's FIP did not provide sufficient description regarding how the shutdown margin analysis accounted for the appropriate range of RCS leakage conditions necessary to satisfy the endorsed white paper on boric acid mixing. Specifically, a case with no RCS leakage had not been adequately described. The licensee's FIP cites the RETRAN-30 analysis as its basis for demonstrating adequate shutdown margin. The RETRAN-30 analysis determined that injection of borated water from the accumulators, combined with the boron supplied by the RCS makeup pumps from the RWST or BA Ts, would be adequate to support an RCS cooldown to 300 °F within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of the event. According to the FIP, borated water would be injected into the RCS using FLEX equipment no later than 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> into the event, which is approximately one hour prior to the predicted time at which RCP seal inlet uncovery would occur in the absence of RCS makeup. In light of these results, the licensee's FIP stated that passive injection from the accumulators should ensure that the reactor core would remain subcritical. However, the NRC staff's audit of the licensee's RETRAN-30 analysis showed that these simulations examined upper bound (in the absence of hydrothermal corrosion) RCS leakage cases. Whereas, for a no-leakage case, it is not clear that the quantity of passive accumulator injection credited by the licensee would occur within the necessary timeframe, nor is it clear that, absent RCS venting, sufficient free volume would be available in the RCS to permit the injection of the credited quantities of borated coolant from the accumulators and FLEX equipment. Furthermore, as noted above in Section 3.2.3.2, the NRC staff did not credit the RETRAN-30 predictions of boric acid mixing directly, inasmuch as the boric acid transport model in RETRAN-30 is overly diffusive. The NRC staff also observed that the licensee's thermal-hydraulic analysis resulted in RCS temperatures below 300 °F by approximately 15.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> into the event. At the time the analysis was terminated, the core inlet temperature was still decreasing and had reached a value of approximately 250 °F. The NRC staff noted that this aspect of the analysis was contrary to the licensee's existing procedures for mitigating an ELAP event and that the analysis did not provide assurance of adequate shutdown margin at this RCS temperature (e.g., in a no-leakage scenario).

Following further audit discussion concerning the adequacy of the licensee's shutdown margin analysis, the licensee identified an additional calculation that considered the shutdown margin required for a scenario with no RCS leakage. The NRG staff's audit review of this calculation found that, while the scenario did assume no RCS leakage, it also considered a more extensive RCS cooldown (e.g., SG PORVs fully opened at 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br />) than that specified in existing procedures for mitigating the analyzed ELAP event. This more-aggressive cooldown has two primary impacts: (1) it imparts additional positive reactivity to the core via the moderator and fuel temperature coefficients of reactivity and (2) it results in additional thermal contraction of the RCS inventory, which creates additional free volume for injecting borated coolant into the RCS.

These impacts are countervailing, and sufficient data and analysis was not presented by the licensee during the audit to determine which is dominant in general for STP. The NRG staff performed confirmatory calculations to estimate the impact of these effects for conditions the licensee stated are applicable to Unit 1 during Cycle 20. According to the NRG staff's estimate for this condition, sufficient pressurizer free volume should be available to inject the quantity of boron that is necessary to ensure adequate shutdown margin. However, depending upon the specific criteria and sequence of actions specified in the licensee's mitigating strategy procedures, RCS venting could still be necessary in order to maintain pressurizer level within its desired control band. The time required for operators to vent the RCS would need to be accounted for in the licensee's analysis to ensure that the mitigating strategy would be successful for the analyzed ELAP event. Because these factors were not explicitly considered in the licensee's current analysis, the NRG staff requested that the licensee revise its analysis to confirm specifically that the strategy it will use for mitigating the analyzed ELAP event will provide adequate shutdown margin.

Toward the end of an operating cycle, when RCS boron concentration reaches its minimum value, some PWR licensees may need to vent the RCS to ensure that their FLEX strategies can inject a volume of borated coolant that is sufficient to satisfy shutdown margin requirements in analyzed cases where minimal RCS leakage occurs. In addition to being desirable from the standpoint of limiting the potential for RCS pressure increases during FLEX injection, RCS venting may effectively become a practical necessity in an actual event due to the limited information available to plant operators. During the audit the licensee indicated that the safety-related reactor vessel upper head vent valves are de-powered and will remain available throughout the ELAP event. Procedure FSG-8 provides instructions for remote operation of the reactor head vents from the MCA under ELAP conditions to support the addition of borated coolant to ensure adequate reactor shutdown margin. However, the NRG staff also observed that both the licensee's FIP and thermal-hydraulic analyses discuss opening the pressurizer PORV to vent the RCS to control RCS temperature and pressure. In particular, following the refilling of the reactor pressure vessel upper head, the licensee considered PORV operation desirable to minimize RCS inventory losses while facilitating RCS depressurization sufficient to allow reseating of the relief valve on the RCP first-stage seal leakoff line.

Based upon its audit of the analyzed ELAP event at STP, however, the NRG staff concluded that venting the RCS using the pressurizer PORV would be unnecessary for the following reasons:

an ample supply of borated coolant is available onsite to allow for gradual RCS depressurization solely due to ambient heat loss from the pressurizer, which may obviate the need for venting the RCS, other smaller and more reliable vent paths are available if required, particularly the reactor vessel head vents, and as discussed above in Section 3.2.3.3, the NRC staff concluded that credit for reseating of the relief valve on the RCP first-stage seal leakoff line is not justified for STP under analyzed ELAP conditions.

Furthermore, from a risk-informed perspective, the NRC staff's audit concluded that operation of the pressurizer PORV during an ELAP event is undesirable inasmuch as:

controlling PORV operation may present a challenge to operators because the PORV flow area is significantly larger than necessary to vent the RCS, which could result in undesirable RCS pressure and temperature transients, failure of the PORV to reclose could lead to a significant loss of RCS inventory with both the emergency core cooling system and normal diagnostic instrumentation unavailable, and PORV failure could result in an uncontrolled cooldown and depressurization of the RCS.

In the FIP supplement (ADAMS Accession No. ML17062A303), the licensee stated that the FLEX procedures ensure that the PORV and block valve are energized prior to their use. The pressurizer PORV is powered from the safety-related de bus and its block valve receives power from the FLEX DG that powers MCC E1A2(E2A2) from FLEX distribution panel DP1000. The licensee stated that If the PORV does not close when the closing criteria is met, the block valve will be used to isolate the pressurizer PORV. Since the reactor vessel vent valves will be available for use, and the pressurizer PORV block valve can be closed if the PORV fails to close, the NRC staff finds this acceptable.

In the FIP supplement (ADAMS Accession No. ML17062A303), the licensee stated that it performed a preliminary boron analyses that models the revised cooldown strategy. The results of the preliminary re-analyses show that the licensee should maintain sufficient shutdown margin to the required critical boron concentration. The FIP supplement states that, after the re-analysis is completed to show that an early cooldown is acceptable, STPNOC will determine any additional or revised actions that could be required and will make the necessary procedure changes. The changes made by the analysis will be incorporated into the STPNOC FLEX timeline to ensure there are sufficient personnel to execute the FLEX strategies. STPNOC stated that the appropriate procedures will be updated to address the requirements for mitigating hydrothermal corrosion within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> from the start of the event.

Therefore, based on the evaluation above and the FIP supplemental information, the NRC staff conclude that the sequence of events in the proposed mitigating strategy should result in acceptable shutdown margin for the analyzed ELAP event.

3.2.3.5 FLEX Pumps and Water Supplies For SG makeup, the licensee described in its FIP the use of two FLEX SG makeup pumps (480V motor-driven centrifugal pumps) that are pre-staged inside two separate IVC bays of each Unit (a total of four FLEX SG makeup pumps). The IVCs are located inside a Seismic Category 1 building and are protected from all applicable external hazards. The FLEX SG makeup pumps are rated for a nominal pressure of 500 psig while flowing at 300 gpm. The FLEX SG makeup pumps are described in the FIP as being used when the TDAFW pumps are no longer capable of operation due to the decrease in SG pressure. The licensee stated that only one FLEX SG makeup pump is required for SG makeup per Unit, with the additional pump serving as the backup pump when needed. This configuration complies with the NEI 12-06 requirement of N+ 1 along with the pumps being protected from all applicable external hazards due to their location in the IVCs.

For RCS makeup, the licensee described the use of FLEX RCS makeup pumps (centrifugal pump, one per Unit), which are pre-staged in the fuel handling building (FHB). The FHBs are Seismic Category 1 structures protected from all applicable external hazards. The FLEX RCS makeup pumps serve as backup pumps to the CVCS PDPs (one per Unit), which are primarily used for RCS makeup. The FLEX RCS makeup pumps provide flow of 70 gpm at 700 psig.

The licensee concluded that the FLEX RCS makeup pumps would serve as N+ 1 components to the CVCS PDPs. The licensee acknowledged that this arrangement is an alternative to the NEI 12-06 guidance and proposed to reduce the maintenance outage time from 90 days to 30 days for the affected FLEX RCS makeup pump.

The licensee also described the TMDD pumps, which can be used to refill the AFWSTs (for SG makeup) and RWSTs (for RCS makeup). These pumps will be used about 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after ELAP is declared to provide available water to the respective water storage locations. The TMDD pumps also have the capability to be connected in place of the FLEX SG and SFP makeup pumps as needed. The TMDD pumps are stored in the FLEX storage buildings located outside the protected area (PA). Also, there is a third unprotected pump, stored inside the power block, that is designated for use in response to mitigate 10 CFR 50.54(hh)(2) events.

Section 11.2 of NEI 12-06 states that design requirements and supporting analysis should be developed for portable equipment that directly performs a FLEX mitigation strategy for core, containment, and SFP cooling that provides the inputs, assumptions, and documented analysis that the mitigation strategy and support equipment will perform as intended. During the audit review, the licensee provided for the staff's review, FLEX hydraulic calculations (DCP 12-11658-24, Revision 0, "FLEX SG Make-Up Including Filling of the AFWST from the Deaerator (DA)

Slowdown Line" and DCP 12-11658-75, "FLEX SG Make-Up Including Filling of the AFWST from the Deaerator (DA) Slowdown Line"), which evaluated the use of the FLEX SG makeup pumps receiving makeup water from the AFWST to supply the SGs. The licensee also provided for the staff's review FLEX hydraulic calculations (DCP 12-11658-23, Revision 5, "FLEX RCS Make-Up/Boration", and DCP 12-11658-7 4, Revision 3, "FLEX RCS Makeup/Boration"), which evaluated the use of FLEX RCS makeup pumps providing makeup to the RCS from the RWSTs or BA Ts to indicate that the above FLEX pumps were capable of performing their functions after a BDBEE.

The staff was able to confirm that flow rates and pressures evaluated in the hydraulic analyses were reflected in the FIP for the respective SG and RCS makeup strategies. These values are based upon the above FLEX pumps being powered by the FLEX DGs and respective FLEX connections being made as directed by the FSGs. The staff also conducted a walk down of the hose deployment routes for the above FLEX pumps during the audit to confirm the evaluations of the hose distance runs and connection points as described in the above hydraulic analyses and FIP.

Based on the staff's review of the FLEX pumping capabilities at STP, as described in the above hydraulic analyses and the FIP, the licensee has demonstrated that its pre-staged FLEX pumps should perform as intended to support core cooling and RCS inventory control during an ELAP caused by a BDBEE, consistent with NEI 12-06 Section 11.2. Further discussion on the staff's evaluation of the licensee's alternate approach to pre-staging the FLEX pumps for SG and RCS makeup can be found in Section 3.14 of this evaluation.

3.2.3.6 Electrical Analyses The licensee's electrical strategies provide power to the equipment and instrumentation used to mitigate the ELAP and loss of normal access to the UHS. The licensee's strategy are practically identical for maintaining or restoring core cooling, containment, and SFP cooling, except as noted in Sections 3.3.4.4 and 3.4.4.4 of this evaluation. Furthermore, the electrical coping strategies are the same for all modes of operation.

The NRG staff reviewed the licensee's FIP, conceptual electrical single-line diagrams, summaries of calculations for sizing the FLEX diesel and turbine generators and station batteries, and summaries of calculations that addressed the effects of temperature on the electrical equipment credited in the FIP as a result of losing heating, ventilation, and air conditioning (HVAC) caused by the event. The NRG staff also reviewed the separation and isolation of the FLEX generators from the Class 1 E emergency diesel generators (EDGs) and procedures that direct operators how to align, connect, and protect associated systems and components.

According to the licensee's Fl P, operators respond to the event in accordance with emergency operating procedures (EOPs) to confirm RCS, secondary system, and containment conditions.

Operators will transition to the EOP for loss of all ac power (OPOP05-EO-ECOO, "Loss of all AC Power,") when it is determined that all ac power has been lost. This procedure directs isolation of RCS letdown pathways, verification of containment isolation, reduction of de loads on the station Class 1 E batteries, and alignment of electrical equipment in preparation for eventual power restoration.

The STP Phase 1 FLEX mitigation strategy involves relying on installed plant equipment and onsite resources, such as use of installed Class 1 E station batteries, vital inverters, and the Class 1 E de electrical distribution system. This equipment is considered robust and protected with respect to applicable site external hazards since they are located within safety-related, Class 1 structures. The licensee anticipates entering FLEX procedures within approximately 30 minutes. The licensee anticipates that load shedding of non-essential de loads should be completed within two hours from the onset of the event.

The installed Class 1 E batteries credited in Phase 1 were manufactured by Exide Technologies (GNB Flooded Classic model). Channels I and IV are model NCN-27 with a capacity of 1,944 ampere-hours. Channels II and 111 are model NCX-17 with a capacity of 1,200 ampere-hours.

During the onsite portion of the audit, the NRC staff reviewed the summary of the licensee's battery coping study (2011-11676-EAD, "2011 Class 1 E Battery Coping Study", Revision 12) to verify the capability of the de system to supply the required loads during Phase 1. The licensee's evaluation identified the required loads and their associated ratings (ampere (A) and minimum required voltage) and the loads that would be shed over 90 minutes after entering the FSGs (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> total elapsed time). Based on its review of the licensee's battery coping study, the NRC staff confirmed the licensee's study conclusion that all of the vital batteries in the study were able to provide at least 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of backup power if non-essential loads are shed.

In its FIP, the licensee noted that it had followed the guidance in NEI White Paper, "EA-12-049 Mitigating Strategies Resolution of Extended Battery Duty Cycles Generic Concern," (ADAMS Accession No. ML13241A186) when calculating the duty cycle of the batteries. This paper was endorsed by the NRC (ADAMS Accession No. ML13241A188). In addition to the White Paper, the NRC sponsored testing at Brookhaven National Laboratory that resulted in the issuance of NUREG/CR-7188, "Testing to Evaluate Extended battery Operation in Nuclear Power Plants," in May 2015. The testing provided additional validation that the NEI White Paper method was technically acceptable. The NRC staff reviewed the licensee's battery calculations and confirmed that the guidance in the NEI White Paper was followed.

Based on the staff's review of the licensee's analysis, the battery vendor's capacity and discharge rates for the batteries, and the licensee's procedures, the NRC staff finds that the STP de systems should have adequate capacity and capability to power the loads required to mitigate the consequences during Phase 1 of an ELAP as a result of a BDBEE provided that necessary load shedding is completed within the times assumed in the licensee's analysis.

The licensee plans to transition to Phase 2 of its mitigating strategies within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (the licensee's staffing assessment showed that a FLEX DG will be started around the 2.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> mark and that the A and C train battery chargers will begin charging the batteries at the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> mark) after the onset of the event. The licensee's Phase 2 strategy includes starting one pre-staged 1 megawatt (MW), 480 Volt alternating current (Vac) FLEX DG to power required FLEX equipment, including RCS makeup pumps, SG makeup pumps, and the A and C battery chargers. There are two 1-MW 480 Vac FLEX DGs (N and N+ 1) pre-staged in a robust enclosure on each unit's MAB roof (a general assessment of these enclosures can be found in Section 3.6.1 this SE). Documents OPOP12-ZO-FSG05 (FSG-05), "Initial Assessment and FLEX Equipment Staging," and OPOP12-ZO-FSG19 (FSG-19), "480V FLEX Diesel Generator Operation," provide guidance for the connection and operation of the Phase 2 FLEX DGs. Only one 1-MW 480 Vac FLEX DG is required per unit to satisfy the licensee's mitigating strategy.

Each 1-MW FLEX DG can provide power to both the RCS makeup and the SG makeup pumps by means of permanent power distribution circuits. Separate electric power distribution feeds from the independent FLEX DGs can provide power to a FLEX Distribution Panel in each unit.

An interlock is provided to only allow one FLEX DG at a time to be aligned to the FLEX Distribution Panel. The FLEX Distribution Panel provides a direct electrical ac power source to the FLEX components independent from the site's normal electrical distribution system. FLEX electrical power circuits have been permanently installed inside Category 1 buildings to ensure a quick and dependable response to an ELAP event. The transition to Phase 2 is expected to occur prior to the calculated depletion of the vital batteries.

The licensee's FLEX DG sizing calculation, EC05101, "STP FLEX Diesel Generator Sizing Calculation," Revision 6, identified the required loads to be 860 kilowatt (kW). The 480 Vac DG is available to power required equipment within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the start of an ELAP with loss of normal access to UHS event.

Based on its review of the summary of the licensee's calculation, conceptual single line electrical diagrams, and station procedures, the NRC staff finds that the licensee's approach seems to be acceptable given the protection and diversity of the power supply pathways, the separation and isolation of the FLEX DGs from the Class 1 E EDGs, and availability of procedures to direct operators how to align, connect, and protect associated systems and components. The NRC staff also finds that the FLEX DGs should have sufficient capacity and capability to supply the required loads.

For Phase 3, STP may choose to continue the Phase 2 coping strategy with additional assistance provided from offsite equipment/resources. The offsite resources that will be provided by the NSRCs includes two 1-MW 4160 Vac combustion turbine generators (CTGs), a distribution panel (including cables and connectors), and a 480 Vac CTG per unit.

Each 4160 Vac CTG should be capable of supplying approximately 1 MW, but two CTGs will be operated in parallel to provide approximately 2 MW (2.5 MVA at 0.8 power factor (pf)). Two 1-MW 4160 Vac CTGs delivered to each STP Unit from the NSRC can be connected to engineered safeguard feature (ESF) transformers on the downstream (load) side. The licensee would deploy the NSRC CTGs in an area near the ESF transformers. Licensee personnel will determine which of the three ESF transformers, if any, will be connected to the NSRC generators, depending on the needs of the plant and the condition of the individual transformers. This is proceduralized in OPOP12-ZO-FSG21 (FSG-21 ), "NSRC Turbine Generator," Revision 1.

The licensee performed a load study using the software program, ETAP, to validate that the Phase 3 CTGs were adequately rated to support the required loading. The loads on Train B buses were used for the load study and are considered worst-case because the Train B motor control centers receive the least support for power from the Phase 2 FLEX DGs. The load study utilized the distribution system loading model contained in Calculation EC05002, "Electrical Auxiliary Power Distribution System Model," for modeling loads. The results of the licensee's study indicate that the total loading on the 4160 Vac CTGs would be 1,856 kW. For loading purposes, the licensee plans to limit loading (per FLEX procedures) on the 4160 Vac CTGs to their combined 2 MW continuous rating.

The licensee does not plan on utilizing the 480 Vac CTGs that will be supplied by an NSRC.

However, these CTGs have sufficient capability and capacity to continue supplying the Phase 2 loads to maintain or restore core cooling, containment, and SFP cooling.

Based on its review, the NRC staff finds that the plant batteries used in the strategy should have sufficient capacity to support the licensee's strategy, and that the FLEX DGs and CTGs that the licensee plans to use should have sufficient capacity and capability to supply the necessary loads during an ELAP event.

3.2.4 Conclusions Based on this evaluation, the NRC staff concludes that the licensee has developed guidance that, if implemented accordingly, should maintain or restore core cooling during an ELAP event consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.3 Spent Fuel Pool Cooling Strategies In NEI 12-06, Table 3-2 and Appendix D summarize an acceptable approach consisting of three separate capabilities for the SFP cooling strategies. This approach uses a portable injection source to provide the capability for 1) makeup via hoses on the refueling floor capable of exceeding the boil-off rate for the design-basis heat load, 2) makeup via connection to spent fuel pool cooling piping or other alternate location capable of exceeding the boil-off rate for the design basis heat load, or 3) spray via portable monitor nozzles from the refueling floor using a portable pump capable of providing a minimum of 200 gpm per unit (250 gpm if overspray occurs). During the event, the licensee selects the method to use based on plant conditions.

This approach also requires a strategy, such as venting, to mitigate the effects of steam from the SFP.

As described in NEI 12-06 Section 3.2.1.7 and JLD-ISG-2012-01 Section 2.1, strategies that have a time constraint to be successful should be identified and a basis provided that the time can be reasonably met. In NEI 12-06, Section 3 provides the performance attributes, general criteria, and baseline assumptions to be used in developing the technical basis for the time constraints. Since the event is beyond the design-basis, the analysis used to provide the technical basis for time constraints for the mitigation strategies may use nominal initial values (without uncertainties) for plant parameters, and best-estimate physics data. All equipment used for consequence mitigation may be assumed to operate at nominal set points and capacities. In NEI 12-06, Section 3.2.1.2 describes the initial plant conditions for the at-power mode of operation; Section 3.2.1.3 describes the initial conditions; and Section 3.2.1.6 describes SFP initial conditions.

NEI 12-06 Section 3.2.1.1 provides the acceptance criterion for the analyses serving as the technical basis for establishing the time constraints for the baseline coping capabilities to maintain SFP cooling. This criterion is keeping the fuel in the SFP covered with water.

The ELAP causes a loss of cooling in the SFP. As a result, the pool water will heat up and eventually boil off. The licensee's response is to provide makeup water. The timing of operator actions and the required makeup rates depend on the decay heat level of the fuel assemblies in the SFP. The sections below address the response during operating, pre-fuel transfer or post-fuel transfer operations. The effects of an ELAP with full core offload to the SFP are addressed in Section 3.11. South Texas has individual SFPs for each unit, and these are located in their respective FHBs. The FHBs are seismic Category I, reinforced concrete structures and should protect the SFPs from all applicable natural hazards.

3.3.1 Phase 1 The licensee stated in its FIP that the SFPs will gradually heat up from decay heat and lose water due to evaporation with the loss of the SFP Cooling and Cleanup system. The operator actions for Phase 1 establish ventilation pathways in the FHB and use the SFP level instrumentation installed per Order EA-12-051 to monitor the SFP water level. The licensee indicated in its FIP that the SFP refill strategy using the FLEX equipment will begin in Phase 2.

3.3.2 Phase 2 The licensee stated in its FIP that the primary SFP makeup strategy is to start a RMW pump (2 per Unit) and manually open the SFP RMW Supply Valve for each Unit. Both RMW pumps per Unit will be powered by the FLEX DGs through feeder breakers. The operators will close one feeder breaker to start the associated RMW pump and begin the SFP refill. The SFP water level will be monitored from the Rad Waste Control Room in the MAB. The alternate method to refill the SFP uses the FLEX SFP makeup pump (along with associated fittings and hoses) that is pre-staged in the B-Train SI bay, which is in the FHB. The FLEX SFP makeup pump discharges into a pipe that runs from the SI bay up to the operating deck. Operators install a short hose/spool piece between the Containment Spray suction piping and the pump suction.

The FLEX SFP makeup pump takes suction from the RWST. The licensee also described the ability to use SFP spray monitors as necessary by using the FLEX SFP makeup pump and hoses to connect through piping that leads to the spray monitor on the south end of the SFP deck.

3.3.3 Phase 3 The licensee stated in its FIP that SFP cooling can be maintained indefinitely using the refill strategies described in Phase 2. However, the NSRC is available to provide equipment during Phase 3 to ensure water is available for SFP cooling and provide additional defense-in-depth.

The NSRC will also provide additional water purification equipment and additional TMDD pumps to refill the RWST and makeup to the SFP.

3.3.4 Staff Evaluations 3.3.4.1 Availability of Structures, Systems, and Components 3.3.4.1.1 Plant SSCs Condition 6 of NEI 12-06, Section 3.2.1.3, states that permanent plant equipment contained in structures with designs that are robust with respect to seismic events, floods, and high winds, and associated missiles, are available. In addition, Section 3.2.1.6 states that the initial SFP conditions are: 1) all boundaries of the SFP are intact, including the liner, gates, transfer canals, etc., 2) although sloshing may occur during a seismic event, the initial loss of SFP inventory does not preclude access to the refueling deck around the pool, and 3) SFP cooling system is intact, including attached piping.

During the audit review, the licensee provided STP Calculation 15-FR-017, "Spent Fuel Pool Heatup Analysis for ELAP Event," Revision 0. The calculation and the FIP indicate that boiling begins at approximately 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> during a normal, non-outage situation. The staff noted that the licensee's sequence of events timeline in its FIP indicates that operators will deploy hoses and spray nozzles as a contingency for SFP makeup around 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after event initiation to ensure the SFP area remains habitable for personnel entry.

As described in the licensee's FIP, the licensee's Phase 1 SFP cooling strategy does not require any operator actions. However, the licensee does establish a ventilation path to cope with temperature, humidity, and condensation from evaporation and/or boiling of the SFP. The operators are directed by OPOP12-ZO-FSG11 (FSG-11 ), "Alternate SFP Makeup and Cooling,"

to open doors in the FHB and MAB to establish a natural circulation flowpath immediately after ELAP is declared. This action will allow airflow to carry the steam from SFP boiling away from the FHB.

The licensee's Phase 2 and Phase 3 SFP cooling strategy involves the use of the installed RMW pumps and/or the pre-staged FLEX SFP makeup pumps with associated hoses and fittings taking suction from the RMWST (for the RMW pumps) or RWST (for the FLEX SFP makeup pumps) and discharging to the SFP. The staff's evaluation of the robustness and availability of FLEX connections points for both pumps is discussed in Section 3.7.3.1 below.

The use of pre-staged pumps is an alternative to NEI 12-06 and is discussed in Section 3.14.5.

Furthermore, the staff's evaluation of the robustness and availability of the RWST and ECP for SFP makeup is discussed in Section 3.10.3.

3.3.4.1.2 Plant Instrumentation In its FIP, the licensee stated that the instrumentation for SFP level will meet the requirements of Order EA-12-051. Furthermore, the licensee stated that these instruments will have initial local battery power with the capability to be powered from the FLEX DGs. The NRC staff's review of the SFP level instrumentation, including the primary and back-up channels, and the display to monitor the SFP water level and environmental qualifications to operate reliably for an extended period is discussed in Section 4.0 of this SE.

3.3.4.2 Thermal-Hydraulic Analyses Section 11.2 of NEI 12-06 states, in part, that design requirements and supporting analysis should be developed for portable equipment that directly performs a FLEX mitigation strategy for core, containment, and SFP that provides the inputs, assumptions, and documented analysis that the mitigation strategy and support equipment will perform as intended. In addition, Condition 4 in NEI 12-06 Section 3.2.1.6 states that SFP heat load assumes the maximum design-basis heat load for the site. In accordance with NEI 12-06, the licensee performed a thermal-hydraulic analysis of the SFP as basis for inputs and assumption used in its FLEX equipment design requirements analysis. During the audit, the licensee referenced STP Calculation 15-FR-017 for the staff's review of the thermal-hydraulic analysis for STP's SFPs.

The licensee evaluated the SFP corresponding to a full core off load with the assumption of initial SFP temperature of 100 °F and increasing to 200 °F due to an ELAP event. The licensee concluded that the minimum time to boil is extended to about 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br />, with a boil-off rate of 28 gpm. The staff evaluated the licensee's calculation during the audit to verify that the licensee's analyses of utilizing the RMW pump (300 gpm using one pump) and the FLEX SFP makeup pump (250 gpm) for both SFP refill strategies were capable of providing the necessary flow needed for SFP makeup.

Based on the information contained in the FIP and the above hydraulic analysis, the staff finds that the licensee provided a comprehensive analysis that considered maximum design-basis SFP heat load during operating, pre-fuel transfer or post-fuel transfer operations. The basis for their assumptions and inputs used in the design requirements for FLEX SFP cooling is consistent with NEI 12-06 Section 3.2.1.6 Condition 4 and Section 11.2.

3.3.4.3 FLEX Pumps and Water Supplies As described in the FIP, the SFP cooling strategy relies on the RMW pump and alternatively, the FLEX SFP makeup pump to provide SFP makeup during Phase 2 and 3. Section 3.3.2 of the FIP describes the hydraulic performance criteria (e.g., flow rate, discharge pressure) for the RMW pumps and the FLEX SFP makeup pumps. The staff noted that the performance criteria of TMDD pumps deployed from the FLEX storage building or pumps supplied from an NSRC for Phase 3 would fulfill the mission of the onsite FLEX SFP makeup pumps if they were to fail. As stated in the FIP, the SFP makeup has a rate of 300 gpm and the SFP spray has a rate of rate of 250 gpm with an additional 50 gpm margin for overspray. The staff found that these rates meet the SFP makeup requirements.

3.3.4.4 Electrical Analyses The licensee's FIP defines strategies capable of mitigating a simultaneous loss of all ac power and loss of normal access to UHS, resulting from a BDBEE, by providing the capability to maintain or restore SFP cooling at all units on the STP site.

The staff analyzed the licensee's electrical strategies, which includes the SFP cooling strategy.

The licensee's Phase 1 strategy is to monitor SFP level using installed instrumentation (the capability of this instrumentation is described in other areas of this SE).

In addition to monitoring SFP level during Phase 2, the licensee is crediting use of the pre-staged 480 Vac FLEX DGs to power certain pumps to maintain or restore SFP cooling. STP has a primary and alternate SFP fill strategy that would be implemented using FSG-11. The primary method for filling the SFP is to start a RMW pump and open the SFP RMW Supply Valve. Both RMW pumps would receive power from the FLEX DGs via MCC E1 B4 (E2B4) or MCC E1 C2 (E2C2). Closing the feeder breaker to the selected RMW pump will provide control power to start the pump from the Control Room. In the event the primary SFP fill strategy is not available, the licensee's alternate strategy is to use a pre-staged FLEX SFP makeup pump installed in the FHB in the B-Train SI bay and powered by the FLEX DGs.

The licensee's Phase 3 strategy is to continue using the Phase 2 makeup strategy, and use the NSRC supplied equipment as necessary. If necessary, the NSRC 4160 Vac CTGs could provide power for makeup to the SFP in emergency situations.

Based on its review of the motor ratings for these pumps and valves, the NRC staff has determined that the pre-staged 480 Vac FLEX DGs and NSRC supplied 4160 Vac CTGs should have sufficient capacity and capability to supply SFP makeup systems.

3.3.5 Conclusions Based on this evaluation, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain or restore SFP cooling following an ELAP consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.4 Containment Function Strategies The industry guidance document, NEI 12-06, Table 3-2, provides some examples of acceptable approaches for demonstrating the baseline capability of the containment strategies to effectively maintain containment functions during all phases of an ELAP event. One such approach is for a licensee to perform an analysis demonstrating that containment pressure limits are not challenged. Both STP units are Westinghouse PWRs with dry ambient pressure containments.

The licensee performed a containment evaluation, NAl-1786-001, "South Texas Project Nuclear Plant Extended Loss of AC Power Containment Response Due to RCS Inventory Loss,"

Revision 0, which was based on the boundary conditions described in Section 2 of NEI 12-06.

The calculation analyzed the licensee's strategy and concluded that the containment parameters of pressure and temperature remain well below the respective UFSAR Table 6.2.1.1-3 (Revision 16) design limits of 56 psig and 286 °F for at least 1 O days. The NRC staff noted that the required actions to maintain containment integrity and required instrumentation functions have been developed, and are summarized below.

3.4.1 Phase 1 As stated on page 38 of the licensee's FIP, the Phase 1 coping strategy for maintaining containment functions only involves verifying containment isolation and monitoring containment temperature and pressure using installed instrumentation. No specific strategy is required to maintain containment integrity during Phases 1, 2, and 3 of an ELAP event. The FIP states that the containment conditions are monitored on the Qualified Display Parameter System (QDPS),

and should be available for the duration of the ELAP.

3.4.2 Phase 2 During Phase 2, containment temperature and pressure are expected to remain below design limits for at least 1 O days. However, containment status will be monitored. An unexpected pressure rise can be addressed by venting or cooling containment as directed in OPOP12-ZO-FSG 12 (FSG-12), "Alternate Containment Cooling," Revision 0. Some strategies outlined in FSG-12 require the use of onsite FLEX equipment while others require the equipment from the NSRC.

3.4.3 Phase 3 Although the analysis in NAl-1786-001 shows that, without any active heat removal strategies from the primary containment, both containment temperature and pressure remain well below their design limits for a minimum of 1 O days, equipment will be required eventually to restore cooling to the containment. As such, the licensee has developed multiple strategies to utilize the NSRC equipment to remove heat from the containment. One such strategy is to use the NSRC 4160 Vac generators to power one or more Reactor Containment Fan Coolers (RCFCs) and supply Component Cooling Water (CCW) to one or more RCFC heat exchangers.

Alternatively, the licensee's FIP states that the Containment Spray System (CSS) pump motors could be powered by the NSRC 4160 Vac generators through the Class 1 E 4160 Vac and 480 Vac buses on each unit. The CSS initially draws suction from the RWST, then switches to the containment sump once the RWST is depleted. The containment sump is cooled by the RHR heat exchangers in conjunction with the low-head SI pumps. The RHR heat exchangers transfer heat from the containment sump to the CCW system, which is cooled by the Essential Cooling Water System (ECWS) (a service water system). Similar to the method described above, if the ECWS pumps are available, they will be used to establish flow through the cooling side of the CCW heat exchangers. In the event that the ECWS pumps are unavailable, cooling water flow will be provided by the low pressure/high flow diesel driven pumps from the NSRC.

3.4.4 Staff Evaluations 3.4.4.1 Availability of Structures. Systems. and Components Guidance document NEI 12-06 baseline assumptions have been established on the presumption that other than the loss of the ac power sources and normal access to the UHS, installed equipment that is designed to be robust with respect to design-basis external events is assumed to be fully available. Installed equipment that is not robust is assumed to be unavailable. Below are the baseline assumptions for the availability of SSCs for maintaining containment functions during an ELAP event.

3.4.4.1.1 Plant SSCs Section 3.8.2 in the UFSAR, Revision 16, states that the containment structure is a steel-lined, post-tensioned, reinforced concrete structure with a vertical cylindrical and hemispherical dome.

It is supported on a flat foundation mat and is designed to withstand an internal pressure of 56 psig and temperature of 286 °F. Table 3.2.A-1 of the UFSAR shows that the containment structure is a Seismic Category I structure which has been designed to resist the seismic forces of the design-basis earthquake.

Section 6.2.1.5.3 in the UFSAR states that the containment net free volume in the design-basis evaluation is 3.56 million cubic feet, and the addition of mass and energy to the containment atmosphere during an ELAP event is driven by the assumed leakage rate from the RCP seals (see Section 3.4.4.2 for details). The relatively small amount of heat and mass being added to the containment atmosphere coupled with the very large net free volume of the containment results in a slow-moving response. As stated above, the licensee's calculation shows that, even with no mitigating actions to remove heat from the primary containment being taken, the containment parameters of pressure and temperature remain well below the respective design limits of 56 psig and 286 °F for 10 days. According to the licensee's evaluation, the containment pressure does not increase to more than 2 psig above the initial pressure nor more than 33 °F above the initial temperature. Nonetheless, measures to remove heat from containment will eventually need to be taken, so the licensee has developed the strategies described in Sections 3.4.2 and 3.4.3 above to utilize NSRC and installed equipment and provide this function.

Section 9.4.9 of the UFSAR states that the RCFC system is used to cool the containment atmosphere during normal plant operation and accident conditions. As described in UFSAR Section 9.4.5.2.1 and Table 3.2.A-1, Revision 16, the RCFC subsystem is safety-related and Seismic Category I. The RCFC air coolers are cooled by Component Cooling Water, which is a safety-related and Seismic Category I system (UFSAR Table 3.2.A-1, Revision 16). The CCWS rejects this heat to the ultimate heat sink via the ECWS which is safety-related and Seismic Category I as described in UFSAR Table 3.2.A-1, Revision 16.

Section 6.2.2 of the UFSAR describes the containment spray subsystem (CSS) of the containment heat removal system. The entire containment heat removal system is an ESF, and Section 6.2.2.1 specifically states the containment heat removal system is designed, tested, and inspected, to prevent and/or mitigate the consequences of accidents that could affect the public health and safety. In the UFSAR, Table 3.2.B-1, Revision 16, states that the CSS is a Seismic Category I system.

Given the above UFSAR information, and the amount of time before active containment heat removal is expected to be needed, at least one of the systems the licensee has identified should be available to support the strategy.

3.4.4.1.2 Plant Instrumentation Guidance document NEI 12-06, Table 3-2, specifies that containment pressure is a key containment parameter which should be monitored by repowering the appropriate instruments.

The licensee's FIP states that instrumentation would be available due to the coping capability of the station batteries and associated inverters in Phase 1, or the portable DGs deployed in Phase 2. If no ac or de power is available, the FIP states that key credited plant parameters, including containment pressure, containment temperature, and containment sump level would be available using alternate methods.

3.4.4.2 Thermal-Hydraulic Analyses During the audit process, the licensee provided the staff access to calculation NAl-1786-001, which was based on the boundary conditions described in Section 2 of NEI 12-06. In this calculation, the licensee utilized the GOTHIC 8.0 code to model the containment response to an ELAP event. The GOTHIC model utilized mass and energy release rates taken from the calculation STP-CP-006, "ELAP Analysis with the South Texas Project RETRAN-30 Input Model," Revision O. The representative model utilized in the plant specific evaluation was a Westinghouse 4-loop design.

The only additions of heat and mass to the containment atmosphere under ELAP conditions are the ambient heat losses from the surfaces of hot equipment and the leakage of reactor coolant from the RCP seals. The only heat removal mechanisms credited in the GOTHIC analysis were the passive heat sinks and the ambient heat loss from the containment structure to the outside atmosphere. Using the input described above, the containment pressure and temperature parameters were calculated to peak at approximately 2.0 psig and 143 °F, respectively, during the 10-day analyzed period. As previously stated, the UFSAR containment pressure and temperature limits are 56 psig and 286 °F, so the licensee has adequately demonstrated that there is significant margin before a limit would be reached.

The licensee revised the STP-CP-006 analysis using revised RCP seal leakage to ensure that containment limits are not exceeded. Given the available margin to the containment pressure and temperature limits, the staff concludes the licensee plans for containment cooling are acceptable.

3.4.4.3 FLEX Pumps and Water Supplies Although not needed for a minimum of 1 O days, the licensee's long-term strategy for removing containment heat is to utilize offsite equipment to restore the RCFCs, CSS pumps, or containment purge fans. The licensee's FIP states that the NSRC is providing a low pressure/high flow pump (nominal 5,000 gpm), which will be used as required to provide cooling loads to the SW system. A low pressure/medium flow (nominal 2,500 gpm) pump is also available from the NSRC, if needed. The licensee has also identified several water supplies in its FIP, with the ECP listed as the last resort.

In the STP UFSAR, Table 9.2.1-1 states that one ECWS pump is normally used to supply water to one ECWS loop at a nominal rate of 19,280 gpm. While the NSRC pump nominal capacity is roughly a quarter of the nominal capacity of the ECWS pump, the number of heat load demands on the ECWS loop 1 O days following an ELAP event should be greatly reduced. By isolating non-essential equipment from the ECWS loop, the NSRC equipment should be sufficient to provide the necessary cooling flow to support containment heat removal.

3.4.4.4 Electrical Analyses The licensee performed a containment evaluation based on the boundary conditions described in Section 2 of NEI 12-06. Based on the results of this analysis, the licensee developed required actions to ensure maintenance of containment integrity and required instrumentation function. With an ELAP initiated, while either STP Unit is in Modes 1-4, containment cooling for that unit is also lost for an extended period of time. Therefore, containment temperature and pressure will slowly increase. Structural integrity of the reactor containment building due to increasing containment pressure will not be challenged during the first several weeks of an ELAP concurrent with loss of normal access to the UHS event. However, with no cooling in the containment, temperatures in the containment are expected to rise and could reach a point where continued reliable operation of key instrumentation might be challenged. The licensee's evaluations have concluded that containment temperature and pressure will remain below containment design limits and that key parameter instruments subject to the containment environment will remain functional. Actions to reduce containment temperature and pressure and to ensure continued functionality of the key parameters should not be required immediately.

If temperature or pressure rise does occur that could challenge containment or required instrumentation, plant operators could vent or cool containment utilizing guidance in FSG-12.

The licensee's guidance in FSG-12 provides several different methods for providing containment cooling. With the support of the TSC, the containment cooling strategy will be determined based on equipment availability.

The licensee's preliminary Gothic analysis (NAl-1786-001) indicated that containment pressure and temperature will remain well below design and equipment qualification limits.

During Phase 3, any necessary actions to reduce containment temperature and pressure utilize existing plant systems powered by offsite equipment. The two portable 4160 Vac CTGs and a distribution panel that will be supplied by an NSRC for each unit can be used to supply power to one of the three Class 1 E 4160 Vac buses in each unit. The CTGs could also be used to power the RCFCs. Procedure FSG-12 also describes an option for spraying the outside shell of containment using the TMDDPs to reduce temperature and pressure. A CCW pump, containment spray pump, or containment purge fans can also be used for cooling and venting the containment if deemed necessary. These could be powered by the NSRC 4160 Vac CTGs.

The NSRC will also provide low pressure, high flow and medium flow pumps that could be used to provide cooling loads to various water systems, if needed.

Based on its review, the NRG staff determined that the electrical equipment available onsite (i.e., 480 Vac FLEX DGs) supplemented with the equipment that will be supplied from the NSRCs (e.g., 480 Vac and 4160 Vac CTGs) should have sufficient capacity and capability to supply the required loads to reduce containment temperature and pressure, if necessary, to ensure that key components remains functional.

3.4.5 Conclusions Based on this evaluation, the NRG staff finds that the licensee has developed guidance that, if implemented appropriately, should maintain or restore containment functions following an ELAP event consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.5 Characterization of External Hazards Sections 4 through 9 of NEI 12-06, Revision 0, provide the methodology to identify and characterize the applicable BDBEEs for each site. In addition, NEI 12-06 provides a process to identify potential complicating factors for the protection and deployment of equipment needed for mitigation of site-specific external hazards leading to an ELAP and loss of normal access to the UHS.

Characterization of the applicable hazards for a specific site includes the identification of realistic timelines for the hazard, characterization of the functional threats due to the hazard, development of a strategy for responding to events with warning, and development of a strategy for responding to events without warning.

The licensee reviewed the plant site against NEI 12-06 and determined that FLEX equipment should be protected from the following hazards: seismic; external flooding; severe storms with high winds; snow, ice and extreme cold; and extreme high temperatures. From these hazards, snow and extreme cold were screened out for STP. High winds, extreme heat, seismic, flooding, and ice storms were screened in.

References to external hazards within the licensee's mitigating strategies and this SE are consistent with the guidance in NEl-12-06 and the related NRG endorsement of NEI 12-06 in JLD-ISG-2012-01. Guidance document NEI 12-06 directed licensees to proceed with evaluating external hazards based on currently available information. For most licensees, this meant that the OIP used the current design-basis information for hazard evaluation. Coincident with the issuance of Order EA-12-049, on March 12, 2012, the NRG staff issued a Request for Information pursuant to Title 1 O of the Code of Federal Regulations (10 CFR) Part 50, Section 50.54(f) (ADAMS Accession No. ML12053A340) (hereafter referred to as the 50.54(f) letter),

which requested that licensees reevaluate the seismic and flooding hazards at their sites using updated hazard information and current regulatory guidance and methodologies.

The NRG staff requested Commission guidance related to the relationship between the reevaluated flooding hazards provided in responses to the requested information and the requirements for Order EA-12-049 and related rulemaking to address beyond-design-basis external events (see COMSECY-14-0037, "Integration of Mitigating Strategies for Beyond-Design-Basis External Events and the Reevaluation of Flooding Hazards" (ADAMS Accession No. ML14309A256)). The Commission provided guidance in a SRM to COMSECY-14-0037 (ADAMS Accession No. ML15089A236). The Commission approved the staff's recommendations that licensees need to address the reevaluated flooding hazards within their mitigating strategies for BDBEEs, and that licensees may need to address some specific flooding scenarios that could significantly impact the power plant site by developing scenario-specific mitigating strategies, possibly including unconventional measures, to prevent fuel damage in reactor cores or SFPs. The NRG staff did not request that the Commission consider making a requirement for mitigating strategies capable of addressing the reevaluated flooding hazards be immediately imposed, and the Commission did not require immediate imposition. In a letter to licensees dated September 1, 2015 (ADAMS Accession No. ML15174A257), the NRG staff informed the licensees that the implementation of mitigation strategies should continue as described in licensee's OIPs, and that the related NRG SEs and inspections will rely on the guidance provided in JLD-ISG-2012-01, Revision O (ADAMS Accession No. ML12229A174) and the related industry guidance in Revision 0 to NEI 12-06 (ADAMS Accession No. ML12242A378). The reevaluations may also identify issues to be entered into corrective action programs consistent with the OIPs submitted in accordance with Order EA-12-049.

As discussed above, licensees are reevaluating the site seismic and flood hazards as requested in the NRC's 50.54(f) letter. After the NRG staff approves the reevaluated hazards, licensees will use this information to perform flood and seismic mitigating strategies assessments (MSAs) per the guidance in NEI 12-06, Revision 2, Appendices G and H (ADAMS Accession No. ML16005A625). The NRG staff endorsed Revision 2 of NEI 12-06 in JLD-ISG-2012-01, Revision 1 (ADAMS Accession No. ML15357A163). The licensee's MSAs will evaluate the mitigating strategies described in this SE using the revised seismic hazard information and, if necessary, make changes to the strategies or equipment. All licensees will submit the MSAs for NRG staff review. By letters dated September 29, 2016, STPNOC submitted its MSAs for seismic (ADAMS Accession No. ML16300A267) and flooding (ADAMS Accession No. ML16300A208). Given that the reevaluated seismic and flooding hazards are bounded by the design-basis criteria, no changes to the strategies are expected from the MSAs.

The licensee developed its OIP for mitigation strategies by considering the guidance in NEI 12-06 and the site's design-basis hazards. Therefore, this SE makes a determination based on the licensee's OIP and FIP. The characterization of the applicable external hazards for the STP site is discussed below.

3.5.1 Seismic In its FIP, the licensee stated that seismic hazards are applicable to the site. The peak accelerations associated with the safe shutdown earthquake (SSE) has been established based on the seismicity evaluation described in UFSAR Section 2.5. The peak horizontal acceleration at this site is less than 0.1 Og. Because this acceleration value is below the minimum established in Appendix A, "Reactor Site Criteria" to 10CFR100, a maximum horizontal acceleration was selected to be 0.1 Og.

As previously discussed, the NRG issued a 50.54(f) letter (ADAMS Accession No. ML12053A340) that requested facilities to reevaluate the site's seismic hazard. The licensee responded to this request in a "CNL-14-038, Tennessee Valley Authoritys Seismic Hazard & Screening Report (CEUS Sites), Response to NRC Request for Information Pursuant to 10 CFR 50.54(f) Recommendation 2.1 of Near-Term Task Force Review of Insights from the [[Topic" contains a listed "[" character as part of the property label and has therefore been classified as invalid. Acci|letter dated March 31, 2014]] (ADAMS Accession No. ML14099A235), showing that the updated ground motion does not exceed the SSE.

By letter dated October 26, 2015 (ADAMS Accession No. ML15287A077), the NRG issued a staff assessment with its review of the information related to the STP reevaluated seismic hazard. This assessment concluded that the licensee responded appropriately to Enclosure 1, Items (1) - (9) of the 50.54(f) letter. The NRG staff review concluded that the STP reevaluated seismic hazard is bounded by the plant's existing design-basis SSE. As such, the NRG staff concluded that no further responses or regulatory actions associated with Phase 2 of NTTF Recommendation 2.1 "Seismic" are required for STP. This closed out the NRC's efforts associated with Phase 1 and 2 of NTTF Recommendation 2.1 "Seismic." The staff evaluation for closing the activities associated with this request for information was issued in a letter dated November 19, 2015 (ADAMS Accession No. ML15313A304). Based on this analysis, the NRG staff agrees with the information provided on Section 3.6.1 of the FIP.

3.5.2 Flooding In its FIP, the licensee stated that the current design basis (CDB) flood elevations for the safety-related structures, systems, and components at STP are governed by the maximum flood levels resulting from this postulated breach of the main cooling reservoir embankment (MCRE). The MCRE is a major feature of the site, which is formed by a 12.4 mile long earth-fill embankment constructed above the natural ground surface elevation. The MCRE has a surface area of 7,000 acres with a normal maximum operating level of 49 ft. mean sea level (MSL). The FIP also states that, as a result of the MCRE breach, the COB flood elevations in the power block vary from a minimum of 44.5 ft. MSL at the diesel generator building and the north face of the mechanical electrical auxiliaries building to a maximum of 50.8 ft. MSL at the south face of the fuel handling building. For the ECP, the COB flood elevation was established to be 40.8 ft. MSL at the essential cooling water intake structure. The general site grade elevation at the power block is 28.0 ft. MSL.

The licensee submitted its Flood Hazard Reevaluation Report (FHRR) (ADAMS Accession No. ML13079A806). The FHRR was prepared in response to the March 12, 2012, 50.54(f) letter to provide information on the reevaluation of external flooding hazards at STP Units 1 and 2 using present day methodologies, data and guidance. The licensee concluded, in the re-evaluation of external flooding hazards, that the MCRE breaching scenario remains the controlling flooding mechanism for STP, and is consistent with the design-basis flood evaluation in UFSAR. Based on the results of the reevaluated flood hazards, the licensee stated that no interim actions or integrated assessment are necessary.

The NRG staff reviewed the information provided in the FHRR for STP. Based on its review, the staff concluded that the licensee conducted the hazard reevaluation using present-day methodologies and regulatory guidance used by the NRG staff in connection with Early Site Permit and Combined Operating License reviews. Based upon the preceding analysis, the NRG staff confirmed that the licensee responded appropriately to Enclosure 2, of the 50.54(f) letter, dated March 12, 2012. In reaching this determination, staff confirmed the licensee's conclusions that (a) the reevaluated hazard results for each reevaluated flood-causing mechanism are bounded by the current design-basis flood hazard, and (b) an Integrated Assessment is not necessary. The NRG staff has no additional information needs at this time with respect to Enclosure 2 of the 50.54(f) Request for Information Letter. This evaluation is documented in a letter dated September 30, 2014 (ADAMS Accession No. ML14259A195).

Based on this analysis, the staff agrees with the information in the FIP.

3.5.3 High Winds NEI 12-06 Section 7 provides the NRG-endorsed screening process for evaluation of high wind hazards. This screening process considers the hazard due to hurricanes and tornadoes.

The screening for high wind hazards associated with hurricanes should be accomplished by comparing the site location to NEI 12-06, Figure 7-1 (Figure 3-1 of U.S. NRG, "Technical Basis for Regulatory Guidance on Design Basis Hurricane Wind Speeds for Nuclear Power Plants,

NUREG/CR-7005, December, 2009); if the resulting frequency of recurrence of hurricanes with wind speeds in excess of 130 mph exceeds 1 E-6 per year, the site should address hazards due to extreme high winds associated with hurricanes using the current licensing basis for hurricanes.

The screening for high wind hazard associated with tornadoes should be accomplished by comparing the site location to NEI 12-06, Figure 7-2, from U.S. NRG, "Tornado Climatology of the Contiguous United States," NUREG/CR-4461, Revision 2, February 2007; if the recommended tornado design wind speed for a 1 E-6/year probability exceeds 130 mph, the site should address hazards due to extreme high winds associated with tornadoes using the current licensing basis for tornados or Regulatory Guide 1.76, "Design Basis Tornado for Nuclear Power Plants," Revision 1.

In its FIP, the licensee stated that STP is susceptible to hurricanes as the plant site is within the contour lines shown in NEI 12-06 Figure 7-1. Based on the location of STP, Figure 7-1 shows an applicable hurricane wind speed of approximately 21 O mph with an annual exceedance probability of 1 E-6. The licensee determined that, based on the location (29° 47' 44" North latitude and 96° 02' 56" West longitude) of STP, Figure 7-2 shows an applicable tornado wind speed of approximately 161 mph with an annual exceedance probability of 1 E-6.

The NRC staff reviewed applicable guidance in NEl-12-06 to confirm that the high-wind hazards identified by the licensee are applicable to the plant site. Therefore, the licensee has appropriately screened in the high wind hazard and characterized the hazard in terms of wind velocities and wind-borne missiles.

3.5.4 Snow. Ice. and Extreme Cold As discussed in NEI 12-06, Section 8.2.1, all sites should consider the temperature ranges and weather conditions for their site in storing and deploying their FLEX equipment consistent with normal design practices. All sites outside of Southern California, Arizona, the Gulf Coast and Florida are expected to address deployment for conditions of snow, ice, and extreme cold. All sites located north of the 35th parallel should provide the capability to address extreme snowfall with snow removal equipment. Finally, all sites except for those within level 1 and 2 of the maximum ice storm severity map contained in NEI 12-06 Figure 8-2 should address the impact of ice storms.

In its FIP, the licensee stated that the STP site is located below the 35th parallel. Therefore, the licensee determined that in accordance with guidance in NEI 12-06 Section 8.2.1, STP is not susceptible to extreme cold or snowfall. The licensee stated that NEI 12-06 Figure 8.2, "Maximum Ice Storm Severity Maps, shows that the STP site is located in ice severity level 3, which is defined as low to medium damage to power lines and/or existence of considerable amount of ice. Section 8.2.1 states that plants with this ice severity level should consider the effects of ice storm impacts. The licensee concluded that the plant screens out for an assessment for snow and extreme cold but must consider the effects of ice storm impacts.

In summary, based on the available local data and Figures 8-1 and 8-2 of NEI 12-06, the plant site should not experience significant amounts of snow, and extreme cold temperatures; therefore, these hazards are screened out. However, due to the site being located in an area classified as "ice severity level 3" in Figure 8-2, the licensee has appropriately screened in the icing hazard.

3.5.5 Extreme Heat Per NEI 12-06 Section 9.2, all sites are required to consider the impact of extreme high temperatures. The licensee stated in its FIP that the UFSAR Section 2.3.2.1.5 (Table 2.3-4) provides extremes of temperature for six surrounding locations to STP. Extreme high temperature ranges from 101 °F to 107 °F. Therefore, the STP site screens in for an assessment for the extreme high temperature hazard. The licensee provided a description of the measures taken to protect FLEX equipment from extreme heat.

In summary, based on the available local data and the guidance in Section 9 of NEI 12-06, the STP site does experience extreme high temperatures. The licensee has appropriately screened in the high temperature hazard and characterized the hazard in terms of expected temperatures.

3.5.6 Conclusions Based on the evaluation above, the NRC staff concludes that the licensee has developed a characterization of external hazards that is consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and adequately addresses the requirements of the order in regard to the characterization of external hazards.

3.6 Planned Protection of FLEX Equipment 3.6.1 Protection from External Hazards In its FIP, the licensee stated that it has designed and constructed a new storage building to protect portable FLEX equipment. An existing low level radwaste (LLRW) building also serves as a second FLEX equipment storage location. The two FLEX storage buildings are designed to protect the FLEX equipment against all applicable external hazards except flooding and tornados. The flooding and tornado hazards are addressed by locating the buildings at different grade elevations and by physical separation. The new FLEX building is located on the intermediate level of the MCRE. The LLRW building is located outside the protected area about one mile from the new FLEX storage building. FLEX equipment will also be pre-staged in existing robust structures within the protected area.

The portable FLEX equipment that will be stored in the two storage buildings are the TMDD pumps and associated hoses and the tow vehicles with front end loaders for debris removal.

The licensee stated that most of the equipment needed for the FLEX strategies is pre-staged and protected inside safety-related concrete structures. These permanent plant safety-related structures are designed to protect the FLEX equipment from all applicable external hazards. In each unit, two FLEX SG makeup pumps are pre-staged in the IVC, one RCS FLEX makeup pump is pre-staged in the FHB and one FLEX SFP pump is also pre-staged in the FHB. Two 480 Vac FLEX DGs are pre-staged on the roof of each unit's MAB in a new protective robust steel enclosure. Pre-staging FLEX equipment is an alternative approach to NEI 12-06, Revision

0. This alternative is evaluated in Section 3.14 of this evaluation.

Below are additional details on how FLEX equipment is protected from each of the applicable external hazards.

3.6.1.1 Seismic In its FIP, the licensee stated that the newly constructed FLEX storage building is a non-Category I pre-engineered metal building designed to the American Society of Civil Engineers (ASCE) 7-10 seismic capability. The licensee performed a condition report engineering evaluation (CREE 12-11658-7 41) to confirmed that wind forces used in the design of the building significantly exceed SSE seismic forces. The licensee stated that this is a consequence of the relatively low mass of the one-story buildings, the low seismicity of the Texas Gulf Coast region, and the relatively high wind forces required by ASCE 7-10 in this region. The engineering evaluation prepared by the licensee estimated seismic forces using the static equivalent method of seismic analysis and 1.5 times SSE peak acceleration. The licensee determined that the higher wind forces used in the design guarantee that the buildings will survive the STP design-basis SSE earthquake.

A portion of the LLRW building serves as the FLEX storage building for the other set of equipment. The LLRW is a non-Category I pre-engineered metal building designed to meet the ASCE 7-05 for seismic capability. The licensee noted that the existing LLRW building was built, prior to the FLEX effort, to the ASCE 7-05, not ASCE 7-10 code. The licensee performed an engineering review to address the difference in code requirements (ASCE 7-05 versus ASCE 7-10). The licensee concluded that, for the location and for this particular building, the differences will not adversely affect the structural and foundation performance. The engineering evaluation cited above for the FLEX storage building also addressed the LLRW building. The evaluation determined that for the LLRW the wind forces that were used in the design assure that building will survive the SSE. The NRC staff compared both versions of the ASCE 7 standard and concluded that the differences should not compromise the structural performance of the LLRW building.

The licensee further stated the two TMDD pumps stored in the FLEX buildings have their wheels chocked to help ensure they are not damaged during a seismic event. The 480 volt FLEX DGs are pre-staged on the roof of the MAB. A protective steel enclosure has been built around the DGs, which is designed for the SSE loads. FLEX equipment is pre-staged in the MAB, FHB, and IVC which are seismic Category I structures.

3.6.1.2 Flooding The FIP states that, due to the flood hazard associated to the postulated breach in the MCRE, most FLEX equipment is pre-staged in safety-related structures protected from the flood hazard.

The licensee pre-staged most of the FLEX equipment because subsequent site flood levels would make any potential deployment paths unpassable. The FLEX pumps used for feeding the SGs, and for refilling the RCS and for SFP makeup, are pre-staged inside safety-related structures. The FLEX DGs, pre-staged on the roof of the MAB, are located above the maximum flood level. The main water sources for feeding the SGs and refilling the RCS, the AFWST and the RWST respectively, are protected from the flood hazard. In addition, the licensee stated that the FLEX TMDD pumps and tow vehicles are stored in two buildings located at different site elevations providing reasonable assurance that one set of equipment will survive the flood hazard.

3.6.1.3 High Winds In its FIP, the licensee stated that the new pre-engineered FLEX storage building and the existing LLRW building are designed for the design-basis wind load. The buildings are separated by over one mile to assure survival of at least one set of FLEX equipment considering the tornado and tornado borne missiles. The FLEX equipment required to implement the FLEX strategies pre-staged in existing seismic Category I buildings are protected from the high wind hazard. The seismic Category I buildings also protect the equipment from tornado borne missiles. Two 480 Vac FLEX DGs are pre-staged on the roof of the MAB of each unit. In its FIP, the licensee stated that the protective structure built around the DGs is designed for the design-basis wind load and tornado missile impact. The staff reviewed condition report CREE 12-11658-7 41, which has the design calculation for this protective structure. The calculation stated that protective structures are designed to withstand winds in accordance with NEI 12-06 Section 7. This is also stated in the supplement letter to the Fl P, dated February 20, 2017.

3.6.1.4 Snow. Ice. Extreme Cold and Extreme Heat In its FIP, the licensee stated that the new FLEX storage, the LLRW buildings and the protected enclosure on top of the MAB rely on natural circulation to cope with high ambient temperatures.

It was also stated that FLEX equipment is protected from cold temperatures through the use of anti-freeze in the tractors and the TMDD pumps. The FIP also stated that the STP FLEX strategies do not rely on powerlines and that the STP area is not likely to experience considerable amounts of ice.

The MAB, FHB, and IVC are described to be environmentally controlled buildings that should provide protection of the pre-staged FLEX equipment from extreme temperature effects.

However, the NRC staff raised a concern associated with the potential effect of freezing temperatures on the DGs inside the protective structures on top of the MABs. The licensee provided FLEX Diesel Enclosure Design Change Packages DCP 12-11658-27, Supp. O (Unit 2) and DCP 12-11658-28, Supp. 0 (Unit 1). These reports stated that DGs are equipped with an engine block heater large enough to accommodate ambient temperatures of 8 °F per vendor correspondence. Also, per procedure OPGP03-Z0-0043, "Fuel Monitoring," the fuel oil clouding point begins at 26 °F and will gel at a lower temperature. Due to this effect, the fuel oil pipping will be added to OPOP01-Z0-0004, "Extreme Cold Weather Guidelines," as a component to protect against adverse low temperature effects. In addition, condition report CR # 16-1487 was written in January 2016 to update the cold weather guidelines to include the FLEX diesels and associated fuel oil piping and sprinkler systems. This is also stated in the supplement letter to the FIP, dated February 20, 2017 (ADAMS Accession No. ML17062A303).

3.6.2 Reliability of FLEX Equipment The FIP states that the following equipment will be stored in the new FLEX storage building and in the LLRW building: two trailer mounted diesel driven FLEX pumps, two four-wheel drive tractors each equipped with a front end loader and hose trailers. A third unprotected pump that is designated for use in response to mitigate 10 CFR 50.54(hh)(2) events is stored inside the power block.

Also stated in the FIP, the following equipment is pre-staged inside existing safety-related buildings: FLEX SG makeup pumps (two per unit), RCS FLEX makeup pump (one per unit) and SFP makeup pump (one per unit). The existing CVCS PDP is the N pump for RCS makeup and the reactor makeup water pump is the N pump for SFP makeup. In addition, two 480 Vac FLEX DGs are pre-staged on the roof of the MAB of each unit. One 480 Vac DG is required to power the FLEX equipment. The second DG serves as the N+ 1 DG.

In the case of hoses and cables associated with FLEX equipment required for FLEX strategies, the licensee stated in its FIP that an alternate approach to meet the N+ 1 capability has been selected. These hoses and cables are passive components being stored in a protected facility.

The licensee postulated that the most probable cause for degradation/damage of these components would occur during deployment of the equipment. Therefore, the N+ 1 capability is accomplished by having sufficient hoses and cables to satisfy the N capability plus 1 O percent spares or at least 1 length of hose and cable. This ensures that failure of any one of these passive components would not prevent the successful deployment of a FLEX strategy. See Section 3.14.1 of this evaluation for further discussion of this alternate approach.

Based on the number of portable FLEX pumps, FLEX DGs, and support equipment identified in the FIP and during the audit review, the staff concludes that the licensee's FLEX strategies include a sufficient number of portable FLEX pumps, FLEX DGs, and equipment for RCS makeup and boration, SG makeup, SFP makeup, and for maintaining containment consistent with the N+ 1 recommendation in NEI 12-06 Section 3.2.2.

3.6.3 Conclusions Based on this evaluation, the NRG staff concludes that the licensee has developed guidance that, if implemented appropriately, should protect the FLEX equipment during a BDBEE consistent with NEI 12-06 guidance as endorsed by JLD-ISG-2012-01 and, by following alternative approaches described in Section 3.14 of this evaluation, should adequately address the requirements of the order.

3. 7 Planned Deployment of FLEX Equipment The licensee stated in its FIP that, due to the severity of the design-basis flood event, most of the FLEX equipment must be pre-staged. The FLEX pumps and DGs are located in structures protected from flood waters. The only actions necessary to place the FLEX equipment into service is to connect the temporary hoses to the pumps' suction and discharge connections and align the electrical power connections.

The only portable pieces of FLEX equipment that will be moved from their protected storage location to the site of use are the TMDD pumps and associated hoses. The TMDD pumps are primarily used to refill the AFWSTs and the RWSTs. The TMDD pumps will be towed and located next to the water source selected to refill the tanks. The TMDD pumps can also be used to provide makeup to the SGs or the SFP as backup to the primary strategy of using the pre-staged FLEX pumps.

For refilling the DG fuel oil tank located in the newly constructed enclosure on the roof of the MAB, portable FLEX fuel oil pumps and hoses will be used. The FLEX fuel oil pumps are stored in the Electrical Auxiliary Building (EAB) and will be deployed to the catwalk between the MAB and the EOG building. Temporary hoses will access the EOG fuel oil storage tanks (FOSTs) and discharge to the fuel oil storage tank located inside the protective enclosure on the roof of the MAB.

The licensee stated that the metal doors to the FLEX storage buildings can be manually opened and function well in high temperatures. During the onsite audit, the staff walked down the FLEX storage buildings and confirmed that the doors can be manually operated without reliance on electric power.

3.7.1 Means of Deployment In its FIP, the licensee indicated that the TMDD pumps are pulled using four wheel drive tractors with front end loaders. The tractors are stored with the pumps and hose trailers in the two FLEX storage buildings. Two haul paths are available for the tractor stored in the LLRW building and three haul paths are available to the tractor stored in the FLEX building on the east side of the MCRE. The front end loaders will be used for debris removal if necessary.

The licensee stated that the haul paths minimize travel through areas with trees, power lines and narrow passages to the extent practical. High winds can cause debris from distant sources to interfere with planned haul paths, so debris removal equipment is used to clear obstructions from the pathway between the storage buildings and the TMDD pumps deployment location(s).

3.7.2 Deployment Strategies With exception of the TMDD pumps, all of the FLEX mitigating strategies equipment is pre-staged in safety related buildings and does not need to be hauled. The TMDD pumps are to be hauled to areas near the potentially available water sources to be used for refilling the AFWST and the RWST. The TMDD pumps are stored in the two FLEX buildings. The licensee stated that the haul paths for transporting the TMDD pumps into the PA to their deployment locations have been reviewed for potential soil liquefaction and were determined to be stable following a seismic event. The licensee stated that soil liquefaction is discussed in UFSAR Section 2.5.4.8.1.5, which states that liquefaction will not occur in the plant area during the SSE.

During the flood mode, the haul paths from the two FLEX storage building locations will be impassable. In order to get a better understanding of the site conditions that would be expected following the very unlikely event of a failure of the MCRE, the licensee performed a more realistic breach analysis. Results of this MCRE breach analysis were used to determine flood levels on site at various time intervals after the event. One of the FLEX scenarios utilizes TMDD pumps to refill the AFWSTs and the RWSTs. The input from the breach analysis was used in developing time lines for implementing the use of the TMDD pumps. Licensee's analysis shows that flood waters will recede to approximately one foot of water approximately 51 hours5.902778e-4 days <br />0.0142 hours <br />8.43254e-5 weeks <br />1.94055e-5 months <br /> after the breach of the MCRE. The licensee stated that the haul tractors would be able to then deploy the TMDD pumps to their designated areas. Also, the TMDD pumps have floating suction strainers available which can be used, depending on the source of water being accessed, to protect the pump suction from floating debris.

3.7.3 Connection Points 3.7.3.1 Mechanical Connection Points Core Cooling (SG) Primary and Alternate Connections The primary connection for SG makeup is located on the AFW system suction and cross-connect lines in the IVCs. The licensee indicated that OPOP12-ZO-FSG03 (FSG-03), "Alternate Low Pressure Feedwater," Revision 1, will direct operators to connect flexible hoses and spool pieces from the FLEX SG makeup pump suction to the primary connections in the AFW system.

Each IVC Train B and C bays, which are separated by individual watertight doors, contain a pre-staged FLEX SG makeup pump. One FLEX SG pump in either train would provide the necessary SG makeup flow for the Unit. The licensee described in the FIP that the alternate connection for SG makeup would be utilizing the other pre-staged FLEX SG makeup pump in the other IVC bay for that particular Unit. The connection points for SG makeup would be associated with different suction and discharge connection points. The arrangement of the pre-staged FLEX SG makeup pumps are the same for both Units. The IVCs are located inside Seismic Category I structures, which protects them from all applicable external hazards.

RCS Inventory Control Primary and Alternate Connections The primary connection for RCS makeup uses the permanently-installed plant PDP and piping associated with the CVCS located in the MAB. The licensee stated that the CVCS PDP will use the BATs as the main suction source for RCS makeup and use the RWST as a secondary borated water source. The alternate RCS connection uses the FLEX RCS makeup pump that is pre-staged in the FHB. The suction connection is located on the safety injection (SI) suction header for the A-Train SI pump and the discharge connection is downstream of the A-Train high head safety injection pump discharge motor-operated valve (MOV) to the RCS hot leg.

Guidance in OPOP12-ZO-FSG08 (FSG-08), "Alternate RCS Boration," directs operators to connect flexible hoses from the FLEX RCS makeup pump to the SI suction and discharge piping. Both the MAB and FHB are Seismic Category I structures, which protect the above connections for RCS makeup from all applicable external hazards.

SFP Makeup Primary and Alternate Connections The primary strategy SFP makeup uses the RMW pump located at elevation 1 O ft. of the MAB for each unit. The RMW pump uses the RMWST to supply water to the SFP. The RMW piping connects to the SFP piping through manual fill valve FC-0048. The alternate connection uses the pre-staged FLEX SFP pump, located on the -29 ft. elevation of the FHB of each unit in the B Train SI bays. The FLEX SFP makeup pump uses the RWST as the suction borated water source and the water is distributed through SI piping to the B Train containment spray suction, where a hose/spool piece is connected to the FLEX SFP makeup pump. The discharge of the FLEX SFP makeup pump goes through FLEX piping to the SFP deck at elevation 68 ft. The water is then distributed directly into the SFP through fire hoses or through the spray monitor.

The SFP makeup connections are in the MAB and FHB buildings respectively, which are both Seismic Category I structures that protect the above connections for SFP makeup from all applicable external hazards.

3.7.3.2 Electrical Connection Points The two 1-MW 480 Vac FLEX DGs are located on each unit's MAB roof. Each enclosure houses two FLEX DGs, a fuel oil tank, and an electrical distribution panel. The enclosure is designed to protect the FLEX equipment from all applicable external hazards. Separate electric power distribution feeds from the independent FLEX DGs can provide power to a FLEX distribution panel. An interlock is provided to only allow one 480 Vac FLEX DG at a time to be aligned to the FLEX distribution panel. The FLEX distribution panel provides a direct electrical ac power source to the FLEX components independent from the site's normal electrical distribution system. The FLEX distribution panel feeds three completely separate and independent "trains" of ESF electrical equipment. These are separated on three different elevations in the EAB and power like components on different trains. Procedure FSG-19 provides guidance for checking proper phase rotation prior to powering the electrical equipment.

These FLEX electrical power circuits have been permanently installed inside Category 1 buildings that should protect against any applicable external hazards. Use of the existing electrical distribution system conforms to the requirements of NEI 12-06, Section 3.2.1.3, Item (8).

The two 1-MW 4160 Vac CTGs delivered to each STP unit from an NSRC can be connected to ESF transformers on the downstream (load) side. The deployment location for the NSRC CTGs is the area near the ESF transformers. An NSRC will supply 300 ft. of generator cable, affording the flexibility to park the generators in a variety of locations. Operators may elect to maintain power to loads supplied by the 480 Vac FLEX DG when the CTGs arrive or to de-energize one train (A, B, or C) of ac buses that the FLEX 480 Vac DG was supplying and put the CTGs in service. Licensee personnel will determine which of the three ESF transformers, if any, will be connected to the NSRC CTGs, depending on the needs of the plant and the condition of the individual transformers. This is proceduralized in FSG-21. The same FSG provides guidance for checking proper phase rotation prior to powering the electrical equipment.

3.7.4 Accessibility and Lighting In its FIP, the licensee stated that lighting for the control room and other vital areas is provided by "Appendix R" battery powered lights (lights installed for fire protection to meet 1 O CFR Part 50, Appendix R) for at least 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following the ELAP event. The licensee stated that these lights are not qualified to operate following a design-basis seismic event but they all have seismic II/I restraints. Also stated in the FIP, there are over 220 such fixtures in each unit at fixed locations. In the event that the Appendix R lighting is damaged at these locations, the FIP states that each unit has three lanterns for a backup lighting source located in the hallway next to the control room. Additionally, the licensee stated that operators are required to carry flashlights with them at all times and handheld navy battle lanterns are stored in the EAB and MAB. The battle lanterns contain LEDs and should last approximately 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br />. Other portable lighting sources are stored in a designated FLEX locker that is protected from applicable external hazards and easily accessed in the EAB.

The FLEX DGs are projected to be started within eight hours following the start of the ELAP event. Six new battery-backed light fixtures have been installed in each FLEX DG enclosure to enhance visibility for personnel starting the generators. When the FLEX DGs are started, Appendix R fixtures will be re-powered. There are numerous 120 VAC receptacles that will also be powered by the FLEX DGs. In Phase 3, the licensee stated that the NSRC will bring light towers to STP which can be placed around the site as needed.

3. 7.5 Access to Protected and Vital Areas In its FIP, the licensee stated that, following a BDBEE and subsequent ELAP, certain barriers (gates and doors) will be opened and remain open for the duration of the event. The operators currently have security keys that will be used to open these doors to ensure the overall integrated strategy can be successfully executed. In addition site security will be available to assist in allowing access to the protected area and all required vital areas.

3.7.6 Fueling of FLEX Equipment In its FIP, the licensee stated that the major FLEX equipment needing periodic refueling are the OGs pre-staged on the MAB roof and the trailer mounted diesel driven pumps. Fuel for the FLEX equipment will be obtained from the three ESF OG FOSTs, which the licensee described to be protected against external events. Each FOST contains at least 60,500 gallons, the technical specification limit, yielding a minimum of 181,500 gallons of fuel oil per unit. Fuel oil quality in the ESF OGs is monitored through plant procedure OPGP03-Z0-0043, "Fuel Oil Monitoring Program, as required by plant technical specifications.

The licensee stated that, approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> into the event, preparations will be underway to begin the refueling effort. A 120 Vac FLEX fuel oil transfer pump will be used to transfer fuel oil from the FOST to the fuel oil tank located in the FLEX OG protective enclosure on the MAB roof. Temporary hoses will be used to connect the FOST to the fuel oil transfer pump and route the discharge line from the FLEX oil transfer pump to the roof of the MAB. This strategy for refueling the FLEX OGs is applicable for both the flood event and non-flood event.

In its FIP, the licensee stated that refueling of the TMOO pumps will not be required until more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the start of the event. To refuel these pumps, the hose used to fill the FLEX OG will need to be lowered to ground level east of the EOG building. When the NSRC refuel equipment arrives on site, it can also be used to move fuel from the EOG FOSTs to the TMOO pumps. For the flood event, the TMOO pumps would not be deployed until flood waters recede and then they could be filled as in the non-flood mode described above or with equipment supplied by the NSRC.

Each FLEX OG uses approximately 70 gallons per hour at full load. The FLEX OGs have a common protected 660 gallon fuel oil tank that will allow over 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of fully loaded run time before requiring refueling. The TMOO pumps have a 130 gallon fuel tank and use approximately 15 gallons per hour at full load. The TMOO pumps require refueling approximately every 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The licensee concluded that given these fuel consumption rates with the minimum of 181,500 gallons of fuel in the EOG FOSTs, STP has sufficient fuel to operate under these conditions for approximately 25 days. Procedure OPGP03-Z0-0043 provides guidance to monitor and maintain fuel oil quality in the trailer mounted diesel fuel oil tank, tractors, and FLEX DG 660 gallon fuel oil storage tank.

3.7.7 Conclusions The NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should allow deploying the FLEX equipment following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.8 Considerations in Using Offsite Resources 3.8.1 South Texas Project SAFER Plan The industry has collectively established the needed off-site capabilities to support FLEX Phase 3 equipment needs via the SAFER Team. The SAFER team consists of the Pooled Equipment Inventory Company (PEICo) and AREVA Inc. SAFER provides FLEX Phase 3 management and deployment plans through contractual agreements with every commercial nuclear operating company in the United States.

There are two NSRCs, located near Memphis, Tennessee and Phoenix, Arizona, established to support nuclear power plants in the event of a BDBEE. Each NSRC holds five sets of equipment, four of which will be able to be fully deployed to the plant when requested. The fifth set allows removal of equipment from availability to conduct maintenance cycles. In addition, the plant's FLEX equipment hose and cable end fittings are standardized with the equipment supplied from the NSRC.

By letter dated September 26, 2014 (ADAMS Accession No. ML14265A107), the NRC staff issued its assessment of the NSRCs established in response to Order EA-12-049. In its assessment, the staff concluded that SAFER has procured equipment, implemented appropriate processes to maintain the equipment, and developed plans to deliver the equipment needed to support site responses to BDBEEs, consistent with NEI 12-06 guidance; therefore, the staff concluded in its assessment that licensees can reference the SAFER program and implement their SAFER Response Plans to meet the Phase 3 requirements of Order EA-12-049.

The NRC staff noted that the licensee's SAFER Response Plan contains (1) SAFER control center procedures, (2) NSRC procedures, (3) logistics and transportation procedures, (4) staging area procedures, which include travel routes between staging areas to the site, (5) guidance for site interface procedure development, and (6) a listing of site-specific equipment (generic and non-generic) to be deployed for FLEX Phase 3.

3.8.2 Staging Areas In general, up to four staging areas for NSRC supplied Phase 3 equipment are identified in the SAFER Plans for each reactor site. Two of these are a Primary (Area C) and an Alternate (Area D, if needed) which are offsite areas (usually within about 25 miles of the plant) for receipt of ground transported or airlifted equipment from the SAFER centers in Phoenix, Arizona or Memphis, Tennessee. From Staging Areas C and/or D, a near-or on-site Staging Area Bis established for interim staging of equipment prior to it being transported to the final location for implementation in Phase 3 at Staging Area A. The STP SAFER plan, made available to the staff for review during the audit process, states that the Alternate Staging Area D is the Wharton County Youth Fair. Staging Area C is the Matagorda County Fairgrounds near Bay City.

Staging Area B is a field west of the STP units. Should road access from Staging Area C and D be unavailable, the use of helicopters to transport equipment to Staging Area B is recognized as a potential need within the STP SAFER Plan and is provided for.

The licensee stated that communications will be established between STP and the SAFER team using satellite phones, helping required equipment to be moved to the site as needed. The NSRC equipment should begin to arrive on site within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from the initial request.

During the onsite audit, NRC staff walked down local staging areas A and B with the licensee and reviewed the licensee's agreement with Matagorda County officials (letter dated September 8, 2014) to provide local resources (road clearing equipment, vehicles, boats, helicopters) for access and to secure the staging areas defined in the response plan.

3.8.3 Conclusions Based on this evaluation, the NRG staff concludes that the licensee has developed guidance that, if implemented appropriately, should allow utilization of offsite resources following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.9 Habitability and Operations 3.9.1 Equipment Operating Conditions 3.9.1.1 Loss of Ventilation and Cooling Following a BDBEE and subsequent ELAP event at STP, ventilation that provides cooling to occupied areas and areas containing required equipment will be lost. The key areas identified for all phases of execution of the FLEX strategy activities are the MCRs, OOPS and Inverter Rooms, the TDAFW Pump and SG PORV Rooms, Vital Battery Rooms, and the containment.

Some plant locations where FLEX equipment is stored have heat loads and no forced ventilation until the FLEX DGs are put into operation and begin powering equipment. Natural circulation and the proceduralized propping open of doors are the initial capabilities for room cooling. STP performed evaluations on the most critical areas and equipment to ensure equipment survivability and area habitability.

The NRG staff reviewed the licensee's calculation NAl-1646-001, "STP Electrical Auxiliary Building GOTHIC Room Heatup Analysis," Revision 1, and procedures (FSG-05 and OPOP1 O-HE-0001, "Loss of EAB HVAC," Revision 2) to verify that equipment remains operable as part of the STP mitigation strategy for an ELAP and will not be adversely affected by increases in temperature as a result of loss of HVAC.

Main Control Rooms (MCRs)

During an ELAP event, the MGR ventilation will be lost; however, heat loads in the MGR will be simultaneously reduced. The de load shedding actions completed during the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the event per OPOP12-ZO-FSG04 (FSG-04), "ELAP DC Bus Load Shed/Management,"deenergizes equipment in the MGR and the adjacent relay room. The remaining heat sources in the MGR are primarily personnel, emergency lighting, and remaining OOPS instrumentation.

Calculation NAl-1646-001 did not specifically model the heat-up in the MGR. The calculation showed that temperature response in the critical rooms is relatively slow, requiring over 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> before temperature limits are approached. Action is taken to open doors to maintain internal cabinet temperatures below 11 O °F for the duration of the event. The calculation models the MGR and assumes that the temperature starts at 78 °F and increases linearly over the next 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to 104 °F. This is a reasonable assumption based on the limited heat sources remaining in the MGR and its relatively large air volume. Additionally, and if necessary, the licensee noted that an additional MGR Return Fan 11 A(21 A) or 11 B(21 B) can then be started to increase outside air flow to the MGR once the FLEX 480 Vac DG is placed in service.

Based on temperatures remaining at or below 120 °F (the temperature limit, as identified in NUMARC-87-00, "Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," Revision 1, for electronic equipment to be able to survive indefinitely), the NRC staff finds that the equipment in the MCR should not be adversely impacted by the loss of ventilation as a result of an ELAP event.

QDPS and Inverter Rooms The licensee's calculation (NAl-1646-001) evaluated ELAP heat-up in critical portions of the Electrical Auxiliary Building, including the OOPS and inverter rooms. The heat-up calculation showed that room doors for these rooms would need to be opened prior to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> into the event. When doors to these rooms are opened, the cabinets and inverters are not expected to reach their high temperature limit for an additional three days, at which point forced ventilation is expected to have been established using offsite resources and equipment from an NSRC.

Based on temperatures remaining below design limits, the equipment in the QDPS and Inverter Rooms should not be adversely impacted by the loss of ventilation as a result of an ELAP event given that preventive actions are taken as described above.

TDAFW Pump and SG PORV Rooms The licensee's calculation MC-06506, "AFW Pump Room D Maximum Temperature During a Station Blackout," Revision 0, showed that running the TDAFW pump during an ELAP event will not cause the TDAFW pump room to heat up beyond the pump Environmental Qualification temperature limit of 170 °F. Procedures are available to direct operators to lineup Auxiliary Feedwater to all SGs early into the event. Procedure FSG-05 directs operators to open the door to the TDAFW pump room to allow the heat being generated in the room to dissipate into the hallway, up the stairwell and out of the building. Once the FLEX 480 Vac DG is in operation, the TDAFW Cubicle Vent fan can also be started. The FLEX SG makeup pumps in the IVC bays also have cubicle vent fans that can be started when the FLEX DG is powering the FLEX load distribution panel DP1000, which provides power to the cubicle vent fan MCC.

Additionally, as part of STP's loss of EAB HVAC procedure, OPOP10-HE-0001, portable ventilation fans are pre-staged in the EAB to be used if ventilation is lost. The loss of EAB HVAC procedure also directs the placement of these fans and identifies which doors to open for best circulation of air to ensure that the TDAFW Pump and SG PORV room temperature remains below the design limits.

Based on temperatures remaining below design limits, the equipment in the TDAFW Pump and SG PORV Rooms should not be adversely impacted by the loss of ventilation as a result of an ELAP event given that preventive actions are taken as described above.

Vital Battery Rooms The licensee's GOTHIC analysis showed that the battery rooms should not exceed 115 °F.

Nonetheless, the licensee has procedures for opening certain doors (but not battery room doors) if temperature approaches established limits. Furthermore, the licensee expects battery room ventilation fans to be restored within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of event initiation (via FLEX 480 Vac DG power).

The concrete walls, floors, and ceiling in the safety-related battery rooms function as a large heat sink following loss of ventilation. Heat loads in and around the Vital Battery Rooms following an ELAP are minimal (lighting, de-powered loads) compared to normal operating loads such as large transformers and breakers, battery chargers, and motors. Additionally, following an ELAP, plant operators would strip loads from the station's safety-related batteries to prolong the life of the batteries. The heat load from batteries during discharge and charging is a function of the internal resistance and the square of the current. Since the licensee expects load shedding to be completed approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> from the onset of an ELAP event, the heat generated in the battery will be minimized due to the lower current draw, and the rate of release into the room will be slow due to the large mass of electrolyte. Furthermore, the heat sinks in and the Vital Battery Rooms minimize the rate of temperature increase or decrease in the battery room, regardless of the outside ambient temperature.

Based on the above, the NRC staff finds that the licensee's ventilation strategy, in combination with the effect of the heat sinks in and around the Vital Battery Rooms, should maintain the battery room temperature below the maximum temperature limit (120 °F) of the batteries, as specified by the battery manufacturer (Exide Technologies). Therefore, the NRC staff finds that the STP Vital Batteries should perform their required functions at the expected temperatures as a result of loss of ventilation during an ELAP event.

Containment See Section 3.4.4.4 above.

3.9.1.2 Loss of Heating The licensee described the use of heat tracing will be in the form of heat trace circuits to keep the 4-weight-percent boric acid in the BATs at approximately 85 °F to maintain solubility. The licensee also indicated that after ELAP, the water temperature in the BATs will decrease but should not drop below 55 °F due to the BATs and the associated piping being insulated and inside concrete buildings. The FLEX DGs will power the Boric Acid pumps. The pumps recirculate the solution in the BATs to ensure the temperature does not continue to lower to the point where boric acid begins to solidify. South Texas FLEX Support Guideline Procedures, OPOP12-ZO-FSG01 (FSG-01 ), "Long Term RCS Inventory Control," Revision 1, and FSG-08, directs the operators to switch the CVCS PDP suction source from the BATs to the RWST if necessary. The FIP did not identify any other areas or equipment that would require heat tracing for ELAP events. Also, per Section 8 of NEI 12-06, snow and extreme cold hazard conditions do not apply to the STP site.

3.9.1.3 Hydrogen Gas Control in Vital Battery Rooms An additional ventilation concern applicable to Phase 2 and 3 is the potential buildup of hydrogen in the battery rooms as a result of loss of ventilation during an ELAP event. Off-gassing of hydrogen from batteries is only a concern when the batteries are charging. The licensee will be repowering the normal battery room exhaust using the Phase 2 FLEX DG. This is planned to occur prior to initiation of battery charging.

Based on its review, the NRC staff finds that hydrogen accumulation in the safety-related battery rooms should not reach the combustibility limit for hydrogen (4 percent) during an ELAP since the licensee plans to repower the battery room exhaust fans when the battery chargers are repowered during Phase 2.

3.9.2 Personnel Habitability To address room heat-up concerns during an ELAP, the licensee referenced STP FLEX Program Document FLEX-0001 90539LFR0001, "Diverse and Flexible Coping Strategies (FLEX) Program Document, South Texas Project (STP) Units 1 & 2," Revision 0, and FSG-05, which describe the strategies and compensatory actions for operators to manage high temperatures when performing actions during ELAP events.

3.9.2.1 Main Control Room As stated in the FIP and demonstrated in calculation MCC-1240.00-00-0010, the MCR doors will be opened and the FLEX DGs will be operated around three hours to make power available for the MCR fans to operate and provide ventilation in the MCR. FSG-05 discusses the opening of MCR doors and the connection of the FLEX DGs to supply power to the MCR fans. Thus, habitability conditions should be sufficient to support continuous occupancy for the operators to perform the strategies. The licensee's analysis and plans of opening the MCR doors, providing spot coolers and FLEX HVAC units should maintain the MCR temperature below the conservative limit for control room habitability of 110 °F, which was analyzed in NUMARC 87-

00.

3.9.2.2 Spent Fuel Pool Area As discussed in Section 3.3.4.1.1 of this evaluation, a ventilation path will be established by opening the doors in the MAB and FHB to allow steam to escape from the SFP area and establish natural circulation immediately following an ELAP-initiating event. The conditions for different locations on the refueling floor are calculated in STP Calculation, 15-FR-017. The FIP states that the nominal minimum time to boil for a non-outage situation is approximately 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> after the initiating event. Thus, the actions required to employ the SFP cooling strategy are anticipated to take place long before the conditions become challenging due to habitability considerations.

3.9.2.3 Other Plant Areas Section 3.9.1.1 of this evaluation described the cubicle fans to be used for operators performing actions in the TDAFW pump rooms as needed. The FIP did not identify any other rooms or areas which would require continuous occupancy.

3.9.3 Conclusions The NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain or restore equipment and personnel habitability conditions following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.1 O Water Sources 3.10.1 Steam Generator Make-Up During Phase 1, the source of makeup water to the SGs is the AFWSTs. An AFWST is provided for each unit. Upon loss of power and reactor trip, the TDAFW pump in each unit takes suction from its AFWST to provide makeup to the SGs for core decay heat removal. In its FIP, the licensee stated that the AFWST is a safety-related, seismic and tornado-missile protected structure designed to withstand the applicable design-basis external hazards stated in NEI 12-06. Each AFWST contains a normal volume of approximately 508,000 gallons of water.

Conservatively assuming the initial water level in the AFWST is at the low level alarm, the licensee determined that the usable volume of the tank (474,000 gallons) provides a sufficient source of water for a minimum of 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> of RCS decay heat removal. As stated in the licensee's FIP, the AFWST can be refilled from the following water sources once the water supply is depleted over the ELAP event (from highest priority to lowest): Secondary Makeup Tank, Demineralized Water Storage Tank, Deaerator Storage Tank, Fire Water Storage Tank, Service Water Storage Tank, Organics Basin, ECP, and the ECP's Circulating Water underground piping.

In Phase 2, when the TDAFW is no longer capable of operating, the FLEX SG makeup pump will be used and it will continue to take suction on the AFWSTs. After approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> preparations will start to refill the AFWSTs from the sources stated above.

If no other water sources are available, one of the TMDD pumps can be positioned to take suction from the ECP. The ECP is a qualified source and has approximately 112 million gallons of storage capacity. The ECP is a man-made excavated below grade pond with an approximately 8 ft. high embankment completely surrounding its perimeter. It is normally filled via the well water system. It is brackish water and of low usage priority. The TMDD pump can deliver water to both units' AFWST and RWST or directly to the SGs when the SGs are sufficiently depressurized. The ECP can be used indefinitely in Phase 3 to refill both the AFWSTs and RWSTs as needed, using the TMDD pumps as a last resort.

In the event of an MCRE breach, the site will be flooded with water and the trailer mounted diesel driven pumps will not be able to be brought to their pumping locations before the AFWSTs would need to begin being refilled. In the flood hazard scenario, the licensee stated that water from the DA will be used for refilling the AFWSTs. The DA contains 148,000 gallons of water. The water from the DA drains by gravity into the AFWST using temporary hoses. The water from the DA allows for an additional 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> of decay heat removal from the RCS. The licensee stated that, in the event additional makeup to the AFWSTs could not be provided, the SGs would contain sufficient water for an additional 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> of decay heat removal, but only assuming that makeup isn't lost until 47 hours5.439815e-4 days <br />0.0131 hours <br />7.771164e-5 weeks <br />1.78835e-5 months <br />, when decay heat is reduced.

3.10.2 Reactor Coolant System Make-Up In Phase 1, RCS makeup to compensate for leakage from the RCP seals and for contraction of water inventory due to cooldown is initially provided by the cold leg accumulators.

Phase 2 begins in less than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> when a FLEX DG is started and power becomes available to the FLEX equipment. The installed CVCS positive displacement pump located in the IVC draws water from either the BAT or the RWST and injects it into the RCS through the existing charging line. An additional FLEX RCS makeup pump, pre-staged in the fuel handling building, also uses water from the RWSTs to inject into the RCS using an alternate injection path through the safety injection system piping.

The licensee described the RWSTs in the FIP as the borated water source for the FLEX RCS makeup strategies. Each Unit has one RWST located inside the MAB. The RWSTs are safety-related and seismically qualified storage tanks that are protected from all applicable external hazards. The licensee concluded in the FIP that the usable borated water in the RWSTs would be around 398,000 gallons before needing to be refilled from an unborated water source as described above for SG makeup or from the ECP using the TMDD pumps. The licensee described the BATs as being located inside the Unit's MAB and protected from all applicable external hazards. The capacity of the BATs consist of 60,000 gallons of borated water with a minimum boron concentration of 7,000 ppm.

The BATs are an additional source of borated water that provide a suction source to the CVCS PDP. The BATs are Seismic Category I tanks. The BATs are protected from external events because these are inside the MAB. The BATs are typically maintained with a combined total of approximately 60,000 gallons of water with a minimum boron concentration of 7,000 ppm.

Water makeup to the RCS can be maintained in Phase 3 using the ECP if needed.

3.10.3 Spent Fuel Pool Make-Up In its FIP, the licensee stated that no makeup to the SFP will be made in Phase 1. Based on worst case SFP heatup calculations, STPNOC intends to provide makeup to the SFP within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of an ELAP.

In Phase 2, the licensee stated that the primary strategy for makeup to the SFP will be provided by the installed RMW pump powered by the FLEX DG. The source of makeup water is the RMWST. An alternate makeup strategy is using a pre-staged FLEX SFP makeup pump located in the FHB taking suction from the RWST. Either the ECP or an unprotected tank that survived the event will be used as the water source to makeup to the RWST or directly to the SFP using the TMDD pumps. The RWST can be refilled from the various tanks as previously described above.

SFP cooling can be maintained indefinitely using the Phase 2 makeup strategy. In Phase 3, the NSRCs will provide equipment that can be used to ensure water is always provided to cool the spent fuel for operational flexibility and additional defense-in-depth.

3.10.4 Containment Cooling In its FIP, the licensee stated that no actions are required in Phases 1, 2, and 3 to maintain containment temperature and pressure within the design limits. Given an unexpected rise in containment pressure or temperature occur, FSGs provide for cooling or venting the containment. Containment cooling can be accomplished using the containment spray system, reactor containment fan cooler or external spray of the outside of the containment shell. The pressure in the containment can also be reduced by operating the containment purge system.

In Phase 3, the NSRC will provide a low pressure, high flow pump (nominal 5,000 gpm) which can be used to provide cooling water to various plant water systems. As discussed previously, water supplies are listed in the FSGs by order of preference. When the RWSTs are depleted, other tanks and basins will be drawn from, if available, and the ECP can be used as a last resort.

3.10.5 Conclusions The NRG staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain satisfactory water sources following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.11 Shutdown and Refueling Analyses Order EA-12-049 requires that licensees must be capable of implementing the mitigation strategies in all modes. In general, the discussion above focuses on an ELAP occurring during power operations. This is appropriate, as plants typically operate at power for 90 percent or more of the year. When the ELAP occurs with the plant at power, the mitigation strategy initially focuses on the use of the steam-driven TDAFW pump to provide the water initially needed for decay heat removal. If the plant has been shut down and all or most of the fuel has been removed from the RPV and placed in the SFP, there may be a shorter timeline to implement the makeup of water to the SFP. However, this is balanced by the fact that if immediate cooling is not required for the fuel in the reactor vessel, the operators can concentrate on providing makeup to the SFP. The licensee's analysis shows that following a full core offload to the SFP, about 33 hours3.819444e-4 days <br />0.00917 hours <br />5.456349e-5 weeks <br />1.25565e-5 months <br /> are available to implement makeup before boil-off results in SFP water level dropping to 1 O ft. above the fuel assemblies, and the licensee has stated that they have the ability to implement makeup to the SFP within that time.

When a plant is in a shutdown mode, steam is not available to operate the steam-powered pump and allow operators to release steam from the SGs (which typically occurs when the RCS has been cooled below about 300 °F), another strategy must be used for decay heat removal.

On September 18, 2013, NEI submitted to the NRG a position paper entitled "Shutdown/Refueling Modes" (ADAMS Accession No. ML13273A514), which described methods to ensure plant safety in those shutdown modes. By letter dated September 30, 2013 (ADAMS Accession No. ML13267A382), the NRG staff endorsed this position paper as a means of meeting the requirements of the order.

The position paper provides guidance to licensees for reducing shutdown risk by incorporating FLEX equipment in the shutdown risk process and procedures. Considerations in the shutdown risk assessment process include maintaining necessary FLEX equipment readily available and potentially pre-deploying or pre-staging equipment to support maintaining or restoring key safety functions in the event of a loss of shutdown cooling. The NRC staff concludes that the position paper provides an acceptable approach for demonstrating that the licensees are capable of implementing mitigating strategies in shutdown and refueling modes of operation. The FIP describes ways to implement mitigating strategies that are in accordance with the guidance in this position paper. During the audit process, the NRC staff observed that the licensee had made progress in implementing this guidance.

Based on the information above, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain or restore core cooling, SFP cooling, and containment following a BDBEE in shutdown and refueling modes consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.12 Procedures and Training 3.12.1 Procedures In its FIP, the licensee stated that FSGs have been developed in accordance with PWROG guidelines. The FSGs are used only as directed for BDBEE conditions. When FLEX equipment is needed to supplement EOPs or abnormal operating procedures (AOPs), the EOP or AOP directs the entry into and exit from the appropriate FSG procedure. The licensee stated that FSGs are used to supplement, not replace, the existing procedure structure that establishes command and control for the event.

In its compliance letter, the licensee stated that it has developed FSGs and integrated them into the existing procedure framework. Other affected procedures required for FLEX implementation have also been revised. The FSGs and applicable procedures have been verified and are available for use and are being controlled in accordance with station processes.

3.12.2 Training In its FIP, the licensee stated that training plans were developed for plant groups such as the Emergency Response Organization, Security, Operations, Engineering, Mechanical Maintenance, and Electrical Maintenance. The training plan development was done in accordance with licensee procedures using the Systematic Approach to Training (SAT).

3.12.3 Conclusions Based on the description above, the NRC staff finds that the licensee has adequately addressed the procedures and training associated with FLEX. The procedures have been issued in accordance with NEI 12-06, Section 11.4, and a training program has been established and should be maintained in accordance with NEI 12-06, Section 11.6.

3.13 Maintenance and Testing of FLEX Equipment As a generic issue, NEI submitted a letter to the NRC dated October 3, 2013 (ADAMS Accession No. ML13276A573), which included EPRI [Electric Power Research Institute]

Technical Report 3002000623, "Nuclear Maintenance Applications Center: Preventive Maintenance Basis for FLEX Equipment." By letter dated October 7, 2013 (ADAMS Accession No. ML13276A224), the NRC endorsed the use of the EPRI report and the EPRI database as providing a useful input for licensees to use in developing their maintenance and testing programs.

In its FIP, the licensee stated that the BDBEE equipment that performs FLEX mitigation strategies for core cooling, containment, or SFP cooling is subject to periodic maintenance and testing in accordance with NEI 12-06 and INPO AP 913, "Equipment Reliability Process."

Additional FLEX support equipment that requires maintenance and testing has preventative maintenance (PM) activities to ensure it will perform its required functions following a BDBEE.

The licensee stated that PMs for FLEX equipment were developed using the templates and guidance contained in the EPRI report or from manufacturer provided information/recommendations when templates were not available from EPRI.

The NRC staff finds that the licensee has adequately addressed equipment maintenance and testing activities associated with FLEX equipment because a maintenance and testing program has been established in accordance with NEI 12-06, Section 11.5.

3.14 Alternatives to NEI 12-06. Revision O 3.14.1 Reduced Set of Hoses and Cables As Backup Equipment In its FIP, the licensee took an alternative approach to the NEI 12-06 guidance for hoses and cables. In NEI 12-06, Section 3.2.2 states that, in order to assure reliability and availability of the FLEX equipment required to meet these capabilities, the site should have sufficient equipment to address all functions at all units on-site, plus one additional spare, i.e., an N+ 1 capability, where "N" is the number of units on-site. Thus, a single-unit site would nominally have at least two portable pumps, two sets of portable ac/dc power supplies, two sets of hoses and cables, etc. NEI, on behalf of the industry, submitted a letter to the NRC (ADAMS Accession No. ML15126A135) proposing an alternative regarding the quantity of spare hoses and cables to be stored on site. The alternative proposed was to use either a) 10 percent additional lengths of each type and size of hoses and cabling necessary for the N capability plus at least one spare of the longest single section/length of hose and cable be provided orb) that spare cabling and hose of sufficient length and sizing to replace the single longest run needed to support any FLEX strategy. The licensee has committed to following the NEI proposal. By letter (ADAMS Accession No. ML15125A442), the NRC agreed that the alternative approach is reasonable, but that the licensees may need to provide additional justification regarding the acceptability of various cable and hose lengths with respect to voltage drops, and fluid flow resistance. The NRC staff approves this alternative as being an acceptable method of compliance with the order.

3.14.2 Pre-staged two DGs on each unit's MAB roof The licensee has two DGs (N and N+ 1) pre-staged in protected structures on top of each unit's MAB roof, as well as associated equipment. The licensee's primary reason for pre-staging this equipment is due to difficulties in retrieving and deploying equipment following a large-scale flooding event. Pre-staging FLEX equipment is an alternative to NEI 12-06.

During the audit at the STP site, the staff confirmed that these pre-staged locations are protected from the applicable external hazards. The protective structure surrounding these DGs was designed to withstand the design basis seismic and tornado loads. The staff also reviewed load and sizing calculations and found no issues. The staff finds that pre-staging of the FLEX DGs is an acceptable alternative as the DGs are protected from all applicable hazards and should be available for the postulated external events, including flooding.

3.14.3 Pre-staged FLEX pumps with separate injection pathways for SGs Two FLEX SG makeup pumps (N and N+ 1) are pre-staged in the B-Train and C-Train of the IVCs for each unit. The SG makeup strategy relies on one FLEX SG makeup pump per unit to supply water from the AFWSTs to the SGs when the TDAFW pumps are unavailable. The primary connections to supply makeup water to the SGs are located on the AFW system suction and cross-connect lines in the IVC. Each IVC train bay is separated by individual watertight doors and each of the FLEX SG makeup pumps has its own independent connection points associated with that train. The IVCs are protected from all applicable external hazards.

The pre-staging of the FLEX SG makeup pumps is an alternative approach to NEI 12-06, Revision 0, which anticipates that the FLEX equipment is portable and has the capability to be deployed and staged in areas as needed for operation. However, the staff acknowledges that the FLEX SG makeup pumps are redundant for each Unit and have independent connections for either pump that is used for SG makeup. The staff finds the alternative approach to NEI 12-06, Revision 0, for the use of pre-staged FLEX SG makeup pumps to be acceptable due to the redundant pumps with independent connections for SG makeup and the protection of the pumps from all applicable external hazards.

3.14.4 Pre-staged FLEX pumps with separate injection pathways for RCS The licensee uses the CVCS PDPs for each Unit to serve as the primary RCS makeup capability. The CVCS PDPs will be powered by the pre-staged FLEX DGs described in Section 3.14.2. The FLEX RCS makeup pump, pre-staged and located in the FHB, will serve as the backup (N+ 1) pump for RCS makeup (one per unit) and have separate injection pathways from the CVCS PDPs. The licensee stated that pre-staging the FLEX RCS makeup pumps in the FHB would provide protection from all applicable external hazards and eliminate deployment time.

The staff finds the alternative approach to NEI 12-06, Revision 0, for the use of the pre-staged FLEX RCS makeup pumps to be acceptable for both the CVCS PDPs and the FLEX RCS makeup pumps due to the protection of the pumps from all applicable external hazards and the reduced time for deployment.

3.14.5 Pre-staged FLEX pumps for Spent Fuel Pool (SFP) Makeup The licensee uses the RMW pumps (one per Unit) in the MAB for SFP makeup as the primary method. The alternate method is to use the FLEX SFP makeup pumps that are pre-staged in the FHB.

The staff recognizes that the pre-staging of the FLEX SFP makeup pumps in the FHB is an alternative approach to NEI 12-06, Revision 0, which assumes the deployment of portable FLEX equipment. The staff finds the alternative approach to NEI 12-06, Revision O, for the use of pre-staged FLEX SFP makeup pumps to be acceptable due to the protection of the pumps from all applicable external hazards and the reduced time for deployment, with additional makeup pumps that can be deployed and connected for SFP makeup as needed.

3.14.6 Conclusions In conclusion, the NRG staff finds that although the guidance of NEI 12-06 has not been met, if these alternatives are implemented as described by the licensee, the requirements of the order should be met.

3.15 Conclusions for Order EA-12-049 Based on the information above, the NRG staff concludes that the licensee has developed guidance to maintain or restore core cooling, SFP cooling, and containment following a BDBEE which, if implemented appropriately, should adequately address the requirements of Order EA-12-049.

4.0 TECHNICAL EVALUATION

OF ORDER EA-12-051 By letter dated February 28, 2013 (ADAMS Accession No. ML13070A006), the licensee submitted its OIP for STP in response to Order EA-12-051. By letter dated June 7, 2013 (ADAMS Accession No. ML13149A092) the NRC staff sent a request for additional information (RAI) to the licensee. The licensee provided a response by letter dated June 25, 2013 (ADAMS Accession No. ML13190A466). By letter dated September 19, 2013 (ADAMS Accession No. ML13254A210), the NRG staff issued an ISE and RAI to the licensee. The licensee provided a response by letter dated February 27, 2014 (ADAMS Accession No. ML14066A388). By letter dated May 6, 2015 (ADAMS Accession No. ML15111A465), the NRC issued an audit report on the licensee's progress.

By letters dated August 27, 2013 (ADAMS Accession No. ML13249A078), February 27, 2014 (ADAMS Accession No. ML14066A388), August 27, 2014 (ADAMS Accession No. ML14251A028), February 26, 2015 (ADAMS Accession No. ML15069A220), and August 26, 2015 (ADAMS Accession No. ML15251A206), the licensee submitted status reports for the Integrated Plan. The Integrated Plan describes the strategies and guidance to be implemented by the licensee for the installation of reliable SFP level instrumentation, which will function following a BDBEE, including modifications necessary to support this implementation, pursuant to Order EA-12-051. By letter dated January 19, 2016 (ADAMS Accession No. ML16043A355),

the licensee reported that full compliance with the requirements of Order EA-12-051 was achieved.

The licensee has installed SFP level instrumentation systems designed by AREVA in the STP, Unit 1 and Unit 2 SFPs. The NRC staff reviewed the vendor's SFP level instrumentation system design specifications, calculations and analyses, test plans, and test reports. The staff issued an audit report on September 15, 2014 (ADAMS Accession No. ML14203A326).

The staff performed an onsite audit to review the implementation of SFP level instrumentation related to Order EA-12-051. The scope of the audit included verification of (a) site's seismic and environmental conditions enveloped by the equipment qualifications, (b) equipment installation met the requirements and vendor's recommendations, and (c) program features met the requirements. By letter dated May 6, 2015 (ADAMS Accession No. ML15111A465), the NRC issued an audit report on the licensee's progress. Refer to Section 2.2 above for the regulatory background for this section.

4.1 Levels of Required Monitoring In its OIP, the licensee identified the SFP levels of monitoring for both units as follows:

Level 1 at Elevation 64 ft. 2 inches (in.) This level allows for over 1 ft. of SFP water level above the top of the suction inlet flange (SFP Cooling Pump suction line with centerline of suction inlet flange at Plant El. 62 ft. 6 in.) which will be sufficient for Net Positive Suction Head (NPSH).

Level 2 at Elevation 49 ft. 1 O in. or 1 Oft. water level above the top of the SFP fuel storage rack.

Level 3 at Elevation 40 ft. 4 in. or 6 in. water level above the top of the SFP fuel storage rack.

In its letter dated June 25, 2013 (ADAMS Accession No. ML13190A466), the licensee further provided the basis for the designated Level 1 as follows: the SFP cooling pumps were analyzed for the conservative worst case operation of the SFP cooling pumps. Maximum values for line resistance, fluid temperature, suction flow and static head were used to calculate NPSH parameters for both required and available NPSH (NPSHR and NPSHA). It was determined that for the worst case scenario, the NPSHA was significantly higher than NPSHR. The NPSHA was calculated to be 42.67 ft. and NPSHR was calculated to be 18. 75 ft. Therefore, NPSHR is not the determining value to be used for LEVEL 1.

The NRC staff noted that Level 1 designation is adequate for normal SFP cooling system operation; it is also adequate to ensure the required fuel pool cooling pump NPSH. This level also represents the higher of either the level at which reliable suction loss to the cooling pump occurs, or, the required NPSH of the cooling pump, which consistent with NEI 12-02 guidance for Level 1. Level 2 designation uses the first of the two options described in NEI 12-02 for Level 2, which is approximately 1 O ft. above the top of the fuel rack. Level 3 designation is 6 inches above the top of the fuel rack, where the fuel remains covered, which is also consistent with NEI 12-02. The staff finds that the licensee's proposed Levels 1, 2, and 3 are consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and adequately addresses the requirements of Order EA-12-051.

4.2 Evaluation of Design Features Order EA-12-051 required that the SFP level instrumentation shall include specific design features, including specifications on the instruments, arrangement, mounting, qualification, independence, power supplies, accuracy, testing, and display. Refer to Section 2.2 above for the requirements of the order in regards to the design features. Below is the staff's assessment of the design features of the SFP level instrumentation.

4.2.1 Design Features: Instruments In its OIP, the licensee stated that both the Primary and Backup Instrument Channels will utilize permanently-installed instruments. Both channels utilize Guided Wave Radar, which functions according to the principle of Time Domain Reflectometry (TOR). A generated pulse of electromagnetic energy travels down the probe. Upon reaching the liquid surface the pulse is reflected and based upon reflection times level is inferred. The measured range will be continuous from elevation 40 ft. 4 in. (Level 3) to elevation 67 ft. (SFP high level alarm) or a range of 26 ft. 8 in. The level sensing components will be located in the northeast corner of the SFP for the Primary instrument channel and in the northwest corner of the SFP for the Backup instrument channel.

The NRC staff noted that the specified measurement range will cover Level 1, 2, and 3 as described in Section 4.1 above. The staff finds that the licensee's design, with respect to the number of channels and measurement range for its SFP, is consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of Order EA-12-051.

4.2.2 Design Features: Arrangement In its OIP, the licensee stated that the SFPs for both units are essentially identical. The dimensions of the SFPs are 52 ft. in the north-south direction by 28 ft. 6 in. in the east-west direction. The fuel handling machine travels on rails in the North-South direction and has a clearance of approximately 3 112 in. between the bottom of the machine and the SFP deck. The plan is to mount the sensor for one channel in the northeast corner of the SFP and the other channel in the opposite, northwest corner of the SFP. The plan is to mount the supporting electronic instruments outside of the spent fuel pool area, to provide a more benign radiation and environmental conditions, and also provide for reasonable and accessible locations for operators.

In its letter dated June 25, 2013, the licensee provided a sketch depicting the routing of the waveguide piping for the two instrument channels. The NRC staff noted that the two pipes to be run side by side from the radar horns to the sensor receivers located in the MAB, and from there, cabling for the two instrument channels to be run side by side to the display units mounted in the Radwaste Control Room (RWCR). The staff had concerns regarding the cabling routing of these two instrument channels in accordance with the guidance on channel separation as described in NEI 12-02. During the onsite audit, the staff specifically raised the following concerns with the licensee:

The radar horns for both instrument channels were installed on the short side of the SFP and the distance between them is not comparable to the shortest length of the pool's side as described in NEI 12-02.

The wave guide piping for two instrument channels were separated by only 8 inches and ran side by side. This arrangement does not provide reasonable protection of the level indication function against missiles that may result from damage to the structure over the SFP as required by Order EA-12-051.

In its letter dated February 26, 2015 (ADAMS Accession No. ML15069A220), the licensee provided a response, in which it stated that the radar horns are separated on the north end of the SFP by approximately 20 ft. There are several obstructions that prevent any further separation on the north end. The horns could only be installed on the north end of the pool because the Spent Fuel Handling (SFH) machine rails on the pool deck run the entire length of the east and west sides of the pool. The reason the south side of the SFP (short side) was not utilized for one of the horns was because the waveguide run would have exceeded the design parameters of the system, due to the number of bends and the length of pipe that would have been required. The south side of the pool across the SFP deck, has limited space to run the waveguide because of removable hatches, new fuel inspection area, and other recessed areas on the SFP area operating deck. Additionally, in order to clear the SFH machine rails in the south direction, the waveguide would have to run along the SFP floor more than 100 ft., before it had a bend to direct it outside the SFP area. This additional 100 ft. would challenge the design criteria limitation on waveguide length, bends and complexity.

The approximately 40 ft. of waveguide piping run is separated by 8 1-4 in. vertically. The waveguides are run close together to avoid obstructions such as existing conduit, piping, lighting panels, removable access hatches, and a transformer which would make the waveguide path too torturous. A minimum number of bends in the waveguide piping is also required to ensure proper operation. Where the waveguides are run in close proximity in the FHB (approximate 40 ft. run), STPNOC will install a protective guard for one of the two waveguides as indicated in its letter dated February 26, 2015 (ADAMS Accession No. ML15069A220).

The NRG staff found the justification for having both sensors installed on the short side of the SFP acceptable and verified this justification during the walkdown. The staff reviewed the proposed design of the protective guard, Design Change Package (DCP) 12-12320-17, "Unit 2 Spent Fuel Pool Level Indication Installation," Supplement 5, and found that the proposed design acceptable and if implemented properly, the protective guard will provide protection for one of the two waveguides piping of the level indication against missiles. The staff also reviewed the following Document Change Notices (DCNs) and found the licensee's proposed design for the protective guard acceptable:

DCN 1500524, against Calculation CC09972, "Qualification of Piping and Piping Support for Spent Fuel Pool Level Indicator," Revision 0. This DCN adds Attachment C to the above calculation providing the qualification of the separation detail and that of the impacted supports.

DCN 1500525, Page 1 thru 19, provides installation details for the separation detail starting from support 003 and ending at support 010.

The staff noted that the licensee adequately addressed the staff's concern regarding the SFP level instrument arrangement. The licensee's proposed design of a protective guard provides reasonable protection against loss of indication of SFP level due to missiles that may result from damage to the structure over the SFP.

Based on the discussion above, the NRG staff finds that the licensee's arrangement for the SFP level instrumentation, if implemented appropriately, should be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of Order EA-12-051.

4.2.3 Design Features: Mounting In its letter dated June 25, 2013 (ADAMS Accession No. ML13190A466), the licensee stated that the loading on the mounting bracket includes the static weight loads and dynamic loads of the horn antenna, waveguide assembly and attached waveguide pipe up to the nearest pipe support. The dynamic loads on the mounting bracket consist of the design basis maximum seismic loads on the bracket and the mounted components, along with hydrodynamic loads produced by impinging surface waves caused by seismically-induced pool sloshing. The methodology for ensuring the mounting bracket and attached equipment can withstand the seismic dynamic forces will be by analysis of the combined maximum seismic and hydrodynamic forces on the cantilevered portion of the waveguide assembly and horn antenna exposed to the potential seismically induced wave actions. In addition, seismic qualification testing will be performed to seismic response spectra that envelope the maximum seismic ground motion for the installed location.

In its letter dated February 26, 2015 (ADAMS Accession No. ML15069A220), the licensee further stated that the horn and waveguide assembly and the electronics units were successfully seismically tested in accordance with Institute of Electrical and Electronics Engineers (IEEE)

Standard 344-2004. In addition to the seismic test, an analysis of the combined effects of the seismic and hydrodynamic forces on the cantilevered portion for the assembly exposed to the potential sloshing effects was performed and the results were satisfactory.

During the onsite audit, the NRG staff reviewed Calculation CC09973, "Qualification of Horn and Transmitter Supports for Spent Fuel Pool Level Indicator, and found the seismic and hydrodynamic forces were adequately calculated for the horn and transmitter assembly supports. However, Calculations CC09972, "Qualification of Piping and Piping Supports for Spent Fuel Pool Level Indicator, CC09974, "Qualification of Power Control Panel Mounting for Spent Fuel Pool Level Indicator, and CC09994, "Qualification of Sensor Supports for Spent Fuel Pool Level Indicator," state that the mountings for the waveguides, sensors, and power panels are designed as Seismic Category II/I. The staff had a concern that Seismic Category II/I mounting design cannot retain the SFP level indication equipment design configuration during and following a maximum seismic ground motion.

In its letter dated February 26, 2015, the licensee provided a response, in which it stated that separate seismic qualification analyses were performed on the pool end mounting brackets, waveguide intermediate mounting brackets, sensor mounting brackets and the power control panel mounting. These supports are designed to meet the STP seismic criteria for the FHB and Mechanical Auxiliary Building, which are Category I structures. These supports will remain fully intact during and after STP's SSE. South Texas calculations are being revised to provide clarification of the seismic evaluation performed.

The NRG staff reviewed DCP 12-12320-17, "Unit 2 Spent Fuel Pool Level Indication Installation," Supplement 5, dated March 18, 2015. In this DCP, STP provided clarification for the SFP level instrumentation mounting requirements. The mountings of the SFP level instrumentation system are designed to withstand the SSE. The clarification is in the following DCNs:

DCN 1500444 against Calculation CC09972, "Qualification of Piping and Piping Support for Spent Fuel Pool Level Indicator," Revision 0.

DCN 1500445 against Calculation CC09973, "Qualification of Horn and Transmitter Supports for Spent Fuel Pool Level Indicator," Revision 0.

DCN 1500446 against Calculation CC09974, "Qualification of Power Control Panel Support for Spent Fuel Pool Level Indicator," Revision 0.

DCN 1500447 against Calculation CC09994, "Qualification of Sensor Supports for Spent Fuel Pool Level Indicator, Revision 0.

The NRG staff noted that the licensee adequately addressed the design criteria and methodology used to estimate and test the total loading on the mounting devices, including the design basis maximum seismic loads and the hydrodynamic loads that could result from pool sloshing. The seismic analyses demonstrated that the SFP level instrumentation's mounting design is satisfactory to allow the instrument to function per design following the maximum seismic ground motion.

Based on the discussion above, the NRG staff finds the licensee's proposed mounting design seems to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of Order EA-12-051.

4.2.4 Design Features: Qualification 4.2.4.1 Augmented Quality Process Appendix A-1 of the guidance in NEI 12-02 describes a quality assurance process for non-safety systems and equipment that is not already covered by existing quality assurance requirements. Per JLD-ISG-2012-03, the NRG staff found the use of this quality assurance process to be an acceptable means of meeting the augmented quality requirements of Order EA-12-051.

In its OIP, the licensee stated that the instrumentation systems will meet the requirements for augmented quality in accordance with NEI 12-02, Revision 1, and the ISG.

The NRC staff noted that if implemented appropriately, this approach should be consistent with NEI 12-02 guidance, and should adequately address the requirements of Order EA-12-051.

4.2.4.2 Equipment Reliability The NRC staff reviewed the AREVA SFP level instrumentation's qualification and testing during the vendor audit for temperature, humidity, radiation, shock and vibration, and seismic (ADAMS Accession No. ML14203A326). The staff further reviewed the anticipated STP's environmental conditions during the on-site audit (ADAMS Accession No. ML15111A465).

4.2.4.2.1 Temperature, Humidity, and Radiation For the expected temperature and humidity conditions at STP and equipment qualifications, in its letter dated June 25, 2013 (ADAMS Accession No. ML13190A466), the licensee stated that the postulated temperature in the SFP room that results from a boiling pool is 100 °C (212 °F).

The electronics in the sensor are rated for a maximum temperature of 80 °C (176 °F). The sensor will be located outside of the SFP room in an area where the temperature will not exceed the rated temperature of the electronics. The maximum humidity postulated for the SFP room is one hundred percent relative humidity, essentially a saturated steam environment. The electronics will be located outside of the SFP room in an area away from the steam atmosphere.

The waveguide tube in the FHB can withstand condensation formed on the inside walls provided there is no pooling of the condensate in the waveguide tube. This is ensured by installing a weep hole(s) at the low spots in the wave guide pipe.

For the expected radiological conditions at STP and equipment qualifications, in its letter dated June 25, 2013 (ADAMS Accession No. ML13190A466), the licensee stated that the area above and around the pool will be subject to large amounts of radiation in the event that the fuel becomes uncovered. The only parts of the measurement channel in the pool radiation environment are the metallic waveguide and horn, which are not susceptible to the expected levels of radiation. The remote display electronics will be located in an area outside the FHB that does not exceed the 1x103 rad analyzed limit for the electronics.

During the vendor audit (ADAMS Accession No. ML14203A326), the NRC staff raised the concerns of the condensation formed inside the waveguide piping may impact the equipment accuracy. To address this, AREVA proposed to change the design from installing weep holes at the low spots in the wave guide pipe to installing a horn cover to prevent the intrusion of moisture in the waveguide. The NRC staff found the design change adequately addressed the staff's concern. To address this design change, in its letter dated August 26, 2015 (ADAMS Accession No. ML15251A206), the licensee stated that condensation build-up within the wave guide or horn assembly during a BOB event has been addressed by a design feature of the instrument. An approved horn cover has been attached to the horn assembly which prevents condensation from forming inside the waveguide during a BOB event. The wave guide system in the FHB is sealed from the effects of humidity changes and/or steam during a BDBEE.

The NRC staff noted that the vendor and the licensee adequately addressed the staff's concern regarding the impact of condensation on the equipment accuracy. However, the staff had concerns with the licensee's lack of information regarding worst case postulated conditions of the temperature, humidity, and radiation in the vicinity where the electronics equipment will be located. In response to the staff's concern regarding temperature and humidity worst case conditions, in its letter dated February 27, 2014 (ADAMS Accession No. ML14066A388), the licensee stated that the electronics in the RWCR are continuous duty rated 70 °C for the indicator and 62 °C (144 °F) for power control panel. During the ELAP event no equipment running in the vicinity of the sensor electronics. With no equipment in the rooms running and the doors opened, inside ambient temperature will eventually equalize with outside air temperatures. FLEX procedures will be developed to evaluate opening doors, if needed. For the postulated accident room temperature of 125 °F (52 °C), there is still adequate margin.

Historical weather data from national weather service, the docketed design base accident temperature identified in the UFSAR Table 3.11-1 for the MAB RWCR (Rm. 217) is 125 °F (52

°C). The expected relative humidity at the electronics location for the ELAP event may be as high as one hundred percent. The sensor has been tested in accordance with IEC 60068-2-30 which varies the temperature from room temperature to elevated temperature at high humidity conditions (from 22 °C to 57 °C at a constant ninety six percent relative humidity) to verify that the test item withstands condensation that can occur due to the changing conditions. The sensor has also been tested to EN 60529:2000 and is rated I P66/I P68, which means totally dust tight housing, protection against string water jets and waves, and protection against prolonged effects of immersion under 0.2 bar pressure. This rating further substantiates the sensor's ability to perform at high humidity conditions including condensing.

In response to the staff's concern regarding radiation worst case conditions, in its letter dated August 27, 2014 (ADAMS Accession No. ML14251A028), the licensee stated that STPNOC performed a Monte Carlo shielding calculation to determine the dose rate at the location of the electronics. The results indicate that the electronic components will not be exposed to an integrated dose greater than 1 x 103 Rads for a 7-day duration of the event with water level at level 3. The design basis dose rate for the Radwaste Control Room during normal operations is 2.5 mRem/hr; however, actual dose rates are< 1 mRem/hr. The RWCR is physically separated from the operating deck of the FHB and the top of the SFP. It is not expected that a postulated event in the SFP vicinity would result in an unacceptable increase in the dose rate in the RWCR.

The NRC staff noted that the licensee adequately addressed the staff's concerns with respect to BOB temperature, humidity, and radiological conditions. The staff verified the above response during the onsite audit by reviewing the following documents:

4E019NQ1009, "Design Criteria for Equipment Qualification Program" STPNOC016-CALC-001, "Spent Fuel Pool Instrumentation Radiological Evaluation per NEI 12-02" 9M129A81110, "Radiation Zones Mechanical and Electrical Aux. Building Plan at EL.

60'-0""

9M129A81109, "Radiation Zones Mechanical and Electrical Aux. Building Plan at ELVES. 35'-0" and 41 '-0""

9M129A81124, "Post Accident Radiation Zones Mechanical and Electrical Aux. Building Plan at EL. 35' -0" and 41 '-0""

4E019NQ1009, "Design Criteria for Equipment Qualification Program" Per Calculation STPNOC016-CALC-001, dose rates and integrated doses are calculated based on a full SFP of 100 hour0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> decayed fuel. The dose of 8.87E+2 rad is below the radiation sensitive limit 1 E+03 rad of the SFP instrumentation electronics.

Per 4E019NQ1009, page 28, Room 217 is a mild environment location and does not have a significant accident dose during a LOCA which would be coming from the same general location as if the accident was due to the SFP being excessively low (Room 326). Drawing 9M 129A81109#2 shows normal radiation levels and Drawing 9M 129A81124 shows post-accident dose levels. Since Room 326's accident dose for a LOCA would be 1. 7E+06 rad per design, and only 8.87E+02 rad for the SFP accident per calculation STPNOC016-CALC-001, the dose would be a factor of 1,900 lower. The accident dose expected during a LOCA by design for room 217 is 100 rad; therefore the accident dose for room 217 for the SFP accident would be less than 1 rad. Normal radiation dose over the life of the equipment is 1 E+3 rad.

Based on this review, the NRC staff found that the licensee adequately addressed the equipment reliability of SFP level instrumentation with respect to temperature, humidity and radiation. The equipment qualification envelops the expected STP's radiation, temperature, and humidity conditions during BOB event. The equipment environmental testing demonstrated that the SFP instrumentation should maintain its functionality during the expected BOB conditions.

4.2.4.2.2 Shock and Vibration For the equipment's shock and vibration qualifications, in its letter dated February 27, 2014 (ADAMS Accession No. ML14066A388), the licensee stated that the Through Air Radar sensor and indicating and adjustment module were shock tested in accordance with MIL-STD-901 D and vibration tested in accordance with MIL-STD-167-1. The MIL-STD-901 D test consisted of a total of nine shock blows, three through each of the three principal axes of the sensor, delivered to the anvil plate of the shock machine. The heights of hammer drop for the shock blows in each axis were one foot, three ft. and five ft. The Through Air Radar sensor has also been shock tested in accordance with EN60068-2-27 (1 OOg, 6ms), ten (10) shock blows applied along a radial line through the support flange. The Ml L-STD-167-1 test frequencies ranged from 4 Hertz (Hz) to 50 Hz with amplitudes ranging from 0.048 in. at the low frequencies to 0.006 in.

at the higher frequencies. The potential vibration environment around the SFP and surrounding building structure might contain higher frequencies than were achieved in the testing discussed above. Additional testing of the sensor was performed in accordance with EN 60068-2-6 (except 4g, 200 Hz). This additional testing is considered to provide a stand-alone demonstration of the resistance to vibration of the sensor and further substantiates the results of the MIL-STD-167-1 testing.

The NRC staff noted that the licensee adequately addressed the equipment reliability of SFP level instrumentation with respect to shock and vibration. The test parameters envelope the STP's expected shock and vibration conditions during a postulated BDBEE.

4.2.4.2.3 Seismic In its letter dated June 25, 2013 (ADAMS Accession No. ML13190A466), the licensee stated that a seismic shake test will be performed to the requirements of IEEE 344-2004 for elements of the VEGAPuls 62ER Through Air Radar instrument to levels anticipated to envelop most if not all plants in the United States. The equipment to be tested includes the sensor, readout and power control panel, horn end of the waveguide, pool end and sensor end mounting brackets, and waveguide piping. The items will be tested to the Required Response Spectra (RAS) contained in EPRI TR-1 07330, "Generic Requirements Specification for Qualifying a Commercially Available PLC for Safety-Related Applications in Nuclear Power Plants," to account for the potentially high seismic motion that could occur to cabinet-mounted readout and power control panel. This RAS will also envelop the seismic ground motion for items mounted to the building structure, pool edge, etc.

In its letter dated February 26, 2015 (ADAMS Accession No. ML15069A220), the licensee further stated that separate seismic qualification analyses were performed on the pool end mounting brackets, waveguide intermediate mounting brackets, sensor mounting brackets and the power control panel mounting. These supports are designed to meet the STP design criteria tor the FHB and MAB, which are seismic Category I structures. These supports should remain fully intact during and after STP's SSE.

The NRC staff noted that the licensee adequately addressed the equipment qualification with respect to seismic. Further evaluation of equipment mounting was discussed earlier in Subsection 4.2.3, "Design Features: Mounting."

The NRC staff finds the licensee's proposed instrument qualification process seems to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of Order EA-12-051.

4.2.5 Design Features: Independence In its OIP, the licensee stated that the instruments and power supplies for all of the components of the Primary Channel will be independent of the components of the Backup Channel in accordance with existing plant design standards for electrical channel separation. The ac or de power sources utilized for the Primary and Backup Channels should come from different buses such that no one single failure will interrupt power to both SFP level instrumentation channels.

In its letter dated June 25, 2013 (ADAMS Accession No. ML13190A466), the licensee further stated that the channel display panels are powered from 120VAC lighting panels (LPs). The LPs are powered independently from different 13.8kV busses. The two panels selected are LP 13B and LP 13P. LP 13B is powered from motor control center (MCC) 1S1 (2S 1) which in turn is powered from 13.8kV bus 1 H (2H). LP 13P is powered from MCC 1 L3 (2L3) which in turn is powered from 13.8 kV bus 1 G (2G). Thus, a failure of one large bus will not cause the loss of both display panels. The NRG staff verified the instrument channels' electrical independence by reviewing the following drawings:

00009EOPFAX#2, "Single Line Diagram 480V Motor Control Center 2L3 (MAB)"

00009EOPFBA#2, "Single Line Diagram 480V Motor Control Center 2S1 (MAB)"

Further evaluation of instrument channel's physical separation is discussed in Subsection 4.2.2, "Design Features: Arrangement." The NRG staff noted, and verified during the walkdown, that the licensee adequately addressed the level measurement channel independence. With this proposed design, the loss of one power supply of an instrument channel will not affect the operation of other channel under BOB event conditions. The staff finds the licensee's proposed design, with respect to instrument channel independence, should be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of Order EA-12-051.

4.2.6 Design Features: Power Supplies In its OIP, the licensee stated that, for Unit 1 and Unit 2, the power supplies for the Primary and Backup Instrument Channels will be provided from different power buses to assure that the loss of one bus will not result in the loss of both channels. In addition, each instrument channel shall have a backup battery power supply for uninterrupted operation after loss of power. Power will be of sufficient capacity to maintain level indication until offsite resources become available.

During a loss of normal power, the installed batteries in each cabinet will power the level instrumentation.

The power source selection is described in Subsection 4.2.5, "Design Features: Independence."

The NRG staff noted that the licensee adequately addressed the power supply requirements.

The staff finds the licensee's proposed power supply design, if implemented as described, should be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of Order EA-12-051.

4.2. 7 Design Features: Accuracy In its letter dated August 26, 2015 (ADAMS Accession No. ML15251A206), the licensee stated that the reference accuracy for the instrument is +/-1 inch based on testing. This is the design accuracy value that will be used for the SFP level instrumentation channels. The accuracy of the instrument channel is little affected under BOB conditions. The stainless steel horn antenna and waveguide pipe that are exposed to BOB conditions are largely unaffected by radiation, temperature and humidity. An approved horn cover has been attached to the horn assembly which prevents condensation from forming inside the wave guide during a BOB event which could affect the radar signal. A minor effect on the length of the overall measurement path can occur due to temperature related expansion of the waveguide pipe. The waveguide pipe permits the sensor receiver to be located in mild environment conditions so that the effect of elevated temperature on sensor receiver accuracy is also limited. Based on the vendor Operating Instruction Manual, a small correction factor is applied on the radar beam velocity to account for the impact of saturated steam at atmospheric pressure. Testing performed in saturated steam and saturated steam combined with smoke environments indicates that the overall effect on the instrument accuracy is minimal. The overall accuracy due at BDB conditions is conservatively estimated to not exceed +/-3 inches, which is within the required +/-1 ft. described in NEI 12-02.

The NRC staff evaluated AREVA' s SFP level instrumentation system design during the vendor audit and noted that the accuracy of the SFP instrumentation is +/-1 inch for normal conditions and +/-3 inch for BDB conditions including 212 °F saturated steam. The SFP instrumentation is designed to maintain its accuracy after a power interruption without recalibration. During the onsite audit, the NRC staff reviewed Test Report 51-9230745-000, "Through Air Radar Spent Fuel Pool Level Instrument (SFPLI) Factory Acceptance Test (FAT) Report for South Texas Project (STP) Unit 2," and found the instrument adequately tested to retain the accuracy following a loss of power and after the restoration of power.

The licensee has demonstrated that the instrument channels' accuracy is not significantly affected by BDB conditions. If implemented properly, the instrument channels will maintain the designed accuracy following a power source change or interruption without the need of recalibration. The NRC staff finds the licensee's proposed instrument accuracy seems to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of Order EA-12-051.

4.2.8 Design Features: Testing In its letter dated June 25, 2013 (ADAMS Accession No. ML13190A466), the licensee stated that multi-point testing is enabled by the capability to rotate the radar horn antenna away from pointing to the SFP water surface and instead aimed at a movable metal target that is positioned at known distances from the horn. This allows checking for correct readings of all indicators along a measurement range and validates the functionality of the installed system.

The Primary and Backup instrument channels will have indicators that can be compared against each other and against any other permanently-installed SFP level instrumentation. The results of the comparison between the SFP level instrumentation channels can be compared with the criteria to determine if recalibration or troubleshooting is needed. Calibrating and channel checks are developed. Functional checks will be performed periodically. Functional checks will include visual inspection, verification of the instrument display reading, and testing of the battery backup on simulated loss of normal power. Calibration tests will be performed.

The NRC staff noted that the SFP level instrumentation is adequately designed to provide the capability for routine testing and calibration including in-situ testing/calibration. By comparing the levels in the instrument channels and the maximum level allowed deviation for the instrument channel design accuracy, the operators could determine if recalibration or troubleshooting is needed. The staff finds the licensee's proposed SFP instrumentation design should allow for testing consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of Order EA-12-051.

4.2.9 Design Features: Display In its letter dated June 25, 2013 (ADAMS Accession No. ML13190A466), the licensee stated that the displays will be located in the RWCR. The RWCR is located in an area that is accessible to the MAB Plant Operator from two different paths from outside the MAB. One path is from the EAB and the other path is from an outside entrance to the MAB. The MAB is a seismic Class 1 safety related structure and the RWCR is inside the MAB. Communications between the control room and the plant operators is provided by a variety of means including radios and sound-powered phones. The RWCR is located on the 41 foot level of the MAB and will not receive a significant increase in background radiation levels in the event the SFP water level reduces to Level 3. The concrete walls around the SFP are five ft. thick. The building walls between the FHB and the MAB are five ft. six inches thick. An additional two foot thick wall separates the RWCR and the penetration area next to the FHB. The distance from the nearest SFP boundary to the FHB/MAB boundary is approximately 49 ft. The distance from the FHB/MAB boundary to the nearest RWCR wall is approximately 65 ft. with an elevation change from 68 ft. (the SFP operating deck level) to 41 ft. The RWCR will be habitable during SFP drain down scenarios and external events. Access to the RWCR is achieved on the east side of the MAB and EAB whereas the FHB and SFP are on the west side of the MAB. As such, the RWCR should be promptly accessible for any event in the FHB.

In its letter dated February 27, 2014 (ADAMS Accession No. ML14066A388), the licensee further stated that the display location is in the RWCR. There are several ways to access this display location. From the MCR, it will take a person< 5 minutes to access the display. The post-accident radiological & environmental conditions for the worst case design-basis accident for the MAB RWCRs (Rm. 217) are <five R/hr, one hundred percent humidity, and 125 °F as indicated in UFSAR Table 3.11-1. Postulated temperature and humidity rise are expected during an ELAP event as outside and inside temperatures equalize but the radiation levels are elevated beyond what would be expected for this event as no fuel damage is expected.

However, it is clearly bounding. Personnel will not be continuously stationed at the display.

They would monitor level periodically.

The NRC staff noted that the licensee adequately addressed the display requirements. If implemented properly, the displays will provide continuous indication of SFP water level. The displays are located in seismically qualified buildings and the accessibility of the RWCR following an ELAP event is considered acceptable. The staff finds that the licensee's proposed location and design of the SFP instrumentation displays seems to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of Order EA-12-051.

4.3 Evaluation of Programmatic Controls Order EA-12-051 specified that the spent fuel pool instrumentation shall be maintained available and reliable through appropriate development and implementation programmatic controls, including training, procedures, and testing and calibration. Below is the NRC staff's assessment of the programmatic controls for the spent fuel pool instrumentation.

4.3.1 Programmatic Controls: Training In its letter dated February 26, 2015 (ADAMS Accession No. ML15069A220), the licensee stated that the SFP level indication changes were distributed for updating training materials for the Initial Licensed and Non-Licensed Operator lesson plans. The technical changes were presented in the Licensed and Non-Licensed Operator Requalification training programs during the recent SFP Cooling and Cleanup system review lesson presented in training cycle 142 and the FLEX implementation training presented in training cycle 145 in 2014. SFP Cooling and Cleanup system requalification review is every 4 years. In addition to this training, Licensed and Non-Licensed Operators will receive email training bulletins on all new or revised operations procedures regarding operation/use of the SFP level instrumentation. Instrumentation & Control

{l&C) technician initial apprentice training lesson plan IMT 303, Level Measurement was revised to include the operation and calibration of the radar level sensing technology used for the new SFP level instrumentation. This same technology is used in the Diesel Fuel Oil Storage Tank and the Caustic tank. A Needs Analysis in accordance with the SAT was conducted for the SFP level indication and the Fluke 705 Calibrator to determine the elements of the training required for operation and calibration of the level detection system. The Curriculum Review Committee approved covering both during cycle training in the summer 2015 (ICC151) for certified l&C technicians even though the same technology instrumentation was included in initial l&C training which has been conducted since 2006.

The NRC staff finds that the use of SAT to identify the training population and to determine both the elements of the required training is acceptable. The licensee's proposed plan to train personnel in the operation, maintenance, calibration, and surveillance of the SFP instrumentation and the provision of alternate power to the primary and backup instrument channels, including the approach to identify the population to be trained, should be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of Order EA-12-051.

4.3.2 Programmatic Controls: Procedures In its OIP, the licensee stated that procedures for the maintenance and testing, and the training of the required personnel on these procedures will be completed prior to the required date for completion of these modifications. Existing procedures for the SFP will be revised as required and training of the required personnel on the revised procedures will be completed prior to the date for completion of these modifications.

In its letter dated February 26, 2015 (ADAMS Accession No. ML15069A220), the licensee further stated that STPNOC is developing and/or revising the following procedures/ preventive maintenance activities for the operation, calibration, maintenance, testing, and inspection of the new spent fuel pool level instrumentation. In the letter, the licensee also provided a list of STP procedures and preventive maintenance activities related to the SFP level instrumentation as follows:

Procedure No. or Title Technical Objectives Preventive Maintenance No.

OPOP04-AE-0003 Loss Of Power To Off-normal procedure for response to loss of One Or More 13.8 normal power to the Remote SFP level KV Standby Bus instrument OPOP04-Z0-0001 Control Room Off-normal procedure for response to Evacuation Control Room evacuation.

OPOP04-SY-0001 Seismic Event Off-normal procedure for response to a seismic event.

OPOP04-Z0-0002 Natural or Off-normal procedure for response to a Destructive severe weather.

Phenomena Guidelines OPOP05-EO-ES01 Reactor Trip Emergency Operating Procedure for Reactor

Response

Trip response which includes periodic verification of SFP cooling and level.

OPOP12-ZO-FSG11 Alternate SFP FLEX Support Guideline for providing Makeup and alternate method (i.e., FLEX SFP makeup Cooling pump) for filling SFP during Extended Loss of AC Power event. Remote SFP level monitoring provided by new SFP level instrument.

SAG-9 Refill the Spent Severe Accident Management Guide Fuel Pool (SAMG) for mitigating severe accident in the Fuel Handling Building where spent fuel overheating and potential for fission product release exists.

SCG-5 Recover Spent Severe Accident Management Guide where Fuel Pool Level spent fuel has been uncovered and potential for fission product release and hydrogen combustion exists.

OPMPOB-FC-1401 AND FLEX SFP Level Periodic calibration of the spent fuel pool associated PM activities Loop Calibration level indication channels which will include calibration on backup power. This will be PM 15127 & 15212 performed in accordance with the STP PM (Unit 2) and similar PMs program and NEI 12-02 guidance.

will be developed for Unit 1 PM 15213 & 15131 Replace SFP level Periodic replacement of Battery backed (Unit 2) and similar PMs instrumentation power for spent fuel pool level indication will be developed for Back Up Power channels.

Unit 1 Supply Batteries.

This will be performed in accordance with the STP PM program and NEI 12-02 Quidance.

PM 15253 & 15254 Replace SFP level Periodic replacement of the sensors for (Unit 2) and similar PMs instrumentation spent fuel pool level indication channels.

will be developed for Sensor This will be performed in accordance with Unit 1 the STP PM program and NEI 12-02 guidance.

OPOP06-PE-OOL2/

Load Center 1 L2 Provides guidance for actions to take when OPOP06-PE-OOSO (2L2) and 1 S (2S) de-energizing the normal power supplies for Bus outage the remote SFP level instrument for maintenance on the applicable bus.

The NRG staff noted that the licensee adequately addressed the procedure requirements. The procedures are being established for the testing, surveillance, calibration, operation, and maintenance of the primary and backup SFP level instrument channels. The staff finds that the licensee's proposed procedures seem to be consistent with NEI 12 02, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of Order EA-12-051.

4.3.3 Programmatic Controls: Testing and Calibration For testing and calibration, in its letter dated February 27, 2014 (ADAMS Accession No. ML14066A388), the licensee stated that the in-situ calibration process at the SFP location utilizes the capability to rotate the waveguide horn assembly from its normal downward-pointing position so that it can be pointed at a target that is moved along the radar beam path. By placing the moveable target at known distances from the horn, the instrument output can be checked at each target location. In the event that the as found values are not within acceptance criteria, the measurement range can be shifted up or down to calibrate the instrument to within the required tolerance. The licensee will perform periodic channel checks and channel calibrations of the SFP level instrumentation. Preventive maintenance activities are being developed to replace the SFP level instrumentation batteries and replace the SFP level instrumentation sensor in accordance with the STP PM program, vendor recommendations and NEI 12-02 guidance.

For PM and compensatory actions for non-functioning SFP level instrument equipment, in its letter dated February 26, 2015 (ADAMS Accession No. ML15069A220), the licensee stated that a new procedure is being developed (OPGP03-Z0-0056) that will list compensatory actions for non-functioning FLEX and SFP level instrument equipment in accordance with NEI 12-02 Section 4.3. Planned compensatory actions for unlikely extended out-of-service events are summarized as follows:

CONDITION REQUIRED ACTION COMPLETION TIME A. One FLEX SFP level A.1 Verify associated alternate FLEX Within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> instrument NOT SFP level is functional. Note (1l functional.

AND Restore non-functional FLEX Within 90 days SFP level instrument to functional status.

B. Action A.1 completion B.1 Initiate compensatory action in Within 14 days time not met, accordance with Note (2l below.

OR One FLEX SFP level instrument expected to be non-functional for greater than 90 days.

C. Two FLEX SFP level C.1 Initiate actions to restore one Within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> instruments NOT SFP level instrument to functional functional.

status.

AND Initiate compensatory action in Within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> accordance with Note (2) below.

(1) Compare local level indication to functional remote SFP level 1nd1cat1on once per shift.

(2) Present report to Plant Operations Review Committee within following 14 days. The report shall outline planned alternate method of monitoring, cause of non-functionality, and schedule for restoring level instrument channel(s) to functional status.

The NRG staff noted that the licensee seems to have adequately addressed necessary testing and calibration of the primary and backup SFP level instrument channels to maintain the instrument channels at the design accuracy. The testing and calibration seem to be consistent with the vendor recommendations. Additionally, compensatory actions for instrument channel(s) out-of-service appear to be consistent with guidance in NEI 12-02.

4.4 Conclusions for Order EA-12-051 In its letter dated January 19, 2016 (ADAMS Accession No. ML16043A355), the licensee stated that they would meet the requirements of Order EA-12-051 by following the guidelines of NEI 12-02, as endorsed by JLD-ISG-2012-03. In the evaluation above, the NRG staff finds that, if implemented as described, the licensee will conform to the guidelines of NEI 12-02, as endorsed by JLD-ISG-2012-03. In addition, the NRG staff concludes that, if the SFP level instrumentation is installed at STP according to the licensee's proposed design, it should adequately address the requirements of Order EA-12-051.

5.0 CONCLUSION

In August 2013 the NRG staff started audits of the licensee's progress on Orders EA-12-049 and EA-12-051. The staff conducted an onsite audit in February 2015 (ADAMS Accession No. ML15111A465). The licensee reached its final compliance date on December 19, 2015 (ADAMS Accession No. ML16067A088) and has declared that both of the reactors are in compliance with the orders. The purpose of this SE is to document the strategies and implementation features that the licensee has committed to. Based on the evaluations above, the NRG staff concludes that the licensee has developed guidance and proposed designs which, if implemented appropriately, appears to adequately address the requirements of Orders EA-12-049 and EA-12-051. The NRG staff will conduct an onsite inspection to verify that the licensee has implemented the strategies and equipment to demonstrate compliance with the orders.

Principal Contributors:

Date: March 9, 2017 J. Lehning M. McConnell K. Nguyen K. Roche G. Armstrong R. Mychajliw, MTS

SOUTH TEXAS PROJECT, UNITS 1AND2-SAFETY EVALUATION REGARDING IMPLEMENTATION OF MITIGATING STRATEGIES AND RELIABLE SPENT FUEL POOL INSTRUMENTATION RELATED TO ORDERS EA-12-049 AND EA-12-051 DATED MARCH 9, 2017 DISTRIBUTION:

PUBLIC JLD R/F RidsNrrDorlLpl4-1 Resource RidsNrrLASLent Resource RidsAcrsAcnw_MailCTR Resource ADAMS Accession No. ML16340A009 OFFICE NRR/JLD/JOMB/PM NAME MValentin DATE 12/2/16 OFFICE NRR/JLD/JERB/BC*

NAME SBailey DATE 3/3/17 RidsRgn4MailCenter Resource MValentin, NRR/JLD RidsNrrPMSouth Texas Resource

• via email NRR/JLD/LA*

SLent 12/9/16 NRR/JLD/JOMB/BC (A)

JBoska 3/9/17 OFFICIAL AGENCY RECORD