ML18311A134

Non Proprietary - Issuance of Amendments Regarding the Updated Final Safety Analysis Report Section for the Standby Shutdown Facility

ML18311A134
Person / Time
Site:	Oconee
Issue date:	12/17/2018
From:	Audrey Klett Plant Licensing Branch II
To:	Burchfield J Duke Energy Carolinas
Klett A
References
EPID L-017-LLA-0365
Download: ML18311A134 (39)

Text

OFFICIAL USE ONLY PROPRIETARY INFORMATION UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 December 17, 2018 Mr. J. Ed Burchfield, Jr.

Site Vice President Oconee Nuclear Station Duke Energy Carolinas, LLC 7800 Rochester Highway Seneca, SC 29672-0752

SUBJECT:

OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3- ISSUANCE OF AMENDMENTS REGARDING THE UPDATED FINAL SAFETY ANALYSIS REPORT SECTION FOR THE STANDBY SHUTDOWN FACILITY (EPID L-2017-LLA-0365)

Dear Mr. Burchfield:

The U.S. Nuclear Regulatory Commission (NRC or the Commission) has issued the enclosed Amendment Nos. 410, 412, and 411 to Renewed Facility Operating Licenses Nos. DPR-38, DPR-47, and DPR-55, for the Oconee Nuclear Station, Units 1, 2, and 3, respectively. The amendments revise the Updated Final Safety Analysis Report (UFSAR) in response to the application from Duke Energy Carolinas, LLC via letter ONS-2017-074 dated October 20, 2017, as supplemented by letters RA-18-0033, RA-18-0098, and RA-18-0164 dated June 15, July 20, and September 21, 2018, respectively.

The amendments revise the UFSAR to provide off-nominal success criteria for maintaining the reactor in a safe shutdown condition when using the Standby Shutdown Facility to mitigate a Turbine Building flood occurring when a unit is not at nominal full power conditions. The amendments also revise the UFSAR to allow the use of the main steam atmospheric dump valves, when available, to enhance Standby Shutdown Facility mitigation capabilities.

The NRC staff has determined that Enclosure 2 contains proprietary information pursuant to Title 10 of the Code of Federal Regulations (10 CFR), Section 2.390, "Public inspections, exemptions, requests for withholding." Accordingly, the NRC staff has prepared a redacted version, which is provided in Enclosure 3.

Enclosure 2 transmitted herewith contains sensitive unclassified non-safeguards information. When separated from Enclosure 2, this document is DECONTROLLED.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL US1i ONLY PROPRlliTARY INFORMATION J. E. Burchfield, Jr. The NRC staff's safety evaluation of the amendments is enclosed. A Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Sincerely, IRA/

Audrey L. Klett, Project Manager Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-269, 50-270, and 50-287

Enclosures:

1. Amendment No. 41 O to DPR-38, Amendment No. 412 to DPR-47, and Amendment No. 411 to DPR-55

2. Safety Evaluation (Proprietary)

3. Safety Evaluation (Non-Proprietary version) cc: Listserv without Enclosure 2 OFFICIAL US1i ONLY PROPRlliTARY INFORMATION

PKG ML18311A111 Letter and Prop SE (QUO Version) ML18311A112 Letteran d Re d ace t d SE ML18311A134 *b I/ ema1*1 - ML18333A212 **b1yema1*1 OFFICE DORL/LPL2-1 /PM DORL/LPL2-1 /LA DSS/SRXB* DSS/SCPB*

NAME AKlett KGoldstein RAnzalone GPurciarello DATE 12/12/18 11/20/18 11/5/18 11/5/18 OFFICE DRA/APOB* DSS/SRXB* DSS/SNPB/BC* DSS/SBPB/BC*

NAME JHughey RBeaton Rlukes SAnderson DATE 11/5/18 11/5/18 11/7/18 11/13/18 OFFICE DRA/APOB/BC* DSS/SRXB/BC* OGC (NLO)** DORL/LPL2-1 /BC NAME CJFong JWhitman AGhosh Naber MMarkley DATE 11/9/18 11/9/18 12/12/18 12/17/18 OFFICE DORL/LPL2-1 /PM NAME AKlett DATE 12/17/18 ENCLOSURE 1 AMENDMENT NO. 410 TO DPR-38, AMENDMENT NO. 412 TO DPR-47, AND AMENDMENT NO. 411 TO DPR-55

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 DUKE ENERGY CAROLINAS, LLC DOCKET NO. 50-269 OCONEE NUCLEAR STATION, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 410 Renewed License No. DPR-38

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment to the Oconee Nuclear Station, Unit 1 (the facility), Renewed Facility Operating License No. DPR-38, filed by Duke Energy Carolinas, LLC (the licensee), dated October 20, 2017, and supplemented by letters dated June 15, July 20, and September 21, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations as set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2. Accordingly, by Amendment No. 410, Renewed Facility Operating License No. DPR-38 is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR),

as set forth in the application dated October 20, 2017, and supplemented by letters dated June 15, July 20, and September 21, 2018. The licensee shall update the UFSAR to incorporate the changes as described in the licensee's application dated October 20, 2017, and supplemented by letters dated June 15, July 20, and September 21, 2018, and the NRC staff's safety evaluation enclosed with this amendment.

3. This license amendment is effective as of its date of issuance and shall be implemented within 90 days of issuance. The UFSAR changes shall be submitted in the next periodic update to the UFSAR in accordance with 10 CFR 50.71(e) following the implementation period.

FOR THE NUCLEAR REGULATORY COMMISSION IRA/

Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: December 17, 2018

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 DUKE ENERGY CAROLINAS, LLC DOCKET NO. 50-270 OCONEE NUCLEAR STATION, UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 412 Renewed License No. DPR-47

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment to the Oconee Nuclear Station, Unit 2 (the facility), Renewed Facility Operating License No. DPR-47, filed by Duke Energy Carolinas, LLC (the licensee), dated October 20, 2017, and supplemented by letters dated June 15, July 20, and September 21, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations as set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2. Accordingly, by Amendment No. 412, Renewed Facility Operating License No. DPR-47 is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR),

as set forth in the application dated October 20, 2017, and supplemented by letters dated June 15, July 20, and September 21, 2018. The licensee shall update the UFSAR to incorporate the changes as described in the licensee's application dated October 20, 2017, and supplemented by letters dated June 15, July 20, and September 21, 2018, and the NRC staff's safety evaluation enclosed with this amendment.

3. This license amendment is effective as of its date of issuance and shall be implemented within 90 days of issuance. The UFSAR changes shall be submitted in the next periodic update to the UFSAR in accordance with 10 CFR 50.71(e) following the implementation period.

FOR THE NUCLEAR REGULATORY COMMISSION IRA/

Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: December 17, 2018

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 DUKE ENERGY CAROLINAS, LLC DOCKET NO. 50-287 OCONEE NUCLEAR STATION, UNIT 3 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 411 Renewed License No. DPR-55

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment to the Oconee Nuclear Station, Unit 3 (the facility), Renewed Facility Operating License No. DPR-55, filed by Duke Energy Carolinas, LLC (the licensee), dated October 20, 2017, and supplemented by letters dated June 15, July 20, and September 21, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations as set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2. Accordingly, by Amendment No. 411, Renewed Facility Operating License No. DPR-55 is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR),

as set forth in the application dated October 20, 2017, and supplemented by letters dated June 15, July 20, and September 21, 2018. The licensee shall update the UFSAR to incorporate the changes as described in the licensee's application dated October 20, 2017, and supplemented by letters dated June 15, July 20, and September 21, 2018, and the NRC staff's safety evaluation enclosed with this amendment.

3. This license amendment is effective as of its date of issuance and shall be implemented within 90 days of issuance. The UFSAR changes shall be submitted in the next periodic update to the UFSAR in accordance with 10 CFR 50.71(e) following the implementation period.

FOR THE NUCLEAR REGULATORY COMMISSION IRA/

Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: December 17, 2018

OFFICIAL USE ONLY PROPRIETARY INFORMATION ENCLOSURE 3 (NON PROPRIETARY VERSION)

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION FOR AMENDMENT NO. 410 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-38 AMENDMENT NO. 412 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-47 AMENDMENT NO. 411 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-55 DUKE ENERGY CAROLINAS, LLC OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3 DOCKET NOS. 50-269, 50-270, AND 50-287 Proprietary information has been redacted from this document pursuant to Title 10 of Code of Federal Regulations, Section 2.390. Proprietary information is identified by blank space enclosed within double brackets, as shown here: (( )).

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION FOR AMENDMENT NO. 410 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-38 AMENDMENT NO. 412 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-47 AMENDMENT NO. 411 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-55 DUKE ENERGY CAROLINAS, LLC OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3 DOCKET NOS. 50-269, 50-270, AND 50-287

1.0 INTRODUCTION

By letter ONS-2017-074 dated October 20, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17299A114), as supplemented by letters RA-18-0033, RA-18-0098, and RA-18-0164 dated June 15, July 20, and September 21, 2018 (ADAMS Accession Nos. ML18173A135, 1 ML18214A364, and ML18271A028), respectively, Duke Energy Carolinas, LLC (the licensee) applied for license amendments to Renewed Facility Operating Licenses DPR-38, DPR-47, and DPR-55, for the Oconee Nuclear Station, Units 1, 2, and 3 (Oconee), respectively. The licensee requested that the Updated Final Safety Analysis Report (UFSAR) be revised to allow off-nominal success criteria for a Standby Shutdown Facility (SSF)-mitigated Turbine Building flood event2 occurring when the Oconee units are not at nominal full power conditions and use of the Main Steam Atmospheric Dump Valves (ADVs) to enhance SSF mitigation capabilities.

From February 14, 2018, through March 23, 2018, the U.S. Nuclear Regulatory Commission (NRC or the Commission) staff conducted an audit to support its review of the amendment request, as discussed in the NRC staff's audit plan dated March 5, 2018 (ADAMS Accession No. ML18032A461 ), and audit summary dated May 1, 2018 (ADAMS Accession No. ML18117A270). By electronic mail (e-mail) dated May 1, and September 6, 2018 (ADAMS Accession Nos. ML18122A374 and ML18250A322), the NRC staff sent the licensee requests for additional information (RAls). By letters dated June 15, July 20, and September 21, 2018, the licensee responded to the NRC staff's requests. The licensee's supplements provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the NRC staff's original proposed no significant hazards consideration determination as published in the Federal Register (FR) on July 3, 2018 1 The licensee's supplement dated June 15, 2018, is not publicly available because it contains proprietary information. The licensee's supplement dated July 20, 2018, replaced the June 15, 2018, supplement in its entirety.

2 Throughout this safety evaluation, Turbine Building flood event" and "SSF-mitigated Turbine Building flood event" are used interchangeably.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL lJSE ONLY PROPRIETARY INFORMATION (83 FR 31193), as corrected by a notice published on July 10, 2018 (83 FR 31979), that changed the period for filing petitions to account for a Federal holiday.

2.0 REGULATORY EVALUATION

2.1 Description of SSF-Mitigated Turbine Building Flood Event Section 3.4 of the UFSAR states that the limiting Turbine Building internal flooding event occurs as the result of the failure of a condenser circulating water piping expansion joint. In its application, the licensee stated that as the flood height in the Turbine Building increases, the flooding results in a reactor and turbine trip and a loss of both main and emergency feedwater systems. Section 3.1 of this safety evaluation describes additional information about a Turbine Building flood event.

Section 9.6.1 of the UFSAR, Revision 27 states that the SSF houses stand-alone systems that are designed to maintain the plant in a safe and stable condition following postulated emergency events that are distinct from the design basis accidents and design basis events for which the plant systems were originally designed. The system provides additional defense-in-depth protection for the health and safety of the public by serving as a backup to existing safety systems. The original licensing basis of the SSF provided an alternate means to achieve and maintain a safe shutdown condition following postulated events, including a Turbine Building flood event, and is designed in accordance with criteria associated with these events.

Section 9.6.1 of the UFSAR states that a Turbine Building flood is not postulated to occur with any other concurrent event. The loss of all other non-SSF power is a design criterion applied to the SSF design to ensure that the SSF can independently mitigate the event over the long term.

The UFSAR states that SSF-designated events are not postulated to simultaneously occur with standard design basis events, such as an earthquake or loss of coolant accident; therefore, the single failure criterion is not applicable or required. However, SSF systems are required to be designed such that a failure of an SSF component would not result in failures or inadvertent operation of existing plant systems that would prevent existing plant systems from performing their intended function. SSF ties to the existing plant are such that no SSF failure will result in consequences more severe than those analyzed in the UFSAR. The SSF requires manual activation that would occur under an adverse flooding event when normal plant systems may have been damaged or have become unavailable.

Section 9.6.1 of the UFSAR states that per the original SSF licensing correspondence, the SSF is designed to:

1. Maintain a minimum water level above the reactor core, with an intact Reactor Coolant System (RCS), and maintain Reactor Coolant Pump Seal cooling.

2. Assure natural circulation and core cooling by maintaining the primary coolant system filled to a sufficient level in the pressurizer while maintaining sufficient secondary side cooling water.

3. Transfer decay heat from the fuel to an ultimate heat sink.

4. Maintain the reactor 1 percent shutdown with the most reactive rod stuck fully withdrawn, after all normal sources of RCS makeup have become unavailable, by providing makeup via the Reactor Coolant Makeup Pump System which always supplies makeup of a OFFICIAL lJSE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION sufficient boron concentration. (The stuck rod requirement was eliminated for fire events when National Fire Protection Association Standard 805 was adopted.)

Section 9.6.2 of the UFSAR states that the Turbine Building flood was one of the events that was identified in the original SSF licensing requirements. The SSF is designed to maintain the reactor in a safe shutdown condition for a period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a Turbine Building Flood.

No other concurrent event is assumed to occur. The success criterion for this event is to assure natural circulation and core cooling by maintaining the primary coolant system filled to a sufficient level in the pressurizer while maintaining sufficient secondary side cooling. The reactor shall be maintained at least 1 percent flk/k (unit of reactivity) shutdown with the most reactive rod fully withdrawn.

In its application, the licensee stated that the SSF auxiliary service water (ASW) system is a high head, high volume system that provides sufficient steam generator (SG) inventory for adequate decay heat removal for the three Oconee units during a loss of normal alternative current power concurrent with the loss of the normal and emergency feedwater systems. The SSF reactor coolant makeup system supplies makeup to the reactor coolant system if normal makeup systems are unavailable. This system ensures that sufficient borated water from the

• spent fuel pools is provided to the reactor coolant system and reactor coolant pump seal injection lines to maintain all three Oconee units in Mode 3 (Hot Standby) for approximately 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Technical Specification 3.10.1, "Standby Shutdown Facility (SSF)," establishes Limiting Condition for Operation 3.10.1, which states that the SSF Instrumentation and the following SSF systems shall be operable: ASW, Portable Pumping, Reactor Coolant Makeup, and the Power Systems. In its application, the licensee stated that the Turbine Building flood is the only remaining SSF-mitigated event associated with Technical Specification operability where the current licensing basis does not specifically limit initial conditions for the evaluation to nominal full power conditions. The licensee stated that its thermal-hydraulic (T-H) analyses demonstrate that the SSF is capable of meeting these success criteria for events initiated from nominal full power conditions.

2.2 Description of the Licensee's Proposed Changes In its application, the licensee stated that it identified that T-H analyses for some SSF-mitigated events, including a Turbine Building flood, did not consider all initial operating conditions - for example, lower operating modes and lower decay heat. Rather, the licensee's T-H analyses only considered nominal full power conditions. Technical Specification Limiting Condition for Operation 3.10.1 requires the SSF to be operable in Modes 1, 2 and 3, which is not met when the current UFSAR Section 9.6 success criteria (i.e., assure natural circulation and core cooling by maintaining the primary coolant system filled to a sufficient level in the pressurizer while maintaining sufficient secondary side cooling) for certain events initiated with low decay heat or from lower temperatures cannot be met for the 72-hour mission time. The licensee determined that the success criteria for the Turbine Building flood event may not be met for an initial condition with low decay heat and an initial condition with a low initial RCS temperature and high decay heat. Therefore, the licensee proposed to revise the success criteria in the UFSAR to state that the current success criteria apply to a Turbine Building flood event occurring at nominal full power conditions (i.e., a unit at 100 percent power operations for a minimum of approximately four days). The licensee also proposed new off-nominal success criteria to apply OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION to a Turbine Building flood event occurring during conditions other than nominal full power conditions.

Section 9.6, "Standby Shutdown Facility," of the UFSAR describes the SSF and its design basis.

In its application, as supplemented, the licensee proposed to revise Section 9.6.2, "Design Bases," of the UFSAR as follows, with deletions shown as struck out text, additions as underlined text.

TURBINE BUILDING FLOOD EVENT The Turbine Building Flood was one of the events that was identified in the original SSF licensing requirements. The SSF is designed to maintain the reactor in a safe shutdown condition for a period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a TB

[Turbine Building] Flood. No other concurrent event is assumed to occur. To verify SSF performance criteria, thermal-hydraulic (T/H) analysis was performed to demonstrate that the SSF can achieve and maintain safe shutdown following postulated turbine building floods. The analysis evaluates RCS subcooling margin using inputs that are representative of nominal full power end of cycle plant conditions. The analysis uses an initial core thermal power of 2619 MWth

[thermal megawatts] (102% [percent] of 2568 MWth) and accounts for 24-month fuel cycles. The consequences of the postulated loss of main and emergency feedwater were analyzed as an RCS overheating scenario. For the examined overheating scenario, an important core input is decay heat. High decay heat conditions were modeled that were reflective of maximum, end of cycle conditions. The high decay heat assumption was confirmed to be bounding with respect to the RCS subcooling response. The results of the nominal case analysis demonstrate that the SSF is capable of meeting t+he success criteria for this event: (1) maintain a minimum water level above the reactor core, (2) i&-te assure natural circulation and core cooling by maintaining the primary coolant system filled to a sufficient level in the pressurizer while maintaining sufficient secondary side cooling, (3) transfer decay heat to an ultimate heat sink, and (4) maintain the reactor. The reactor shall be maintained at least 1% ak/k shutdown with the most reactive rod fully withdrawn. (Reference 1, 10)

Off nominal success criteria are only applicable to unit(s) with the SSF letdown line and SSF RC [reactor coolant] makeup pump pulsation dampener modifications complete.

In addition to the nominal case analysis described above, off-nominal cases with low decay heat, low initial power and low initial temperature were analyzed. In each of these off-nominal cases, the results demonstrate that the SSF continues to meet the following success criteria for this event: (1) maintain a minimum water level above the reactor core, (2) transfer decay heat to an ultimate heat sink, and (3) maintain the reactor at least 1% ak/k shutdown with the most reactive rod fully withdrawn.

During periods of very low decay heat the SSF will be used to establish conditions that support the formation of subcooled natural circulation between the core and the SGs: however, natural circulation involving the SGs may not occur if the amount of decay heat available is less than or equal to the amount of heat OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION removed by ambient losses to containment and/or by other means, e.g., letdown of SSF reactor coolant makeup. When these heat removal mechanisms are sufficient to remove core decay heat, they are considered adequate to meet the core cooling function and systems supporting SG decay heat removal, although available, are not necessary for core cooling.

A nominal full power condition is defined as a unit at 100% power for approximately 4 days of operation which provides the decay heat required to meet the nominal SSF success criteria. Regarding operation in MODES 1, 2, and 3 at other than nominal full power, T-H analyses demonstrate that the SSF maintains conditions that support the formation of subcooled natural circulation between the core and SGs such that there is not water relief through the pressurizer safety valves.

Regarding operation at low initial temperature, T-H analyses demonstrate that in some cases, pressurizer level was not maintained on scale: however, conditions that support the formation of subcooled natural circulation between the core and SGs were maintained. In cases where the pressurizer did go water-solid, there was no liquid relief through the pressurizer safety valves.

In Section 9.6.3.3, "Auxiliary Service Water (ASW) System," of the UFSAR, the licensee proposed to add text as follows (shown as underlined text).

Auxiliary service water enters the steam generators via the normal emergency feedwater ring headers. Main Steam pressure is controlled automatically by the main steam relief valves or manually by the atmospheric dump valves (ADVs).

When the ADVs are operated in this manner, communication with the SSF Control Room is in place to coordinate main steam pressure control with RCS pressure/temperature parameters. Local main steam pressure indication is also available at the ADVs.

2.3 Regulatory Review The NRC staff considered the following licensing and design basis information and guidance during its review of the proposed changes.

Licensing and Design Basis The general design criteria (GDC) applicable to Oconee are those described in the UFSAR, Chapter 3.1, "Conformance with NRC General Design Criteria," and in applicable UFSAR sections. As discussed in the UFSAR, the licensee made changes to the facilities and committed to some of the GDC from Title 10 of the Code of Federal Regulations ( 10 CFR)

Part 50, Appendix A, "General Design Criteria for Nuclear Power Plants." Based on its review of the UFSAR and the licensee's submittals, the NRC staff identified the following GDC as being applicable to the proposed amendment and a basis for review acceptance criteria:

UFSAR Section 3.1.9, "Criterion 9 - Reactor Coolant Pressure Boundary (Category A)," states, "The reactor coolant pressure boundary shall be designed and constructed so as to have an exceedingly low probability of gross rupture or significant leakage throughout its design lifetime."

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION The NRC staff evaluated operator actions related to maintaining RCS pressure and temperature limits and preventing loss of reactor coolant through the pressurizer safety valves.

Guidance The NRC staff reviews the human performance aspects of license amendment requests utilizing the review guidance in NUREG-1764, Revision 1, "Guidance for the Review of Changes to Human Actions" (ADAMS Accession No. ML072640413). In accordance with the generic risk categories established in Appendix A to NUREG-1764, the tasks under review involve risk-important human actions associated with feed and bleed operation of the RCS and operator manual actions during shutdown. Because of this risk importance, the NRC staff performed a "Level I" review, which is the most stringent of the graded reviews possible under the guidance of NUREG-1764. This assessment of risk is only for purposes of scoping the human factors review and may not necessarily align with the licensee's assessment of risk importance or that of other portions of the NRC staff review. This assessment is not intended to be equivalent to the assessment of risk performed with other methods, especially those using plant-specific data and NRG-accepted methods of probabilistic risk analysis and human reliability analysis.

3.0 TECHNICAL EVALUATION

In determining whether an amendment to a license will be issued, the Commission is guided by the considerations that govern the issuance of initial licenses to the extent applicable and appropriate. The NRC staff evaluated the licensee's application to determine if the proposed changes are consistent with the regulations, guidance, and licensing and design basis information discussed in Section 2 of this safety evaluation. The NRC staff reviewed the proposed changes to verify that the proposed acceptance criteria are adequate for protecting the plant. The NRC staff also reviewed the thermal hydraulic analyses to verify that the proposed changes provide reasonable assurance that the plant can successfully mitigate a Turbine Building flood event and meet the new acceptance criteria. The NRC staff reviewed human factors considerations associated with the operator manual actions described in the licensee's application dated October 20, 2017, as supplemented by letters dated July 20, and September 21, 2018. The NRC staff performed a Level I human factors review per the guidance in NUREG-1764, Revision 1.

In its application, the licensee described two modifications that it was making to the plant:

providing a larger capacity SSF reactor coolant letdown line and an improved pulsation dampener for the positive displacement SSF reactor coolant makeup pump that will allow sufficient reactor coolant system letdown and makeup capability over the full range of system pressure required for Turbine Building flood mitigation. In its application, the licensee stated that it was not applying for NRC approval of these modifications; rather, that the licensee determined that prior NRC approval was not required via 10 CFR 50.59. The licensee stated that these modifications in combination with the proposed changes to the UFSAR would resolve the nonconforming conditions discussed in its application. The NRC staff did not review the adequacy or acceptability of these modifications nor the licensee's 10 CFR 50.59 analyses in its evaluation of the licensee's application. However, the NRC staff was concerned that the licensee would not be able to implement the requested changes until the modifications were complete. Therefore, in its RAI dated May 1, 2018, the NRC staff requested the licensee to propose changes to its application that would enable the staff to make a finding that the licensee OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION can operate the plants in conformity with the amendments. In its supplement dated July 20, 2018, the licensee responded to the RAI and modified its request to ensure that it can conform to the amended UFSAR statements upon implementation of the amendments by proposing the UFSAR to state, "Off nominal success criteria are only applicable to unit(s) with the SSF letdown line and SSF RC makeup pump pulsation dampener modifications complete."

The NRC staff finds that this proposed change would enable the licensee to implement the amendments upon updating the UFSAR text while affording the licensee flexibility regarding the implementation date for the modifications.

In its application dated October 20, 2017, the licensee stated that the approximate 4-day duration in the low decay heat conditions and the approximate 10-hour duration in operation during shutdown when reactor coolant temperature is low and decay heat is high do not result in an appreciable contribution to overall plant risk. Because the NRC staff was able to reach its conclusions about the licensee's proposed changes based on traditional engineering analysis, the NRC staff did not review or approve this risk information. In its supplement dated July 20, 2018, the licensee provided a risk insight associated with the Conditional Core Damage Probability (CCDP) of a Turbine Building flood event. Section 3.4.6 of this safety evaluation discusses how the NRC staff considered this insight during its human factors review.

3.1 Description of Event As stated in Section 3.4 of the UFSAR, the limiting Turbine Building internal flooding event occurs as the result of the failure of a condenser circulating water (CCW) piping expansion joint.

Depending on the initial condition at time of the break, this could result in either an overcooling or an overheating event. The following paragraphs generally describe the SSF-mitigated Turbine Building flood event; however, different assumptions are used for specific overcooling or overheating cases.

Immediately after a presumed break, main feedwater would be lost, and reactor and turbine trips would occur. In its application dated October 20, 2017, the licensee stated that the flooding would result in a loss of emergency feedwater (EFW); however, the licensee credited EFW in some of its analyses. Therefore, in its RAI dated May 1, 2018, the NRC staff asked the licensee to clarify the sequence of events during a Turbine Building flood event. In its response dated July 20, 2018, the licensee clarified that the Turbine Building flood event would result in a gradual loss of normal and emergency equipment as the flood water rises to the elevations of the equipment inside the Turbine Building. The licensee also clarified that normal plant equipment is modeled in the analyses until the time that it is lost. For example, the condensate booster pumps in the feedwater system are located on the basement floor of the Turbine Building and would be flooded almost immediately, resulting in a rapid loss of main feedwater at event initiation. Motor driven emergency feedwater equipment, which is located at a higher elevation, would not be lost until approximately 13 minutes into the event. Therefore, EFW is modeled with a minimum or maximum flow capacity during the first 13 minutes depending on whether the T-H analyses is an overheating or overcooling case, respectively. The licensee also provided representative sequence-of-events tables for both nominal and off-nominal conditions. The NRC staff finds that the licensee modelling equipment loss as a function of water level in the Turbine Building is appropriate because the modelling accurately represents the sequence of events in the flooding scenario and, therefore, is acceptable.

About the time EFW is lost, operators trip the reactor coolant pumps then proceed to the SSF to reduce the heat input to the RCS. Secondary side steam loads would then be isolated to OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION reduce overcooling of the RCS. Operators would begin controlling SG level with the ASW pump and control RCS inventory with the SSF reactor coolant makeup pump and new larger SSF letdown line. In cases where there is sufficient decay heat (overheating cases), the SG secondary side pressure would remain around that of the lowest main steam safety relief valve setpoint.

In its application dated October 20, 2017, the licensee stated that the SSF ASW pump suction supply is lake water from the embedded Unit 2 CCW supply piping and the limiting Turbine Building internal flooding event occurs as the result of failure of a CCW piping expansion joint.

In addition, during the Turbine Building flood, procedures would have operators trip the CCW pumps to stop or reduce the break flow. In its RAI dated May 1, 2018, the NRC staff asked the licensee to clarify the resulting effect of the failure in the CCW piping and tripped pumps on the ASW flowrate to the SGs. In its letter dated July 20, 2018, the licensee responded and stated that the postulated failure of the CCW piping expansion joint and the subsequent tripping of the CCW pumps has no effect on the SSF ASW.flowrate provided to the SGs. The licensee stated that the inlet to the suction pipe that feeds the SSF ASW pump is located inside the underground portion of the Unit 2 CCW supply line. Because the underground CCW supply pipe is located at a lower elevation than the CCW pipe expansion joint, water contained in this pipe is available to feed the SSF ASW system if a failure of the CCW piping expansion joint occurs. The licensee discussed the SSF ASW pump net positive suction head requirements and margin to avoid vortex formation at the inlet of the SSF ASW supply pipe. The licensee also stated that an analysis showed that the water volume contained in the underground portion of the Unit 2 CCW supply pipe is adequate to feed the SSF ASW pump at the flow rates used in the RETRAN analysis until the SSF submersible pump is installed to refill the Unit 2 CCW supply pipe. The NRC staff finds that the licensee has examined the issue in sufficient detail to confirm that the required ASW flow would remain available upon failure of the CCW piping and, therefore, the NRC staff finds the licensee's response acceptable.

3.2 Changes to Acceptance Criteria As described in Section 2.2 of this safety evaluation, the licensee is proposing to revise the UFSAR to provide off-nominal success criteria for maintaining the reactor in a safe shutdown condition when using the SSF to mitigate a Turbine Building flood occurring when any of the Oconee units are not at nominal full power conditions. The existing success criteria would apply to a Turbine Building flood event occurring at nominal full power conditions. Nominal conditions are defined by the licensee as a unit at 100 percent power operation for a minimum of approximately 4 days, which provides the decay heat required to meet the current nominal SSF success criteria. Off nominal conditions would include approximately four days at 100 percent power operation after startup, infrequent mid-cycle power reductions below approximately 85 percent full power, and during cooldown following reactor shutdown when RCS temperature is low.

The proposed off-nominal success criteria would (1) allow the pressurizer to go water-solid provided that there is no liquid relief through the pressurizer safety valves, and (2) consider ambient losses and letdown and makeup of reactor coolant acceptable methods of decay heat removal during periods of low decay heat in lieu of sustained natural circulation with heat removal through the SGs. The proposed criteria would also allow the pressurizer to empty; however, the water level would need to remain above the top of the core.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL YSE ONLY PROPRIETARY INFORMATION A water-solid pressurizer is not an ideal situation because small changes in RCS conditions can result in liquid flow through the pressurizer safety valves (PSVs), and the PSVs were not designed to pass liquid and can fail upon passing liquid. In its application dated October 20, 2018, the licensee stated that if the pressurizer goes water-solid, there would be a margin of 700 pounds per square inch (psi) below the PSV lift setpoint, and the operator is required to maintain a very high awareness of the plant status for RCS pressure. In its RAI dated May 1, 2018, the NRC staff asked the licensee to clarify the available margin from a PSV opening because in its application, the licensee also states that the operators would maintain RCS pressure in a band of approximately 1,950 to 2,250 pounds per square inch gauge (psig),

which is only 475 to 175 psi below the PSV opening setpoint. In its response dated July 20, 2018, the licensee stated that the statement, "operators maintain RCS pressure in a band of approximately 1,950 to 2,250 psig," refers to how operators control RCS pressure from the SSF when pressurizer level is on scale and a steam bubble is present, whereas the statement, "Results from the [T-H] analyses show RCS pressure remains more than 700 psi below the [PSV] lift setting with a water-solid pressurizer condition for the duration of the event,"

relates to how operators control RCS pressure from the SSF when pressurizer level is off scale high and possibly in a water-solid condition. The licensee clarified that when RCS temperature is greater than or equal to 350 degrees Fahrenheit (°F), operators will control RCS pressure to a target setpoint of 1,600 psig per the proposed operator guidance described in the RETRAN SSF-mitigated Turbine Building flood T-H analysis. The SSF-mitigated Turbine Building flood T-H analyses modeling this mode of control showed that RCS pressure remained more than 700 psi below the nominal PSV lift setpoint (2,500 psig) for those off nominal cases (high decay heat/low initial temperature) in which indicated pressurizer level was off scale high and/or a water-solid condition was present in the pressurizer. The NRC staff finds that the licensee's different strategies are appropriate for a water-solid pressurizer and one with an on-scale water level; therefore, the NRC staff finds the licensee's response acceptable.

In its application, the licensee stated that the operators are expected to maintain a very high awareness of the RCS pressure. The operators would be using the new SSF letdown line to control system pressure. In its RAI dated May 1, 2018, the NRC staff asked the licensee if the new SSF letdown line would be fully open during the time the pressurizer is water-solid and to clarify what options the operators have to reduce pressure if the pressurizer is water-solid. In its response dated July 20, 2018, the licensee stated that the new SSF letdown line is designed to pass approximately 300 gallons per minute (gpm) flow at nominal RCS conditions but varies as a function of RCS pressure and position of throttle valves. The maximum flow predicted at any time in the RETRAN T-H analyses was about 250 gpm; thus, there was some extra SSF letdown line capacity available. The licensee clarified that the operating strategy for controlling the plant during the evolution into and during a water-solid condition is to maintain RCS subcooling such that RCS natural circulation flow is not interrupted in the primary loops. The licensee stated that by controlling RCS pressure to a minimum condition of 1,600 psig using the SSF letdown line, RCS subcooling is assured because the RCS will not reheat above approximately 550 °F, which is the maximum temperature condition based on the lowest lifting main steam relief valve setpoint. The recovery strategy is to allow available pressurizer heaters to resaturate the pressurizer where a steam bubble is recovered such that the pressurizer level comes back on scale. At this time, operators can then switch the plant controlling strategy to use pressurizer heaters for RCS pressure control and SSF letdown line throttling to control to a targeted pressurizer level setpoint.

In its RAI response dated July 20, 2018, the licensee stated that it is unlikely that further opening of the SSF letdown line would have prevented the pressurizer from reaching a OFFICIAL YSE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION water-solid condition for all cases that went water-solid in the T-H analyses. If operators were to open the SSF letdown line beyond what was analyzed, RCS pressure would decrease below the 1,600-psig setpoint and could potentially cause a loss of subcooling outside of the pressurizer, which would be undesirable because it could impact RCS natural circulation in the loops. The NRC staff finds the proposed operating strategy described in the licensee's response acceptable because the proposed new SSF letdown line would be large enough to prevent water flow through the PSVs even with a water-solid pressurizer.

In its application dated October 20, 2017, the licensee described how ambient heat loss to the containment environment would assist in removing decay heat during a Turbine Building flood event. The NRC staff finds that ambient heat losses to the containment environment are typically not modelled in Chapter 15 events because such losses are generally short in duration and would have little effect on the events' analysis results. However, for a Turbine Building flood event lasting three days, heat losses to the containment environment play a larger role.

The NRC staff determined that ambient heat loss to the containment environment is a real phenomenon that removes decay heat. Therefore, the NRC staff finds the licensee's consideration of ambient heat losses to the containment environment acceptable.

The licensee proposed the following off-nominal acceptance criteria: (1) maintain a minimum water level above the reactor core, (2) transfer decay heat to an ultimate heat sink, and (3) maintain the reactor at least 1 percent Lik/k shutdown with the most reactive rod fully withdrawn. The proposed off-nominal criteria do not include the nominal full power condition to assure natural circulation and core cooling by maintaining the primary coolant system filled to a sufficient level in the pressurizer while maintaining sufficient secondary side cooling. Because cooling can be accomplished through ambient heat losses to the containment environment as well as through feed and bleed (makeup and letdown), rather than through the normal path (through the SGs), the NRC staff finds that removal of this criterion acceptable. The NRC staff finds the proposed acceptance criteria acceptable to maintain the plant in a safe and stable condition following an SSF-mitigated Turbine Building flood.

3.3 Thermal-Hydraulic Analyses The licensee performed T-H analyses for an SSF-mitigated Turbine Building flood event using Duke Energy's RETRAN-3D Oconee model. The model was previously approved for use in the Oconee UFSAR Chapter 6 and Chapter 15 accident analyses. In order to capture important phenomena for the long duration Turbine Building flood event, the RETRAN-3D model was modified to include ambient heat losses from the pressurizer and RCS, as well as pressurizer nodalization changes, to better model thermal stratification of fluid in the pressurizer.

Appendix C of the Duke Energy NRG-approved methodology report DPC-NE-3000-PA, evaluates the conditions and limitations in NRC's Safety Evaluation Report (SER) for Electric Power Research Institute (EPRI) Topical Report NP-7450(P), Revision 4, "RETRAN 3D - A Program for Transient Thermal-hydraulic Analysis of Complex Fluid Flow Systems," for the application of RETRAN-3D for Oconee with replacement once-through SGs. With the exception of several model modifications, application of the modified Oconee RETRAN-3D model for analyzing the SSF-mitigated Turbine Building flood event is considered consistent with the NRG-approved use of the RETRAN model. The NRC staff's review of the model's specific conditions and limitations for use and their related model modifications are discussed in the following sections of this safety evaluation.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION 3.3.1 Model Modifications In order to simulate the SSF-mitigated Turbine Building flood event during off-nominal conditions, the licensee made modifications to the RETRAN model in order to simulate ambient heat losses from the RCS to the containment environment. The licensee also made changes to the pressurizer region nodalization to improve the modeling capability for thermal stratification of fluid in the pressurizer region.

3.3.1.1 Ambient Heat Losses Heat losses to the containment environment are typically not modelled in design basis events because these events are generally short in duration and including heat losses would have little effect on the results. However, for an SSF-mitigated Turbine Building flood event, which is analyzed for three days, heat losses to the containment environment play a larger role.

Pressurizer ambient heat losses can cause condensation of the vapor space on internal structural surfaces, which leads to a reduction in RCS pressure and increases in pressurizer level. As the vapor space collapses and pressurizer pressure falls, the insurge of subcooled liquid into the pressurizer bottom challenges the ability of the pressurizer heaters to re-saturate the fluid. Because ambient heat loss to the containment environment is a real phenomenon and can have a large effect on the RCS, the NRC staff finds that it is appropriate for the licensee to include it in the analysis. Therefore, the NRC staff finds the consideration of ambient heat losses to the containment environment acceptable.

The licensee modified the existing exterior heat structures on the RCS and pressurizer components to allow heat losses to the containment environment. The licensee stated that plant data was used to determine the total ambient heat loss to the reactor building, as well as the specific heat losses from the pressurizer structures. The addition of heat losses to the existing model allows the analyses to simulate the impact of a real phenomenon on the RCS and pressurizer response for long duration events. The model modifications made by the licensee used an unrealistically large heat transfer coefficient on the inside pipe wall surfaces, with the actual heat transfer to the containment environment being controlled on the outside surfaces. The use of a large heat transfer coefficient results in the inside wall surface temperature and fluid saturation temperature being very close together and will affect the condensation rate (and resulting RCS pressure) because the condensation rate is based on the temperature difference between the fluid saturation temperature and the pipe wall surface temperature. Therefore, in its RAI dated May 1, 2018, the NRC staff asked the licensee to clarify why this is an acceptable modelling method for both overheating and overcooling events and how the results would be different if the inside wall heat transfer coefficient were allowed to be code calculated.

In its response dated July 20, 2018, the licensee stated that a fixed heat transfer coefficient was chosen at the inside surface to more realistically model the conditions in the pressurizer.

Because some of the cases performed in the SSF-mitigated Turbine Building flood T-H evaluation reach near stagnant flow conditions in the RCS, the licensee also decided to do the same modeling for those conductors in which ambient losses were being modeled to prevent what was thought to be an unrealistic differential temperature developing between a volume fluid temperature and its associated conductor surface temperature. The licensee performed two additional analyses (i.e., for overheating and overcooling) in which RETRAN was allowed to determine the heat transfer coefficient on selected components, and the licensee made comparisons to the cases where the large heat transfer coefficient was used. The licensee OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION found that there was little difference in the pressurizer conductor inside surface temperatures in the vapor region for the cases in which RETRAN selects the heat transfer coefficients versus the large heat transfer coefficient. Even though there is a sizable difference in the actual heat transfer coefficient values, the values computed by RETRAN are large enough that adequate heat transfer occurs between the vapor region and the conductor to match the ambient losses from the outside of the conductors without developing a large temperature differential.

However, in the liquid region of the pressurizer where stagnant flow conditions occur, RETRAN defaults to a minimum heat transfer coefficient value of 5 British thermal units per hour times square feet times°F (BTU/(hr*ft2 *°F)). The licensee found that this value results in a large temperature differential between the conductor inner surface temperature and the pressurizer fluid temperatures ranging from about 60 °F to 130 °F. Based on engineering judgement, the licensee determined this temperature differential to be exceedingly large and, therefore, chose a fixed heat transfer coefficient at the inside surface to more realistically model the conditions in the pressurizer. The licensee provided figures comparing results from cases with the large heat transfer coefficient versus the heat transfer coefficient computed by RETRAN. While there are some differences in results early in the transient, specifically in RCS pressure and subcooling, there is a negligible difference in the long term.

Because there were some unrealistically large temperature differences with the RETRAN computed heat transfer coefficients, and the results of the additional cases show that the success criteria associated with this event would not be challenged when using either a fixed heat transfer coefficient or allowing RETRAN to compute the heat transfer coefficient, the NRC staff finds that the use of a fixed heat transfer coefficient on selected heat transfer surfaces is acceptable for SSF-mitigated Turbine Building flood events.

3.3.1.2 Pressurizer Nodalization During an SSF-mitigated Turbine Building flood, the pressurizer plays a significant role in regulating RCS pressure. In some cases, there is an initial insurge of subcooled liquid into the pressurizer from thermal expansion of the RCS inventory. In slow developing transients (multiple days in this case), there is little mixing in the fluid region, and density effects cause the colder liquid to remain near the bottom of the pressurizer while the hotter (originally saturated) liquid remains near the top and in contact with the vapor space. This thermal stratification of the pressurizer liquid helps limit the amount of steam condensation that occurs at the steam-liquid interface. The base Oconee RETRAN model for the pressurizer is considered inappropriate for longer-duration events because the pressurizer liquid region is homogenized to a single lumped temperature, effectively ignoring thermal stratification of the fluid region. Consequently, any insurge of subcooled liquid to the pressurizer instantly reduces the fluid temperature in the pressurjzer. Therefore, the licensee modified the RETRAN model to allow thermal stratification of fluid in the pressurizer region.

The NRC staff position for Item 18 of the SER for EPRI Topical Report NP-7450(P), Revision 4 states, "While the model does not directly account for thermal stratification, its effects can be included by use of normal nodes below the pressurizer volume." In its RAI dated May 1, 2018, the NRC staff asked the licensee for the basis for the choice of the number of normal nodes used as well as the choice to only use them below the pressurizer heaters. In its response dated July 20, 2018, the licensee stated that ((

)),a volume size was chosen such that the possibility of those volumes becoming Courant limited OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION during the transient was minimized. (( 11 volumes were chosen as a reasonable number to represent this. The licensee stated that the noding size is consistent with the NEPTUNUS pressurizer tests documented in Volume 4 of the RETRAN-3D theory manual (ADAMS Accession No. ML16315A295). The licensee stated that the decision to subnodalize 11 is twofold: it is preferable to maintain the pressurizer level within the non-equilibrium portion of the pressurizer during the course of the event, and thermal stratification (( 11 would be unlikely during times that pressurizer heaters are active. The NRC staff finds the licensee response acceptable because the noding size (( 11 is consistent with the NEPTUNUS pressurizer tests, and thermal stratification is not likely to occur above pressurizer heaters when they are active.

While 1-D codes such as RETRAN-3D can simulate thermal stratification with appropriate noding, they generally have little to no heat transfer between adjacent nodes when there is little to no flow (as would be the case in the pressurizer during the majority of the three-day SSF-mitigated Turbine Building flood event). In its RAI dated May 1, 2018, the NRC staff asked the licensee to provide RETRAN-3D results showing the axial temperature distribution and explain how the lack of mixing between adjacent nodes in the lower pressurizer region is acceptable for both overcooling and overheating events. In its response dated July 20, 2018, the licensee stated that after steady-state conditions are achieved in the SSF-mitigated Turbine Building flood cases where the SSF letdown line has been throttled to match reactor coolant makeup, the pressurizer reaches a near stagnant condition with almost no change in level seen for the remainder of the event. With only a small mass oscillation occurring into and out of the pressurizer from cycling of the main steam relief valves, a stratified axial temperature distribution develops through the RETRAN pressurizer nodes. The licensee provided figures showing the temperature distribution for two cases that are generally representative of the axial temperature distributions seen in all of the SSF-mitigated Turbine Building flood cases (both overheating and overcooling).

The licensee stated that while it is expected that some mixing would actually occur within these lower volumes of the pressurizer resulting in a more "averaged" temperature profile, the difference between the RETRAN response and that of a more realistic response is considered to be negligible because the total ambient losses from the RETRAN volumes with their distinct axial temperature profile would be very close to the total ambient losses from a more homogenized equivalent. The NRC staff finds the licensee response acceptable because the

(( 11 that remains thermally stratified over the course of the long duration event would have a negligible effect on the overall RCS conditions if it were allowed to come to an equilibrium condition.

For some events, the pressurizer may empty as a result of the initial overcooling; however, in overheating events, it may fill solid. Item 31 of the conditions of use in the SER for EPRI Topical Report NP 7450(P), Revision 4 states, "The pressurizer model requires model qualification work for the situations where the pressurizer either goes solid or completely empties," and Item 37 states, "For PWR [pressurized water reactor] transients where the pressurizer goes solid or completely drains, the pressurizer behavior will require comparison against real plant or appropriate experimental data." In its RAI dated May 1, 2018, the NRC staff asked the licensee what plant/experimental data was used to qualify the code response for thermal stratification. The NRC staff also asked if the updated modelling is consistent with the qualification work. In its response dated July 20, 2018, the licensee stated that the NRC staff OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION position for RETRAN-3D SER limitations 31 and 37 are referenced to the NRC staff position for Item 18, which states:

The NRC staff notes that when a pressurizer fills or drains, a single region exists for which the normal pressure equation of state is used. Lack of numerical discontinuities in validation analyses of filling and draining pressurizers indicates that the model is functioning properly. It is the responsibility of the code user to justify any numerical discontinuity in the pressurizer during a filling or draining event.

The licensee stated that in regard to the SER conditions related to filling and draining a pressurizer non-equilibrium volume, those cases in which this occurs were reviewed and found to have no noticeable discontinuities in the system response at the particular times at which these conditions occurred. The licensee also stated that work documented in Volume 4 of the RETRAN-3D theory manual benchmarks a RETRAN single node pressurizer and an eight-node pressurizer to the NEPTUNUS Pressurizer tests performed at Delft University in the Netherlands. This benchmark was done to demonstrate thermal stratification effects in the pressurizer for insurge and outsurge transients with the presence of spray flow. Results of this benchmark demonstrate that the multi-node pressurizer response closely matched the test results, while the single node pressurizer response diverged significantly from the test results.

The licensee stated that the current modeling is consistent with the NEPTUNUS benchmark work in the portion of the model that was renodalized. Based on the documentation presented in Volume 4 of the RETRAN-3D theory manual for this benchmark, the NEPTUNUS pressurizer model did not include pressurizer heaters, which allowed for modeling the entire pressurizer region with subnodes in the RETRAN benchmark. Because of the use of pressurizer heaters during the SSF-mitigated Turbine Building flood event, the licensee decided to use

)). The NRC staff agrees that this modelling approach is necessary because the upper portion of the pressurizer would be expected to be well mixed when the pressurizer heaters are in use and because RETRAN does not model heat transfer between adjacent volumes of fluid (i.e., fluid-to-fluid). Therefore, the NRC staff finds the modelling changes to renodalize the pressurizer acceptable.

3.3.1.3 Decay Heat For analyzing conditions where high decay heat is conservative, the licensee stated that it uses the decay heat model, including 2o uncertainties, per American National Standards Institute/American Nuclear Society (ANSI/ANS) Standard 5.1 (dated August 29, 1979) for Decay Heat Power in Light Water Reactors (LWRs). The NRC staff finds this acceptable because this is an NRC-approved model. 3 For off-nominal initial conditions for an SSF-mitigated Turbine Building flood event, the licensee modeled decay heat to provide a better estimate for the spectrum of initial conditions analyzed for these operating conditions. For analyzing overcooling conditions, the NRC staff finds that low decay heat is conservative. In these cases, for a low 3 The 1979 ANSI/ANS 5.1 standard decay heat model was added to the code as RETRAN-02 MOD005. This version was approved by the NRG staff in Letter from A.G. Thadani (NRG), to J. Boatwrite (TUEG), "Acceptance for Reference of RETRAN02/MOD005.0," dated November 1, 1991 (ADAMS Accession No. 9111150320).

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION initial power or burnup scenario, the long-term decay heat response is modeled as a low constant value that conservatively bounds future cycle conditions.

For scenarios starting with high decay heat and low initial RCS temperature, the licensee achieved these conditions by assuming a controlled cooldown of the unit following a typical unit shutdown at end-of-cycle conditions and assuming the SSF-mitigated Turbine Building flood event is postulated to occur sometime during the plant cooldown. To analyze these conditions, the licensee used a calculated end-of-cycle decay heat profile assuming continuous operation at 102 percent full-power conditions followed by a multi-hour power reduction to zero percent power conditions. The licensee based the power reduction duration on a review of shutdown data for all three units over multiple operating cycles. The decay heat profile used in the off-nominal SSF-mitigated Turbine Building flood analyses for high decay heat and low initial temperatures reflects 24-month operating cycle lengths and includes additional conservatisms to bound future operating cycles.

Based on the above, the NRC staff finds the licensee modelled the decay heat appropriately for the off-nominal conditions, including both overcooling (low decay heat) and overheating events (high decay heat).

3.3.1.4 Letdown Line In its application dated October 20, 2017, the licensee stated that with the existing SSF letdown line, T-H analysis determined that under certain conditions, the pressurizer may reach an RCS water-solid condition with the potential for water relief through the pressurizer safety valves.

The licensee stated that modifications to the plant are being made to provide a larger capacity SSF reactor coolant letdown line and an improved pulsation dampener for the positive displacement SSF reactor coolant makeup pump that will allow sufficient reactor coolant system letdown and makeup capability over the full range of system pressure required for Turbine Building flood mitigation. The licensee described the new letdown line as follows:

Each Unit's SSF RC letdown line is independent of the normal RC letdown line.

Currently, the SSF RC letdown line originates off one of the RCS cold legs and discharges to a fuel transfer tube via an orifice and isolation valve arrangement; flow through the line cannot be throttled. At nominal RCS operating pressures, the SSF RC letdown flow is limited to approximately 41 gpm and is reduced at lower RCS pressures. The SSF RC letdown line is being replaced with a new line that originates off one of the RCS hot legs and discharges to a fuel transfer tube or the reactor building via an isolation and throttle valve arrangement. The new SSF RC letdown line will be capable of providing approximately 300 gpm at nominal RCS operating pressures and is effective at low RCS pressures.

The licensee also states that the T-H analyses credit the increased capacity and throttle capability of the new SSF letdown line modification. The NRC staff finds it acceptable to simulate the larger SSF letdown capability; however, the NRC staff also finds that these physical plant changes must be installed successfully and operational before the licensee can credit them, as discussed in Section 3.0 of this safety evaluation.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION 3.3.1.5 Boron Transport Item 3 of the conditions of use in the SER for EPRI Topical Report NP 7450(P), Revision 4 states, "A boron transport model is unavailable. User input models will have to be reviewed on an individual basis." The NRC staff position for this condition is that modeling boron transport with the RETRAN general transport model identifies the diffusive nature of the general transport model solution scheme, particularly if the Courant limit is exceeded. The licensee states that the calculated RCS boron concentration does not affect the T-H analyses because the boron reactivity feedback effect is neglected in the point kinetics model during the analysis and because the results for core boron concentration and fluid temperature are used to externally verify shutdown margin requirements that are maintained on a cycle-specific basis. In addition, the natural circulation RCS flow rates in the SSF-mitigated Turbine Building flood T-H analyses are very low and do not approach the Courant limit by a large margin. The NRC staff finds that this modeling approach is consistent with the limitations described in Item 3 and, therefore, is acceptable.

3.3.2 RETRAN-3D Analysis Results The licensee performed T-H analyses of an SSF-mitigated Turbine Building flood event using Duke Energy's RETRAN-3D Oconee T-H model. The RETRAN-3D model is described in Duke Energy's NRC-approved methodology report DPC-NE-3000-PA. The model was modified as described in Section 3.2 of this safety evaluation to capture important phenomena in the RCS and pressurizer for long duration events that may transition to a water-solid condition. The licensee stated that three scenarios envelop the initial conditions for which the SSF is required to be operational for the SSF-mitigated Turbine Building flood event, including nominal full power, low initial power, and high decay heat with low RCS temperature. Each of these three conditions is described in the following sections of this safety evaluation. The licensee states that results from these analyses demonstrate that SSF systems and operator guidance can be used to successfully mitigate an SSF-mitigated Turbine Building flood event and meet the current success criteria for nominal full power conditions and the proposed off-nominal success criteria for off-nominal conditions.

3.3.2.1 Nominal Full Power Conditions The licensee defines nominal full power condition as a unit at 100 percent power operation for a minimum of about 4 days, which provides the decay heat required to meet the current nominal SSF success criteria. The licensee selected boundary conditions, inputs, and assumptions in the analyses to examine cases as either overheating or overcooling events to verify the predicted plant response is conservatively bounding. The licensee varied parameters such as decay heat response, timing of reactor trip, EFW flow rates while pumps are available, RCS ambient heat losses, and modeling of secondary system steam loads. For an overcooling event, for example, input assumptions included using the decay heat shortly after achieving full power (about 4 days), maximum EFW flow rates while pumps are still available, and including RCS ambient heat losses. For an overheating event, input assumptions included the use of maximum decay heat at the end of a cycle, delayed reactor trip, minimum EFW flow while the pumps are still available, and neglecting RCS ambient heat losses. For both overheating and overcooling events, the licensee stated that the analyses show subcooled single-phase natural circulation flow is maintained in the RCS for the duration of the event, thus ensuring core cooling and decay heat removal through the SGs.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION The NRC staff has reviewed the analyses of the SSF-mitigated Turbine Building flood event under nominal full power conditions and concludes that the analyses have adequately accounted for the operation of the plant and were performed using acceptable analytical models with appropriate input assumptions.

3.3.2.2 Low Initial Power The low initial power off-nominal condition considers the plant shortly after a refueling outage in which decay heat is lower than the heat removed from ambient losses and reactor coolant makeup and letdown, resulting in an overcooling scenario. The licensee looked at low initial power conditions in Hot Standby (Mode 3), Startup (Mode 2), and about 4 days of Power Operation (Mode 1). Input assumptions were chosen to maximize the overcooling effect, including low decay heat, tripped RCPs, maximum secondary steam loads, and maximum EFW flow while the pumps are still available.

In its application dated October 20, 2017, the licensee stated that for the range of initial conditions examined through analysis within the low initial power or burnup envelope, the results show that subcooled single-phase natural circulation flow is maintained in the RCS for the duration of the event, thus ensuring core cooling and decay heat removal through the SGs and RCS ambient heat losses. The licensee also stated that natural circulation may not occur if the amount of decay heat is less than or equal to the amount of heat removed by ambient losses to containment and/or by other means (e.g., letdown of SSF reactor coolant makeup).

When these heat removal mechanisms are sufficient to remove core decay heat, they are considered adequate to meet the core cooling function, and systems supporting SG decay heat removal, while although available, are not necessary for core cooling.

The NRC staff has reviewed the analyses of the SSF-mitigated Turbine Building flood event under low initial power conditions and concludes that the analyses have adequately accounted for the operation of the plant and were performed using acceptable analytical models with appropriate input assumptions. The NRC staff also finds that the licensee calculations demonstrate that the proposed off-nominal acceptance criteria are met.

3.3.2.3 High Decay Heat/Low RCS Temperature This group of off-nominal conditions considers high decay heat with low RCS temperature in Hot Standby (Mode 3), such as during shutdown at the end of a cycle. The licensee stated that with the existing SSF letdown line, T-H analysis determined that the pressurizer may reach a water-solid condition with the potential for water relief through the pressurizer safety valves if the event initiates at a low enough RCS temperature.

In the overheating cases, the RCS heats up and thermally expands following the loss of main feedwater following Turbine Building flood initiation until the primary system temperatures approach the saturation temperature of the lowest SG secondary side relief valve. At this point, SG pressure and RCS temperatures stabilize. As the RCS heats up and pressurizes, fluid surges into the pressurizer, thus rapidly increasing pressurizer level and potentially resulting in a water-solid pressurizer. When the operators begin controlling RCS pressure with the SSF letdown line, the rate of pressurizer level increase slows down. In some cases, the large insurge of subcooled liquid to the pressurizer overcomes the available pressurizer heaters and leads to the collapse of the pressurizer steam bubble because of the ambient heat losses and increased interfacial heat transfer in the presence of subcooled liquid. The licensee states that OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION the transition to a water-solid pressurizer condition occurs slowly over several hours after pressurizer level goes off-scale high and that it is within operator's capability to control subsequent increases in RCS pressure following the loss of the pressurizer steam bubble because of the letdown capacity of the new modified SSF letdown line and operational margin between RCS pressure and PSV or power operated relief valve (PORV) lift setpoints.

As discussed in Section 3.2 of this safety evaluation, the operator is required to maintain a very high awareness of the plant status for RCS pressure and through the use of the new larger SSF letdown line to prevent liquid flow through the pressurizer safety valves. Further discussion on operator actions are discussed in Section 3.4 of this safety evaluation.

The NRC staff has reviewed the analyses of the SSF-mitigated Turbine Building flood event under high decay heat and low RCS temperature conditions and concludes that the analyses have adequately accounted for the operation of the plant and were performed using acceptable analytical models with appropriate input assumptions. The NRC staff also finds that the licensee calculations demonstrate that the proposed off-nominal acceptance criteria are met.

3.3.3 RELAP5 Confirmatory Calculations For the SSF-mitigated Turbine Building flood cases occurring at off-nominal conditions that result in a water-solid pressurizer, the licensee performed confirmatory calculations using Duke Energy's RELAP5/MOD2-B&W Oconee T-H model. This model has been approved previously by the NRC for use in the Oconee UFSAR Chapter 6 Loss of Coolant Accident mass and energy release analyses. In order to perform the analysis, the licensee made similar input modifications as those made to the RETRAN model as previously described in Section 3.3.1 of this safety evaluation. These modifications include the addition of ambient heat losses from the RCS and pressurizer and renodalization of the pressurizer region to improve its capability to model thermal stratification.

The licensee stated that results from the RELAP5/MOD2-B&W and RETRAN-3D analyses show good agreement. For both analysis methods, the RCS pressure response for the transition to and during a water-solid pressurizer condition is reasonable and well-behaved. Additionally, there are no numerical discontinuities in the code predictions for filling or emptying of the pressurizer. Therefore, the NRC staff finds the use of RELAP5 confirmatory calculations to be an appropriate method for providing confidence to the RETRAN-3D results for when the pressurizer fills water-solid.

3.4 Evaluation of Operator Actions The NRC staff evaluated the human factors considerations associated with the operator manual actions described in the licensee's application dated October 20, 2017, as supplemented by letters dated July 20, and September 21, 2018. As discussed in Section 2.0 of this safety evaluation, the NRC staff has determined to apply a Level I human factors review to the licensee's application per the guidance in NUREG-1764, Revision 1.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION 3.4.1 Description of Operator Actions and Associated Changes The Enclosure of the licensee's application dated October 20, 2017, describes operator manual control of a newly installed SSF letdown throttle valve. Section 2.3.2 of the Enclosure describes current plant configuration and operation as follows:

The current configuration of the SSF reactor coolant letdown line controls flow by means of an orifice; the line cannot be throttled.

In addition, in its supplement dated September 21, 2018, the licensee states:

In order to balance RCS inventory during an SSF event, letdown flow must be established. The current nominal SSF reactor coolant letdown capacity is more than SSF reactor coolant makeup capacity. Thus, SSF reactor coolant letdown must either be throttled or periodically secured. The current SSF letdown line valve was designed and intended to be used as a throttle valve. Neither the Oconee SSF design LAR [license amendment request] nor the NRC SE [safety evaluation] explicitly stated how SSF letdown flow would be controlled, only that the SSF letdown line would be used to control pressurizer level. Subsequently, Duke Energy identified a design limitation that made fine control with the throttle valve not possible. This resulted in the need to procedurally control the valve to not throttle, but cycle full open or closed.

The licensee's proposed UFSAR change will rely on SSF letdown flow being controlled by operator action to throttle flow rather than operator action to maintain full flow or no flow through the SSF letdown line. Therefore, the NRC staff has evaluated the operator action to throttle flow through the SSF letdown line to mitigate SSF events as described in the licensee's application and supplements.

Per Section 2.4 of the Enclosure of the licensee's application dated October 20, 2017, the licensee also requests NRC approval to utilize the manually operated ADVs, when available, to control main steam pressure during the mitigation of SSF events. In addition, in the response to RAl-5.A in its supplement dated July 20, 2018, the licensee states the following with regard to the use of the ADVs to mitigate SSF events:

The SSF is designed to maintain the affected unit(s) in a natural circulation safe shutdown condition and the reactor coolant pumps are secured prior to placing the SSF systems in operation. The ADVs will not be used to achieve plant cooldown during the stabilization phase of an SSF mitigated event. The ADVs may be used to reduce main steam pressure until the MSRVs [main steam relief valves] reseat following SSF mitigated events that occur from a nominal operating condition. The ADVs may also be used to stabilize RCS temperature following SSF mitigated events that occur from a high decay heat/low RCS temperature off-nominal plant operating condition to prevent the RCS from reheating back to 550°F. During the recovery phase of an SSF mitigated event, the ADV's (sic) may be used to achieve plant cooldown as described in the Safety Evaluation Regarding Implementation of,Mitigating Strategies Related to Orders EA-12-049 ([ADAMS Accession No.] ML17202U791 ). Oconee has not made any changes in regard to use of the ADVs during a FLEX event in preparation for the NRC Tl [Temporary lnstruction]-2515/191 inspection.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION Operating the ADVs to control main steam pressure is not a new operator action for the licensee. However, the licensee is proposing to utilize the ADVs in a new context (i.e., during the mitigation of SSF events). Manual operation of the ADVs requires communication between the field operator and the SSF control room in order to coordinate main steam pressure control with RCS pressure and temperature parameters as described in Section 3.1 of this safety evaluation. The NRC staff evaluated the manual operation of the ADVs in the context of mitigating SSF events as described in the licensee's application dated October 20, 2017, and its supplements, as described below.

3.4.2 General Deterministic Review The licensing basis changes proposed in the application dated October 20, 2017, for operation of the SSF system are related to two primary areas: operation of the SSF during off-nominal conditions and the allowance to use the ADVs, if available, to mitigate SSF events. In its application dated October 20, 2017, the licensee stated that it will install a plant modification (separate from this amendment request) that will add the capability to throttle the SSF letdown line flow. This modification is needed to operate the plant as requested in the licensee's application.

Per Section 2.3 of the Enclosure of the application dated October 20, 2017, the licensee previously performed T-H analyses for SSF-mitigated events under nominal full power reactor conditions only. The proposed changes would allow the SSF to be credited for event mitigation under off-nominal conditions defined as an event initial condition of low decay heat or an event initial condition of a low RCS temperature and high decay heat. Operation of the SSF under off-nominal conditions applies directly to a turbine building flood event occurring at less than nominal full power conditions. The proposed off-nominal success criteria for the SSF system are described in Section 2.4 of the Enclosure of the application dated October 20, 2017, as follows:

Duke Energy proposes to revise the UFSAR, as shown in Attachment 1, to state that current success criteria applies to a TB flood event occurring at nominal full power conditions and that off-nominal success criteria applies to a TB flood event occurring at less than nominal full power conditions. A nominal full power condition is defined as a unit at 100% power operation for a minimum of approximately 4 days, which provides the decay heat required to meet the current nominal SSF success criteria. The current success criteria for events occurring during nominal full power conditions are to assure natural circulation and core cooling by maintaining the primary coolant system filled to a sufficient level in the pressurizer while maintaining sufficient secondary side cooling with the reactor maintained at least 1% b.k/k shutdown with the most reactive rod fully withdrawn. For off-nominal operating conditions, the proposed off-nominal success criteria would: (1) allow the pressurizer to go water-solid provided that there is no liquid relief through the pressurizer safety valves; and, (2) would consider ambient losses and letdown and makeup of reactor coolant acceptable methods of decay heat removal during periods of low decay heat in lieu of sustained natural circulation with SG heat removal. SSF equipment needed to support SG heat removal will remain available.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION As noted above, off-nominal operating conditions for the SSF system would allow operation with a water-solid RCS and low decay heat removal without sustained natural circulation. In (proprietary) and Attachment 3 (non-proprietary) to the licensee's application dated October 20, 2017, the licensee described revised T-H analyses performed for a turbine building flood event to assess the plant response under the defined off-nominal conditions.

Section 3.1 of Enclosure of the licensee's application dated October 20, 2017, concludes that the revised T-H analyses confirm acceptable plant response for a SSF-mitigated Turbine Building flood event under off-nominal conditions. Acceptable results include operation with a water-solid pressurizer utilizing the new expanded letdown line flow throttling capability to control pressurizer pressure. In addition, the licensee concludes that use of the ADVs is acceptable and beneficial to plant operation, however, use of the ADVs is not credited in the T-H analyses.

In Section 3.3 of this safety evaluation, the NRC staff has evaluated and addressed the deterministic acceptability of the proposed changes on the plant T-H response. The NRC staff has evaluated the acceptability of the associated operator actions to throttle the SSF letdown line flow and control main steam pressure using the ADVs for SSF-mitigated events, as described in the following sections of this safety evaluation.

3.4.3 Operating Experience Review In its response to RAl-4.D in the supplement dated July 20, 2018, the licensee provides a review of industry operating experience related to the plant and operator response to water-solid pressurizer conditions. The licensee described several plant-specific experiences where RCS water-solid conditions resulted from unintended plant perturbations associated with component or system failures or misoperation rather than from intentional operation. In the instances reviewed, the plants recovered from the RCS water-solid condition through operator action and/or automatic plant response. The licensee notes that Oconee has not experienced a plant event that resulted in RCS water-solid conditions. However, the licensee does have existing procedural guidance to maintain the plant in a water-solid safe shutdown condition. The procedural guidance is provided for operation from both the main control room and the SSF.

In its response to RAl-7.B in the supplement dated September 21, 2018, the licensee identifies that operator adjustments of normal RCS letdown to compensate for changes in RCS inventory and maintain pressurizer level, throttling emergency feedwater flow as required to maintain a prescribed steam generator level or RCS temperature, and throttling high pressure injection to maintain a desired level in the pressurizer from the main control room following nominal and off-nominal events are similar to throttling flow in the SSF letdown line. In its response to RAl-7.B, the licensee further notes that the indications and actions required of operators to throttle normal RCS letdown flow are not appreciably different than those required to throttle SSF letdown line flow. Therefore, the licensee states that the operating experience with Oconee's normal RCS letdown line and the other operations identified above are relevant to controlling SSF letdown by throttling flow in the SSF letdown line.

In its response to RAl-5.B in the supplement dated July 20, 2018, the licensee provides a review of an Oconee Unit 1 event occurring on February 15, 2007, wherein the plant tripped because of an electrical grid disturbance. Failure of the unit's 4-kilovolt electrical buses to rapid transfer complicated the event, and the MSRVs lifted to relieve excessive steam flow. The plant staff subsequently made a decision to cool down the unit to low pressure injection decay heat removal entry conditions using the ADVs. Transition to the ADVs occurred approximately OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> after the trip. The plant cool-down proceeded smoothly, and unit temperature and pressure were reduced sufficiently to place the unit in Mode 4.

The licensee's operating experience review identifies that the existing plant practice at Oconee, including throttling flow in the normal RCS letdown line, provid,es operating experience that is applicable to controlling SSF letdown by throttling flow in the SSF letdown line. The licensee's industry operating experience review also supports that controlling the plant with a water-solid condition has been demonstrated at other nuclear units. The licensee's proposed change involves operating the plant utilizing the SSF under conditions where water-solid conditions are a known expected possibility. Furthermore, the licensee has existing procedural guidance to address operation from the SSF when the plant is in a water-solid condition. In addition, successful plant cooldown utilizing the ADVs has been demonstrated on Oconee Unit 1.

Therefore, the NRC staff concludes that the licensee has identified and incorporated appropriate operating experience and satisfied this element of the human factors review.

3.4.4 Functional Requirements Analysis and Functional Allocation The proposed tasks and functions to control SSF letdown line flow are similar to the current tasks and functions in that in both cases, as described in the licensee's supplement dated September 21, 2018, the operator is manipulating the SSF letdown valve position to maintain pressurizer level or RCS pressure within a prescribed control band. In the current configuration, the SSF letdown valve is set to be fully open or fully closed, whereas the new configuration allows the operator to throttle the valve to an intermediate position. The same parameters (i.e.,

RCS temperature, pressure, and pressurizer level) will be monitored by licensed operators at the beginning of an SSF-mitigated event. Operators will take the same actions to stabilize RCS temperature for nominal conditions or the same actions to attempt to stabilize RCS temperature during off-nominal conditions. Operators will then operate the SSF letdown valves to control SSF letdown flow.

Manipulating the SSF letdown flow valve in the current configuration wherein the operator only controls the valve fully open or fully closed is less complex than throttling the valve(s) to an intermediate condition. However, in its supplement dated September 21, 2018, the licensee notes that the capability to throttle the SSF letdown line valve(s) also provides the operator with finer controllability to maintain more precise regulation of pressurizer level or pressure within its control band.

While the isolated operator action to throttle the SSF letdown line valve( s) is somewhat more complicated than controlling the valve fully open or fully closed, the added throttling capability results in enhanced operator control over the function to stabilize pressurizer level or pressure in total. Therefore, the NRC staff finds that the proposed change to throttle SSF letdown line flow to mitigate SSF events during nominal or off-nominal conditions places less demand on operator functions overall and is acceptable.

Operating the ADVs to control main steam pressure is not a new function for Oconee. The licensee is proposing these existing operator functions to be applied to SSF-mitigated events utilizing the SSF control room in addition to the main control room. The NRC staff finds that the licensee's proposal to utilize the ADVs to control main steam pressure during SSF-mitigated events relies on existing operator functions applied in a manner that is consistent with their current use and is, therefore, acceptable.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION 3.4.5 Task Analysis and Staffing As described previously in this safety evaluation, the proposed tasks to control SSF letdown line flow are similar to the current tasks and functions in that in both cases, the operator is manipulating the SSF letdown valve position to maintain either pressurizer level or RCS pressure within a prescribed control band. In its supplement dated September 21, 2018, the licensee notes that the added throttling capability results in fewer SSF letdown valve manipulations required by the operator to stabilize and control pressurizer level or pressure.

In the response to RAl-3.A in its supplement dated July 20, 2018, the licensee describes sensitivity studies performed to evaluate the time available for the operator to manipulate the SSF throttle valves to prevent liquid relief through the PSVs during off-nominal conditions when the RCS is water-solid. In this case, operators are dispatched to the SSF and procedurally directed to open the SSF letdown line with a target RCS pressure of 1,600 psig. Operators are assumed to take control of the SSF letdown line within 20 minutes of losing normal RCS letdown caused by the loss of low pressure service water. The reported operator action time margin is in addition to the 20-minute operation action time to initiate SSF letdown flow.

The 1,600-psig target provides 900 psig of margin to the PSV nominal lift setpoint of 2,500 psig.

Additional conservatism was incorporated in the analysis in that the licensee used the 2,450-psig pressurizer PORV setpoint in the calculations. The sensitivity study cases assumed that operators did not open the SSF letdown valves at the 1,600-psig target and calculated the additional operator action time margin as well as margin available before liquid relief through the PORV began.

The sensitivity studies demonstrated that for the cases where SSF letdown availability does not occur until after the 1,600-psig target is reached, margin to the PORV relief setpoint of between approximately 26 to 31 minutes was still present. For the more limiting cases where operation of the SSF letdown was available but margin to the PORV setpoint was reduced, operator action margin was shown to be approximately 20 to 65 minutes. The limiting cases also demonstrated that margin (1,600-psig operator action target to the PORV setpoint of 2,450 psig) remained in addition to the operator action margin (SSF letdown availability to the 1,600-psig operator action target). The crossover case where operation of the SSF becomes available near the 1,600-psig target resulted in a margin of approximately 31 minutes and an operator action time margin of approximately 4 minutes. Therefore, the NRC staff finds that the licensee's sensitivity studies demonstrate that adequate margin exists with respect to the operator action to initiate SSF letdown and prevent water relief through the PSVs when the RCS is in off-nominal, water-solid conditions.

In its supplement dated September 21, 2018, the licensee also addressed the potential impact to the plant should operator error result in failure to correctly throttle the SSF letdown flow. If the SSF control room operator fails to open the SSF letdown line valve(s) and provide adequate flow, then procedural direction in the SSF emergency operating procedures (EOPs) and routine control board monitoring can inform the operator to increase SSF letdown line flow. Should the operator continue to fail to increase SSF letdown flow, the PORV and/or the pressurizer code safety valves will lift to limit RCS pressure. The impacts above are applicable to both nominal and off-nominal operating conditions and are unchanged from the impacts of failing to establish sufficient SSF letdown flow with the current SSF letdown line valve.

If the SSF control room operator misoperates the SSF letdown line valve(s) and establishes excess flow, then procedural direction in the SSF EOPs can inform the operator to decrease OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION SSF letdown line flow. Should the operator continue to fail to decrease SSF letdown flow, RCS pressure may decrease to the point where there is a lo.ss of subcooling outside of the pressurizer, which would be undesirable because it could impact RCS natural circulation in the loops. However, per Section 3.2, "Changes to Acceptance Criteria," of this safety evaluation, the NRC staff finds the proposed operating strategy described in the licensee's submittal dated September 21, 2018, acceptable because the proposed new SSF letdown line would be large enough to prevent water flow through the PSVs even with a water-solid pressurizer. In addition, in the response to RAl-4.E in its supplement dated July 20, 2018, the licensee states that the current SSF event mitigation procedure also contains guidance for maintaining the plant in a safe shutdown condition with a water-solid pressurizer.

The enhanced capability afforded by the ability to throttle SSF letdown flow requires fewer valve manipulations and reduces the number of operator actions required to stabilize pressurizer level or pressure. Given that task demands are reduced, the proposed change also does not increase required staffing levels. In addition, the potential impacts to the plant caused by misoperation of the new SSF letdown throttle valves are unchanged from the potential impacts resulting from misoperation of the current SSF letdown line valve with the exception of a greater SSF letdown line flow from the proposed larger letdown line. However, the licensee's proposed off-nominal water-solid operating strategy has been determined to be acceptable by the NRC staff as described above. Therefore, the NRC staff finds that the proposed change to throttle SSF letdown line flow to mitigate SSF events during nominal or off-nominal conditions places less demand on operator tasks and does not increase the potential impact to the plant resulting from operator errors.

Operating the ADVs to control main steam pressure is not a new operator action for Oconee.

However, the licensee is proposing to utilize the ADVs in a new context (i.e., during the mitigation of SSF events). Manual operation of the ADVs requires communication between the field operator and the SSF control room in order to coordinate main steam pressure control with RCS pressure and temperature parameters as described in the licensee's proposed revision to UFSAR Section 9.6.3.3. Per the response to RAl-5.D in the licensee's supplement dated July 20, 2018, EOPs for events such as loss of condenser vacuum, station blackout, and loss of coolant accident cooldown with degraded high pressure injection currently contain direction for the use of the ADVs as an alternate means of stabilizing RCS temperature or conducting a unit cooldown from the main control room.

In the response to RAl-5.A in its supplement dated July 20, 2018, the licensee notes that stabilizing RCS temperature with the ADVs following an SSF-mitigated event that occurs from a high decay heat/low RCS temperature off-nominal plant operating condition, including an RCS water-solid condition, relies on an existing ADV control system configuration and an existing operator action consistent with an existing approved procedure. The licensee states that specific guidance to operate the ADVs during an SSF-mitigated event will be added to either the EOPs or the SSF EOP.

In the response to RAl-5.C in its supplement dated July 20, 2018, the licensee notes that misoperation of the ADVs while reducing main steam pressure to below the lift setpoint of the MSRVs following an SSF-mitigated event that occurs at nominal plant conditions will have no impact on plant operations. This conclusion is based on the fact that the 1.5-inch bypass control valve is sized to limit the rate of steam flow through the valve in order to limit the decrease in main steam pressure to a value where the MSRVs remain seated and thereby limit OFFICIAL USE ONLY* PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION the rate of steam flow through the valve such that rapid depressurization of the main steam header cannot occur.

Misoperation by opening the 10-inch ADV more than required while reseating the MSRVs during nominal operating conditions can be quickly recognized and immediately corrected by the SSF control room operator. If the operator fails to throttle the ADVs open sufficiently to stabilize RCS temperature during off-nominal operating conditions, RCS temperature will eventually return to 550 °F and be controlled by the MSRVs. The SSF control room operator will throttle open the SSF letdown control valve to accommodate the resultant expansion of RCS inventory.

The NRC staff finds that the licensee's proposal to utilize the ADVs to control main steam pressure during SSF-mitigated events relies on existing operator tasks applied in a manner that is consistent with their current use and is, therefore, acceptable.

3.4.6 Probabilistic Risk Assessment and Human Reliability Analysis The NRC staff reviewed the licensee's application and its supplements and determined that while the licensee's application was not submitted as a risk-informed application in accordance with NRC Regulatory Guide 1.174, Revision 3, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"

(ADAMS Accession No. ML17317A256), the licensee did provide risk insights related to the

• operation of the SSF. In the response to RAl-2.C in its supplement dated July 20, 2018, the licensee reported that a risk-informed approach was applied to determine the risk significance associated with the unanalyzed conditions existing for the SSF-mitigated turbine building flooding event. The licensee determined that the CCDP associated with this event is less than 1.0E-06 because of the average exposure period and, therefore, was considered to have a small risk impact.

Consistent with the NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition," Chapter 19.2, "Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance,"

Appendix D, "Use of Risk Information in Review of Non-risk-informed License Amendment Requests" (ADAMS Accession No. ML071700658), the NRC staff reviewed the licensee's application to determine whether "special circumstances" were present that would warrant a more detailed risk evaluation. Based on the risk information provided by the licensee, the NRC staff concluded that the expected increase in risk associated with implementation of the proposed change would be within the risk acceptance guidelines delineated by Regulatory Guide 1.174, Revision 3. Therefore, the NRC staff's review did not identify any "special circumstances" that would warrant an in-depth probabilistic risk assessment review.

3.4. 7 Human-System Interface Design In the response to RAl-3.B in its supplement dated July 20, 2018, the licensee states that the new SSF letdown line throttle valves will be located inside containment, will be powered from the SSF, and can only be operated from the SSF control room. The new valve control switches will be located on the SSF control board in approximately the same location as the current valve switches. In its supplement dated September 21, 2018, the licensee notes that the current SSF letdown line valve control switch must be maintained in the open position until the valve travels to fully open or maintained in the close position until the valve travels to fully closed. Therefore, OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION the new SSF letdown line throttle valve control switches will be physically operated in the same manner as the current SSF letdown line valve.

The ADVs are locally manually operated, and no changes to ADV components or hardware are proposed. Manual operation of the ADVs will be coordinated between field operators and the SSF control room in a similar manner as is currently done with the main control room. In the response to RAl-5.A in its supplement dated July 20, 2018, the licensee notes that stabilizing RCS temperature with the ADVs following an SSF-mitigated event that occurs from a high decay heat/low RCS temperature off-nominal plant operating condition, including an RCS water-solid condition, relies on an existing ADV control system configuration and an existing operator action consistent with current procedures.

Based on the above, the NRC staff finds that the operation of the new SSF throttle valves and utilization of the ADVs for SSF-mitigated events does not involve any significant changes to the human-system interface design and is, therefore, acceptable.

3.4.8 Procedure Design In the response to RAl-4.A in its supplement dated July 20, 2018, the licensee states that procedural guidance, including operational control bands, for throttling SSF letdown flow will be revised for an SSF event that occurs from both nominal operating conditions and from off-nominal operating conditions. In its response to RAl-3.B, the licensee notes that the SSF EOP provides existing procedural guidance to address operation from the SSF with the RCS in a water-solid condition. In the response to RAl-5.D in its supplement dated July 20, 2018, the licensee states that procedural guidance will be added to the SSF EOP to direct non-licensed operator actions and SSF control room communications to operate the ADVs following an SSF-mitigated event during nominal operating conditions. Guidance for operation of the ADVs in coordination with the SSF control room following an SSF-mitigated event during off-nominal operating conditions will be added to the EOPs or the SSF EOPs as appropriate.

Based on the above, the NRC staff finds that the licensee's submittal addresses appropriate procedural changes in support of operation of the new SSF letdown line throttle valves and utilization of the ADVs for SSF-mitigated events occurring from nominal and off-nominal operating conditions.

3.4.9 Training Program Design In the response to RAl-4.A in its supplement dated July 20, 2018, the licensee states that training on the current SSF letdown line configuration is included in initial license training {ILT) and licensed operator requalification (LOR). These training programs include training on the SSF simulator. Operation of the SSF with the new SSF letdown line throttle valves will be included in the ILT and LOR training programs. The training will address SSF operation during nominal, off-nominal, and RCS water-solid operating conditions.

In the response to RAl-5.E in its supplement dated July 20, 2018, the licensee states that non-licensed operators currently receive initial and periodic training regarding the purpose and operations of the ADVs. Licensed operators currently receive training in the ILT and LOR training programs, including the directing of non-licensed operators when operating the ADVs.

Additional classroom and simulator training will be developed and added to the ILT and LOR training programs to address the proposed utilization of the ADVs.

OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION Based on the above, the NRC staff finds that the licensee's submittal addresses appropriate changes to non-licensed and licensed operator training in support of operation of the new SSF letdown line throttle valves and utilization of the ADVs for SSF-mitigated events occurring from nominal and off-nominal operating conditions.

3.4.10 Human Factors Verification and Validation In the response to RAl-7.B(2) in its supplement dated September 21, 2018, the licensee stated that validation of throttling the new SSF letdown line valves following an SSF event that occurs from a nominal or off-nominal operating condition will be completed prior to the new SSF letdown line being placed in service in accordance with administrative procedures. In the response to RAl-4.E in its supplement dated July 20, 2018, the licensee notes that the current SSF event mitigation procedure contains guidance for maintaining the plant in a safe shutdown condition with a water-solid pressurizer. This guidance has been validated on the SSF simulator. Per the response to RAl-5.D in the licensee's supplement dated July 20, 2018, the procedural guidance being developed regarding operation of the ADVs will also be validated.

Based on the above, the NRC staff finds that the licensee's submittal addresses appropriate validation of the proposed operation of the new SSF letdown line throttle valves and utilization of the ADVs for SSF-mitigated events occurring from nominal and off-nominal operating conditions.

3.4.11 Human Performance Monitoring Strategy Per the licensee's response to RAl-4.B in the supplement dated July 20, 2018, licensed operators will receive periodic ongoing classroom and simulator training and re-qualification in the LOR program regarding throttling SSF letdown flow using the new SSF letdown line configuration to mitigate nominal and off-nominal turbine building floods in addition to the existing SSF mitigation events during nominal operating conditions. Per the licensee's response to RAl-5.E in the supplement dated July 20, 2018, non-licensed operators will receive periodic continuing classroom training on the purpose and operations of the ADVs.

Non-licensed operators are required to qualify to the local operation of ADV task during on-the-job training and may also be required to demonstrate proficiency during their annual requalification exam (tasks are selected by random sampling).

Based on the above, the NRC staff finds that the licensee's submittal includes an appropriate human performance monitoring strategy for the proposed operation of the new SSF letdown line throttle valves and utilization of the ADVs for SSF-mitigated events occurring from nominal and off-nominal operating conditions.

3.5 Technical Evaluation Summary The NRC staff finds the licensee's proposed changes would maintain the plant in a safe and stable condition following an SSF-mitigated Turbine Building flood event and are acceptable.

The NRC staff also reviewed the licensee's modelling of specific conditions and limitations for use and related model modifications in the T-H analyses and found them acceptable for the proposed nominal and off-nominal conditions. The NRC staff finds the licensee's application, as supplemented, has adequately addressed the human factors considerations associated with the proposed operation of the new SSF letdown line throttle valves and utilization of the ADVs for OFFICIAL USE ONLY PROPRIETARY INFORMATION

OFFICIAL USE ONLY PROPRIETARY INFORMATION SSF-mitigated events occurring from nominal and off-nominal operating conditions and is acceptable.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the NRC staff notified the State of South Carolina officials by email on October 10, 2018 (ADAMS Accession No. ML18298A160), of the proposed issuance of the amendments. The State officials had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendments change requirements with respect to the installation or use of facility components located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts and no significant change in the types of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding, which was published in the Federal Register on July 3, 2018 (83 FR 31193), as corrected by a notice published on July 10, 2018 (83 FR 31979). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b),

no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

Based on the aforementioned considerations, the Commission has concluded that: ( 1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors: R. Beaton, NRR/DSS J. Hughey, NRR/DRA A. Klett, NRR/DORL Date: December 17, 2018 OFFICIAL USE ONLY PROPRIETARY INFORMATION