RA-19-0301, Proposed Amendment to Renewed Facility Operating Licenses Regarding Revisions to Final Safety Analysis Report Sections Associated with Oconee Tornado Licensing Basis -Responses to Request for Additional Information

Proposed Amendment to Renewed Facility Operating Licenses Regarding Revisions to Final Safety Analysis Report Sections Associated with Oconee Tornado Licensing Basis -Responses to Request for Additional Information

ML19217A149
Person / Time
Site:	Oconee
Issue date:	07/31/2019
From:	Burchfield J Duke Energy Carolinas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML19217A167	List: RA-19-0301, Proposed Amendment to Renewed Facility Operating Licenses Regarding Revisions to Final Safety Analysis Report Sections Associated with Oconee Tornado Licensing Basis -Responses to Request for Additional Information
References
RA-19-0301
Download: ML19217A149 (48)

Text

.. .. . . ....

.. : * . J. Ed Bun:hfield, Jr.. : * .... * *

• .:*.*:*:*::: VicePtesldent : .... * *

• Oconee ~uc!ear Station.

.. Dllke Ehet!iv ..

ON01VP: f 7.800 Rochester Hwy: : : *

• *::: : :* .Seneca, SC 29672 *

..... RA-19.:0301. *

'! 8ij4:873,341'.8

• july 31; 2019 *. t . 864.873:4208 Ed,~urchfie(d@dukH11e,gy.com:

ATTN:. Document*control .Desk t(s. Nuclear Regi.ji~tory Commissiqh **>

115!?5 Rpckville Pike ** **** * *

.Rockville; Marylan~ 20852 *: .* .

Subject:

.*. Duke Energy: Carolinas, LLC .

• • • .: **oconee Nuclear Station (ONS),: Units t; .2, and 3

. . D(?'cket _N!Jmbers 50-26.9, ~()-~70, and 50:287.::: . .*: ..

R~newed Facility Opetating;l.,.icense Nos.*PPR-38, DPR-47, ah<fOPR-55

Proposed Amendment to the Renewed Facility Operating Licenses Regarding to

• * *Re.visions theUpdc1ted FinalSafety Analysis Report Sections*Associatedwith:***

• the* Ocohe.e Tornado licensing Basis - Responses to Requestfor Additional : >: *:

• information. ' ' ' .. . . ... ' '

....... Referehcei:**

1.. .LE!tter to tiis' U.: S: l'JlJ~le,ar iteg*ufatbry. Gc:unmiss10~ i~om ~ .. E:cJ. Burdifi~id; :Jr.' Vic:f9 ' :*:'

• p~esi.dent, Ocone~ N1,1clear Station, 0:1,1~~ Ef"!ergy CaroHn:~s, :l,J,..C, "Proposed *. *

• Amendment to the Renewed .F.l:!cility Operating LiGenses-Regarding Revisions to the*

UpdatedFinalSafety Analysis.Report SectionsAssociated with the:oconee Tornado * .

. .Licens1rig Basis," :dated September 14, 2018 (AbAMS Accession No.* MLf8264A018).' .

Pursuanrfo.10 CFR 50.90;Duke Energy Carolhias,.:LLC (Duke Energyrsubmitted ai_jcerise

Ar:nendment R~que~t:(LAR) whictfpfoppses to revise:foe*ONS Updated FinaLSafety Analysis *

Report (UFSAR): regarding the tornado licensing basis: (LBj on* September: 1,t( 20.18 (Reference :*:.

1). T~e :tjew .licensing ba~is 'Aiot.i!d allow the :$ta~dby Shutdown F=acfllty :(SSF) to mitiga~~: a .:

. .tornado Vilith* th~ .a.ssumed initial co.ndit.iqns of loss :of all. ~lt.ernating *current. pp,iver. to all *units with

.;*$ignificant torn$i\'.i!'.t d;3mage to one *v.ni.t, t.he use of tornado: missile probabilistic methodology I , : ' ***.

' *and the elimination of the spentfuel poor to high pressure injection flow paitdor reactor. coolant :

makeupJrom the licensiri~r bases. . ' ' . .. ' .

. *Qtl February t1, :20~ 9, tlie u:s. N~cle~t R,eguiatory Co1Timis$ion (NRC) b$ga1:i:ari audit to .

• s4pport its revi~W*qfthe LAR, as discussed in the NRC*staff's*audit plan dated February 8, 2ot9:***

(ADAMS Accession No. ML19037A005). Based on its review ofthe application and :its audit, the NRC. issued requests fcfr additional inform.atlori (RAls) on June :2a, 2019 (ADAMS Acbeasion

_ :.J~o. ML 19183A4.a~t:in order to coff;lpl~t~ its review. . .. *; . *: . .... .  : *: .

• *Enclqs!Jre .2 provides th~ rt:)sponses to the RAls which includes Jnforrnation thatis proprietary to Duke :f;nergy, The proprietary information is: identified by brackets and is annotated as :suctil .

.:* ** *. The annotated :information has substantial comm*ercial value that provides: a: competitive. . .

. . .. .:~dvantage. Attachnierit 1 contains an Affidavit attesting to :the proprietary natute*c:,f the inforniatibn ip Enclosur~ 2. Eiicl9sure 1 contE1in~ *~ rion-proprieta*iy [tei(.iijcted] version c:ifthis.

contehf Attachment 2 contains the revised rriarked-:-up UFSAR p:ages. No changes to Technical

• • Specifications ~rejfroposed. * *** * ** ** * ** ** ** * *

jw5?.::

. Enclosure 2 of ttlis letter *contains. proprietary* 1nformatie>r1. Withhold from Public Disclosure ..

Under: .1 Q. CFR 2.390. Upo,n J~i'noval of Enclo$ur~ ~. this letter is Uncontrolled. * **/r//< &.

U. S. Nuclear Regulatory Commission July 31, 2019 Page2 The responses to the RAls have been reviewed and determined to not affect the conclusions of the No Significant Hazards Consideration provided in the LAR dated September 14, 2018 (Reference 1). of the LAR (Reference 1) provided a schedule for completion of the SSF modifications supporting the new tornado mitigation strategy. The schedule submitted with the LAR was based on the anticipated date of issuance of the Safety Evaluation Report (SER) in the second quarter of 2020. It is requested that the schedule date for the SSF instrumentation modifications be revised to 1EC33 {Fall 2024), 2EC32 (Fall 2025), and 3EC33 (Spring 2026). A request for changes to the other modification schedules is not deemed necessary. The addition and upgrade of the SSF instrumentation requires significant work within containment which is planned to span over multiple outages. Based on the outage related work, the project has started for the Unit 1 SSF instrumentation modifications. Unit 2 and Unit 3 SSF instrumentation modifications would follow with completion in Fall 2025 and Spring 2026, respectively.

Inquiries on this proposed amendment request should be directed to Timothy D. Brown, ONS Regulatory Projects Group, at (864) 873-3952.

I declare under penalty of perjury that the foregoing is true and correct. Executed on July 31, 2019.

Sincerely, Jct~

J. Ed Burchfield, Jr.

Vice President Oconee Nuclear Station Enclosure 1: Responses to Requests for Additional Information [Non-Proprietary]

Enclosure 2: Responses to Requests for Additional Information [Proprietary]

Attachment 1 Duke Energy Affidavit Attachment 2 UFSAR Marked-Up Pages

U. S. Nuclear Regulatory Commission July 31, 2019 Page 3 cc w/enclosure and attachments:

Ms. Laura A Dudes, Administrator, Region II U.S. Nuclear Regulatory Commission Marquis One Tower 245 Peachtree Center Ave., NE, Suite 1200 Atlanta, GA 30303-1257 Ms. Audrey Klett, Project Manager (by electronic mail only)

Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Mr. Adam Ruh Acting NRC Senior Resident Inspector Oconee Nuclear Station Ms. Susan E. Jenkins, Manager, (by electronic mail only: jenkinse@dhec.sc.gov)

Infectious and Radioactive Waste Management, Bureau of Land and Waste Management Department of Health & Environmental Control 2600 Bull Street Columbia, SC 29201

/

U. S. Nuclear Regulatory Commission July 31, 2019 Page4 bee w/enclosure and attachments:

J. E. Burchfield P. V. Fisk H. T. Grant C. J. Wasik D. M. Hubbard M. J. Dunton C. P. King V. 8. Bowman T. D. Brown J. D. Galloway S. B. Thomas R. I. Rishel M. C. Nolan - GO A. H. Zaremba - GO NSRB, EC05N ELL,EC2ZF ONS Document Management

ATTACHMENT 1 Duke Energy Affidavit

Duke Energy Affidavit AFFIDAVIT of Steve Snider

1. I am Vice President of Nuclear Engineering, Duke Energy Carolinas, and as such have the responsibility of reviewing the proprietary information sought to be withheld from public disclosure in connection with nuclear plant licensing and am authorized to apply for its withholding on behalf of Duke Energy.

2. I am making this affidavit in conformance with the provisions of 10 CFR 2.390 of the regulations of the Nuclear Regulatory Commission (NRC) and in conjunction with Duke Energy's application for withholding which accompanies this affidavit.

3. I have knowledge of the criteria used by Duke Energy in designating information as proprietary or confidential. I am familiar with the Duke Energy information contained in the response to question 8 of the Request for Additional Information (RAI) by the Office of Nuclear Reactor Regulation for Oconee License Amendment request 2018-02 which proposes to update the Updated Final Safety Analysis Report (UFSAR) regarding the Tornado licensing basis.

4. Pursuant to the provisions of paragraph (b)(4) of 10 CFR 2.390, the following is furnished for consideration by the NRG in determining whether the information sought to be withheld from public disclosure should be withheld.

(i) The information sought to be withheld from public disclosure is owned by Duke Energy and has been held in confidence by Duke Energy and its consultants.

(ii) a The information is of type that would customarily be held in confidence by Duke Energy. Information is held in confidence if it falls in one or more of the following categories.

(a) The information requested to be withheld reveals distinguishing aspects of a process (or component, structure, tool, method, etc.) whose use by a vendor or consultant, without a license from Duke Energy, would constitute a competitive economic advantage to that vendor or consultant.

(b) The information requested to be withheld consist of supporting data, including test data, relative to a process (or component, structure, tool, method, etc.),

and the application of the data secures a competitive economic advantage for example by requiring the vendor or consultant to perform test measurements, and process and analyze the measured test data.

(c) Use by a competitor of the information requested to be withheld would reduce the competitor's expenditure of resourc.es, or improve its competitive position, in the design, manufacture, shipment, installation assurance of quality or licensing of a similar product.

(d) The information requested to be withheld reveals cost or price information, production capacities, budget levels or commercial strategies of Duke Energy or its customers or suppliers.

1

Duke Energy Affidavit (e) The information requested to be withheld reveals aspects of the Duke Energy funded (either wholly or as part of a consortium) development plans or programs of commercial value to Duke Energy.

(f) The information requested to be withheld consists of patentable ideas.

The information in this submittal is held in confidence for the reasons set forth in paragraphs 4(ii)(a) and 4(ii)(c) above. Rationale for this declaration is the use of this information by Duke Energy provides a competitive advantage to Duke Energy over vendors and consultants, its public disclosure would diminish the information's marketability, and its use by a vendor or consultant would reduce their expenses to duplicate similar information. The information consists of analysis methodology details that provides a competitive advantage to Duke Energy.

(iii) The information was transmitted to the NRC in confidence and under the provisions of 10 CFR 2.390, it is to be received in confidence by the NRC.

(iv) The information sought to be protected is not available in public to the best of our knowledge and belief.

(v) The proprietary information sought to be withheld in the RAI response is that which is marked by brackets in the response to RAI 8. This information is consistent with marked proprietary information in the NRC-approved Duke Energy methodology report DPC-NE-3003-PA. This information enables Duke Energy to:

{a) Support license amendment requests for its Oconee reactors.

(b) Perform transient and accident analysis calculations for Oconee.

(vi) The proprietary information sought to be withheld from public disclosure has substantial commercial value to Duke Energy.

(a) Duke Energy uses this information to reduce vendor and consultant expenses associated with supporting the operation and licensing of nuclear *power plants.

(b) Duke Energy can sell the information to nuclear utilities, vendors, and consultants for the purpose of supporting the operation and licensing of nuclear power plants.

(c) The subject information could only be duplicated by competitors at similar expense to that incurred by Duke Energy.

5. Public disclosure of this information is likely to cause harm to Duke Energy because it would allow competitors in the nuclear industry to benefit from the results of a significant development program without requiring a commensurate expense or allowing Duke Energy to recoup a portion of its expenditures or benefit from the sale of the information.

2

Duke Energy Affidavit Steve Snider affirms that he is the person who subscribed his name to the foregoing statement, and that all the matters and facts set forth herein are true and correct to the best of his knowledge.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on July 18, 2019.

3

ATTACHMENT 2 UFSAR MARKED-UP PAGES

• UFSAR Marked-Up Pages UFSAR Chapter 3 Oconee Nuclear Station

n. Reactor Building penetrations and piping through isolation valves.

o. Siphon Seal Water System.

p. Essential Siphon Vacuum System.

q. Electric power for above.

r. Nitrogen supply to the EFW control valves FDW-315 and FDW-316.

f S n~ ~ . lo r1a *n t and Its components are contained in section 9.7.

4

.  ::::c:klr CoolaAl System ~ dad .!

~ =o~ lgss 9f Reactor CoolaAl Pump (RCP) seal iRtegrity was Rot p96tulated a& p;m 9f tRe tgmado de&igA ba&i&.

Capability is pFCWide<:l te shutdewn safely all three 1:1nits.

The Reactor CoolaAt ~ tem, by virtue 9f it& ~ A withiR the Reaaor BuDding, iii protec:tad fiQm tornado damage. A. &uffic:ient &uppfy of &ec:oAdary side c;ggliRg water for &ate shutdown i& a&&ured by f4Qtec:ted Servic:e Water Pump& loc:atad in the Auxiliary auildiA9 aAEI takiAg suaien ffem OE8Aee 2 CCW intake piping. Re<:l1:1Adant and di*Jer:se soorces 8f seeefldary makeup water ari! aedited fer temade mitigati8A. These iRa ude: 1) the etAer lfflits' EFW Systems, 2) the PSW pumps, aAd 3) tAe SSF M*J pump.

Pfeteeted er physieall>f separated lines are used le suppl)* ooeling water te eaeh steam generater. The seurees ef pewer te Die P~".' pumps are Die K~*Jee Hyam Stalien aAd Die GeAlFal Tie SwiWlyam via a 100 kV tfansmissieA line te a 198/13.8 kV sullslatien.

An external source of coofmg water is not inmediately required due to the large quantities of water stored undergrouoo in the intake and discharge CCW piping. The stored vo ume of water in the intake and discharge lines below elevation 791ft would provide sufficient coo in9 water for au three units for at feast 30 days after tr1) of the three reactors.

Anheugh net fully preteeted frem temadaes; Die fell8\'iiRg saYrees pre\lide reaSeRallle assuranee Dial a suffieieAt supply ef p,ifflary side makeup water is a'l'ailallle dl:lnng a temada ifliliateEI less ef effsite pawer.

a. The SSF Reaeter Coolant Makeup Pump eaR take suelioo ff8ffl the Spent Fuel Peel.

The pump eaA be suppliea p8\1'1er ff8ffl the SSF Diesel.

b. A High Pl&&&ure IAje,tiGA ~mp c;an bke &wtion ff.QR! either Iha Borated Water S&Qrage Ta er the SpeAt FYel Peel. Either the "A" er "B* High Pressure lfljeelioo P1:lmf) ean be powered ffem Die PSW Switehgear.

P-R>tec:tioR again&& lORlado i& an Qc;QRQQ de&igR uit&Jia, similar to tRe ,r:iteJia to plOled agai-l&t

' * *

• J;SA~c;oo * ~ ~i!:-A speeifie eeelfffeflee ef these phenemena is R8t pes(lllated, ner is aH equipment that '.tl8Uki be used la llnng tlte plant te safe shutd8'MI eemprehensillety listed. The statement,

• capabilit'J is pf8'Jided te ~ safely all Dlree l:!Rits. is iRteAEled la be a qualitati'.'e assessment that, after a tomaoo, AOfmal shutdo!Ml &y&tem& will remam available or allemate 6Y&l&m& wiNbe available to allow &hutdo1iw:i of the plaRl It was ROt iAtended to impl>J that &pec:lfic: ~m& should be temade p,eef. As palt ef the angina! FS!R det/elepmeRt, speeilie aeeideAt aAaJyses were net peffomled te preye this Joogemem, ner were they requeslea by the NRG. S\lllseq11ent prebabllistit swdies ha*Je eeARFFAe<:l that the engiflal qualitative assessments were eerrett. The 3.2 -4 (31 DEC2M1) 1

UFSAR Marked-Up Pages Oconee Nuclear Station Ask ef Aet HiAI alJle le acmieve safe ehlllde\tA\ after a teFAaEle i& ewffieieRlly &mall that additiORal pr.o&IGIIOA ~. AOI raquised.

IA aEIElitieA, there was considerable oor<<!$poodeAoo betweef:I Duke aAd NRC in the yeaFS pest TMI EliS0:1ssifl!} Oeooee's aeil~* to sl:A'we tomaEla gener-ateEI m~les. Based 1:1pen the preeability ef failijff! ef the EFW ar:ut Sta1ien Af>>.1systems oomhiAeEI *Mth the pete&ti8A against tomaEle miss~e5 afferEled by the SSF Af!}N system, the NRG OOAEkJded that the seOOAElafY side Eleeay heat t:emeval fuAMA oom,1lied i.*Ath tRe eriteAGfl ~ ~ r M E l e e s.

ystem Classlflcatlons Plant piping systems, or portions of systems, are classified according to their function in meeting design objectives. The systems are further segregated depending on the nature of the contained fluid. For those systems which normally contain radioactive fluids o, gases, the Nudear Power Piping Code, USAS 631 .7 and Power Piping Code USAS, 831 .1.0 are used to define material, fabrication, and inspection requirements.

Diagrams for each system are included in the FSAR sections where each system is described.

Fabrication and erection of piping, fittings, and valves are in accordance with the rules for lhejr respective dasses. Welds bel'Neen classes of systems (Class I to II, I to 111, or II to Ill) are performed and inspected in accordance with the rules for the higher class. This preceding sentence does not apply to valves where the cl.ass break has been determined to occur at the valve sea~ and to pipe with 1" nominal diameter and less.

In-tine instrument components such as turbine meters, flow nozzle assemblies, .and control valves, etc. are dassified with their associated piping unless their penetration area is equal to or less than that of a I inch i.d. pipe of appropriate schedule for the system design temperature and pressure, in which case they are placed in Class Ill. Definitions of the three classes are listed below:

.ctmJ This class is fimited to the Reactor Coolant System (RCS) and Reactor Coolant Branch lines, as described herein. The Reactor Coolant Branch lines indude connecting piping out to and including the first isolation valve. This section of piping is aass I in material, fabrication, erection, and supports and restraints. A Class I analysis of the piping to the first isolation valve has been completed for the following systems:

1. High Pressure Injection (Emergency Injection)

2. High Pressin Injection (Ncnnal Injection)

3. High Pressure Injection (Letdown)

4. Low Pressure Injection (Decay Heat Removal DrQJHine)

5. Low Pressure Injection (Core Flood)

6. Reactor Coolant Drain Lines

7. Pressurizer Spray

8. Pressurizer Relief Vatve Nozzles Modifications that affect the Reactor Coolant System and the aass I portion of the branch lines must demonstrate that the inpact on the Class I piping is acceptable. The impact may be assessed by ee,torming a Class I analysis or by other conservative techniques to assure aass I allowable limits are not exceeded. Isolation valves can be either stop, relief, ex check valves.

Piping 1 inch and less is excluded from Class I.

Class 11 3.2. s 2

UFSAR Marked-Up Pages UFSAR Section 32.2, 4. Tornado The Reactor Coolant System, by virtue of its location within the Reactor Building, will not be damaged by a tornado. Capability is provided to shutdown safely aD three units. Tomado is not considered a design basis event (DBE) or transient for Oconee. Protection against tornado is an Oconee design aiterion, similar to the criteria to protect against earthquakes, wind, snow, or other natural phenomena described in UFSAR Section 3.1 .2. A specific occurrence of these phenomena is not postulated.

The statement, *Capability is provided to shutdown safely an three units" was intended to be a qualitative assessment that, after a tornado, normal shutdown systems would remain available or alternate systems would be available to allow shutdown of the plant It was not intended to imply that specific systems should be tornado proof. As part of the original FSAR development, specific accident analyses were not performed lo prove this judgment, nor were they requested by the NRC. Subsequent probabilistic studies confirmed that the original qualitative assessments were correct. The risk of not being able to achieve safe shutdown after a tornado was sufficiently small that additional protection was not required.

In an effort to ensure the risk of not being able to achieve safe shutdown after a tornado is maintained sufficiently small, design aiteria are applied to the SSF through physical protection and TORMIS to establish its capability to mitigate a tornado. The overall tornado mitigation strategy utirizes the deterministicaDy tornado protected SSF for secondary side decay heat removal (SSDHR) and reactor coolant makeup (RCMU) following a postulated loss of all normal and emergency systems which usually provide these safety functions.

Successful mitigation of a tornado condition at Oconee is defined in UFSAR Section 9.6, SSF.

The SSF and its related equipment have been physically protected to meet tornado requirements or have been evaluated using TORMIS.

In addition to the SSF deterministic capability to mitigate a tornado, the inherent plant design of system redundancy, independence, and diversity is maintained for reasonable assurance that sufficient primary and secondary makeup is available following a tornado. Though all features of the inherent plant design are not tornado proof, their colective capabilities result in high availability and reflability to eruue that system functions are not reliant on any single feature of the design. As such, the high availabirlty and reliability provided by the inherent design of the plant which indudes redundancy, independence, and diversity ensures defense in depth is maintained if the SSF and related components become unavailable either prior to or during a tornado. The sources of secondary makeup include: 1) the Emergency Feedwater system including the capability to cross connect from another unit, 2) the PSW system, and 3) the SSF Af3W system capable of being powered by the SSF diesel. The sources of primary makeup include: 1) the SSF React>r Coolant Makeup Pump supplied from the Spent Fuel Pool and capable being powered from the SSF diesel and 2) A High Pressure Injection (HPI) pump supplied from the Borated Water Storage Tank. Note that in addition to their normal and emergency power sources, the *A* and *a* HPI pulll)S can be powered from the PSW switchgear.

The revised tornado mitigation strategies will be rnplemented when the SSF letdown fine, SSF control room QA-1 instrumentation upgrade, and SSF diesel fuel oil tank fiD/vent missile protection conforming modmcations are completed.

3

UFSAR Marked-Up Pages Ocon ee Nucl ear Station UFSAR Chapter 3 3.5.1.3 M issiles Generated by Natural Phenomena For an analysis of missiles aeated by a tornado having maximum wind speeds of 300 mph, two missiles are considered. One is a missile equivalent to a 12 foot long piece of wood 8 inches in diameter traveling end on at a speed of 250 mph. The second is a 2000 pound automobile with a minimt.m im pact area of 20 square feet traveting at a speed of 100 mph.

For the wood missile, calculations based on energy principle indicate that because the impact pressure exceeds the ultimate compressive strength of wood by a factor cl about fol.a", the wood

'WOUid aush due to impact. However, this could cause a secondary source of missiles if the impact force, is sufficiently large to cause spatting of the free Onside) faoe . The compressive shock wave which propagates inward from lhe impact area generates a tensile pulse, if it is large enough, will cause spalring of concrete as it moves back from the free [inside) surface.

This spalled piece moves off with some velocity due to energy trapped in the material.

Successive pieces will spall unlil a plane is reached where the tensile pufse becomes smaler than the tensile strenQ1h of concrete. From the effects of impact of the 8 inch diameter by 12 foot long wood missile, this plane in a conventionally reinforced concrete section would be located approximately 3 inches from the free (inside} surface. However, since the Reactor Building is prestressed, there will be residual compression in the free face, as the tensile pulse moves out and spalling wiB not ocrur. Calculations indicate that in 1he ill1)3Ct area a 2 inch or 3 inch deep crushing of conaete should be expected due to excessive bearing stress due to impact.

For the automobile missile, using the same methods as in the turbine taaure analysis, the calculated depth of penetration is Y. inch and for all practical purposes the effect of impact on the Reactor Building is negligible.

From the above, it can be seen that the tornado generated missiles neither penetrate the Reactor Building wall nor endanger the structural integrity of t!he Reactor Building or any components of the Reactor Coolant System.

Additional tornado missile requirements were subsequently imposed by NRC post-TMI on Emergency Feedwater Systems. ONS met these requirements based upon the probability of failure of the EFW and station ASW Systems combined with the protection against tornado missiles affoofed the SSF ASlv System. Subsequently, PSW replaced station A'sl'/ relative to this function. See UFSAR Sections 3.2.2 and 10.4.7.3.6 for additional information.

Revision 1 to Regulatory GuiCM 1.76, *DesiQn-Basis Tornado and Tom3do MiSS11es for Nuclear Power Plants." was released in March :1007. Revision 1 to Regulatory Guide 1.76 was

• * * * * *

• e O hedesi nofnew systems (and their associated components ani:1/or s s u t

• t loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Requtatay Guide 1.76, Revision 1 ~ !or be evaluated by TORMIS. I

~Add Insert 2 3.5.2 Barrier Design Proc.cturts The React<< Building and Engineered Safeguards Systems components are protected by barriers from all aedible missiles which might be generated from the primary system. Local yielding or erosion of barriers is permissible due to jet or missie impact provided there is no general failure.

The final design of missile barrier and eqtipment support structures inside the Reactor Building is reviewed to assure that they can withstand applicable presstn loads, jet forces, pipe (31 DEC 20Ul 3.5. 7 4

UFSAR Marked-Up Pages

35. J. 3.1 TOR MIS Mdhodalogy The TORMIS mdhmology provides an approach ID demmstrate adequate pro(ectlon fer exis.ing SSCa that were oriJinally iequired to be protected from tornado missiles in acc:ocda:nce wil:h the pt.ant deslp basis but that a.re not adequ1teJy pt'(Jleced due tosotre ovenlJhL The apptoved lftfmdology does nat allowTORMIS analysis to be used to teff110t&rlly er pemuently eliminate ex.hting banlers that a.re ttedited for pN:Nlding tormdo missile pocection.

The TORM IS acceptance criteria are based on the cumulative damage frequency of tormdo mlssi te damage co all safety-telated SSCa that a.re not pN:Nided pos ill~

protectim. Therefae. the impacts of al I non-conforming items are combined so that the tcul lrissile damage f~quency is evaluated apimt the acceptance criterion of 1 E-06 per year. If additional new non-amfornun, SSCa a.re identified In the future. TORMIS analysis may .b e uied to evalt:ate these specific platt features and cocmlne their d&l111.Je iffl*U with the itnputsof SSCa that were (ttYiously anal>-d uslcg lheTORMIS methodoklgy to deletmi~ if adequate protection is malruincd.

The TORM IS computer code ls used to determine the frequency of a damaging tornado missile sane on impratecttd p~ SSCa that are used to mil !gate a tornado. The TORMIS code ls an updlted venlm of the original TORMIS cale developed fer the Electric Powe,- Research lmtlt~e (EPRI), The methodalogies u2:d in the code to evaluate the freq.a.e ncy of darmging tornado rriuite llrikes a.re documented in References 9, 10. 11 and 12 The TOR.MIS code ICCQIJ:llts for the frequency and severity of tornadoes that could sttllie the plant site.performs u:rndynamic c:alcub.tlms to ptedict the tnnspoll of potential mssiles around the site, a.ad usesses the amual frequency of these missiles striking and damaging structures and other ta.igets of !merest.

The analys is requiies thedevdopmetll of input data in three !road areas:

1. de...e~~t of site tom.ado hazard information.

2. de¥eloprrr.nt of site mssilechancteristics.

l. de~pmmt o f target su.e. kx:aion. and ptysical prq,erties.

TORMIS Model Inputs The TatMIS methodology seeb ID demonstrate tha the amual pnibabil ity d a raoOICti~ release i n ~ of 10 CFR 100 resulting fllDm tornado nissile damage IO u..,raieaed SSCs used to mtigate a aomado is less lha.n the aa:epwice criterim of IE-06/tx-yr. This nans that lhe unprotected SSCa ,11e evalualed collect~y agahut the accepunce criaetioo rather than individually. For a multi-unit s ite such as Oconee. this criterim is applied to each lnit individll1lly.

Fer this evaluation, the prevention or a

• ielea.se in ~cess or 10 CFR 100" Is accotq,lished by e:ab&hing SSD conditloos following a ta11adostrike and malntainlng these conditlcm fer up to 72 ho1n. The followln& saf~ functions are required:

Seciondl.ty Side Decai Hat RelNW&I, Reactor Coalm Makeup.

Reactor Coal art Sistem pressure bound~ icu".

Throu&h a process of p~ wallidowns and reviews of platt drawittp, c.alcul:at ions, and other information. a deuOed Lia of llrllc:tures and equipment lack.in& deterministic prouction was developed that meets lhe scope of Che TORMIS safety targe.ts described abm,ie .

TORMIS Results A site specific analysis d vulnerable tomado milip.Llon equipment (SSCs) has been conduded usl_oa the TORMJS 1t1aJysls mcthoddcgy. This includes a eharac.termtion of the site tornado hanrd and potential tornado genetated missila developed in a mamer comilf.alt 'Mth the requlremetts of the TORMlS User's Manual and oehez TORMIS reference materials.

For each Oconee urut.. lhe mean annual frequen~ of a damapc tmmdD missile slrlh resultia& ina ndiolop:al release in excess of 10 Cf'R IOOl!mlcs was detennard IO be less lhan the aca:pcaace crileria d IE..06. The anal?sis was performed io a mamcr c:oosiscmc wil:h lhe requircazm of the EPRI taplcal ~poru and with the requiremr.ots ct fonh In the NRC's SER (Refett:nce 14) and RIS 2CO- J4 (Reference lj).

5

UFSAR Marked-Up Pages Attachment 2 Oconee Nuclear Station UFSAR Chapter 9 250*f with a long term strategy for reactivity, decay heat removal and inllefltorylpressure control.. Long-term subcooled natural circulation decay heat removal is provided by StJPPIYilO lake water to the steam oeneratOf'S and steamtno to atmosphere. Tbe extended C'Opino petlod at these conditions is based on the significant volume of water ava[lable for decay heat removal and feduced need for primary makeup to only match nominal system losses. A stuek rod IS not required to be postulated for this event Initial CX>nditions are 100% power with sufficient decay heat suc:h that natural ciR:utation can be achieved. The hypothesiZed fire is to be considered an

• evenr, and thus need not be postulated concurrent with non-flf8-f'elated fa res in safety systems, other plant accidents, or the most severe natural phenomena (Reference ll>-

Oeleted Paragraph(s) per 2015 update.

Deleted Paragraph(s) per 2012 update.

TURBINE BUILDING FLOOD EVENT Ttle Turbine BultdinQ Flood was one of the events that was iclenttned in the qnal SSF licensino requirements. The SSF is designed to maintain the reactor in a safe shutdoWn condition for a period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a TB Flood. No other conament ewnt is assumed to ocar. The success crneria for this event is to assure natural circulation and core cooling by mai1laining the primary coolant system filled to a sufficient level in the pressunzer while maillalntng sufficient secondary side cooling. The reactor sh be maintained at least 1% &I\

with the most reactive rod fully Withdrawn. (Reference 1. 10.)

SECURITY-RELATED EVEHT A Security Related Even! was one of the events that was identified in the oriOinal SSF licensing requrements. The SSF is deSigned to achieve and maintail a safe shUtdown condition for this event. No other concurrent event is ass001ed to occur. (Reference 1) The success criteria for this event is IO assure the core I not return to criticality, the active fuel wiD not be mcovered, and IOnO-tef'm natural circulatlon will not be halted. (Reference il)

)L-;..____;,_ _ _. . . . seismic quaification review of the Oconee EFW system in the 1980s, the NRC postulated that a seismic event could break a ~ and potentially cause a flood cl the turbine 9.6-3 6

UFSAR Marked-Up Pages Section 9.61, SSF Tornado Design Criteria: Insert 4 Successful mitijation of atornado condition at Oconee shanbe defined as meeting the following Clitelia to ensure that the integrity of the core and RCS remails unchaDenged:

• The core must remain intact and in a coolable core geome!Jy during the credited strategy period.

• Minimum Departure from Nucleate Bolling Ratio (ONBR) meets specified acceptable fuel design fimits.

• RCS must not exceed 2750 psig (110% of design).

In addition to the criteria specified above, the following Cliteria are vafidated for the overcooling analysis to demonstrate acceptable results:

• Steam Genera or tubes remain intact

• RCS remails within acceptable pressure and temperature imits.

me The tornado initial conditions are defined ror the lllit(s) as MODE 1, 102% rated lhennal power at end or core (690 effective full-power days). The tornado is assumed to leave one untt sionificanUy damaged .rid a loss or aD AC power to all three units.

Two bounding analyses were performed, overheating and overcooling. For an overheatilg even~ the significantly damaged 111it is suppfied by SSF ASW. The other two units will be initially supplied by the TDEFWP and subsequently supplied by SSF ASW. For an overcooling even~ the TDEFWP is conservatively assumed to run until the contents or the Upper Surge Tank are depleted (to maximize the overcooling). SSF ASW now is subsequently established to all three units as needed.

Following a tornado ilduced overcooling event the untt may experience aminor return to power of short duration. There are no consequences associated with the return to power due to the very low power level generated. The SSF is not required to meet the single failure criterion or the postulation of the most reactive rod stuck fuly withdrawn. Failures in the SSF system will not cause failures or inadvertent operations in other plant systems. The SSF requires manual activation and C31 be activated if emergency systems are not available.

7

I ** * *

. . . . *: UFSAR MarKE!d-Up-Pages

• ** : Attachment 2 ** * * *

. . . :0 ~ r,tuclear Station .. :.* UFSAR Chapter :(0 * . *

• such ttmt,it, w~ci be expecteq ~- ~~ the aesfQn *tmss ea~quake. The PIP.loo ,ro~ the hoJ,Welt:to theMQEFW~ Is ~smica!lyQU3:i!~~lc... ,. .. ... :. ..

. ::PortioilS of the Ef.W System are vulneratir~: to : t ~ lllissiles. ln.l.lS.. :the plant relies upoij: : :. .

• d.iver,;e. fl'.!$~ to pro\,tde fe~~tQ the s~ in.the ev...or atQr,,ado. *roose <.liV~ means***.*

inclu~~ thEf~F Af/N Systenl'~d the:~SW System. *:

.11\e. :Emergency. ~ t e r System** was .not.de$.;ln~ *to wilhstaod ttie eff~s *of. "internally

• • • generated missiles. *If -sueh an event were to occur and if main feedwater were unavailable. the*

ot

.single train SSF ASW System would provide an *anured means providing. h~ remov;11 from: *: *

. the :S_Gs. .f\. detaDea eval. . :or t,tie* capabititi, of 1t.l!!: ~xistirm EFW Sys,tenUo. WithsJand ..

missil~Hll:S_oot ~idered ~~(Refe,e_noe ~- .: : . : :: : .

... .. ..:Tile effects ct 'Hig~ .Eflergy Line *erealis h;We_ pe/m. atlatyied as 3'Jdte~ :m UFsAR Seclio11. *

.. *3..6 ..1.3. *. ***

• ProVislons for water hammer events. are *cons1ciered wmecessary *crue 10 the: use or: once T~~*~ Generators (O~HR~erence.B). *** ** * * * * * * * .. * *

... :P~~~ of *111e Eme19ency* F~r -~. are credited to m~ 1he Extensive Damage

.... a.ti0.11 Str.l~~ (Q.5;b) cornrt!itmenls, :Wfl!ctt* !lal(e ~ Jncoiw.rafe.d l11to the Oconeij::

clear.Station. operatirlg liceose.S~n H.; Mitigation~~ Licens&-Con~itioo. .

10,4i;1.1

• *: Delet~

~ .

P!H' 2002 Update 10.4.:1! 1~~ :*~

• Deleted Per 20~2 Update

10.4.1.1..J peie-.d Per2002 Update

• * ... : 10.4.7.1A Deleted Per 2002 Update 10.4.7,1..5.: *: Deleb!dP,r2002U~

10.,.1.t6 **. oeteted per 1996 ReVision

).!lo.4.7.1.7 Dei.d&>er.2002Update

... . 1$".4.7.1.8 Oel* Per 2002 Update

: . (~1 DEC 201.,_

• . :: .. l)fSAR Marked-.Up Pages *

Attachment 2. ::*: . *

• * *0conee

.. Nuclear Station  :* UFSAR c~apter 10 ..

• * * ***1.* requiring portions of the EfW System (defined in UFSAR Section~) to be capable of withstanding a Mt£ .and . . :. *.

i p~ding ;iltemative seismically quimfied means *of decay heat removal wlllttb1tSSF ASN .

• Syslerr! ~d the HPI System; .: *::: .

• • * : *10.4.7.3.6 EFW:R~poosefQllowingtornadoMissUes Refereoce I contiudes that the Standard RevjeW Plan probabilistic toteiioo is' met based upoh **

the *,:,tot,abifify of failure of the .EFW and sla:tion 'ASW :Systems coml)ined with the* protection

. . against tornado missiles. afford~. the SSF ASW System:* :subsequemly, PSW replaced $iation .

• • .*ASW refative to 1his.funcjon.

10.4;7.3.7

• j . EFW Response FolloVAng a SBO . .

This eyeri(is:similar to the ~FW with .LOOP analysis 'Nith the adaltional assunJPlk,ti ihatttle

.*onsite efTIE!l9ency AC pQWI!' sour~ have ~ f9$l Th~ l'e!jults in the loss-of the MDEFVVPs. ::

. : The TDEFWP should be. available for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> during this event becaUse. of its AC power: .

. jndepel!leru::e.. The:SSF *-ASW* System; however; is*aed'ited to i'eljlove'the*decay heat.in this.: .

event. The :seo, event, which is not* a design basis *event, is described ii) UFSAR ..Section 8.3.i:2.4: : .: .. ... . .. ... .. ...

• 10.4.7.3,IJ lllitiittiori of. SSF ASW. PSW;~mfHPI Fo~ Cooling: : ... . .

The S$F ASW System. fl.SW; arid HPI fon:ed cooling ~ as aftemate means ofdeci.iy. tif!at remo~ fo{ ~ome of the EFW.~n.~\/8rl1s described in:~O 1°"1.;7.3. . ::**.. : *. * ..

• * *Once the 0011trof room *decides to use the SSF A.S~l'system. the systenr can be aligned within *: ****. .

• 14 minutes, eoof3i!iitent l'!li1h the assumpti0ll$ Q1 ~ safety analyse$, Tue $$F ASW ffow rate *: . * *

• provided .to eadl unit's st~am generat<tected .Service Water (F>$W} system is designed_~ a standby s ~ for use. u~der; *...

emergency conditions. ThePSW System i s ~ rrom either .the Central Tie SwitchFd via a 100:1y maosmission line IQ' a 1001'3..8 I\V substatiQn

• the: l<eowee Hyd,oeleclric Station.

.*.The PSW System is PfQYided **an alternate means to achieve and maintain safe shutdown for *

one, two, or three ~nils.

... .. . . . .*. .. . ...

. . The PSW.  :~em is cai>able* of cooling each unit's RCS. to .appro>iima1ely 250°F and .. .

mairita,ining tms amdiiion f91'*~:extended ~riod. Fai~ in the PSW SystemjiJillriof~se

.. . ~lur~ or i ~ ol)m!.tipns iQ ~ ~nt $Y$JemS. The P5'N Syt.tem is operated~ ..

.. ****the Main. Control *Room$ (MCRs) vmen uisting diwrse emergE!JICY s ~ are not ayaifable... * *

• The power to PSVV:~ed pressurizer heateis must be manually aligne(loutside the MCR .***

Please notfdhat infonnatim... assoo=tteci with ~ the p.:-uozer heates :arid '...ttaf l&C balt.ety: cha,gers will not be effective m1til oompletion of Milestone 5, but is being included in the

. .UFSARfor~. * . . . . . . .. . . . .....

• *:1ffeedwater is unavailable*.operator action.is takai on high RCS pressure oi. pressurizer level to **

• iriitiate* HPI forced cooling.' These actions n from. the controf room and include starting HPI **

pumps;*~ the PORV*.anci* ~ HPI ffow. as~~- HPI fcrcedc:ool1119 is (riiliafed

. wUhin 5 minutes cf JJU:eeding the initiation criteria, The (iPI System is ~ in 8ection §J.

....oftheUFSAR ::. * *:** .  ::. * *:*.  : * ** * :*  :: ** *

... 10.4- 21 9:

ENCLOSURE1 RESPONSES TO REQUESTS FOR ADDITIONAL INFORMATION

[NON-PROPRIETARY]

Enclosure 1 Responses to Requests for Additional Information Enclosure 1 Responses to Requests for Additional Information [Non-Proprietary]

RA! 1 Regarding Section 3.8 of the application dated September 14, 2018 (i.e., the license amendment request (LAR)), the NRC staff requests the licensee to provide a discussion of the meaning of "Passive Civil Features" with respect to the Oconee licensing basis and Technical Specification operability.

RAI 1 Response:

Tornado is a design criterion that applies to structures, systems, and components (SSCs) credited in the Oconee Current Licensing Basis (CLB) for the mitigation of tornadoes. Similar to the treatment of other design criteria in the CLB, the operability/functionality process is entered when aspects of a particular design criterion are found deficient. Since there are no Technical Specifications applicable to tornado, functionality is assessed according to station procedures to determine if a non-conforming condition exists.

To control design features that are credited in the mitigation of tornadoes, Oconee maintains a passive design features control process. The process is described in Site Directive 3.2.16, "Control of Passive Design Features." The objective of this process is to maintain civil structures to protect important systems and components from both internal and external events described in the Updated Final Safety Analysis Report (UFSAR). The directive allows tornado protection barriers to be temporarily taken out of service to allow maintenance or changes to the facility.

However, the directive requires in those cases that compensatory actions be available should a tornado watch/warning be declared by the National Weather Service. The compensatory actions may take different forms including: (1) Having the means, such as tools, equipment, labor, etc. in place to restore the original barrier back to its design configuration; (2) Having the means to install a temporary barrier equivalent to the normal barrier. Also, the directive provides guidance that intentional breaches of tornado related barriers should be accomplished in periods of the year where there is a lower risk of a tornado impacting the site.

If a passive design feature is found to be out of service without Operation's approval, then Operations shall be contacted immediately. A Nuclear Condition Report must be initiated, operability/functionality assessed, and action taken to restore the design feature. Appropriate contingency actions must be established until the passive design feature is restored. The LAR credits the Standby Shutdown Facility (SSF) as the tornado mitigation system.

RAl2 Section 3.8 of the LAR states, "Because a tornado is a design criterion and does not constitute a design basis accident or transient as described in 10 CFR 50.36(c)(2)(ii), degradation of passive civil features protecting the SSF will not apply to operability under TS LCO 3.10.1,

'Standby Shutdown Facility."' The SSF satisfies criterion 4 of 10 CFR 50.36(c)(2)(ii), which is not related to design basis accidents or transients. Criterion 4 is for SSCs which operating experience or probabilistic risk assessment has shown to be significant to public health and safety. The NRC staff requests the licensee to provide a more substantial discussion and justification for why degradation of passive civil features protecting the SSF will not apply to operability under TS LCO 3.10.1, "Standby Shutdown Facility."

1

Enclosure 1 Responses to Requests for Additional Information RAI 2 Response:

0 TS Limiting conditions for operations (LCOs) are defined in 10 CFR 50.36(c)(2) as *** the lowest functional capability or performance levels of equipment required for safe operation of the

. facility." 10 CFR 50.36(c)(2)(ii) notes that "A technical specification limiting condition for operation of a nuclear reactor must be established for each item meeting one or more of the following criteria." Criterion 4 of 10 CFR 50.36(c)(2)(ii) states "A structure, system, or component which operating experience or probabilistic risk assessment has shown to be significant to public health and safety." The NRC Policy Statement associated with technical specification improvements (No.93-102, dated July 23, 1993) refers to "unique plant vulnerabilities" that a plant specific probabilistic safety assessment (PSA} has shown to be significant to public health and safety. Oconee agrees that the SSF meets criterion 4 for scenarios to which it was originally designed and licensed and not specifically to the mitigation of tornadoes or the maintenance of tornado passive design features associated with the SSF. The plant specific PSA shows that the importance of SSF is primarily associated with the mitigation of fire events and its vulnerabilities are associated with human reliability and equipment availability/reliability and not the maintenance of tornado passive design features.

Oconee maintains that tornado is not a design basis accident or transient. The SSF was originally licensed to mitigate fires postulated to occur in the TB, internal flooding in the TB due to failures of CCW, and security events. The facility met 10 CFR 50.36 criterion 4 based on the risk associated with these events, not tornado.

Oconee has recognized the importance of managing and maintaining passive design features in protecting the station from natural phenomena. To that end, a site administrative directive was created to manage the barriers to facilitate modifications to and maintenance of the station. The site directive (SD 3.2.16, "Control of Passive Design Features") is described in the response to RAl-1. The site directive requires that contingency actions be established prior to the intentional or planned breach of a given barrier associated with the SSF. This provides assurance that a given barrier can be quickly restored should deteriorating weather develop. It also requires entry into the operability process should a given barrier be discovered impaired. This provides assurance that should a given barrier be found deficient, functionality will be assessed, and corrective actions implemented in a timely manner to restore the barrier. Given the NRC-recognized low probability of a tornado impacting a particular nuclear station, the actions described above collectively assure that the SSF associated tornado passive design features will be in place and functioning should a tornado impact the site.

Oconee concludes that the potential degradation of SSF related tornado passive design features does not apply to the operability of the SSF as defined in TS 3.10.1 "Standby Shutdown Facility." This is due to the insignificant contribution of passive design features to the overall risk profile of the SSF, the NRC-recognized low probability of a tornado impacting a particular nuclear station, and the robust control and maintenance of tornado passive design features as described in the site directive.

RA13 The LAR does not include references to official calculations that document support for the assumptions made in the success criteria for the TORMIS Boolean logic. These references 2

Responses to Requests for Additional Information need to be provided on the docket to support the decision of the safety evaluation and to provide traceability, auditability, and inspectability.

A. The NRC staff requests the licensee to provide a reference (i.e., title(s), revision number(s),

and date(s)) for the official calculation (or calculations) that support the following statement from the LAR concerning the CCW surge lines (emphasis added]:

The surge piping targets are evaluated for crushing or crimping failure that would prevent adequate vent flow. An evaluation showed that only 44% of the flow area of only one of the 24 inch pipe (one of two for success) is required to provide an adequate vent path.

B. The NRC staff requests the licensee to provide a reference (i.e., title(s), revision number(s),

and date(s)) for the official calculation (or calculations) that support the following statement from the LAR concerning the Main Steam Relief Valves:

The assumed success criteria for the MSRVs for tornado mitigation is that one of two lowest pressure relief valves opens (either 1/2/3MS-8 on the 'A' Header or 1/2/3MS-16 on the 'B' Header), and that one relief valve (any one of eight) on the opposite header opens for overpressure protection.

RAI 3 Response:

3A The source of the statement described originates from OSC-8860 (Evaluation of Tornado Missile Damage Frequency for Oconee Unit 3), Revision 5, approved June 10, 2018. The evaluation performed to determine the minimum flow area of the surge line is contained within OSC-11622 (Oconee Tornado Strategy Utilizing the Standby Shutdown Facility (SSF)), Revision 2, approved October 30, 2018.

38 The source of the statement described originates from OSC-8860 (Evaluation of Tornado Missile Damage Frequency for Oconee Unit 3), Revision 5, approved June 1O, 2018; OSC-9307 (Evaluation of Tornado Missile Damage Frequency for Oconee Unit 1),

Revision 2, approved June 10, 2018; and OSC-9308 (Evaluation of Tornado Missile Damage Frequency for Oconee Unit 2), Revision 2, approved June 10, 2018.

The thermal hydraulic analysis within OSC-11638 (RCS Response to a Loss of Main Feedwater and 4160VAC Power with PSW or SSF Recovery (High Energy Line Break Analysis/ Tornado Analysis)), Revision 5, approved May 15, 2019 documents that the required initial SSF ASW flow rate to a unit from the most limiting of the main steam relief valve (MSRV) sensitivity cases performed is 408 gpm (refer to case 1f1). OSC-4171 (SSF ASW Design Inputs Calculation), Revision 37, approved April 30, 2018 documents that the available SSF ASW flow rate provided to a single unit is 711.9 gpm (refer to case 55.1) assuming the most limiting variation of the described TORM IS MSRV success criteria. As seen by a comparison of the analysis results, the available SSF ASW flow significantly exceeds the required SSF ASW flow from the thermal hydraulic analysis. The success criteria documented within OSC-8860, OSC-9307, and OSC-9308 related to the available MSRVs ensures that the assumptions of the thermal hydraulic analysis contained within OSC-11638 and the SSF ASW flow analysis contained within OSC-4171 are met.

3

Enclosure 1 Responses to Requests for Additional Information RA14 The application is crediting many conservatisms in the TORM IS modeling that offset the simplification and limitations of TORM IS computer code. One source of conservatism is the choice of worst case missiles (i.e., concrete block) to derive damage velocity values for the CCW surge lines. The application states:

The finite element analysis supporting the damage velocity values for the CCW surge lines for concrete block, wood plank, and metal siding missiles are based on missile impacts at the worst-case location and at the worst-case angle of incidence. This combination represents only a small fraction of the potential missile interactions and is very conservative for estimating the frequency of damage to the CCW surge lines.

According to OSC-11760, "FINITE ELEMENT ANALYSIS [FEA] OF ONS CCW SURGE PIPES," the concrete block missile is modeled with smooth particle hydrodynamics (SPH) as opposed to finite elements. However, the distance chosen between particles can affect the failure property of the aggregate structure hence the actual energy delivered to the target and the subsequent deformation. The NRC staff requests the licensee to explain the basis for how the particle distances are chosen and benchmarked.

RAI 4 Response:

The SPH particle spacing was selected based on prior experience conducting concrete missile impact analyses against other targets. In general, as a smaller particle size is used a more accurate answer is obtained and less damage is imparted to the target. This is because smaller particles allow the material to fracture into smaller pieces, with the potential to spread the applied impulse over larger areas. The best approach in general is to run analyses with varied particle spacing and demonstrate that the predicted damage (in this case crimping) has converged or to demonstrate that the spacing selected is conservative. This approach has been taken for other concrete missile geometries in previous analyses against other targets and this trend is seen. It was not taken here. But, based on these previous analyses, selection of smaller particles would likely result in equal or less crimping. Consideration was also taken for the specific concrete block geometry such that sufficient resolution (10 particles through the thickness of each wall of the concrete block) was used to resolve through-thickness and bending stresses.

RAIS:

The defined missile types in the current licensing basis, as defined in UFSAR Table 9-17, includes a utility pole, which is usually the most conservative in terms of damage. Section 5.3 of the LAR does state the dominant missile types striking safety targets are wood plank and metal siding types; however, the NRC staff notes that the wood plank may not bound a utility pole.

While the TORM IS analysis contains defined missile types of about 23 missiles, the FEA analysis for OSC-11760 includes site-specific missiles (i.e., concrete block and aluminum siding). The NRC staff requests the licensee to justify why the dominant missiles do not bound the utility pole and explain the justification for the missile set chosen for the FEA.

4 Responses to Requests for Additional Information RAI 5 Response:

The utility pole and other missile types similar to those defined in the UFSAR are conservatively modeled and are shown in the TORM IS missile simulations to have a very low contribution to the CCW surge line damage frequency.

The tornado missile parameters defined in the CLB are conservatively defined to ensure that plant physical barriers can withstand worst case tornado missile impacts to provide adequate protection of safety related SSCs. The impact frequency for missile types comparable in weight and velocity to these deterministic missiles is inherently very low because they are defined at the upper range of these parameters to create the highest potential for barrier damage. In contrast, the subject TORMIS targets are not designed to withstand deterministic missile strikes and are susceptible to damage from lower velocity and lighter weight missile types that are more aerodynamic and more likely to strike the targets.-Accordingly, the TORMIS missile types are chosen to represent the highest damage frequency potential rather than the highest potential physical damage.

For the analysis of the circulating cooling water (CCW) surge lines, a set of preliminary TORMIS simulations were made to collect data on missile hits on the surge lines. The data showed that the majority of hits came from wood planks, aluminum siding, and concrete blocks. These missile types were then evaluated using detailed analysis (FEA or SPH) to estimate the minimum impact velocity (VDAM) required to cause damage to the CCW surge lines. The final TORMIS analysis runs utilized the estimated VDAM values for the wood plank, aluminum siding, and concrete block and applied a conservative VDAM value of zero (hit=damage) for all other missile types including the utility pole.

RAI 6

The LAR requests *Approval for elimination of the Spent Fuel Pool (SFP) to High Pressure Injection (HPI) flow path for Reactor Coolant Makeup (RCMU)," which implies that the flow path will be physically removed. The technical justification for this change in Section 3.7, "Elimination of SFP Suction for HPI," of the Enclosure to the LAR, could also be read that the line is being physically removed as it is no longer necessary. However, in Section 4.3, "No Significant Hazards Consideration," of the Enclosure to the LAR, it states, "The spent fuel pool suction path to the HPI system currently described in UFSAR Section 3.2.2 is being deleted from the licensing basis. The existing piping configuration that connects the spent fuel pool suction path to the HPI system will remain but will no longer be credited." The NRC staff requests the licensee confirm that this request is specifically to eliminate the flow path from the tornado licensing basis and not to make any changes to the plant itself. If this is not the case, then the NRC staff requests the licensee provide information on when this flow path is currently used and if it is credited in any analysis.

RAI 6 Response:

Though it will not be credited in the tornado licensing basis nor in plant operating procedures, the existing piping configuration that connects the SFP suction path to the HPI system will remain in the plant for beyond design basis response.

RA17 Page 21 of the Enclosure to the LAR states that the tornado initial conditions are defined for the unit(s) as MODE 1, 102% rated thermal power at end of core life {690 effective full-power days).

5

Enclosure 1 Responses to Requests for Additional Information Given that this initial condition may not be bounding, the NRC staff requests the licensee to provide justification for assuming a single initial condition and no consideration of other initial conditions (i.e., low power/low decay heat) which could be more limiting for overcooling events.

RAI 7 Response:

The LAR described mitigation of a tornado assuming the units are at 100% power (the RCS thermal hydraulic analyses were performed assuming 102% power). As described in Section 3.1 of the SSF Thermal Margin LAR dated October 20, 2017, all SSF events are not subject to consideration for off nominal modes of operations. For SSF mitigated station blackout (SBO) events, initial reactor power assumptions are defined as 100% power and at least 100 days of operation at this power level (Regulatory Guide 1.155, Station Blackout, Section 3.2.1 ). A similar approach was used in the thermal hydraulic analysis of fire events, most recently NFPA 805, and historically Appendix R. Based on the low risk of off nominal modes of operations associated with the SSF usage during a Tornado, the SSF is being treated similarly to the initial conditions associated with SBO events (i.e. full power conditions) as described within 10 CFR 50.63.

As described within the SSF Thermal Margin LAR dated October 20, 2017, off nominal conditions represent those times in which the plant is not at 100% power for a minimum of approximately 4 days. These low power or low decay heat conditions were not deemed to result in an appreciable contribution to overall plant risk. A similar conclusion is reached for off nominal conditions for the SSF with respect to tornado mitigation. This is further supported by the NRR memorandum dated February 28, 2019 (Closeout of Low Safety Significant/Low Risk Concerns - Tornado-Generated Missile Protection), which stated that tornado missile scenarios that may lead to core damage are generally very low probability events.

RAI 8

Page 20 of the Enclosure to the LAR states, "The ONS RELAP5/MOD2-B&W model and analysis methods are described in Duke Energy's NRC approved methodology report DPC-NE-3003-PA (Reference 15) and have been modified, as described in Attachment 5, to include additional detail and features required to perform these analyses." On page 2 of the March 15, '1995 SE in Reference 15, it states, "RELAP5/MOD2-B&W has been reviewed by the NRC staff and is the subject of a safety evaluation (Ref.: Letter from A. Thadani to J. Taylor, dated April 18, 1990). The NRC staff found the code acceptable for use, subject to specified limitations, for calculation of transient response for reload analyses of large and small break LOCAs and operational transients for plants having recirculating steam generators. The NRG staff is currently evaluating its use, for those purposes, for once-through steam generator (OTSG) plants [emphasis added]."

Given that the approved methodology report is for use in the Oconee Updated Final Safety Analysis Report (UFSAR) Chapter 6 Loss of Coolant Accident (LOCA) mass and energy release analyses, the NRC staff requests the licensee to provide details on the approval of the RELAP5/MOD2-B&W code for use in analyzing overcooling (main steam line break) and overheating (loss of feedwater) transients: If the code has not been approved for use for these transients, provide justification for its use. In addition, the NRC staff requests the licensee describe any limitations and conditions as well as how they are met for use of the code for the selected transients.

6 Responses to Requests for Additional Information LAR Reference 15: Duke Energy Methodology Report DPC-NE-3003-PA, Revision 1, "Mass and Energy Release and Containment Response Methodology," dated September 2004 (Safety Evaluations dated March 15, 1995; September 24, 2003, ADAMS Accession No. ML050320034)

RAI 8 Response:

RELAP5/MOD2-B&W SER for non-LOCA analyses RELAP5/MOD2-B&W has been approved for non-LOCA analyses in the BAW-10193NP-A SER dated October 15, 1999 [Reference ML003682985]. This is a Framatome topical report for the B&W-designed nuclear steam supply system (NSSS). Based on the safety evaluation report (SER), RELAP5IMOD2-B&Wversion 19.0 is used in the BAW-10193 submittal.

The BAW-10193 topical report presents benchmarks of RELAP5/MOD2-B&W calculations to data from test facilities and plant transients, as well as comparisons to computer code predictions from CADDS and TRAP2, to demonstrate that RELAP5/MOD2..:B&W properly predicts the phenomena exhibited by Babcock and Wilcox (B&W) designed Pressurized Water Reactors (PWRs) during non-LOCA events. The benchmarks and comparisons include an overheating and an overcooling event.

BAW-10193 Section 5.2 provides a benchmark of Three Mile Island (TMl)-2 Loss of Feedwater (LOFW) Event. The benchmark of the TMl-2 LOFW event shows that RELAP5/MOD2-B&W is appropriate for analyzing overheating events on B&W-designed PWRs, as stated in Section 2.2.1 of the NRC Safety Evaluation for BAW-10193.

BAW-10193 Section 6.2 provides a code to code comparison of a main steam line break (MSLB) between RELAP5/MOD2-B&W and TRAP2. The RELAP5/MOD2-B&W and TRAP2 comparisons of the MSLB events demonstrate that, given conservative initial and boundary conditions, RELAP5/MOD2-B&W produces conservative results, similar to those predicted by TRAP2 as stated in Section 2.3.2 of the NRC Safety Evaluation for BAW-10193.

The Safety Evaluation does not provide limitations and restrictions for the use of the topical report, but Framatome included Appendix A in response to staff question #1. Appendix A describes the noding details to be used to model the NSSS for various accidents and lists the options for constitutive models and correlations.

Review of BAW-10193 Appendix A The discussion provided in BAW-10193 Section A.2 relates to the code options available in RELAP5/MOD2-B&W deal with interface drag inputs for the OTSG, and heat transfer correlation adjustments made to the nucleate boiling, critical heat flux (CHF) and post-CHF correlations.

These options are either not available in the code version used by Duke Energy or are not adjusted from the base coding values in the Oconee RELAP5 model.

The Duke Energy Oconee RELAP5 model is similar to the large detail model described in BAW-10193 Appendix A. The Oconee model has a similar number of steam generator (SG) secondary nodes, uses the same approach for the high elevation auxiliary feedwater (AFW) model, and has a finer nodalization in the reactor core and pressurizer.

Duke Proprietary Information

• Proprietary bracketing is consistent with DPC-NE-3003-PA 7

Responses to Requests for Additional Information

• Reactor core, SG secondary, and high elevation AFW model are based on DPC-NE-3003-PA

• Pressurizer and SG tube wetting percentage are based on the Oconee Tornado analyses BAW-10193 non-proprietary information obtained from ML003682985 BAW-10193 App A Oconee RELAP5 model large detail model Tornado analyses Reactor Core 3 nodes [ }a,c SG secondary 11 nodes [ ]a,c Pressurizer 11 nodes [ ]a,c High elevation AFW 2 radial regions [ ]a.c model SG tubes % wetted 10% [ ]a,c Comparison of RELAP5/MOD2-B&W code versions The Duke Energy methods described in DPC-NE-3003-PA were submitted on August 11, 1993, a couple of years before Framatome submitted BAW-10193, RELAP5/MOD2-B&Wfor Safety Analysis of B&W Designed PWRs. This time difference is the source of the DPC-NE-3003 Revision O SER text, which is highlighted in the first paragraph of RAI 8. At the time the DPC-NE-3003-PA Revision OSER was being written, the approved version of BAW-10164P-A addressed recirculating SGs.

• RELAP5/MOD2-B&W is described in BAW-10164P-A and approved for use with OTSGs in Revision 3. This code provides the basis for the B&W plant safety analysis capability described in BAW-10193.

Duke Energy methods use RELAP5/MOD2-B&W version 13.0 which roughly corresponds to BAW-10164 Revision 1. The topical revision record on page v of the BAW-10164 Revision 4

[ML030220134] provides a description of the changes included in the various revisions of BAW-10164. This information has been transcribed below for convenience. Based on the BAW-10193 SER (ML003682985), RELAP5/MOD2-B&Wversion 19.0 is used in the BAW-10193 Revision 0.

8 Responses to Requests for Additional Information BAW-10164 Description Program Documentation Version Revision 0 Original Issue 8.0 1 Typographical corrections 10.0 Replace CSO correlation with Condie-Bengston IV 2 SBLOCA modifications 18.0 Miscellaneous corrections 3 EM Pin Enhancements I 19.0 Filtered flows for hot channel heat transfer Rupture area enhancement for surface heat transfer OTSG improvements and benchmarks using the Becker CHF, Slug Drag, and Chen Void Ramp 4 Zirconium-based allow pin model changes 24.0 Option for multiple pin channels in a single core fluid channel Void-dependent core cross flow option Zirconium-based alloy rupture temperature The modifications made to RELAP5/MOD2-B&W in BAW-10164 Revisions 2, 3 and 4 are primarily to facilitate the LOCA peak cladding temperature (PCT) calculations required for BAW-10192 LOCA analyses. Revision 4 of BAW-10164 is referenced in the latest revision of DPC-NE-3003-PA as the basis for the RELAP5/MOD2-B&W code due to the information contained in the BAW-10164 Revision 4 SER on the applicability of RELAP5/MOD2-B&W to the B&W designed lowered loop plants. The BAW-10164 revision 4 topical report includes the Revision 3 SER and includes information on the benchmarks performed for the B&W plants.

The high elevation heat transfer model described in BAW-10164 is used in the Duke Energy's Oconee RELAPS model. The details of this model are provided starting on page 5-354 of BAW-10164 Revision 4 which can be found in ML030410278. Review and approval for usage of the high elevation heat transfer model is included in the DPC-NE-3003-PA methods.

BAW-10164 Limitations and Restrictions The limitations and restrictions from BAW-10164 Revisions 1 through 4 are provided below.

Following each limitation or restriction is a paragraph describing the applicability to the Duke Energy DPC-NE-3003-PA based methods used for the Oconee tornado analyses.

BAW-10164 Revision 1 The following limitations and restrictions are obtained from the BAW-10164 Revision 1 SER (ML030220205).

1. The Chen-Sundaram-Ozkaynak film-boiling correlation in the core heat transfer model and the B&W auxiliary feedwater model for OTSGs were not reviewed and, therefore, should not be used in licensing calculations without prior review and approval by the NRC. .

9 Responses to Requests for Additional Information Duke Energy applicability The core heat transfer model identified is not selected for use in the Duke methods. The B&W AFW model is part of the approved DPC-NE-3003-PA methods.

2. Prerupture cladding swell is not modeled because BWFC indicated that the swell is generally less than 20 percent with insignificant flow diversion effects. The acceptability of neglecting the effects of prerupture swelling is part of the LOCA EM review based on BWFC's analysis of the flow diversion effects. The SER on report BAW-10168P will address the resolution of this matter.

Duke Energy applicability The prerupture cladding swell option is not used.

3. The built-in kinetics data for decay heat calculations in the RELAP5/MOD2-B&W code are based on the 1973 and 1979 standards of the American Nuclear Society (ANS).

Because Appendix K requires the use of a value that is 1.2 times the 1971 ANS standard for decay heat calculation, BWFC should ensure that the decay heat used in licensing LOCA analysis complies with Appendix K.

Duke Energy applicability The Oconee tornado analyses use input designed to replicate ANS-79 based decay heat loads. The Duke Energy Oconee applications are not required to comply with Appendix K.

4. The LOCA assessments of the Extended Henry-Fauske and Moody critical flow models were based on the use of the static properties as input to the critical flow tables. The LOCA licensing calculations should be performed accordingly.

Duke Energy applicability The Extended Henry-Fauske and Moody critical flow models are not used.

5. The interphase drag model of the RELAP5/MOD2-B&W code tends to overpredict interphase drag. This overprediction may cause nonconservative predictions of loop seal clearing phenomena in that liquid is cleared even when the steam flow is not sufficiently high to drag the-liquid out of the loop seal. Therefore, this model may not accurately calculate the core uncovery and the PCT. A resolution requiring a sensitivity study to choose a proper loop seal nodalization that results in the highest PCT calculation will be addressed in the LOCA EM review.

Duke Energy applicability The Duke Energy applications are not used for determining PCT. The loop seal clearing phenomena described in the limitation is applicable to recirculating SG plants. The internal reactor vessel vent valves in the B&W plant eliminate this phenomena during LOCAs.

6. Even though noncondensible gases are not modeled in the small break LOCA (SBLOCA) system analysis, BWFC demonstrated negligible effect that all sources of noncondensible gases will have on the overall response of the system for the range of SBLOCAs. However, BWFC noted that a 50 psi increase above the steam generator 10

Enclosure 1 Responses to Requests for Additional Information control pressure of 1150 psia could result from a worst case release of noncondensible gases. The staff believes that this pressure increase generally would not substantially reduce the injection capabilities of the charging and safety injection (SI) systems.

However, because the performance characteristics of the SI pumps vary widely in the plants, verification should be made on a plant-specific basis to ensure that a 50 psi pressure increase will not greatly reduce SI flow such that the PCT would increase by more than 500°F. Otherwise, additional information should be provided to justify neglect of noncondensible gases, or the effect of the pressure increase caused by noncondensible gases should be included in the analysis.

Duke Energy applicability The Duke Energy applications are not used for determining PCT, and noncondensible gases are not modeled. The concern identified in the limitation is not present in the Oconee tornado analyses.

7. For a complete safety analysis, an approved core thermal hydraulic code and CHF correlation should be used with the RELAP5/MOD2-B&W code. The noding details and inputs should be justified on a plant-specific basis. The choice of constitutive models including the empirical models and correlations should be justified to ensure their use is within the ranges of applicability.

Duke Energy applicability The Duke Energy methods use an approved core thermal hydraulic code and CHF correlation to evaluate the core thermal response using transient results from the RELAP5/MOD2-B&W code.

A departure from nucleate boiling ratio (DNBR) evaluation is performed for the overcooling analysis using VIPRE and the EPRI and Modified Barnett CHF correlations.

The VIPRE methodology used is described in the Duke Energy NRC approved methodology report DPC-NE-3000-PA. The EPRI CHF correlation is used to identify the limiting critical heat flux and DNBR statepoints. The Modified Barnett CHF correlation is then used to evaluate the limiting statepoints identified with the EPRI correlation and the peak heat flux statepoint. The Modified Barnett correlation is the current licensed correlation used for low pressure (steam line break) events for Oconee and B-HTP fuel.

Reference for DPC-NE-3000-PA Duke Energy Methodology Report DPC-NE-3000-PA, Oconee Nuclear Station, McGuire Nuclear Station, Catawba Nuclear Station, Thermal-Hydraulic Transient Analysis Methodology, Revision 5. (Safety Evaluations for Oconee Nuclear Station dated August 8, 1994 (Accession Number ML16293A840); October 14, 1998 (Accession Number 9810190223); September 24, 2003 (Accession Number ML032670816); October 29, 2008 (Accession Number ML082800408); and July 21, 2011 (Accession Number ML11137A150)).

BAW-10164 Revision 2 and Revision 3 The following limitations and restrictions are obtained from the BAW-10164 Revision 2 and 3 SER (ML030410278). Note the code version used for the Duke Energy calculations does not include all of the options included in this version of BAW-10164. ,,,.

11

Enclosure 1 Responses to Requests for Additional Information Modifications made to RELAP5/MOD2-B&W as described in Revisions 2 and 3 of BAW-10164P have been reviewed and evaluated. Based on the benchmarks presented, the staff finds that the models described in version 19 of RELAP5/MOD2-B&W to be acceptable for LOCA and non-LOCA analysis for PWRs with recirculating and OTSGs subject to the following limitations:

1. Use of the Wallis and UPTF parameters at the tube bundle and steam generator plenum inlet are acceptable. The parameters used in the CCFL model for any other application must be validated, and the validation reviewed and approved by the staff for that application (see section 3.1.3 of this evaluation).

Duke Energy applicability These options are not used. The CCFL model input addressed by this limitation is not available in the code version used by Duke Energy.

2. The BWUMV correlation is limited to pressures above 1300 psia.

Duke Energy applicability The BWUMV correlation option is not used.

3. For large break LOCA emergency core cooling system (ECCS) evaluation model

. calculations, form losses due to ruptured cladding should not be excluded using the user option described in Section 3.2.4 of this evaluation.

Duke Energy applicability The cladding rupture options are not used.

4. The value of the user specified parameters listed in Table 1 of this evaluation (i.e.

those used for the benchmark calculations) are the only acceptable values for LOCA licensing calculations.

Duke Energy applicability A review of the parameters appearing in Table 1 shown on pages 5-392 to 5-394 indicates these options are not used. In addition, the Duke Energy methods are not used for LOCA licensing calculations to determine fuel cladding PCT.

BAW-10164 Revision 4 The following limitations and restrictions are obtained from the BAW-10164 Revision 4 SER (ML030220258). Note the code version used for the Duke Energy calculations does not include the options included in this version of BAW-10164. The text referring to Secti.on 2 below, is

• copied from the BAW-10164 Revision 4 SER.

I Based on reviews discussed in Section 2, the staff finds the following Framatome proposed methodology changes (BAW-10164P, Revision 4) acceptable within the stated terms and limitations:

1. A change that will model the hot channel modeling to treat the hot pin and the hot assembly as two heat structures for large break LOCA (LBLOCA) evaluations* of RSG and OTSG plants.

12 Responses to Requests for Additional Information Duke Energy applicability The Duke Energy methods do not include hot channel modeling and are not used for LOCA licensing calculations to determine fuel cladding PCT.

2. A change to the initial fuel stored energy uncertainty that will apply a lower uncertainty in the initial fuel stored energy, derived from TAC03, to the hot assembly and core average heat structures for LBLOCA evaluations of RSG and OTSG plants.

Duke Energy applicability The Duke Energy methods use an initial core average fuel temperature selected based on the transient objectives. For the overcooling analysis, the predominant concern is the potential for a return to criticality. A high initial fuel temperature is assumed to maximize the Doppler feedback during the transient. For the overheating analysis, a high initial fuel temperature is assumed to maximize the initial stored energy in the core.

The limitation is intended to ensure appropriate inputs are selected for the initial fuel stored energy for analyses that determine fuel cladding PCT. The Duke Energy methods are not used for LBLOCA licensing calculations to determine fuel cladding PCT.

3. A change to automate the void dependent crossflow model and to interpolate the inter-channel void-dependent cross-flow for SBLOCA evaluations for OTSG plants.

Duke Energy applicability The Duke Energy methods do not include the void dependent crossflow model and are not used for SBLOCA licensing calculations to determine fuel cladding PCT.

4. Automation of the core heat BEACH blockage limitation that will automate the flow blockage limit in BEACH, used for LBLOCA and SBLOCA analyses of RSG and OTSG plants.

Duke Energy applicability The Duke Energy methods do not include hot channel modeling and are not used for LOCA licensing calculations to determine fuel cladding PCT.

For reasons discussed in Section 2, in its review of future changes to the LBLOCA and SBLOCA methodologies beyond the context discussed in this safety evaluation, the staff will closely examine the impacts of the proposed changes with respect to the TAC03 stored energy model, the hot channel modeling changes, and the cross-flow model discussed in this safety evaluation.

Duke Energy applicability The Duke Energy methods are not used for LOCA licensing calculations to determine fuel cladding PCT.

Review of Overcooling Transient Phenomena The following is a review of the major phenomena in the Oconee tornado overcooling transients.

The initiating event is a loss of the secondary system pressure boundary that leads to an RCS temperature and pressure decrease, pressurizer level decreases, and a reactor trip. The 13

Enclosure 1 Responses to Requests for Additional Information Reactor Coolant Pumps (RCPs) are either tripped by a loss of power or by the operator in accordance with procedural guidance, causing a flow coastdown. Liquid flashing in the condensate and feedwater piping occurs. Sustained two-phase conditions develop in the RCS.

RCS makeup flow refills the RCS and restores pressurizer level. Steam line relief valves must be modeled and high elevation heat transfer occurs in the SGs as the heat sink is restored.

With the exception of the initial increase in SG heat transfer due to decreasing SG pressure, each of these phenomena are present in the large and small break LOCA analyses using the approved methods described in DPC-NE-3003-PA.

• Initial increase in SG heat transfer due to decreasing SG pressure. In the tornado analyses the initial overcooling is due to the available SG heat removal exceeding the core decay heat load. The main feedwater pumps are assumed to trip, liquid flashing in the condensate/feedwater piping is aided by extended turbine driven emergency feedwater (EFW) flow to provide the sustained heat removal capability.

• Reactivity feedback due to RCS temperature decrease. The LOCA analyses include moderator density feedback that will account for temperature changes as well as voiding. Reactivity feedback due to density changes is modeled for the tornado analyses. The overcooling analyses use a significantly more negative moderator temperature coefficient than that assumed in the LOCA analysis to maximize the reactivity feedback.

• Pressurizer level decreases offscale low, then recovers. ECCS restores pressurizer level for the smaller SBLOCAs. The pressurizer level increase is a function of the RELAPS state equations and the mass and energy balance for the event.

• Reactor trip and turbine trip. Both are modeled in the SBLOCA analyses.

• RCP coastdown. LOCAs model RCP coastdown on either loss of power or by operator action on the loss of subcooled margin.

• High elevation SG heat transfer. At Oconee, main feedwater auto-swaps from the main nozzles to the upper nozzles on RCP trip. All other feedwater sources, such as EFW, SSF ASW, PSW, or Flex equipment, are aligned to the upper nozzles. Thus, when the heat sink is restored, the high elevation heat transfer model is used.

The overcooling transient phenomena are well within the capabilities of the RELAP5/MOD2-B&W code. The overcooling transient benchmark results provided in BAW-10193 demonstrate the code capability, and the acceptability is provided by the NRC approval of BAW-10193 and BAW-10164 for performing non-LOCA analyses for the B&W-designed NSSS.

Review of Overheating Transient Phenomena The following is a review of the major phenomena in the Oconee tornado overheating transients. The initiating event is a loss of SG heat transfer that leads to an RCS temperature and pressure increase, pressurizer level increase, and a reactor trip. The RCPs are either tripped by a loss of power or by the operator causing a flow coastdown. Pressurizer and steam line relief valves must be modeled, and high elevation heat transfer occurs in the SG(s) as the heat sink is restored.

In general overheating transients are not as challenging from a code simulation perspective, with the potential for sustained two-phase conditions resulting in the selection of RELAPS for the 14

Enclosure 1 Responses to Requests for Additional Information Oconee tornado analyses. With the exception of the RCS pressure and temperature increase, resulting in a pressurizer level increase, each of these phenomena are present in the large and small break LOCA analyses using the approved methods described in DPC-NE-3003-PA.

• Loss of SG heat transfer due to loss of feedwater flow. In a larger break LOCA heat transfer is initially lost due to the depressurization of the RCS and limiting the ability to release steam in the SG secondary. Feedwater flow is also terminated at the beginning of the LOCA transient. The heat transferred from the RCS to the SG steam environment is modeled in a portion of the SBLOCA analyses.

• RCS pressure/temperature increase and Pressurizer level swell. The RCS temperature increase is the result of a mismatch in heat transfer between the core in the steam generator. The ability to transfer heat from the core is established in the LOCA analyses. The RCS pressure and Pressurizer level increase are functions of the RELAP5 state equations and the mass and energy balance for the event.

• Reactor trip and turbine trip. Both are modeled in the SBLOCA analyses.

• RCP coastdown. LOCAs model RCP coastdown on either loss of power or by operator action on the loss of subcooled margin.

• High elevation SG heat transfer. At Oconee, main feedwater auto-swaps from the main nozzles to the upper nozzles on RCP trip. All other feedwater sources, EFW, SSF ASW, PSW, or Flex equipment, are aligned to the upper nozzles. Thus, when the heat sink is restored, the high elevation heat transfer model is used.

The overheating transient phenomena are well within the capabilities of the RELAP5/MOD2-B&W code. The overheating transient benchmark results provided in BAW-10193 demonstrate the code capability, and the acceptability is provided by the NRC approval of BAW-10193 and BAW-10164 for performing non-LOCA analyses for the B&W-designed NSSS.

RAl9 Page 17 of the Enclosure to the LAR describes revisions to the SSF Tornado Design Criteria in UFSAR, Section 9.6.2, and lists the following five criteria to ensure that the integrity of the core and RCS remains unchallenged:

• The core must remain intact and in a coolable core geometry during the credited strategy period.

• RCS must not exceed 2750 psig (110% of design).

• Minimum Departure from Nucleate Boiling Ratio (DNBR) meets specified acceptable fuel design limits.

• Steam Generator tubes remain intact.

• RCS remains within acceptable pressure and temperature limits.

Page 21 of the Enclosure to the LAR states, "In addition to the criteria specified above, the following criteria are validated for the overcooling analysis to demonstrate acceptable results:

• The steam generator tubes remain intact.

• RCS remains within acceptable pressure and temperature limits."

The above implies that these last two criteria are examined only for the overcooling analysis and not the overheating analysis. The NRC staff requests the licensee clarify whether the last two criteria are validated for the overheating analysis. If they are not, then the NRC staff requests the licensee to also justify why it used different criteria between the two analyses (overheating 15

Enclosure 1 Responses to Requests for Additional Information and overcooling) and why this distinction is not made clear in the proposed revisions to the UFSAR section.

RAI 9 Response:

The acceptance criteria identified in LAR Section 2.6 for UFSAR Section 9.6.2 description on page 17 of the LAR is not consistent with the content of LAR Section 3.2 and will be revised.

See Attachment 2 for revised markup.

The overcooling analysis includes two acceptance criteria not applicable to the overheating analysis. The difference in the acceptance criteria provided in LAR Section 3.2 does reflect the criteria used in the respective analyses, as described in LAR Attachment 7, Section 2.0. The LAR Section 2.6 description of changes for UFSAR Section 9.6.2 has been modified to reflect the LAR Section 3.2 description of the acceptance criteria.

The two additional criteria validated in the overcooling analysis recognize the thermal stress induced on the RCS and SG materials during the transient evolution. These criteria ensure the thermal stress induced on the RCS materials during the transient evolution does not challenge the integrity of the RCS pressure boundary. The first criteria is required by the OTSG design.

The second criteria is validated to ensure the transient response remains within analyzed limits.

During the initial stages of an overcooling event, the SG tubes become cooler than the surrounding SG shell. Because the upper and lower tubesheets are constrained at the edge by the SG shell, a tensile load develops due to the decreasing temperature in the SG tubes relative to the SG shell temperature. Later in the recovery phase of the. event a compressive load can develop if the SG tube temperatures increase due to RCS temperatures returning to a normal zero power condition with a depressurized SG secondary allowing the SG shell temperature to decrease. This compressive stress develops as the SG shell cools by steam cooling and ambient heat losses through the insulation.

The Oconee replacement OTSGs have a compressive tube stress analytical limit with a limiting tube-to-shell temperature difference of +343°F (defined by the RCS at 555°F and the SG shell at 212°F), and a tensile tube stress analytical limit with a limiting tube-to-shell temperature difference of -375°F (defined by the large break LOCA tube stress analysis). The overcooling analyses demonstrate adequate margin to these values.

The generic pressurized thermal shock guidance for the B&W designed lowf!red loop design currently requires the operator to stabilize the plant and perform a one hour "soak" to allow thermal gradients to normalize. This guidance was developed by the vendor considering normal plant equipment is available. The intent of this guidance is incorporated into the tornado MSLB analyses.

For overheating events with an intact SG secondary, such as the limiting feedwater line break (FWLB) cases evaluated for the tornado LAR, RCS and SG tube temperatures tend to remain within normal bounds. Validating the thermal stress limits is not required for these events.

For overheating events with an intact SG secondary such as the limiting FWLB cases evaluated for the tornado LAR, RCS and SG tube temperatures do increase but not sufficiently to approach the compressive temperature limit. Similarly, the tensile limits are not approached for an event where RCS temperatures are increasing.

16 Responses to Requests for Additional Information Consider a scenario where the SG shell temperature is controlled by the saturated steam temperature, and RCS temperatures limited by saturated liquid temperatures at the pressurizer safety valve lift setpoint. Assuming a SG saturation temperature of 550°F, RCS temperatures would need to approach 890°F before a compressive tube load issue was present or decrease to 175°F to reach the tensile tube load. These conditions are well outside of the expected response for a tornado-induced overheating event.

Therefore, the thermal stress related criteria are not used for overheating transients.

RAl10 Chapter 9.6.1 of the Oconee UFSAR states that the SSF is designed to:

1. Maintain a minimum water level above the reactor core, with an intact Reactor Coolant System, and maintain Reactor Coolant Pump Seal cooling.

2. Assure natural circulation and core cooling by maintaining the primary coolant system filled to a sufficient level in the pressurizer while maintaining sufficient secondary side cooling water.

3. Transfer decay heat from the fuel to an ultimate heat sink.

4. Maintain the reactor 1% shutdown with the most reactive rod stuck fully withdrawn, after all normal sources of RCS makeup have become unavailable, by providing makeup via the Reactor Coolant Makeup Pump System which always supplies makeup of a sufficient boron concentration.

• The above criteria are different than the acceptance criteria given on Page 17 of the Enclosure to the LAR. The NRC staff requests the licensee clarify whether the current UFSAR SSF criteria are applicable and met by the existing analysis. If the current criteria are not applicable to tornado events, then the NRC staff requests the licensee to also justify why these criteria are no longer needed.

RAI 1O Response:

The criteria described in UFSAR 9.6.1 are specific to the SSF for fire and TB flood and are not applicable to the SSF for tornado. As described within UFSAR 9.6.2, the SSF was not originally licensed to mitigate a tornado. The SSF ASW system was later identified after Three Mile Island as an alternative for EFW tornado missile protection vulnerabilities. UFSAR 9.6.2 documents that this licensing action did not specify a tornado missile event or define a tornado missile mitigation strategy. Using a probabilistic approach, it solely focused on ensuring that a secondary side heat removal path is adequately designed to withstand the effects of tornado missiles.

As part of the SSF licensing history, the acceptance criteria for the SSF have varied based on the event or scenario. The varying acceptance criteria for the events and scenarios associated with the SSF are detailed within UFSAR 9.6.2. As part of this licensing action, the tornado acceptance criteria for the SSF was modeled after the SBO success criteria. As described within UFSAR 9.6.2 for SBO, "The success criteria is to maintain the core covered ... "

Specific to the analyses performed for tornado, the acceptance criteria are:

• Verify the core remains intact and in a coolable core geometry and verify minimum DNBR limits ensures sufficient core coverage.

17

Enclosure 1 Responses to Requests for Additional Information

• Verify that the peak allowable RCS pressure is not exceeded; the steam generators remain intact; and the RCS remains within acceptable pressure and temperature limits ensures the capability to establish long term core cooling, thereby maintaining core coverage.

The individual system specific design parameters for the SSF subsystems (seal injection, decay heat removal, pressurizer level control, etc.) were not detailed in the acceptance criteria as the bounds of their limits and operation may vary based on the overcooling or overheating scenarios evaluated. The results from the various safety analyses demonstrate the SSF systems and operator guidance can be used to successfully mitigate a Tornado by maintaining core cooling and coverage.

RAI 11

Page 6 of Attachment 6 to the LAR states, "The steam line ADVs [Atmospheric Dump Valves]

(or other steam flow paths) are included in the overcooling analysis for examining long term recovery actions for single MSLB cases, and are not credited in the mitigation phase of the analysis."

Previously (in 2008) one of the licensee commitments was to protect the ADVs from tornado, but the commitment was withdrawn. LAR reference No. 41 (i.e., Letter to the U.S. Nuclear Regulatory Commission from Thomas D. Ray, Vice President, Oconee Nuclear Station, Duke Energy Carolinas, LLC, "Revision to Tornado/HELB Mitigation Strategies and Regulatory Commitments," dated November 15, 2017" (ML17333A120)) clarifies the Duke Energy decision to not install MSIVs nor tornado protect the ADVs. In addition, the ADVs are not included in the TORM IS analysis to justify probabilistically. The NRC staff requests the licensee to justify use of the ADVs in the analysis given they are not protected from tornado or considered in the TORMIS analysis.

RAI 11 Response:

The statement in Attachment 6 to the LAR was intended to mean that even though the ADVs are included in the TORMIS model, they were not used or needed in the analysis to demonstrate that the unit could be placed and maintained in a safe shutdown (SSD) condition from the SSF following a single MSLB.

RAI 12

Page 4 of Attachment 7 to the LAR states that the goal of the operator guidance assumed in the analysis is to stabilize the plant by maintaining RCS temperature between 325°F - 350°F and pressure between 650 psig - 700 psig. The NRC staff requests the licensee to confirm if this can be accomplished without the use of the ADVs, as they are unprotected and may be damaged in the tornado (see RAl-11 above). If these conditions cannot be met without use of the ADVs, then the NRC staff requests the licensee to also explain how the RCS would respond, what conditions would be achieved, and how the acceptance criteria are still met.

RAI 12 Response:

Page 4 of Attachment 7 is referring to an overcooling scenario. For overcooling, the plant can be stabilized without the use of ADVs. In addition, the ADVs are not required for any other tornado scenarios.

18

Enclosure 1 Responses to Requests for Additional Information

RAI 13

The licensee's LAR summary describes the future use of TORM IS. The licensee notes that modifications are being performed under 10 CFR 50.59 and that their approval is not a part of this LAR. The licensee credits some plant modifications to be physically protected or evaluated in the TORMIS model. The licensee appears to have proposed allowing the option to evaluate the future plant modifications in the TORMIS model. However, the TORM IS methodology is only to be used on existing plant structures' and components' nonconformances. RIS 2008-14 states, "TORMIS acceptance criteria are based on the cumulative effects of tornado missile damage to all safety-related SSCs that are not provided positive protection. Therefore, when using TORMIS to address any additional tornado missile vulnerabilities that are identified in the future, the analysis should include those SSCs that were previously analyzed."

The TORM IS safety evaluation report (SER) (i.e., Letter* from L. S. Rubenstein (U. S. NRC) to F. J. Miraglis (U. S. NRC), "Safety Evaluation Report- Electric Power Research Institute (EPRI)

Topical Reports Concerning Tornado Missile Probabilistic Risk Assessment (PRA)

Methodology," dated October 26, 1983, ADAMS Accession No. ML080870291) stated that the use of TORMIS should be limited to the evaluation of specific plant features where additional costly tornado missile protective barriers or alternative systems are under consideration.

Therefore, to evaluate whether the use of TORMIS will be consistent with the position that was stated in the TORMIS SER, the NRC staff requests the licensee to:

(1) confirm that TORMIS will not be used to temporarily or permanently eliminate existing barriers that are credited for providing tornado missile protection, (2) confirm that the use of TORMIS will be limited to demonstrating adequate protection for existing SSCs that were originally required to be protected from tornado missiles in accordance with the plant design basis due to some oversight, are not adequately protected, (3) describe how the cumulative effects of newly found non-conforming SSCs will be incorporated into TORMIS, and (4) provide draft updates to the UFSAR based on these responses.

RAI 13 Response:

From the viewpoint of the new deterministic SSF mitigation pathway including the associated enhancement modifications, the TORMIS methodology is used to evaluate nonconformances of the tornado missile protection for the SSF and related structures and components. TORMIS is not and will not be used to temporarily or permanently eliminate existing barriers that are credited for providing tornado missile protection.

Physical Tornado missile protection is provided for SSF components within the SSF structure and containment structure. The TORMIS analysis addresses areas of the Cask Decontamination Tank Room (CDTR) and West Penetration Room (WPR) where some of the existing SSF components are located. The cabling for the enhancement modifications will be within the same target area as the existing SSF cabling. Therefore, the TORMIS analysis for the CDTR and WPR will similarly apply to the cabling of the enhancement modifications that routes through these same areas. TORMIS will not be used for future modifications beyond this LAR.

For non-conforming SSCs identified, TORMIS analysis may be used to evaluate the specific plant features where additional costly tornado missile protective barriers or alternative systems 19 Responses to Requests for Additional Information are under consideration. However, the impact of any new tornado missile vulnerabilities will be considered in combination with the impact of other SSCs that were previously analyzed using the TORM IS methodology. This approach ensures that the cumulative impact of tornado missile damage to all unprotected SSCs is evaluated against the TORMIS acceptance criteria consistent with the approved methodology.

The following paragraphs are added to the beginning of Section 3.5.1 ~3.1 of the proposed UFSAR changes to clarify the application of the TORMIS methodology for Oconee Nuclear Station. See Attachment 2 for markups.

The TORMIS methodology provides an approach to demonstrate adequate protection for existing SSCs that were originally required to be protected from tornado missiles in accordance with the plant design basis but that are not adequately protected due to some oversight. The approved methodology does not allow TORMIS analysis to be used to temporarily or permanently eliminate existing barriers that are credited for providing tornado missile protection.

The TORMIS acceptance criteria are based on the cumulative damage frequency of tornado missile damage to all safety-related SSCs that are not provided positive protection. Therefore, the impacts of all non-conforming items are combined so that the total missile damage frequency is evaluated against the acceptance criterion of 1E-06 per year. If additional non-conforming SSCs are identified in the future, TORMIS analysis may be used to evaluate these specific plant features and combine their damage impacts with the impacts of SSCs that were previously analyzed using the TORM IS methodology to determine if adequate protection is maintained.

RAI 14

In the NRC staffs TORMIS SER dated October 26, 1983 (ADAMS Accession No. ML080870281), Section Ill, "Conclusion," states, "Further, use of the EPRI PRAs or any tornado missile probabilistic study should be limited to the evaluation of specific plant features where additional costly tornado missile protective barriers or alternative systems are under consideration." RIS 2008-14 identifies issues raised by NRC staff during reviews of TORMIS applications, including that licensees did not fully address the fifth point identified in the SER nor explain how the methodology was implemented when the parameters used differed from those specified in the TORMIS methodology (e.g., inappropriately limiting the number of targets modeled).

• In its application, the licensee provided a list of the revised tornado licensing basis and committed modifications, which include:

1. LAR Item 2.5.1 references Commitment 18T identified in the Tornado/HELB Commitment letter submitted to the NRC on November 15, 2017.

2. LAR Item 2.5.2 references commitment 19T previously identified in the Tornado/HELB

• Commitment letter submitted to the NRC on November 15, 2017

3. LAR Item 2.5.4 indicates to provide missile protection for the outdoor SSF diesel fuel oil tank fill and vent lines to prevent shear/perforation of the piping and subsequent rain water intrusion into the underground tank.

4. LAR Item 2.5.5 and 2.5.6 indicates to credit new pulsation dampener and letdown line.

5. LAR Item 2.5.7 references new QA-1 instrumentation to provide.

20 Responses to Requests for Additional Information Other commitments or noted changes discussed in the application include:

6. Various instrumentation is credited for tornado damage stabilization (Section 3.2 table),

but LAR Attachment 1 commitments are not yet installed. The Table located in Section 3.2 of LAR contains a note stating, "Note this will be upgraded or newly installed instrumentation." *

7. In response to RIS 2008-14 documented in LAR Attachment 4, Section 8.3, Item 3.c, "proposing plant modifications," the licensee clarified that TORMIS is not being used as a justification to modify plant features to reduce, eliminate, or otherwise engineer the design of existing*or new tornado missile protection features. However, the licensee indicated that additional modifications will be implemented that could impact the TORM IS analysis and results further when it stated, "Duke is enhancing the SSF capabilities through modifications implemented by 10 CFR 50.59. The routing of those modifications has been or will be included in the TORM IS evaluation as required."

8. RIS 2008-14 provides a discussion for including limiting the number of targets modeled, as indicated in Attachment 1, "Regulatory Commitments" of the LAR. The licensee proposed to provide missile protection for the outdoor SSF diesel fuel oil tank fill and vent lines to prevent shear/perforation of the piping and subsequent rain water intrusion into the underground tank. The licensee has proposed to complete this within 3 years after issuance of the SER. Therefore, the tank and main tank capacity will remain unprotected until the commitment is completed.

While these proposed modifications are presented as commitments in the LAR, the NRC staff requests the licensee to clarify whether and how these commitments are credited or may impact TORMIS results for the NRC staff to decide whether to escalate the commitments to requirements (e.g., new license conditions). Additionally, the NRC staff requests the licensee to discuss whether and how any of these unprotected components will be required or credited for a plant shutdown.

RAI 14 Response:

Each of the commitments are detailed below with respect to how they are credited or may impact TORM IS results, as well as whether and how any of these unprotected components will be required or credited for a plant shutdown.

1. LAR Item 2.5.1 is associated with the revision and clarification of the UFSAR, including incorporation of the TORM IS methodology, as provided in the LAR. The subject item represents implementation of the revised licensing basis upon receipt of the NRC safety evaluation. As such, the activity is not deemed to impact the TORMIS results nor will it introduce any additional credited components for a plant shutdown beyond those already presented within the LAR.

2. LAR Item 2.5.2 is associated with the revision and clarification of TS Bases relative to passive civil features as provided in the LAR. The subject item represents implementation of the revised licensing basis upon receipt of the NRC safety evaluation.

As such, the activity is not deemed to impact the TORM IS results nor will it introduce any additional credited components for a plant shutdown beyond those already presented within the LAR.

3. LAR Item 2.5.4 represents a modification to provide missile protection for the outdoor SSF diesel fuel oil tank fill and vent lines to prevent shear/perforation of the piping and 21 Responses to Requests for Additional Information subsequent rain water intrusion into the underground tank. The TORMIS analysis was performed from the perspective that the modifications for deterministic protection of these components were completed. Therefore, *the frequency of tornado missile impact to the diesel fuel oil tank fill and vent lines were not included in the TORMIS analysis.

Inclusion of these components without physical protection would be expected to increase the frequency of tornado missile impacts within the TORM IS results.

The proposed SSF deterministic mitigation strategy credits operation of the SSF diesel as a power source. Preventing shearing or perforation of the piping that connects to the SSF diesel fuel tank was the chosen method for assuring the diesel fuel source is not adversely affected by the introduction of potential rain water.

The modifications to the SSF diesel fuel oil tank fill and vent lines are to be performed under 10 CFR 50.59 to conform to the new licensing basis as described in the LAR. The new licensing strategy will become effective as the enhancement modifications are completed.

Until the enhancement modifications are completed, the existing Tornado licensing basis will be maintained during the implementation period. Oconee remains in compliance with its existing Tornado licensing basis of redundancy, diversity and separation as defined in UFSAR Chapter 3 to fulfill:

• Secondary Side Decay Heat Removal (SSDHR).

• RCMU.

• Reactor Coolant System Pressure Boundary Integrity.

Oconee has redundant systems normally available for SSDHR which are EFW, SSF ASW, and the PSW system which is an enhanced replacement for the original Station ASW system. The RCMU function can be provided either by SSF RCMU or by the HPI system. Both systems can provide RCP Seal Cooling while providing RCS makeup.

4. LAR Item 2.5.5 represents a modification to provide a new pulsation dampener on each unit's SSF RCMU system. The addition of new pulsation dampeners has been completed on all three units. The new pulsation dampeners are located within containment and are deterministically protected from the effects of tornado missiles.

Therefore, their inclusion is not required within the TORMIS analysis and the TORMIS results are not impacted. The proposed SSF deterministic mitigation strategy credits the new SSF RCMU pulsation dampener to accommodate operation of the SSF RCMU system at lower range RCS pressures, which could potentially occur with a loss of the secondary side pressure boundary.

LAR Item 2.5.6 represents a modification to replace the SSF letdown line on each unit's SSF RCMU system. Prior to the modification, the existing SSF letdown line valve cabling is unprotected. The new SSF letdown line valve cabling will also be unprotected but routed within the footprint of analyzed missile strikes associated with the unprotected portions of the SSF pathway detailed in the TORMIS analyses. The TORM IS conclusions are provided in the LAR. Therefore, although inclusion of the unprotected portions of the new SSF letdown line valve cabling is required within the TORMIS analyses, the TORMIS results are not impacted by the planned modifications. The proposed SSF deterministic mitigation strategy credits the new SSF letdown line to 22 Responses to Requests for Additional Information accommodate operation of the SSF RCMU system at lower range RCS pressures, which could potentially occur with a loss of the secondary side pressure boundary.

The modifications for the new SSF letdown lines are to be performed under 10 CFR 50.59 to the existing licensing basis. Following receipt of the SER, the new SSF letdown line is to be credited as described in the LAR.

As previously described above for Item 3 (LAR Item 2.5.4), until the enhancement modifications are completed, the existing Tornado licensing basis will be maintained during the implementation period. Oconee remains in compliance with its existing Tornado licensing basis of redundancy, diversity and separation as defined in UFSAR Chapter 3.

5. LAR Item 2.5.7 represents a modification to provide new QA-1 instrumentation in the SSF CR for SG pressure, nuclear instrumentation, core exit thermocouples, pressurizer temperature, and temperature compensated pressurizer level. The portions of the new SSF instrumentation which are unprotected are routed within the footprint of analyzed missile strikes associated with the unprotected portions of the SSF pathway detailed within the TORMIS analyses and represented by the TORMIS conclusions provided in the LAR. Therefore, although inclusion of the unprotected portions of the new SSF instrumentation is required within the TORMIS analyses, the TORMIS results are not impacted by the planned modifications. The proposed SSF deterministic mitigation strategy credits the new SSF instrumentation to provide similar instrumentation in the SSF as is provided in the Main Control Room for operation with a potential loss of the secondary side pressure boundary.

The modifications for the new SSF instrumentation are to be performed under 10 CFR 50.59 to conform to the new licensing basis as described in the LAR. The new licensing strategy will become effective on a staggered per unit basis as the enhancement modifications are completed.

As previously described above for Item 3 (LAR Item 2.5.4), until the enhancement modifications are completed, the existing Tornado licensing basis will be maintained during the implementation period. Oconee remains in compliance with its existing Tornado licensing basis of redundancy, diversity and separation as defined in UFSAR Chapter 3.

6. Section 3.2 of the LAR is related to the new SSF instrumentation described in LAR Item 2.5.7. The requested information for LAR Item 2.5.7 is provided within Item 5 above.

7. The statement included in Attachment 4 of the LAR which reads "The routing of those modifications has been or will be included in the TORM IS evaluation as required," is clarified to state "The routing of the unprotected portions of the SSF components associated with the new SSF tornado mitigation strategy has been included in the TORMIS evaluation described within this LAR."

8. The modifications to provide protection for the outdoor SSF diesel fuel oil tank fill and vent lines to prevent/perforation of the piping and subsequent rain water intrusion into the underground tank are described in LAR Item 2.5.4. The requested information for LAR Item 2.5.4 is provided within Item 3 above.

23 Responses to Requests for Additional Information Note that the following information is added to UFSAR section 3.2.2 to describe the conforming modifications:

The revised tornado mitigation strategies will be implemented when the SSF letdown line, SSF control room QA-1 instrumentation upgrade, and SSF diesel fuel oil tank fill/vent missile protection conforming modifications are completed.

RAI 15

UFSAR Section 3.2.2, "Tornado," clearly requires ability to shut down all three units in the event of a tornado. The UFSAR states that the Reactor Coolant System will not be damaged by a tornado, a loss of Reactor Coolant Pump (RCP) seal integrity was not postulated as part of the tornado design basis, and capability is provided to shutdown safely all three units. The UFSAR further states, "Capability is provided to shutdown safely all three units," which was intended to be supported by a qualitative assessment that, after a tornado, normal shutdown systems will remain available, or alternate systems will be available to allow shutdown of the plant.

In its application, the licensee requests approval for crediting the SSF as the assured mitigation path following a tornado with the assumed initial conditions of loss of all Alternating Current (AC) power to-all units with significant tornado damage to one unit.

A. The NRC staff requests the licensee to define "significant damage" and to clarify whether a damaged unit includes failure of all unprotected components on an affected unit, or a single worst case/bounding failure of exposed components on a damaged unit.

8. The NRC staff requests the licensee to describe any failure from a tornado event that might impact safe shutdown of all units. If one exists, the NRC staff requests the licensee to describe how it is analyzed.

C. The current licensing basis provides the option to credit other undamaged units for secondary makeup. The NRC staff requests the licensee to discuss whether any function or feature of the undamaged units would be credited to assist the degraded state of damaged unit for tornado mitigation recovery.

D. The NRC staff requests the licensee to discuss whether any systems shared between units are modeled in TORMIS and how an impact on multiple units is accounted for in TORMIS.

RAI 15 Response:

1SA For the significantly damaged unit, significant tornado damage includes failure of all unprotected components directly associated with that unit that are not either physically protected or evaluated within the TORM IS methodology described within the LAR.

158 With the assumed initial conditions of loss of all AC power to all units with significant tornado damage to one unit, there are no failures from a tornado that might impact SSD of all three units.

15C While significant damage is only assumed to a single unit, all units are assumed to be impacted by the tornado. A station blackout is assumed for all three units. In response to the station blackout, secondary makeup would be required for all three units. The SSF ASW system is credited to provide secondary makeup to the significantly damaged unit.

The rnargins associated with the SSF ASW de.cay heat removal to the significantly 24

Enclosure 1 Responses to Requests for Additional Information damaged unit are discussed within the response to RAI 3. The turbine driven EFW pump is assumed available for the initial secondary makeup to the units experiencing a blackout (i.e. non-significantly damaged units). Based on UFSAR 3.2.2, redundant and diverse sources of secondary makeup water include the EFW system, the other unit's EFW system, and the PSW system.

Beyond the shared systems, no function or feature of the undamaged units are credited to assist the degraded state of the significantly damaged unit for tornado mitigation.

Treatment of the shared systems between the units are discussed below.

150 The unprotected portions of shared systems and features are modeled within TORMIS.

The missile damage frequency for unprotected shared features are counted against each applicable unit. For example, the shared SSF ASW System takes suction from the large embedded CCW pipes. Although it is unlikely for tornado effects to impact a vent path to the embedded pipes that lead back to the CCW intake, the Unit 2 CCW surge lines were credited as providing the vent path for the SSF ASW system suction. The tornado missile damage frequen*cy was calculated for the Unit 2 CCW surge lines but was applied beyond Unit 2. Given that the SSF ASW system was credited for any unit that may have experienced significant damage, the tornado missile damage frequency result for the Unit 2 CCW surge line was included as part of the total missile damage frequency result for Unit 1, Unit 2, and Unit 3.

RAl16 The existing licensing basis defined-in the UFSAR for tornado mitigation following a tornado provides redundancy, independence, and diversity with reliance on the combined capabilities of the tornado-protected station ASW system, EFW from the unaffected units, and the SSF ASW system. However, the proposed tornado mitigating strategy includes reliance on the use of SSF ASW alone, which degrades the level of defense-in-depth and subsequently increases risk.

Additional risk results from the TSs allowing the SSF to be inoperable for 45 days.

The defense-in-depth philosophy has traditionally been applied in plant design and operation to provide multiple means to accomplish safety functions. System redundancy, independence, and diversity result in high availability and reliability of the function and also help ensure that system functions are not reliant on any single feature of the design. In the event of tornado, damage (ie. fallen trees, blocked access roads, etc ... ) could occur at the site resulting in limited ability for movement throughout the site. By relying only on a manually-operated SSF ASW system as the assured means of providing SSHR following a tornado, redundancy and diversity are lost. Eliminating the redundancy and diversity of the SSHR capability and RCMU makeup path provided under the existing licensing basis for tornado mitigation eliminates defenses-in-depth and increases risk related to achieving safe shutdown (SSD) following a damaging tornado. While the combination of physical protection and use of TORMIS to justify SSF meets the criteria for a fully protected system, additional information is needed to demonstrate that the planned use of the SSF alone is enough to overcome the loss of redundancy and diversity that would result from the proposed change.

The NRC staff requests the licensee to:

A. Discuss actions to retain tornado mitigation capability during the SSF 45-day inoperable periods of maintenance.

25 Responses to Requests for Additional Information B. Discuss whether SSF is the only credited method to mitigate a tornado and shutdown all units. Discuss other protected systems or methods available to mitigate impacts of tornado.

C. Describe how defense-in-depth is maintained in the event of the SSF and related components being unavailable.

D. Describe post-72-hour actions and the long-term strategy.

RAI 16 Response:

16A and 16C The existing licensing basis defined in the UFSAR for tornado mitigation following a tornado provides redundancy, independence, and diversity. It is recognized that the system redundancy, independence, and diversity result in high availability and reliability of the function and also help ensure that system functions are not reliant on any single feature of the design. With the exception of crediting the SFP suction path to the HPI system, there are no changes proposed to eliminate the redundancy, independence, and diversity of the existing SSDHR capability and RCMU paths. Furthermore, there are no changes proposed to eliminate the tornado design criteria applied to the various systems, structures, or components as described in the UFSAR. As such, the high availability and reliability provided by the inherent design of the plant which includes redundancy, independence, and diversity ensures defense in depth is maintained if the SSF and related components become unavailable either prior to (i.e. SSF 45-day inoperable periods of maintenance) or during a tornado.

One of the redundant, diverse paths for makeup to the RCS is the BWST flowpath to the suction of the HPI pumps. The BWST has since been modified to withstand tornado missiles defined in UFSAR Section 3.8.4 (Table 3-23), such that the SFP is not expected to be needed as a redundant or diverse suction path for the HPI pumps. FLEX equipment is also available as a viable beyond design basis event mitigation option.

168 A new mitigation strategy is being defined for Oconee that is deterministic. Although diverse means of primary makeup, secondary decay heat removal, and electrical power may remain available during a tornado, only one protected deterministic strategy will be credited within the plant licensing. The SSF is credited for establishing and maintaining SSDHR and RCMU up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a damaging tornado. Currently, the CLB is a combination of probabilistic, diversity, and defense-in-depth strategies addressing the capability to provide SSD of the ONS units. The establishment of a tornado deterministic path provides clarity with respect to the licensing basis. In addition, the high availability and reliability which is provided by the inherent design of the plant which includes redundancy, independence, and diversity is not changed. Furthermore, there are no changes proposed to eliminate the tornado design criteria applied to the various systems, structures, or components as described in the UFSAR. The sources of secondary makeup include: 1) the Emergency Feedwater system including the capability to cross connect from another unit, 2) the PSW system, and 3) the SSF ASW system capable of being powered by the SSF diesel. The sources of primary makeup include: 1) the SSF Reactor Coolant Makeup Pump supplied from the Spent Fuel Pool and capable being powered from the SSF diesel and 2) An HPI pump supplied from the Borated 26 Responses to Requests for Additional Information Water Storage Tank. FLEX equipment is also available as a viable beyond design basis event mitigation option.

16D The SSF is designed to maintain a SSD condition for a period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a fire or turbine building flood, and for a period of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following an SBO. Consistent with other SSF scenarios, the tornado mitigation strategy credits the SSF for establishing and maintaining SSD up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a tornado. The existing licensing basis defined in the UFSAR for tornado mitigation following a tornado provides redundancy, independence, and diversity. The systems which provide inherent plant redundancy, independence, and diversity include such capabilities as long-term decay heat removal, reactor coolant makeup, and plant cooldown. With the exception of the SFP suction path to the HPI system, there are no changes proposed to eliminate the redundancy, independence, and diversity of the existing SSDHR capability and RCMU makeup paths.

There are also no changes proposed to eliminate the tornado design criteria applied to the various systems, structures, or components as described in the UFSAR.

Redundancy, independence, and diversity of the plant provide means of long term response for tornado mitigation.

The proposed changes to the UFSAR have been revised as follows to provide clarification based on the responses to RAI 16:

• Add the following paragraph to UFSAR Section 3.2.2 at the end of Insert 1:

"In addition to the SSF deterministic capability to mitigate a tornado, the inherent plant design of system redundancy, independence, and diversity is maintained for reasonable assurance that sufficient primary and secondary makeup is available following a tornado. Though all features of the inherent plant design are not tornado proof, their collective capabilities result in high availability and reliability to ensure that system functions are not reliant on any single feature of the design. As such, the high availability and reliability provided by the inherent design of the plant which includes redundancy, independence, and diversity ensures defense in depth is maintained if the SSF and related components become unavailable either prior to or during a tornado. The sources of secondary makeup include: 1) the Emergency Feedwater system including the capability to cross connect from another unit, 2) the PSW system, and 3) the SSF ASW system capable of being powered by the SSF diesel. The sources of primary makeup include: 1) the SSF Reactor Coolant Makeup Pump supplied from the Spent Fuel Pool and capable being powered from the SSF diesel and 2) A High Pressure Injection (HPI) pump supplied from the Borated Water Storage Tank. Note that in addition to their normal and emergency power sources, the "A" and "B" HPI pumps can be powered from the PSW switchgear."

• Eliminate the addition to UFSAR 9. 6.2 section "EFW Tornado Missile Design Criteria".

• Eliminate the revision to UFSAR 10.4.7.1.

• Eliminate the revision to UFSAR 10.4.7.3.6.

RAI 17

Section Ill, "Conclusion," of the NRC staffs SER dated October 26, 1983, ADAMS Accession No. ML080870291), appoving the TORMIS methodology states:" ... Further, use of the EPRI PRAs or any tornado missile probabilistic study should be limited to the evaluation of specific plant features where additional costly tornado missile protective barriers or alternative systems 27

Enclosure 1 Responses to Requests for Additional Information are under consideration." As discussed in RIS 2008-14, the NRC staff noted that licensees did not fully address the fifth point identified in the SER nor explain how the methodology was implemented when the parameters used differed from those specified in the TORMIS methodology.

Section 3.1, "RCS T-H Analysis," of the LAR states, "The Main Feedwater and Main Steam piping located outside containment are not protected from tornado missiles. Therefore, these piping systems may or may not remain intact following a tornado strike."

Section 5.2 "Determination of Safety Targets," of Attachment 4 of the LAR references the following components that are "Unprotected SSCs that if damaged could fail the SSF Mitigation Strategy":

• Main Steam Relief Valves (MSRVs) - damage preventing adequate steam relief for SSDHR,

• Main Steam header in EPR - damage causing pipe rupture affecting SSF equipment in WPR, and

• Main Feedwater headers in EPA - damage causing pipe rupture affecting SSF equipment in WPR.

The NRC staff requests the licensee to discuss whether the complete portion of the exposed components on the main steam and feedwater systems' referenced in Section 3.1 are included and analyzed in the TORMIS analysis.

RAI 17 Response:

The portions of main steam and feedwater piping located inside the East Penetration Room (EPR) are included in TORM IS models for each respective unit. A tornado induced rupture of main steam or main feedwater piping inside the EPR is postulated to fail the barrier separating the EPR and WPR potentially exposing SSF equipment for that unit to adverse environmental conditions. Damage to the portions of main steam and main feedwater piping outside the EPRs will dissipate the energy to either the turbine building or the outside environment and is not postulated to cause damage to the West Penetration Room barrier or pose an adverse environmental condition to SSF.equipment located there. Therefore, the portions of main steam and main feedwater piping outside the EPRs are not included in the Oconee TORMIS model.

Additional Requested Information Please note that section 2.6, pages 17 and 18 of the Tornado LAR dated September 14, 2018 have the revised UFSAR description for UFSAR Section 9.6.2. Some information was inadvertently omitted and some has been deleted with the response to RAI 9 above.

The information in UFSAR Section 9.6.2 (page 17, section 2.6 of the LAR Enclosure) should match the information contained in the red marked UFSAR section in Attachment 2 and should read as follows: ,

"The tornado initial conditions are defined for the unit(s) as MODE 1, 102% rated thermal power at end of core life (690 effective full-power days). The tornado is assumed to leave one unit significantly damaged and a loss of all AC power to all three units. Two bounding analyses were performed .....

28 Responses to Requests for Additional Information Following a tornado induced overcooling event the unit may experience a minor return to power of short duration. There are no consequences associated with the return to power due to the very low power level generated. The SSF is not required to meet the single failure criterion or the postulation of the most reactive rod stuck fully withdrawn .... "

In section 2.6, page 19 of the Tornado LAR dated September 14, 2018, it was proposed that UFSAR section 9.7.1 be revised to add the following information from UFSAR Section 3.2.2:

"An external source of cooling water is not immediately required due to the large quantities of water stored underground in the intake and discharge CCW piping. The stored volume of water in the intake and discharge lines below elevation 791 ft would provide sufficient cooling water for all three units for at least 30 days after trip of the three reactors."

This statement will not be relocated as part of the Tornado LAR package. It will be left in UFSAR section 3.2.2. The revised section is provided in Attachment 2.

29