RA-18-0026, Proposed Amendment to the Renewed Facility Operating Licenses Regarding Revisions to the Updated Final Safety Analysis Report Sections Associated with the Oconee Tornado Licensing Basis

Proposed Amendment to the Renewed Facility Operating Licenses Regarding Revisions to the Updated Final Safety Analysis Report Sections Associated with the Oconee Tornado Licensing Basis

ML18264A018
Person / Time
Site:	Oconee
Issue date:	09/14/2018
From:	Burchfield J Duke Energy Carolinas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
LAR-2018-02, RA-18-0026
Download: ML18264A018 (165)

Text

e/_~DUKE

~ ENERGY RA-18-0026 September 14, 2018 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission 11555 Rockville Pike Rockville, Maryland 20852

Subject:

Duke Energy Carolinas, LLC 10 CFR 50.90 Oconee Nuclear Station (ONS), Units 1, 2, and 3 Docket Numbers 50-269, 50-270, and 50-287 J. Ed Burchfield, Jr.

Vice President Oconee Nuclear Station Duke Energy ON01VP / 7800 Rochester Hwy Seneca, SC 29672 o: 864.873.3478

f. 864.873.4208 Ed.Burchfield@duke-energy.com Renewed Facility Operating License Nos. bPR-38, DPR-47, and DPR-55

References:

Proposed Amendment to the Renewed Facility Operating Licenses Regarding Revisions to the Updated Final Safety Analysis Report Sections Associated with the Oconee Tornado Licensing Basis License Amendment Request No. 2018-02

1. Letter to the U. S. Nuclear Regulatory Commission from Dave Baxter, Vice President, Oconee Nuclear Station, Duke Energy Carolinas, LLC, "License Amendment Request to Revise Portions of the Updated Final Safety Analysis Report Related to the Tornado Licensing Basis," dated June 26, 2008.

2. Letter to the U. S. Nuclear Regulatory Commission from Thomas Ray, Vice President, Oconee Nuclear Station, Duke Energy Carolinas, LLC, "Revision to Tornado/HELB Mitigation Strategies and Regulatory Commitments," dated November 15, 2017.

Pursuant to 1 O CFR 50.90, Duke Energy Carolinas, LLC (Duke Energy) proposes to amend Renewed Facility Operating Licenses Nos. DPR-38, DPR-47, and DPR-55 for Oconee Nuclear Station (ONS) Units 1, 2, and 3. The License Amendment Request (LAR) proposes to revise the ONS Updated Final Safety Analysis Report (UFSAR) regarding the tornado licensing basis (LB).

Specifically, the LAR requests the following:

Approval for crediting the Standby Shutdown Facility (SSF) as the assured mitigation path following a tornado with the assumed initial conditions of loss of all Alternating Current (AC) power to-all units with significant tornado damage to one unit.

Approval for formal incorporation of the use of tornado missile probabilistic methodology (TORMIS) in the ONS tornado LB and associated UFSAR changes.

Approval for elimination of the Spent Fuel Pool (SFP) to High Pressure Injection (HPI) flow path for Reactor Coolant Makeup (RCMU).

The LAR also proposes to credit a number of plant modifications to enhance ONS capability to withstand the effects of a damaging tornado. Implementation of the proposed tornado LB and the related commitments will clarify and, in some cases, revise the ONS current LB to collectively enhance ONS overall design and safety margin. Note that the modifications are being performed under 10 CFR 50.59 and their approval is not a part of this LAR even though of this letter contains proprietary information. Withhold from Public Disclosure Under 10 CFR 2.390.

Upon removal of Attachment 5, this letter is uncontrolled.

U. S. Nuclear Regulatory Commission September 14, 2018 Page2 they are discussed. Equipment installed by these modifications will be physically protected or evaluated in the TORMIS model noted above.

The specific actions proposed in this LAR have been selected based upon a thorough assessment of operational, design and safety benefits, as well as regulatory considerations.

Tornado is not considered a design basis event (DBE) or transient for ONS. Protection against tornado is a design criterion, similar to the criteria to protect against earthquake, wind, snow, or other natural phenomena. However, as described in the attached LAR, additional analysis has been performed to show that safe shutdown (SSD) can be achieved following a tornado that impacts the station. The Thermal-Hydraulic (T-H) analysis evaluated the condition of the primary system following a tornado relative to the operation of the SSF with a compromised Main Steam or compromised feedwater pressure boundary due to potential breaks in the respective systems.

Methodology and results of the analyses are discussed in Attachments 5 and 7 respectively.

The enclosure provides background information related to NRC approval of the original tornado LB and SSF design, a description of proposed plant improvements, the proposed changes to the UFSAR, and a technical evaluation that justifies the proposed UFSAR changes. A regulatory evaluation (including the No Significant Hazards Consideration) and environmental considerations are provided in Sections 4 and 5 of the Enclosure. Attachment 1 contains the list of regulatory commitments made as a result of this LAR. Attachments 2 and 3 contain the marked-up and retyped UFSAR pages, respectively. Attachment 4 is a summary of how the TORMIS methodology was applied to ONS. Attachment 5 describes the T-H codes and models used to perform analysis of SSF mitigated tornado scenarios in support of this LAR. Within, proprietary information is identified by brackets. In accordance with 1 O CFR 2.390, Duke Energy requests that this information be withheld from public disclosure. contains the non-proprietary (redacted) version of this content. Attachment 7 describes the SSF T-H analysis. Attachments 8 and 9 contain Affidavits attesting to the proprietary nature of the information in Attachment 5. The proprietary information is owned by Duke Energy and Framatome and is annotated as such. The annotated information has substantial commercial value that provides a competitive advantage. Note that Attachments 4 through 7 have their own list of references. No changes to Technical Specifications are proposed.

This LAR supersedes the previous LAR dated June 26, 2008 (Reference 1) and its associated documentation. All calculations, procedures, and design basis documents cited in this LAR and posted on the sharepoint are owned by Duke Energy and will continue to be updated through normal station processes.

~

In a letter to the NRC dated November 15, 2017 (Reference 2), Duke Energy re-baselined the Tornado/High Energy Line Break (HELB) commitments. Tornado commitments 7T, 18T, and 19T (provided in Attachment 2 of that letter) will be completed with submittal and implementation of this LAR. Details can be found in the Enclosure of this LAR.

In accordance with Duke Energy administrative procedures that implement the Quality Assurance Program Topical Report, the proposed changes have been reviewed and approved by the Onsite Review Committee. A copy of this LAR is being sent to the State of South Carolina in accordance with 1 O CFR 50.91 requirements.

U.S. Nuclear Regulatory Commission September 14, 2018

• Page 3 Duke Energy requests approval of this amendment request by December 31, 2020 with an implementation period in accordance with completion dates identified in Attachment 1. Note that Duke Energy plans to implement the revised Tornado licensing basis in a staggered fashion on a per unit basis. The UFSAR changes will also be issued on a per unit basis. For the intent of this LAR and sake of review, the proposed changes are treated like all modifications have been completed for all three units.

Inquiries on this proposed amendment request should be directed to Timothy D. Brown, ONS Regulatory Projects Group, at (864) 873-3952.

I declare under penalty of perjury that the foregoing is true and correct. Executed on September 14, 2018.

Sincerely, J ufl-¢V/

J. Ed Burchfield, Jr.

Vice President Oconee Nuclear Station

Enclosure:

Evaluation of Proposed Changes Regulatory Commitments UFSAR Marked-Up Pages UFSAR Retyped Pages Tornado Missile Probabilistic Methodology Thermal-Hydraulic Models for Standby Shutdown Facility Transient Analysis [Proprietary]

Thermal-Hydraulic Models for Standby Shutdown Facility Transient Analysis [Non-Proprietary]

Thermal-Hydraulic Transient Analysis of Tornado Induced Overheating and Overcooling Events Mitigated Using the Standby Shutdown Facility Duke Energy Affidavit Framatome Affidavit

U.S. Nuclear Regulatory Commission September 14, 2018 Page 4 cc w/enclosure and attachments:

Ms. Catherine Haney, Administrator, Region II U.S. Nuclear Regulatory Commission Marquis One Tower 245 Peachtree Center Ave., NE, Suite 1200 Atlanta, GA 30303-1257 Ms. Audrey Klett, Project Manager (by electronic mail only)

Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Mail Stop 0-8G9A 11555 Rockville Pike Rockville, Maryland 20852 Mr. Eddy Crowe NRC Senior Resident Inspector Oconee Nuclear Station Ms. Susan E. Jenkins, Manager, (by electronic mail only: jenkinse@dhec.sc.gov)

Infectious and Radioactive Waste Management, Bureau of Land and Waste Management Department of Health & Environmental Control 2600 Bull Street Columbia, SC 29201

ATTACHMENT 8 DUKE ENERGY AFFIDAVIT

License Amendment Request No. 2018-02 AFFIDAVIT OF JOSEPH DONAHUE

1. I am Vice President of Nuclear Engineering, Duke Energy Corporation, and as such have the responsibility of reviewing the proprietary information sought to be withheld from public disclosure in connection with nuclear plant licensing and am authorized to apply for its withholding on behalf of Duke Energy.

2. I am making this affidavit in conformance with the provisions of 1 O CFR 2.390 of the regulations of the Nuclear Regulatory Commission (NRG) and in conjunction with Duke Energy's application for withholding which accompanies this affidavit.

3. I have knowledge of the criteria used by Duke Energy in designating information as proprietary or confidential. I am familiar with the Duke Energy information contained in Attachments 5 and 6 of Oconee License Amendment request 2018-02 which proposes to update the Updated Final Safety Analysis Report (UFSAR) regarding tornado licensing basis.

4. Pursuant to the provisions of paragraph (b) (4) of 1 O CFR 2.390, the following is furnished for consideration by the NRG in determining whether the information sought to be withheld from public disclosure should be withheld.

(i)

The information sought to be withheld from public disclosure is owned by Duke Energy and has been held in confidence by Duke Energy and its consultants.

(ii)

The infprmation is of a type that would customarily be held in confidence by Duke Energy. Information is held in confidence if it falls in one or more of the following categories.

(a) The information requested to be withheld reveals distinguishing aspects of a process (or component, structure, tool, method, etc.) whose use by a vendor or consultant, without a license from Duke Energy, would constitute a competitive economic advantage to that vendor or consultant.

(b) The information requested to be withheld consist of supporting data, including test data, relative to a process (or component, structure, tool, method, etc.),

and the application of the data secures a competitive economic advantage for example by requiring the vendor or consultant to perform test measurements, and process and analyze the measured test data.

(c) Use by a competitor of the information requested to be withheld would reduce the competitor's expenditure of resources, or improve its competitive position, in the design, manufacture, shipment, installation assurance of quality or licensing of a similar product.

(d) The information requested to be withheld reveals cost or price information, production capacities, budget levels or commercial strategies of Duke Energy or its customers or suppliers.

License Amendment Request No. 2018-02 (e) The information requested to be withheld reveals aspects of the Duke Energy funded (either wholly or as part of a consortium ) development plans or programs of commercial value to Duke Energy.

(f) The information requested to be withheld consists of patentable ideas.

The information in this submittal is held in confidence for the reasons set forth in paragraphs 4(ii)(a) and 4(ii)(c) above. Rationale for this declaration is the use of this information by Duke Energy provides a competitive advantage to Duke Energy over vendors and consultants, its public disclosure would diminish the information's marketability, and its use by a vendor or consultant would reduce their expenses to duplicate similar information. The information consists of analysis methodology details that provides a competitive advantage to Duke Energy.

(iii)

The information was transmitted to the NRC in confidence and under the provisions of 1 O CFR 2.390, it is to be received in confidence by the NRC.

(iv)

The information sought to be protected is not available in public to the best of our knowledge and belief.

(v)

The proprietary information sought to be withheld is that which is marked in Attachments 5 and 6 of Oconee License Amendment request 2018-02 which proposes to update the Updated Final Safety Analysis Report (UFSAR) regarding tornado licensing basis. This information enables Duke Energy to support license amendment requests for Oconee.

(vi)

The proprietary information sought to be withheld from public disclosure has substantial commercial value to Duke Energy.

(a) Duke Energy uses this information to reduce vendor and consultant expenses associated with supporting the operation and licensing of nuclear power plants.

(b) Duke Energy can sell the information to nuclear utilities, vendors, and consultants for the purpose of supporting the operation and licensing of nuclear power plants.

(c) The subject information could only be duplicated by competitors at similar expense to that incurred by Duke Energy.

5. Public disclosure of this information is likely to cause harm to Duke Energy because it would allow competitors in the nuclear industry to benefit from the results of a significant development program without requiring a commensurate expense or allowing Duke Energy to recoup a portion of its expenditures or benefit from the sale of the information.

Joseph Donahue affirms that he is the person who subscribed his name to the foregoing statement, and that all the matters and facts set forth herein are true and correct to the best of his knowledge.

License Amendment Request No. 2018-02 I declare under penalty of perjury that the foregoing is true and correct.

Executed on June 19, 2018.

ATTACHMENT 9 FRAMATOME AFFIDAVIT

License Amendment Request No. 2018-02 COMMONWEALTH OF VIRGINIA CITY OF LYNCHBURG AFFIDAVIT ss.

1.

My name is Gayle Elliott. I am Deputy Director, Licensing & Regulatory Affairs, for Framatome Inc. (Framatome) and as such I am authorized to execute this Affidavit.

2.

I am familiar with the criteria applied by Framatome to determine whether certain Framatome information is proprietary. I am familiar with the policies established by Framatome to ensure the proper application of these criteria.

3.

I am familiar with the Framatome information contained in Attachment 1 to Duke Energy Carolinas, LLC letter for Oconee Nuclear Station (ONS), Units 1, 2, and 3, Docket Numbers 50-269, 50-270, and 50-287, Renewed Facility Operating License Nos. DPR-38, DPR-47, DPR-55, with Subject, "Proposed Amendment to the Renewed Facility Operating Licenses Regarding Revisions to the Updated Final Safety Analysis Report Section Associated with the Oconee Tornado Licensing Basis, License Amendment No. 2018-02," ONS-2018-02. The attachment is entitled "Thermal-Hydraulic Models for Standby Shutdown Facility Transient Analysis,* and referred to herein as "Document." Information contained in this Document has been classified by Framatome as proprietary in accordance with the policies estabnshed by Framatome for the control and protecUon of proprietary and confidential information.

4.

This Document contains information of a proprietary and confidential nature and is of the type customarily held in confidence by Framatome and not made available to the public. Based on my experience, I am aware that other companies regard information of the kind contained in this Document as proprietary and confidential.

License Amendment Request No. 2018-02

5.

This Document has been made available to the U.S. Nuclear Regulatory Commission In confidence with the request that the Information contained in this Document be withheld from public disclosure. The request for withholding of proprietary information is made in accordance with 10 CFR 2.390. Tho infoITT1ation for which withholding from disclosure is requested qualifies under 10 CFR 2.390(a){4) "Trade secrets and commercial or financial information."

6.

The following criteria are customarily applied by Framatome to determine whether Information should be classified as proprietary:

(a)

The information reveals details of Framalome's research and development plans and programs or their results.

(b)

Use of the information by a competitor would permit the competitor to significantly reduce its expenditures, in time or resources, to design, produce, or market a similar product or service.

(c)

The information includes test data or analytical techniques concerning a process, methodology, or componen~ the application of which results in a competitive advantage for Framatome.

(d}

The information reveals certain distinguishing aspects of a process, methodology, or component, the exclusive use of which provides a competitive advantage for Framatome in product optimization or marketability.

(e)

The information is vital to a competitive advantage held by Framatome, would be helpful to competitors to Framatome, and would likely cause substantial harm to the competitive position of Framatome.

The information in this Document is considered proprietary for the reasons set forth in paragraphs 6(d) and 6(e) above.

7.

In accordance with Framatome's policies governing the protection and control of Information, proprietary information contained in this Document has been made available, on II r

License Amendment Request No. 2018-02 a limited basis, to others outside Framatome only as required and under suitable agreement providing for nondisclosure and limited use of the information.

8.

Framalome policy requires that proprietary information be kept in a secured file or area and distributed on a need-to-know basis.

9.

The foregoing statements are true and correct to the best of my knowledge, information, and belief.

SUBSCRIBED before me this ~:l..,~J day of Jua f_..

, 2018.

Ella Carr-Payne NOTARY PUBLIC, COMMONWEAL TH OF VIRGINIA

ENCLOSURE EVALUATION OF PROPOSED CHANGE LICENSE AMENDMENT REQUEST 2018-02

Subject:

Proposed Amendment to the Renewed Facility Operating Licenses Regarding Revisions to the Updated Final Safety Analysis Report Section Associated with the Oconee Tornado Licensing Basis

1.

SUMMARY

DESCRIPTION

2.

DETAILED DESCRIPTION 2.1.

System Design and Operation 2.2.

Current Licensing Basis Requirements 2.3.

Current Technical Specification Requirements 2.4.

Reason for the Proposed Changes 2.5.

Description of the Proposed Changes 2.6.

UFSAR Changes

3.

TECHNICAL EVALUATION 3.1 RCS T-H Analysis 3.2 Revised Licensing Basis Strategy for Tornado 3.3 Operations Response, Training, and Procedures 3.4 Other Safety Considerations 3.5 Corrosion Effects 3.6 TORMIS Methodology 3.7 Elimination of SFP Suction for HPI 3.8 Passive Civil Features 3.9 Conclusions

4.

REGULATORY EVALUATION 4.1.

Applicable Regulatory Requirements/Criteria 4.2.

Precedents 4.3.

No Significant Hazards Consideration 4.4.

Conclusions

5.

ENVIRONMENTAL CONSIDERATION

6.

REFERENCES

7.

ACRONYMS

License Amendment Request No. 2018-02 September 14, 2018 1

SUMMARY

DESCRIPTION Pursuant to 1 O CFR 50.90, Duke Energy Carolinas, LLC (Duke Energy) proposes to amend Renewed Facility Operating Licenses (OLs) Nos. DPR-38, DPR-47, and DPR-55 for Oconee Nuclear Station (ONS) Units 1, 2, and 3. The License Amendment Request (LAR) proposes to revise the ONS Updated Final Safety Analysis Report (UFSAR) regarding the tornado licensing.

basis (LB). Specifically, the LAR requests the following:

Approval for crediting the Standby Shutdown Facility (SSF) as the assured mitigation path following a tornado with the assumed initial conditions of loss of all Alternating.

Current (AC) power to all units with significant tornado damage to one unit.

Approval for formal incorporation of the use of tornado missile probabilistic methodology (TORMIS) in the ONS tornado LB and associated UFSAR changes.

Approval for elimination of the Spent Fuel Pool (SFP) to High Pressure Injection (HPI) flow path for Reactor Coolant Makeup (RCMU).

Implementation of the proposed tornado LB and the related commitments will clarify and, in some cases, revise the ONS current LB to collectively enhance ONS overall design and safety margin. The LAR also proposes to credit a number of plant modifications to enhance ONS capability to withstand the effects of a damaging tornado. Equipment installed by these modifications will be physically protected or evaluated in the TORMIS model noted above. Note that the modifications are being performed under 1 O CFR 50.59 and their approval is not a part of this LAR even though they are discussed.

This enclosure provides background information related to NRG approval of the original tornado

• LB and SSF design, a description of proposed plant improvements, the proposed changes to the UFSAR, and a technical evaluation that justifies the proposed UFSAR changes. A regulatory evaluation (including the No Significant Hazards Consideration) and environmental considerations are provided in Sections 4 and 5 of the Enclosure. Attachment 1 contains the list of regulatory commitments made as a result of this LAR. Attachments 2 and 3 contain the marked-up and retyped UFSAR pages, respectively. Attachment 4 is a summary of how the TORMIS methodology was applied to ONS. Attachment 5 describes the Thermal-Hydraulic (T-H) codes and models used to perform analysis of SSF mitigated tornado scenarios in support of this LAR. Within Attachment 5, proprietary information is identified by brackets. In accordance with 1 O CFR 2.390, Duke Energy requests that this information be withheld from public disclosure. Attachment 6 contains the non-proprietary (redacted) version of this content. describes the SSF T-H analysis. Attachments 8 and 9 contain Affidavits attesting to the proprietary nature of the information in Attachment 5. The proprietary information is owned by Duke Energy and Framatome and is annotated as such. The annotated information has substantial commercial value that provides a competitive advantage. Note that Attachments 4 through 7 have*their own list of references. No changes to Technical Specifications (TS) are proposed.

This LAR supersedes the previous LAR dated June 26, 2008 (Reference 30) and its associated documentation. All calculations, procedures, and design basis documents cited in this documentation and posted on the sharepoint are owned by Duke Energy and will continue to be updated through normal station processes.

1

License Amendment Request No. 2018-02 September 14, 2018 In a letter to the NRG dated November 15, 2017 (Reference 41), Duke Energy re-baselined the Tornado/HELB commitments. Tornado commitments 7T, 18T, and 19T (provided in Attachment 2 of that letter) will be completed with submittal and implementation of this LAR. Commitment 7T is met by submittal of this LAR. Other details for meeting commitments can be found in section 2.5 of this LAR.

2 DETAILED DESCRIPTION 2.1 System Design and Operation The three units at ONS were designed in the late 1960's and the construction permits were issued prior to the development of many of the present regulations and requirements regarding tornado. Oconee Unit 1 received its initial OL in February 1973, Unit 2 in October 1973 and Unit 3 in July 1974. Each unit features a Nuclear Steam Supply System (NSSS) designed and supplied by Babcock and Wilcox (B&W). The SSF, which was not a part of the original plant design, was installed in the early 1980s to address concerns related to plant security, fire protection, and turbine building flooding.

2.1.1 Current Design Description of SSF The SSF is designed as a standby system for use under certain emergency conditions. The system provides additional "defense-in-depth" protection for the health and safety of the public by serving as a backup to existing safety systems. It provides an alternate means to achieve and maintain the unit(s) in MODE 3 with average Reactor Coolant system (RCS) temperature.::

525°F (unless the initiating event causes the unit(s) to be driven to a lower temperature) following a fire, turbine building flood, and station blackout (SBO) events. The SSF is designed for the criteria associated with these events. The SSF Auxiliary Service Water (ASW) system is credited as a backup to Emergency Feedwater (EFW) to address EFW system equipment vulnerabilities associated with single failures, tornado missiles, and seismic design (Reference 29). The SSF may also be activated as necessary in response to events associated with plant security. The single failure criterion is not required. Failures in the SSF system will not cause failures or inadvertent operations in other plant systems. The SSF requires manual activation and can be activated if emergency systems are not available.

The SSF is designed to maintain the reactor(s) in a safe shutdown (SSD) condition for a period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a fire or turbine building flood, and for a period of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following an SBO. The capability of the SSF to maintain the reactor(s) in a SSD condition is also credited for certain security related events. The design criteria associated with each of these events is described in UFSAR Section 9.6.2. The main components of the SSF are the SSF ASW system, SSF Portable Pumping system, SSF RCMU system, SSF Power system, and SSF instrumentation.

The SSF ASW system is a high head, high volume system designed to provide sufficient steam generator (SG) inventory for adequate decay heat removal for three units during a loss of normal AC power in conjunction with the loss of the Main Feedwater and EFW systems. One motor driven SSF ASW pump, located in the SSF, serves all three units. The SSF ASW pump utilizes a suction supply of lake water from the embedded Unit 2 Condenser Circulating Water (CCW) piping.

The SSF ASW system is used to provide adequate cooling to maintain single phase RCS natural circulation flow in MODE 3 with an average RCS temperature.:: 525°F (unless the 2

License Amendment Request No. 2018-02 September 14, 2018 initiating event causes the unit(s) to be driven to a lower temperature). In order to maintain single phase RCS natural circulation flow, an adequate number of Bank 2, Group B and C pressurizer heaters are needed to compensate for ambient heat loss from the pressurizer. As long as the temperature in the pressurizer is maintained, RCS pressure will also be maintained.

This will preclude hot leg voiding and ensure adequate natural circulation cooling.

Portions of the SSF ASW system are credited to meet the Extensive Damage Mitigation Strategies commitments per NEI 06-12 (B.5.b) and the SSF is fully credited to meet the Extensive Damage Mitigation Strategies commitments per NEI 12-06 (FLEX).

The SSF Portable Pumping system, which includes a submersible pump and a flow path capable of taking suction from the intake canal and discharging into the Unit 2 CCW line, is designed to provide a backup supply of water to the SSF in the event of loss of CCW and subsequent loss of CCW siphon flow. The SSF Portable Pumping system is installed manually in accordance with procedures.

The SSF RCMU system is designed to supply makeup to the RCS and RCP seal cooling in the event that normal makeup systems are unavailable. An SSF RCMU pump located in the reactor building of each unit supplies makeup to the RCS should the normal makeup system flow and seal cooling become unavailable. The system is designed to ensure that sufficient borated water is provided from the SFP to allow the SSF to maintain all three units in MODE 3 with average RCS temperature~ 525°F (unless the initiating event causes the unit(s) to be driven to a lower temperature) for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. An SSF RCMU pump is capable of delivering borated water from the SFP to the RCP seal injection lines. A portion of this seal injection flow is used to makeup for RCP seal leakage while the remainder flows into the RCS to makeup for other normal RCS leakage.

The SSF Power system includes 4160 VAC, 600 VAC, 208 VAC, 120 VAC and 125 VDC power.

It consists of switchgear, a load center, motor control centers, panelboards, remote starters, batteries, battery chargers, inverters, a diesel generator (DG), relays, control devices, and interconnecting cable supplying the appropriate loads. The SSF Power system provides electrical isolation of SSF equipment from non-SSF equipment. The SSF 125 VDC Power system provides a reliable source of power for Direct Current (DC) loads needed to black start the DG. The DC power system consists of two 125 VDC batteries and associated;chargers, two 125 VDC distribution centers (DCSF, DCSF-1), and a DC power panelboard (DCSF). The SSF Power system is provided with standby power from a dedicated DG. The SSF DG and support systems consist of the DG, fuel oil transfer system, air start system, diesel engine service water system, as well as associated controls and instrumentation. This SSF DG is rated for continuous operation at 3500 kW, 0.8 pf, and 4160 VAC. The SSF electrical design load does not exceed the continuous rating of the DG. The auxiliaries required to assure proper operation of the SSF DG are supplied entirely from the SSF Power system. The SSF DG is provided with manual start capability from the SSF only. It uses a compressed air starting system with four air storage tanks. An independent fuel system, complete with a separate underground storage tank, duplex filter arrangement, a fuel oil transfer pump, and a day tank, is supplied for the DG.

The SSF building is a reinforced concrete structure. The SSF building has a seismic classification of Category 1 and considers tornado wind and missile loads in the analysis and design. The normal non-tornadic design wind velocity for the SSF building is 95 mph, at 30 feet above the nominal ground elevation. This velocity is the fastest wind with a recurrence interval 3

License Amendment Request No. 2018-02 September 14, 2018 of 100 years. A gust factor of unity is used for determining wind forces. The design tornado used in calculating tornado loadings is in conformance with Regulatory Guide (RG) 1.76, Revision 0, with the following exceptions:

Rotational wind speed is 300 mph.

Translational speed of tornado is 60 mph.

Radius of maximum rotational speed is 240 ft.

Tornado induced negative pressure differential is 3 psi, occurring in three seconds.

The SSF building is designed to resist the effects of tornado generated missiles in combination with other appropriate loadings. The postulated tornado generated missiles are the wood plank, steel pipe, steel rod, utility pole, and automobile as defined in UFSAR Table 9-17. Penetration depths are calculated using the modified National Defense Research Committee (NDRC) formula and the modified Petry formula. UFSAR Table 9-18 lists calculated penetration depths and the minimum barrier thicknesses to preclude perforation and scabbing, hence eliminating secondary missiles.

2.2 Current Licensing Basis Requirements 2.2.1 Tornado The tornado current LB is derived from information presently contained within several sections of the ONS UFSAR and generally relies on probabilistic insights, separation, and defense-in-depth concepts to provide reasonable assurance that SSD can be achieved. See UFSAR details provided in section 4.1, Applicable Regulatory Requirements/Criteria, for additional information.

Protection against tornado is considered an Oconee design criterion, similar to the criteria to protect against earthquakes, wind, snow, or other natural phenomena as described in UFSAR Section 3.1.2. A specific occurrence of these phenomena is not postulated, nor is all equipment that would be used to bring the plant to SSD comprehensively listed. Capability to bring the plant to SSD is intended to be a qualitative assessment that, following a tornado, normal shutdown systems will remain available or alternative systems will be available to allow shutdown of the plant. It was not intended to imply that specific systems should be tornado proof. No accident analyses were originally performed, nor were they required. The risk of not being able to achieve SSD after a tornado is sufficiently small that additional protection is not required.

Secondary Side Decay Heat Removal (SSDHR)

The current tornado LB relies on EFW, SSF ASW, EFW from an alternate unit, or Protected Service Water (PSW) to provide SSDHR.

During events that result in a loss of Condensate/Main Feedwater, the EFW system provides sufficient feedwater to the SGs of each unit to remove energy stored in the core and primary coolant. For diversity, the EFW system includes two AC motor driven pumps and one turbine driven pump that is independent of AC power. Sources of steam for the turbine driven EFW pump are provided from each Main Steam line of the associated unit and auxiliary steam, which may be provided from an alternate unit. Following a loss of all AC power, the turbine driven EFW pump automatically starts and is capable of operating for at least two hours completely 4

License Amendment Request No. 2018-02 September 14, 2018 independent of AC power. The water inventory that is immediately available to the turbine driven EFW pump (Upper Surge Tank) is sufficient to supply feedwater to the SGs for at least 40 minutes assuming automatic SG level control and no reliance on operator action. After this time, operators align the water source to the condenser hotwell. Portions of the EFW system are vulnerable to tornado missiles. Thus, the plant relies upon diverse means to provide feedwater to the SGs following a tornado. These diverse means include the SSF ASW system, EFW from an alternate unit, and the PSW system..

Manual operator actions to align and provide flow from SSF ASW, EFW from an alternate unit, and PSW systems are necessary. The SSF ASW system is manually aligned, started and monitored from the SSF control room (CR). EFW from an alternate unit is locally aligned, but started and monitored from the main CR. The PSW system is manually aligned, started, and monitored from the main CR.

The SSF ASW system is a high head, high volume system that provides sufficient SG inventory for adequate decay heat removal for all three units during a loss of normal AC power in conjunction with the loss of normal and EFW systems. The SSF ASW pump is the-major component of the system and is housed in the SSF building. The water contained in the buried CCW piping for Unit 2 serves as the water supply. The SSF ASW system is not designed to meet single failure criterion; however, failure of SSF ASW components will not cause failures or inadvertent operation of existing plant systems. The SSF ASW system decay heat removal path is typically SG feed with steaming through the Main Steam Relief Valves (MSRVs).

The SSF portable pumping system includes a submersible pump and a flow path capable of taking suction from the intake canal and discharging into the Unit 2 CCW line. This pump and cable spool is stored in the tornado protected SSF building and is powered from the SSF DG.

This system provides a backup supply of water to the SSF in the event of loss of CCW functions and subsequent loss of CCW siphon and gravity flow. The SSF portable pumping system is installed manually according to procedures.

The PSW system is a high head, high volume system provided as an alternate means to achieve and maintain SSD conditions for one, two, or three units following postulated scenarios that damage essential systems and components normally used for SSD. The PSW system utilizes the inventory of lake water contained in the Unit 2 CCW piping. The PSW primary and booster pumps are located in the auxiliary building at elevation 771' and take suction from the Unit 2 CCW piping and discharge into the SGs of each unit via the EFW system headers. The raw water is vaporized in the SGs, removing residual heat, and is dumped to atmosphere via the MSRVs or Atmospheric Dump Valves.

For extended operation, the PSW portable pump with a flow path capable of taking suction from the intake canal and discharging into the Unit 2 CCW piping is designed to provide a backup supply of water to the PSW system in the event of loss of CCW and subsequent loss of CCW siphon flow. The PSW portable pump is stored onsite.

Primary Side Makeup Water If the normal and emergency power supplies to the HPI system are lost, an HPI train powered from PSW is capable of providing primary makeup. If the HPI system is lost, the SSF RCMU system is capable of providing primary makeup. In addition to providing primary makeup, these 5

License Amendment Request No. 2018-02 September 14, 2018 systems ensure RCP seal cooling to prevent seal failure after a loss of normal seal injection and Component Cooling system flow.

Main CR operators can align an HPI train to the PSW switchgear and align its suction source to the Borated Water Storage Tank (BWST). If the BWST is unavailable, the HPI suction source can be locally aligned to the SFP. Cooling water to the HPI motor is provided by the PSW Booster pump.

The SSF RCMU pump takes suction from the SFP and RCS inventory is managed from the SSF CR. An adequate supply of borated water is provided to the SSF RCMU pumps from the SFP for each respective unit. This inventory is assured based upon minimum required SFP levels and maximum allowed SFP temperatures.

Emergency Power An onsite power system and an offsite power system are provided for each unit at ONS to supply the unit auxiliaries during normal operation and the Reactor Protection systems and Engineered Safeguards Protection systems during abnormal and accident conditions. ONS has the following diverse/redundant and separated sources of power:

The 230 kV and/or 525 kV transmission networks through the units' startup transformers.

The overhead power connections from one Keowee hydro unit through the 230 kV switchyard to units 1, 2, and 3.

The tornado protected underground pathway to all three units from the two unit Keowee Hydro Station located approximately 1 mile east of ONS through transformer CT-4, also located in a tornado protected structure attached to and directly east of the turbine building. It should be noted that while the lower portions of Keowee Hydro Station are constructed of reinforced concrete and protected from tornado related effects, the upper superstructure of the station is not protected from tornado related effects.

A tornado protected underground pathway from Keowee Hydro Station to the tornado protected PSW building (designed to RG 1.76 Revision 1) on the south side of the 'site and from the PSW building via a tornado protected pathway to the below grade portions of the auxiliary building (AB).

A separate unprotected source of power via a commercial connection from the Central Tie Switchyard to the tornado protected PSW Electrical building.

A separate unprotected source of power via a commercial connection from the Lee Combustion turbines, located approximately thirty five miles south of ONS to CT-5, located on the west side of the plant.

The SSF DG located in the tornado protected SSF through tornado protected underground trenches to each unit's partially protected rooms on the west side of the AB. These rooms known as the West Penetration rooms (WPRs) and Cask Decontamination Tank rooms (CDTRs) have been upgraded to withstand tornado induced wind and differential pressure effects (RG 1.76 Revision 1 ), but not tornado induced missiles. The underground trenches were originally designed to UFSAR Class 1 criteria documented in UFSAR Section 3.8.4. Modifications to the above grade portions 6

License Amendment Request No. 2018-02 September 14, 2018 of the trench adjacent to the north end of the SSF, above the CT-5 trench, and adjacent to each units' BWST enclosure have been designed to RG 1.76 Revision 1.

A tornado protected underground pathway from the PSW building to the SSF. This is not credited in the LB, it is for defense-in-depth.

Manual operator action is required to actuate the SSF. A protected DG supplies power to the SSF and its support systems for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The SSF power system is designed to provide normal and independent emergency sources of AC and DC electrical power to their associated electrical distribution systems and various support systems.

2.2.2 SSF In the late 1970's and early 1980's, Duke Energy developed the conceptual and final design of the SSF to augment existing plant capabilities relative to mitigating postulated occurrences such as fires, turbine building flooding and security related incidents. The ONS SSF design and associated criteria were approved in an NRC Safety Evaluation (SE) dated April 28, 1983 (Reference 16). The NRC SE was based on submittals made by Duke Energy in References 17, 18, 19, 20, 21, and 22. Within these communications, the SSF is described as a "bunkered" facility which houses the systems and components necessary to provide an alternate and independent means to achieve and maintain a hot shutdown condition for one or more of the three ONS units. At that time, hot shutdown was defined in the ONS TSs as the reactor subcritical by at least 1 % 11 k/k and Tavg.:: 525°F.

Duke Energy performed analyses to support the SSF design during this time frame that evaluated and confirmed the effectiveness of the SSF in controlling and mitigating the response of the RCS based on initial conditions of full power (Reference 17). The two concerns of importance, the possibility of return to criticality and the ability to maintain natural circulation, were addressed by the analyses. During the licensing of the SSF design, Duke Energy and the NRC acknowledged the SSF would have the capability of maintaining hot shutdown conditions in all three units for approximately three days following a loss of normal AC power (Reference 16).

The April 28, 1983 SE (Reference 16) stated that the SSF design meets appropriate requirements and acknowledged that the SSFwas designed to provide an alternate and independent means to achieve hot shutdown conditions. In the SE, the NRC requested that Duke Energy continue work on the TSs needed to ensure the operability of SSF components agreed with the assumptions used in the design. The SE acknowledged that the SSF RCMU system was designed with a capacity to account for normal primary system leakage and shrinkage which results from transitioning from a hot power operating condition to hot shutdown.

The SE also stated that the SSF systems required for SSD are designed with adequate capacity to ensure safe hot shutdown conditions for all three ONS units.

Duke Energy submitted a LAR on July 26, 1985 (Reference 23), proposing TSs requiring the SSF to be operable at any time an ONS unit's Tavg > 525°F. By letter dated January 23, 1987 (Reference 24), NRC stated the proposed TSs should be revised to incorporate a Limiting Condition of Operation (LCO) Applicability comparable to that in Standard TSs for the EFW system and other safety related systems since the SSF ASW system was being credited as a backup to the EFW system. Duke Energy supplemented the July 26, 1985, LAR on August 14, 1987 (Reference 25), to address these concerns and extended the SSF operability 7

License Amendment Request No. 2018-02 September 14, 2018 requirements down to Tavg.:: 250°F; further expanding the applicability of the SSF TS rather than just expanding the applicability of TS requirements for the SSF ASW system.

After the SSF design was approved by the NRC in 1983 (Reference 16) and prior to approval of the initial SSF TS in 1992 (Reference 26), Duke Energy requested and received approval to credit the SSF to mitigate SBO (References 27 and 28) and to address EFW system equipment vulnerabilities associated with single failures, tornado missiles, and seismic design (Reference 29).

Revision 1 to RG 1.76 was incorporated into the SSF LB in 2007. The design of future changes to and/or analysis of SSF related structure, system, or components (SSCs) subject to tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in RG 1.76, Revision 1.

Criterion 4 of 1 O CFR 50.36 states a SSC which operating experience or probabilistic risk assessment (PRA) has shown to be significant to public health and safety requires inclusion into TS. The SSF satisfies criterion 4 of 1 O CFR 50.36 due to the risk significant role it plays as a backup for existing safety systems to provide an alternate and independent means to achieve and maintain one, two or all three of the units in MODE 3 with average RCS temperature

.:: 525°F (unless the initiating event causes the unit(s) to be driven to a lower temperature).

2.3 Current Technical Specification Requirements There are no specific TS Requirements for tornado. The regulatory basis for tornado protection of equipment originates from principal design criteria 2 (pre-GDC) as described in UFSAR Section 3.1.2 and since tornado is a design criterion, it does not constitute a design basis accident or transient as described in 1 O CFR 50.36(c)(2)(ii).

2.4 Reason for the Proposed Changes Currently, the LB is a combination of probabilistic, diversity, and defense-in-depth strategies addres$ing the capability to provide SSD of the ONS units. This proposed change establishes the SSF as a deterministic strategy.

The original 1973 Final Safety Analysis Report contained a description of tornado protection design requirements which relied on:

Physical protection of Class 1 structures, such as the reactor building and selected portions of the AB. (Note that Section 4.1.4 of this LAR contains a listing of ONS Class 1 structures),

Sufficient supply of secondary side cooling water for SSD, Diverse sources of emergency power, and Physical separation of systems as defense against tornado missiles. The application of physical separation was applied to the 'A' and 'B' SG paths of the station ASW system (replaced with PSW) since either path was considered capable of providing the necessary flow to restore SSDHR and was physically separated by the reactor buildings. Additionally, physical separation was applied to the Keowee Hydro Units and the station. The NRC acknowledged the use of physical separation as a viable means of defending against missiles in the SE Report (Reference 1), stating, "With regard to Class I (seismic) components in the AB [such components] will be protected by concrete walls and roofs to prevent potential missile penetration, or be separated to prevent failures in redundant systems from such missiles."

8

License Amendment Request No. 2018-02 September 14, 2018 In the late 1970s, there was regulatory activity pertaining to the NRC's Systematic Evaluation Program (SEP) to establish a standard tornado LB for pre-Standard Review Plan (SRP) plants that received their OLs before 1975 since the tornado design requirements differed significantly for pre-and post-SRP plants. In resolving SEP Issue 156.1.5, Tornado Missiles," the NRG concluded that the guidance relative to tornado missile protection prior to 1972 was not adequate. The NRG recommended that this issue be resolved by the NRC's Individual Plant Examination of External Events (IPEEE) (Reference 2) process.

In February 1978, Duke Energy proposed the SSF as an alternate and independent means to achieve and maintain SSD conditions for one or more of the three ONS units for approximately three days following a loss of normal AC power. The SSF was designed to provide a means to meet SSD requirements for fire protection, turbine building flooding, and physical security. The SSF was also credited as the alternate AC power source and the source of SSDHR to demonstrate SSD during the required SBO coping duration. The SSF was approved by the NRG in 1983 (Reference 3) and was put into service soon thereafter.

The ONS LB at the time of the issuance of operating licenses is documented in the original FSAR and NRG SER for the facility. The FSAR demonstrated SSD following a tornado via the establishment of secondary side cooling from the Station ASW system. No single failure was postulated as part of the tornado LB. The fact that a single failure was not postulated is very clear in that the original LB relied upon one Station ASW pl.imp, powered from the single ASW switchgear located in the basement of the AB. As with the original LB, the CLB does not postulate single failure with a tornado.

The only tornado licensing action that has occurred since the original licensing of the facility was the post-Three Mile Island (TMI) review of the ONS EFW system. In the early 1980's, the primary tornado licensing interactions between Duke Energy and the NRG focused on addressing EFW system vulnerabilities and the ability to establish secondary side cooling on a loss of EFW. Duke responded in October 1981, that the primary source-of secondary cooling following a loss of EFW would be Station ASW. Additionally, the SSF ASW system would likely be capable of providing an additional cooling water source following a tornado.

Due to limitations associated with each of the cooling alternatives credited, the NRG requested that Duke Energy provide an evaluation to assure that the probability of tornado damage to both EFW and SSF is acceptably low. This information was provided in late 1982 and focused on systems' vulnerabilities to wind. Following this Duke Energy submittal, there was no tornado licensing related correspondence until mid-1986 when the NRG requested additional information to complete its review of tornado generated missiles. From this point on, Duke Energy's submittals and the NRC's review focused on tornado missiles. Duke Energy submitted secondary side heat removal risk analyses by letters dated September 15, 1986 (Reference 44),

July 17, 1987 (Reference 45), and December 19, 1988 (Reference 46). These risk analyses considered the effect of tornado damage to a single unit. The NRC's July 28, 1989 (Reference 1 ), SER acknowledges this fact. The cover letter of this safety evaluation states:

"Finally, the undamaged EFW system in one unit can supply feedwater to the steam generators in a unit with a damaged EFW system by means of system cross-connections in the pump discharge piping."

9

License Amendment Request No. 2018-02 September 14, 2018 The cover letter of the NRC's SER concludes the following:

"Based on review of your probabilistic analysis, the staff concludes that the Oconee secondary side heat removal capability complies with the criterion for protection against tornadoes, and is therefore acceptable. This conclusion is based primarily on the availability of the SSF ASW system.

11 The post-Three Mile Island (TMI) review of the EFW system for tornado missiles acknowledges that EFW, Station ASW, and SSF ASW are not fully protected from tornado damage. However, collectively, these systems afford sufficient protection against tornado damage and provide reasonable assurance that safe shutdown conditions can be achieved following a tornado. The current LB, documented in Section 3.2.2 of the UFSAR, includes the secondary side heat removal functions credited in the NRC's post-TMI review of the EFW system for tornado missiles. Historically, a tornado that damages all three units has not been postulated in risk studies. Studies previously submitted to the NRC assume a tornado damages one unit with an associated LOOP on the other two units.

Between 1982 and 1984, Duke Energy developed a PRA model in accordance with NSAC/60 (Reference 4) that included a tornado assessment. Also in the early 1980's, to resolve EFW (for SSDHR) tornado missile issues related to the post-TMI actions (NUREG 0737), TORMIS was first used by Duke Energy to evaluate missile mitigation vulnerabilities associated with the EFW system. In 1989, the NRC issued an SE Report that acknowledged Duke Energy's specific application of the TORM IS methodology. In the 1989 SE (Reference 1) which closed out the post-TMI EFW issue, the NRC stated,

"... the undamaged EFW system in one unit can supply feedwater to the SGs in a unit with damaged EFW system cross-connections in the pump discharge piping...Based on review of your probabilistic analysis, the staff concludes that the ONS secondary side heat removal capability complies with the criterion for protection against tornadoes, and is therefore acceptable. This conclusion is primarily based on the availability of the SSF ASW system.

11 Duke Energy submitted an IPEEE on December 18, 1997 (Reference 37), that included a tornado PRA to address the high winds portion of the IPEEE's high winds, flood, and other external events requirement. The NRC approved the ONS IPEEE on March 15, 2000 (Reference 5). As stated in the Technical Evaluation Report, "On the basis of our review of your submittals only, the staff has concluded that your IPEEE process is capable of identifying the most likely severe accident and severe accident vulnerabilities at the Oconee Nuclear Station, Units 1, 2, and 3 and therefore, that the Oconee IPEEE has met the intent of Supplement 4 to Generic Letter 88-20.

11 In June 2002, following two (2) tornado-related white findings in the 1999-2000 timeframe and in an effort to strengthen the current tornado LB, Duke Energy submitted a "risk-informed" LAR using an upgraded PRA tornado model. The LAR requested approval for removal of the HPI pump from the SFP flowpath that was used as a backup to the HPI from the BWST primary makeup flowpath. The backup flow path had low risk significance and involved significant operator actions outside the main CRs.

10

License Amendment Request No. 2018-02 September 14, 2018 The SSF provides an additional primary makeup flowpath. Although the SSF structure is tornado protected, there are vulnerable areas of the SSF systems primarily where the piping and cabling enter the AB via the WPRs and CDTRs. Duke Energy proposed to physically protect the exterior walls of these rooms, thus fully protecting the SSF from a damaging tornado.

Duke Energy also upgraded the station's tornado PRA model to address multi-unit events. This upgrade introduced additional interaction vulnerabilities that were not addressed in earlier tornado models; however, Duke Energy concluded that the room modifications resulted in an overall risk reduction relative to the effects of a damaging tornado.

After two years of deliberation on the LAR, the NRC stated that the agency would not approve the submittal on the grounds that defense-in-depth was not preserved and in late 2004, Duke Energy retracted the LAA. In a 30 day response to the NRC's withdrawal acknowledgment letter, Duke Energy provided a program schedule for re-evaluating the WPR and COTA modification effort and evaluating other alternatives that would result in an appreciable risk benefit for tornadoes and other design basis issues. To further reduce plant risk and future regulatory challenges, Duke Energy initiated a risk reduction initiative in 2004. The goal of this initiative was to further clarify the LB and produce a set of design, program, and procedure changes that would reduce SSD vulnerability concerns. Duke Energy believed that this integrated approach was more beneficial than recommending changes that targeted individual design issues.

Duke Energy's risk reduction initiative report was completed in May 2005 and recommended a number of modifications to resolve old design issues that included tornado. The proposed modifications would result in a significant improvement in overall core damage frequency.

In light of the risk reduction team's recommendations and as a result of continued communications with the NRC regarding resolution of tornado and HELB outstanding issues, Duke Energy submitted a combined tornado and HELB mitigation strategies letter on November 30, 2006 (Reference 6). The submittal contained a number of regulatory commitments as well as responses to key issues identified by the NRC related to the tornado and HELB LB (Reference 7).

In 2007, there were additional communications between Duke Energy and the NRC regarding the mitigation strategies in the November 2006 submittal. The result of this effort is documented -

in an NRC letter to Duke Energy dated March 28, 2007 (Reference 8). Finally, as concluded in a May 15, 2007 NRC letter (Reference 9) to Duke Energy,

"... as a result of the extensive dialogue that we have had concerning your proposed modifications and mitigation strategies, we believe that the future LARs based on this approach could be found acceptable."

Since that time, Duke Energy has submitted follow-up letters (References 1 O and 11) to refine and adjust implementation schedules of several of the commitments made in the November 30, 2006, letter.

On June 26, 2008 (Reference 30), Duke Energy submitted the revised tornado LB. The submittal was a commitment from the November 2006 (Reference 6) letter. The LAA specifically requested approval of: (1) the revised tornado LB, (2) the station modifications that provide additional protection of key structures to better withstand the effects of postulated tornadoes, (3) 11

License Amendment Request No. 2018-02 September 14, 2018 the application, formal incorporation, and use of the TORMIS methodology at ONS, and (4) the UFSAR revisions associated with the revised tornado LB.

Supplemental letters dated September 2, October 23, 2009; May 6, June 10, June 24, August 31, and December 7, 201 O were provided to address requests for additional information (RAI).

RAls dated December 16, 2011; January 20, March 1, March 16, July 11, July 20, August 31, November 2, 2012; April 5, June 28, August 7, December 18, 2013; February 14, April 3, April 11, and July 24, 2014 were credited for PSW review and approval, but also had information regarding tornado.

During this timeframe, PSW was also being implemented and reviewed as part of the National Fire Protection Association (NFPA) 805, HELB and tornado LB reconstitution work. Each LAR credited PSW for varying types of mitigation. The NRC realized that PSW required final approval before they could continue review of tornado and HELB. As a result, the NRC suspended their review of the tornado and HELB LARs and separated the PSW review from it

, as stated in the issuance of PSW License Amendments 386, 388, and 387 dated August 13, 2014 (Reference 38).

On June 10, 2015, Regulatory Issue Summary (RIS) 2015-06 (Reference 32) was issued for tornado missile protection. The NR,C issued the RIS to 1) remind licensees of the need to conform with the plant's current, site specific LB for tornado-generated missile protection, 2) provide examples of failure to conform with a plant's tornado-generated missile LB, and 3) remind licensees of the staff's position that a licensee's SEP and IPEEE results do not constitute regulatory requirements and are not part of the plant-specific LB unless the NRC or licensee took action to specifically amend the OL.

A fleet initiative to address RIS 2015-06 (Reference 32) was implemented in which each of Duke Energy's nuclear sites was reviewed to verify the tornado protection licensing bases are documented. Surveys of ONS were conducted to determine gaps with respect to the LB. Non-conformances with the design criteria regarding the SSF were discovered, documented in the corrective action program, and correct~d.

Previously, the LB was a combination of probabilistic analysis and defense-in-depth strategy for addressing the capability to provide SSD of the ONS units. This LAR clearly defines the future ONS tornado LB as a deterministic approach with a defined mitigation strategy.

This LAR supersedes the previous LAR dated June 26, 2008 (Reference 30) and its associated documentation.

2.5 Description of the Proposed Changes The purpose of this LAR is to.credit the SSF as the assured mitigation path following a tornado. More specifically, this LAR credits SSF ASW as the replacement for EFW and PSW, and credits SSF RCMU as the replacement for HPI. In addition, the SSF eliminates reliance on the other onsite and offsite power systems for SSD.

The LAR requests the following:

Approval for crediting the SSF as the assured mitigation path following a tornado with the assumed initial conditions of loss of all AC power to all units with significant tornado damage to one unit.

12

License Amendment Request No. 2018-02 September 14, 2018 Approval for formal incorporation of the use of TORMIS in the ONS tornado LB and associated UFSAR changes.

Approval for elimination of the SFP to HPI flow path for RCS Makeup.

implementation of the proposed tornado LB and the related commitments will clarify and, in some cases, revise the ONS current LB to collectively enhance ONS overall design and safety margin. The LAR also proposes to credit a number of plant modifications to enhance ONS capability to withstand the effects of a damaging tornado. Equipment installed by these modifications will be physically protected or evaluated in the TORMIS model noted above. Note that the modifications are being performed under 1 O CFR 50.59 and their approval is not a part of this LAR even though they are discussed.

Specific elements of the revised tornado LB and committed modifications are as follows:

2.5.1 Revise and clarify the tornado LB description documented in UFSAR Sections 3.2, 3.3, 3.5, 5.1, 5.2, 9.6, 9.7, and 10.4; and add the TORMIS methodology, inputs, and results to UFSAR Section 3.5. Changes are described in detail in Section 2.6 and submitted with this LAR. This addresses commitment 18T identified in the Tornado/HELB Commitment-fetter submitted to the NRG on November 15, 2017 (Reference 41). Note that the change related to UFSAR Table 3-23 will be tracked as an implementation item and made through nmmal station processes.

2.5.2 Revise and clarify the SSF Bases for TS 3.10.1 to address degradation of passive civil features as not applying to operability under TS LCO 3.10.1, "Standby Shutdown Facility," but rather as UFSAR commitments outside of ONS TS. This addresses commitment 19T previously identified in the Tornado/HELB Commitment letter submitted to the NRG on November 15, 2017 (Reference 41).

2.5.3 Eliminate the SFP to HPI flow path for RCS Makeup. Changes are described in detail in section 2.6, justified in section 3.7, and submitted with this LAR.

2.5.4 Provide missile protection for the outdoor SSF diesel fuel oil tank fill and vent lines to prevent shear/perforation of the piping and subsequent rain water intrusion into the underground tank.

2.5.5 Credit for a new SSF RCMU pulsation dampener in each unit to accommodate operation of the SSF RCMU system at lower range RCS pressures.

2.5.6 Credit for a new SSF letdown line in each unit to provide SSF CR operators with the ability to control the plant at lower range RCS pressures.

2.5.7 Provide new QA-1 instrumentation in the SSF CR for SG pressure, nuclear instrumentation, core exit thermocouples, pressurizer temperature, and temperature compensated pressurizer level.

2.6 UFSAR Changes Duke Energy proposes to modify the UFSAR, as follows below, to describe the ONS tornado mitigation strategy and update other applicable sections to reflect the SSF as the mitigation strategy. Duke Energy plans to implement the UFSAR changes on a per unit basis. When all modifications are complete on a unit, the proposed changes described below will be issued for that unit through normal station processes. For the intent of this LAR and sake of review, the 13

License Amendment Request No. 2018-02 September 14, 2018 proposed changes are treated like all modifications have been completed for all three units. The UFSAR marked-up and retyped pages are provided in Attachments 2 and 3, respectively.

Replace the text in UFSAR Section 3.2.2 for 4. Tornado (Page 3.2-4) with the following:

"The Reactor Coolant System, by virtue of its location within the Reactor Building, will not be damaged by a tornado. Capability is provided to shutdown safely all three units. Tornado is not considered a design basis event (DBE) or transient for Oconee. Protection against tornado is an Oconee design criterion, similar to the criteria to protect against earthquakes, wind, snow, or other natural phenomena described in UFSAR Section 3.1.2. A specific occurrence of these phenomena is not postulated.

The statement, "Capability is provided to shutdown safely all three units" was intended to be a qualitative assessment that, after a tornado, normal shutdown systems would remain available or alternate systems would be available to allow shutdown of the plant. It was not intended to imply that specific systems should be tornado proof. As part of the original FSAR development, specific accident analyses were not performed to prove this judgment, nor were they requested by the NRC. Subsequent probabilistic studies confirmed that the original qualitative assessments were correct. The risk of not being able to achieve safe shutdown after a tornado was sufficiently small that additional protection was not required.

In an effort to ensure the risk of not being able to achieve safe shutdown after a tornado is maintained sufficiently small, design criteria are applied to the SSF through physical protection and TORMIS to establish its capability to mitigate a tornado. The overall tornado mitigation strategy utilizes the deterministically tornado protected SSF for secondary side decay heat removal (SSDHR) and reactor coolant makeup (RCMU) following a postulated loss of all normal and emergency systems which usually provide these safety functions.

Successful mitigation of a tornado condition at Oconee is defined in UFSAR Section 9.6, SSF. The SSF and its related equipment have been physically protected to meet tornado requirements or have been evaluated using TORMIS."

Add the License Amendment to UFSAR Section 3.2.3, Reference (Page 3.2-7) per the following:

"5. License Amendment No. XXX, XXX, and XXX (date of issuance - Month XX, 20XX);

Tornado Mitigation."

Add the text in UFSAR Section 3.3.2.1, Applicable Design Parameters (Page 3.3-

1) to the last paragraph as follows:

"... The design of new systems (and their associated components and/or structures) that are required to resist tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Regulatory Guide 1.76, Revision 1 or be evaluated by TORMIS."

14

License Amendment Request No. 2018-02 September 14, 2018 Add the License Amendment to UFSAR Section 3.3.3, Reference (Page 3.3-2) per the following:

"3. License Amendment No. XXX, XXX, and XXX (date of issuance - Month XX, 20XX);

Tornado Mitigation."

Add the text in UFSAR Section 3.5.1.3, Missiles Generated by Natural Phenomena (Page 3.5-7) to the last paragraph as follows:

"... The design of new systems (and their associated components and/or structures) that are required to resist tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Regulatory Guide 1.76, Revision 1 or be evaluated by TORMIS."

Insert Section 3.5.1.3.1 following the last paragraph of UFSAR Section 3.5.1.3 Missiles Generated by Natural Phenomena (Page 3.5-7) as follows:

"3.5.1.3.1 TORMIS Methodology The TORMIS computer code is used to determine the frequency of a damaging tornado missile strike on unprotected plant SSCs that are used to mitigate a tornado. The TORMIS code is an updated version of the original TORMIS code developed for the Electric Power Research Institute (EPRI). The methodologies used in the code to evaluate the frequency of damaging tornado missile strikes are documented in References 9, 1 O, 11, and 12.

The TORMIS code accounts for the frequency and severity of tornadoes that could strike the plant site, performs aerodynamic calculations to predict the transport of potential missiles around the site, and assesses the annual frequency of these missiles striking and damaging structures and other targets of interest.

The analysis requires the development of input data in three broad areas:

1. development of site tornado hazard information.

2. development of site missile characteristics.

3. development of target size, location, and physical properties.

TORMIS Model Inputs The TORMIS methodology seeks to demonstrate that the annual probability of a radioactive release in excess of 1 O CFR 100 resulting from tornado missile damage to unprotected SSCs used to mitigate a tornado is less than the acceptance criterion of 1 E-06/rx-yr. This means that the unprotected SSCs are evaluated collectively against the acceptance criterion rather than individually. For a multi-unit site such as Oconee, this criterion is applied to each unit individually.

For this evaluation, the prevention of a "release in excess of 10 CFR 100" is accomplished by establishing SSD conditions following a tornado strike and maintaining these conditions for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The following safety functions are required:

15

License Amendment Request No. 2018-02 September 14, 2018

• Secondary Side Decay Heat Removal,

• Reactor Coolant Makeup,

• Reactor Coolant System pressure boundary integrity.

Through a process of plant walkdowns and reviews of plant drawings, calculations, and other information, a detailed list of structures and equipment lacking deterministic protection was developed that meets the scope of the TORMIS safety targets described above.

TORMIS Results A site specific analysis of vulnerable tornado mitigation equipment (SSCs) has been conducted using the TORMIS analysis methodology. This includes a characterization of the site tornado hazard and potential tornado generated missiles developed in a manner consistent with the requirements of the TORMIS User's Manual and other TORMIS reference materials.

For each Oconee unit, the mean annual frequency of a damaging tornado missile strike resulting in a radiological release in excess of 1 O CFR 100 limits was determined to be less than the acceptance criterion of 1 E-06. The analysis was performed in a manner consistent with the requirements of the EPRI topical reports and with the requirements set forth in the NRC's SER (Reference 14) and RIS 2008-14 (Reference 15)."

Add the references discussed in new ~ection 3.5.1.3.1 to UFSAR Section 3.5.3, Reference (page 3.5-8) as follows:

9.

Electric Power Research Institute Report - EPRI NP-768 and NP-769, "Tornado Missile Risk Analysis," dated May 1978.

1 O.

Electric Power Research Institute Report - EPRI NP-2005, Volumes I and 2, "Tornado Missile Risk Evaluation Methodology," dated August 1981.

11.

Applied Research Associates, Inc., Project 5313, "TORMIS95 User's Manual:

Tornado Missile Risk Methodology," dated December 1995.

12.

License Amendment No. XXX, XXX, and XXX (date of issuance - Month XX, 20XX);

Tornado Mitigation.

13.

Regulatory Issue Summary 2015-06, "Tornado Missile Protection," dated June 10, 2015.

14.

Rubenstein, L.S. "Safety Evaluation Report - Electric Power Research Institute (EPRI)

Topical Reports Concerning Tornado Missile Probabilistic Risk Assessment (PRA)

Methodology," U.S. Nuclear Regulatory Commission letter to F. J. Miraglia, dated October 26, 1983.

15.

Regulatory Issue Summary 2008-14, "Use of TORMIS Computer Code for Assessment of Tornado Missile Protection," dated June 16, 2008.

Insert the proposed paragraph after the last paragraph in UFSAR Section 5.1.2.4, Natural Circulation (5.1-5) as follows:

"The effects of a tornado may drive a unit to an average reactor coolant temperature less than 525°F. The subsequent minor reduction in RCS temperature required to compensate for the increase in RCS inventory by the SSF RCMU pump during plant stabilization does not 16

License Amendment Request No. 2018-02 September 14, 2018 constitute a natural circulation cooldoyvn requiring use of the reactor vessel head vent. Refer to Reference 2 for additional information."

Add the License Amendment to UFSAR Section 5.1.3, Reference (page 5.1-5) as follows:

2. License Amendment No. XXX, XXX, and XXX (date of issuance - Month XX, 20XX);

Tornado Mitigation.

Revise UFSAR Section 5.2.3.4, Steam Generators (page 5.2-23) as follows:

"Feedwater line breaks and other overheating events impose compressive loads on the steam generator tubes as the RCS heats up and/or the steam generator shell cools down.

Analyses have demonstrated that steam generator tube integrity is maintained for these loads for the replacement steam generators."

. Revise UFSAR Section 9.6.1, SSF, General Description (page 9.6-2) as follows:

"System Main Components are listed in Table 9-14. SSF Primary Valves are listed in Table 9-15. SSF instrumentation is listed in Table 9-16.

Based on subsequent SSF licensing correspondence, different design criteria may have been applied for new SSF events. Refer to the event specific design bases below for details."

Revise UFSAR Section 9.6.2, SSF, SSF Tornado Design Criteria (page 9.6-3) as follows:

"This is a design criterion for the SSF structure that was committed to as part of the original SSF licensing correspondence and remains valid. All parts of the SSF structure that are required for mitigation of the SSF events are required to be designed against tornado winds and associated tornado missiles. This requirement is satisfied through appropriate design of the SSF structure. Originally, the design criterion did not extend to SSCs that were already part of the plant which SSF relies upon and interfaces with for event mitigation. The design criterion is now extended to SSCs that are a part of the plant which the SSF relies upon and interfaces with for tornado mitigation. This is satisfied either through physical protection or evaluated by TORMIS. It is important to note that the overall tornado mitigation strategy utilizes the SSF to mitigate a tornado (Reference 42). Tornado design requirements for the plant itself are addressed in Section 3.2.2.

Successful mitigation of a tornado condition at Oconee shall be defined as meeting the following criteria to ensure that the integrity of the core and RCS remains unchallenged:

The core must remain intact and in a coolable core geometry during the credited strategy period.

RCS must not exceed 2750 psig (110% of design).

Minimum Departure from Nucleate Boiling Ratio (DNBR) meets specified acceptable fuel design limits.

Steam Generator tubes remain intact.

RCS remains within acceptable pressure and temperature limits.

The tornado initial conditions are defined for the unit(s) as MODE 1, 102% rated thermal power at end of core life {690 effective full-power days). Two analyses were performed, overheating and overcooling. For an overheating event, the significantly damaged unit is 17

License Amendment Request No. 2018-02 September 14, 2018 supplied by SSF ASW. The other two units will be initially supplied by the TDEFWP and subsequently supplied by SSF ASW. For an overcooling event, the TDEFWP is conseNatively assumed to run until the contents of the Upper Surge Tank are depleted (to maximize the overcooling). SSF ASW flow is subsequently ~stablished to all three units as needed.

The SSF is not required to meet the single failure criterion or the postulation of the most reactive rod stuck fully withdrawn. Failures in the SSF system will not cause failures or inadvertent operations in other plant systems. The SSF requires manual activation and can be activated if emergency systems are not available. A subsequent issue related to crediting SSF ASW as an alternative for EFW tornado missile protection vulnerabilities is discussed below (see EFW Tornado Missile Design Criteria)."

Revise UFSAR Section 9.6.2, SSF, EFW Tornado.Missile Design Criteria (page 9.6-4) to add the following as a 2nd paragraph:

"However, the current overall tornado mitigation strategy utilizes the SSF to mitigate a tornado. Thus, the plant relies upon the SSF ASW System to provide feedwater to the SGs of the significantly damaged unit after a tornado (Ref. 42). The SSF ASW System is either physically protected or evaluated by TORMIS."

Add the text in UFSAR Section 9.6.3.1, Structure - Wind And Tornado Loads (Page 9.6-6) to the last paragraph as follows:

"... The design of all future changes to and/or analysis of SSF-related systems, structures, and components subject to tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Regulatory Guide 1.76, Revision 1 or be evaluated by TORMIS."

Add the text in UFSAR Section 9.6.3.1, Structure - Missile Protection (Page 9.6-7) to the last paragraph as follows:

"... The design of all future changes to and/or analysis of SSF-related systems, structures, and components subject to tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Regulatory Guide 1.76, Revision 1 or be evaluated by TORMIS."

Revise UFSAR Section 9.6.5, Operation and Testing (page 9.6-18) to state the following:

"The SSF will be placed into operation to mitigate the consequences of the following events/criterion:

Note that tornado is a design criterion per Section 3.2.2, but is treated similar to an event in that planned, formalized actions are taken as the result of a reported tornado.

1. Flooding

2. Fire

3. Sabotage

4. Station Blackout

5. Tornado" 18

License Amendment Request No. 2018-02 September 14, 2018 Revise the 4th paragraph as follows:

"For flooding, sabotage, station blackout, tornado, and those fire events where the SSF is credited for safe shutdown, operators will be sent to the SSF. When directed by the shift supervisor or procedure, the operator will start the SSF RCMU system and establish SSF.

Auxiliary Service Water flow to the steam generators as needed, as well as close SSF controlled Reactor Coolant System pressure boundary valves."

Add the License Amendment to UFSAR Section 9.6.6, Reference (Page 9.6-20) as follows:

42. License Amendment No. XXX, XXX, and XXX (date of issuance - Month XX, 20XX);

Tornado Mitigation.

Revise UFSAR Section 9.7.1, PSW General Description (Page 9.7-2) to add the following after the second paragraph:

"In the event of a loss of access to cooling water from Lake Keowee due to a dam failure with a subsequent loss of the intake canal submerged weir, the volume of water that remains trapped in the CCW intake and discharge piping of the three ONS units is relied upon as an alternative heat sink. The PSW system can draw on the stored volume of water retained in the CCW piping (intake and discharge lines below elevation 791 ft.) of all three ONS units, which is sufficient to provide secondary side decay heat removal for at least 30 days.

Operation of the PSW system does not increase the temperature. of the water in the CCW volume beyond the design limits for the PSW system components."

Revise UFSAR Section 10.4.7.1, the 1st full paragraph as follows: (Page 10.4-9)

"Portions of the EFW System are vulnerable to tornado missiles. Thus, the plant relies upon the SSF ASW System to provide feedwater to the SGs (See UFSAR Section 9.6.2) after a tornado."

Revise UFSAR Section 10.4.7.3.6 (page 10.4-21) to include a 2nd paragraph as follows:

"The current overall tornado mitigation strategy utilizes the SSF to mitigate a tornado. Thus, the plant relies upon the SSF ASW System to provide feedwater to the SGs (See UFSAR Section 9.6.2) after a tornado (Ref. 20)."

Add the License Amendment to UFSAR Section 10.4.9, References (Page 10.4-24) as follows:

20. License Amendment No. XXX, XXX, and XXX (date of issuance - Month XX, 20XX);

Tornado Mitigation.

3 TECHNICAL EVALUATION The Technical Evaluation assesses the new licensing basis of the SSF as the assured mitigation path following a tornado without the previous backup flowpath from the SFP to the HPI system. Consideration was given to the T-H response utilizing the SSF, the tornado protection features of the SSF, and operator actions utilizing the SSF.

3.1 RCS T-H Analysis The Main Feedwater and Main Steam piping located outside containment are not protected from tornado missiles. Therefore, these. piping systems may or may not remain intact following a 19

License Amendment Request No. 2018-02 September 14, 2018 tornado strike. The RCS T-H analysis was performed for the SSF considering the possibility that either piping system could be faulted. A faulted Main Feedwater line is considered in the overheating analysis while assuming Main Steam lines remain intact to maximize the overheating. A faulted Main Steam line(s) is considered in the overcooling analysis while assuming Main Feedwater piping remains intact. Both the overheating and overcooling analyses assume that tornado damage has resulted in the loss of both offsite and onsite emergency power sources.

RCS T-H analysis was performed for the SSF as the assured mitigation path following a tornado with the assumed initial conditions of loss of all AC power to all units with significant tornado damage to one unit. The significant damage to one unit is defined as either a Main Feedwater or Main Steam line break.

For tornadoes that are postulated to create a Main Feedwater or Main Steam line break, T-H analyses were performed using Duke Energy's RELAP5/MOD2-B&W ONS T-H model. The ONS RELAP5/MOD2-B&W model and analysis methods are described in Duke Energy's NRG approved methodology report DPC-NE-3003-PA (Reference 15) and have been modified, as described in Attachment 5, to include additional detail and features required to perform these analyses.

3.1.1 Tornado Mitigation - Overheating Analysis The postulated piping failures in the Main Feedwater system outside containment were analyzed for their effects on the ability to achieve and maintain SSD of the affected unit following a tornado. It is assumed that a loss of all station AC power occurs as a result of the tornado.

The SSF ASW system is credited with providing a means of establishing SG heat removal to the unit experiencing the Main Feedwater line break.

A new analysis has been performed to evaluate the ONS RCS response to a loss of feedwater and a loss of all AC power due to a tornado. The primary objective of the analysis is to demonstrate the SSF is capable of meeting the proposed tornado mitigation success criteria for a limiting overheating event.

The results of the analysis met the success criteria. Details of the overheating analysis are contained in Attachment 7.

3.1.2 Tornado Mitigation - Overcooling Analysis The primary objective of the overcooling analysis is to demonstrate adequate core cooling and establish a basis for mitigation strategies using the SSF for establishing and maintaining SSD conditions following a tornado.

This analysis evaluates the ONS RCS response to a single or double Main Steam line break on one unit and loss of all AC power to all three units due to a tornado.

The results of the analysis met the success criteria. Details of the overcooling analysis are contained in Attachment 7.

20

License Amendment Request No. 2018-02 September 14, 2018 3.2 Revised Licensing Basis Strategy for Tornado Proposed Licensing Strategy Based upon the ongoing tornado project efforts, a new mitigation strategy is being defined for ONS that is deterministic. Although diverse means of primary makeup, secondary decay heat removal, and electrical power may remain available during a tornado, only one protected strategy will be credited. That strategy is utilization of the SSF. For those limited portions of the SSF and associated support systems that are not physically protected as a result of structural/physical/economic constraints, TORMIS is utilized.

The proposed licensing strategy for mitigating a tornado condition depends solely upon the SSF and its associated support systems. The tornado initial conditions are defined for the unit(s) as MODE 1, 102% rated thermal power at end of core life (690 effective full-power days). The tornado is assumed to leave one unit significantly damaged and a loss of all AC power to all three units.

Following a tornado induced overheating event, the SSF provides the means to achieve and maintain the unit in MODE 3 with average RCS temperature ;;:: 525°F (unless the initiating event causes the unit(s) to be driven to a lower temperature) for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a tornado.

Following a tornado induced overcooling event, the SSF provides the means to achieve and maintain the unit in MODE 3 at a reduced RCS temperature and pressure for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a tornado.

The new success criteria will be as follows:

Successful mitigation of a tornado condition at Oconee shall be defined as meeting the following criteria to ensure that the integrity of the fuel and RCS remains unchallenged:

The core must remain intact and in a coolable core geometry during the credited strategy period.

Minimum Departure from Nucleate Boiling Ratio (DNBR) meets specified acceptable fuel design limits.

RCS pressure must not exceed 2750 psig (110% of design).

In addition to the criteria specified above, the following criteria are validated for the overcooling analysis to demonstrate acceptable results.

The steam generator tubes remain intact.

RCS remains within acceptable pressure and temperature limits.

Stabilization is accomplished utilizing the following features of the SSF and the containment structure:

SSF Structure The SSF structure is designed for tornado differential pressure, wind, and missile loadings in accordance with the UFSAR.

21

License Amendment Request No. 2018-02 September 14, 2018 SSF RCMU System The SSF RCMU system is aligned to take suction from the SFP to borate the RCS, maintain adequate RCS inventory control, and provide RCP seal cooling. The SSF RCMU system injects borated water into the RCS via the RCP seals. The SFP serves as the only suction source for the SSF RCMU system. The inventory in the SFP is sufficient to support operation of the SSF RCMU system for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The SSF RCMU system is designed to provide RCS letdown. For overheating cases, SSF letdown is established to compensate for the borated water injected by the RCMU pump to maintain RCS inventory and pressurizer level stable. For overcooling cases, the pressurizer is initially subcooled and RCS pressure is maintained stable by controlling pressurizer level via the RCMU pump and by controlling RCS temperature via SSF ASW flow to the SGs. Once the pressurizer is saturated, RCS temperature is maintained stable by SSF ASW flow, RCS pressure is maintained stable by the pressurizer heaters and RCS inventory and pressurizer level is maintained stable by establishing SSF letdown.

The SSF RCMU system components include the makeup pump, suction valves, discharge valves, and RCS letdown valves. The RCMU system pressure boundary piping is wholly contained in the reactor building and the SFP. The reactor buildings are designed to withstand the postulated tornado loadings including missiles created by tornado winds. The SFP is deterministically protected through physical protection and evaluated by the TORMIS analysis.

SSF Powered Pressurizer Heaters The SSF is capable of supplying power to pressurizer heater bank 2, groups B and C. These heater groups are controlled from the SSF CR to restore and maintain the RCS within the desired pressure range.

SSF ASW System As a result of postulated tornado effects, the Main Feedwater and EFW systems (except the TDEFWP on undamaged units) are assumed to be unavailable. The SSF ASW system is designed to feed directly to the SGs to provide secondary side heat removal to cool the RCS following this postulated loss of all Main Feedwater and EFW systems. Two analyses were performed, overheating and overcooling. For an overheating event, the significantly damaged unit is supplied by SSF ASW. The other two units will be initially supplied by the TDEFWP and subsequently supplied by SSF ASW. For an overcooling event, the TDEFWP is conservatively assumed to run until the contents of the Upper Surge Tank are depleted (to maximize the overcooling). SSF ASW flow is subsequently established to all three units as needed.

SSFDG Tornado protected electrical power to the SSF system is provided by an independent 4kV DG contained within the SSF structure. The generator, diesel engines, and associated electrical equipment (switchgear, transformers, load center, motor control centers, and panel boards) are contained within the SSF structure.

22

License Amendment Request No. 2018-02 September 14, 2018 SSF Instrumentation The instrumentation needed to support SSD from the SSF CR is either physically protected or analyzed by TORMIS. The instrumentation used to mitigate the tornado with indications in the SSF CR includes the following for all three Oconee Units:

Core Exit Thermocouples*

RCS Loop A Pressure RCS Loop 8 Pressure RCS Loop A Hot Leg Temp RCS Loop 8 Hot Leg Temp RCS 'A1' Cold Leg Temp RCS 'A2' Cold Leg Temp RCS '81' Cold Leg Temp RCS '82' Cold Leg Temp Temperature Compensated Pressurizer Level*

Pressurizer Pressure Pressurizer Temperature*

'A' SG Pressure*

'8' SG Pressure*

'A' SG Water Level

'B' SG Water Level SSF ASW Flow (to each Unit)

Nuclear Instrumentation*

• Note this will be upgraded or newly installed instrumentation.

23

License Amendment Request No. 2018-02 September 14, 2018 3.3 Operations Response, Training, and Procedures Operator's Response The tornado mitigation strategy utilizes the tornado protected SSF for SSDHR and RCMU following a loss of all normal and emergency systems which usually provide these safety functions. The SSF is designed to maintain the reactor(s) in a SSD condition with average RCS temperature ~ 525°F (unless the initiating event causes the unit(s) to be driven to a lower temperature) for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The SSF subsystems are manually initiated and are completely controlled from the SSF with the exception of the SSF portable pump. The portable pump is installed locally at the CCW intake canal and operated from the SSF.

The tornado mitigation strategy credits the SSF for establishing and maintaining SSD up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following the tornado.

In preparation for a potential tornado, Operations may staff the SSF with at least one licensed operator. Upon receipt of a "Tornado Watch" or "Tornado Warning" message on the National Weather Service radio located in the main CR, the Control Room Senior Reactor Operator (CRSRO) enters abnormal operating procedure AP/O/A/1700/006, Natural Disaster. In the Natural Disaster AP, the CRSRO has the option to preemptively staff the SSF with a licensed operator upon receipt of a "Tornado Watch" message. "Tornado Watch" means conditions are favorable for the development of tornadoes in and close to the watch area. Tornado watches predominately occur during afternoon thunderstorms. Operations can track thunderstorms via the Duke Energy meteorological website from the main CR computers. If the thunderstorm is tracking towards the site, the CRSRO may elect to staff the SSF. If the thunderstorm is tracking away from the site, the CRSRO would likely not staff the SSF:

The CRSRO is required to preemptively staff the SSF with a licensed operator upon receipt of a "Tornado Warning" message in accordance with the Natural Disaster AP. A tornado warning means that a tornado has been sighted or indicated by weather surveillance radar in the warning area.

In addition to the procedure described above, the Shift Manager, acting as the site Emergency Coordinator, has the discretion to staff the SSF (including continuously) in accordance with site Emergency Plan Response Procedure RP/O/A/1000/035, Severe Weather Preparations. An example of when this procedure may be implemented is if a hurricane has tracked through the Gulf of Mexico and tornado watch and warning boxes are approaching ONS.

)

The revised tornado LB assumes that a tornado strikes the plant site during full power operation and disables all AC power supplies to the site. This includes loss of power from the Keowee Hydro Units, transformer CT-5, the PSW substation to the PSW building, the 230kV switchyard, and the 525kV switchyard. A loss of all AC power to the site results in a loss of normal reactor coolant injection and RCP seal cooling capability to all three units. The revised tornado LB also assumes that the tornado results in significant damage to one Oconee unit causing either an overheating scenario from a loss of all sources of feedwater to the SGs or an overcooling scenario from a possible breach of the MS system pressure piping. For an overheating scenario, the turbine driven EFW pump is assumed unavailable for the significantly damaged unit. For an overcooling scenario, the turbine driven EFW pump is assumed available until the Upper Surge Tank is depleted.

24

License Amendment Request No. 2018-02 September 14, 2018 The operating crew on each affected unit will respond to the reactor trip by performing procedure EP/1,2,3/A/1800/001, Emergency Operating Procedure (EOP). The EOP provides guidance to ensure the reactor and turbine are tripped, RCP seal cooling is available, the reactor remains subcritical, adequate RCS inventory is being provided, and the appropriate amount of SG cooling is being provided. During performance of the EOP, the operating crew determines if a loss of RCP seal cooling and SG cooling has occurred and directs, as necessary, the operator stationed at the SSF to establish RCP seal cooling and SG feed from the SSF for the unit not being supplied with EFW.

For the significantly damaged unit, when directed by the main CR by radio, telephone, or additional dispatched operator, the operator stationed at the SSF takes the following actions to reestablish RCP seal cooling and SSDHR using AP/O/A/1700/025, SSF Emergency Operating Procedure (SSF EOP):

1. Proceeds from the SSF CR to the Heating, Ventilation, and Air Conditioning (HVAC) room one floor above and performs a breaker transfer for the 600 VAC Motor Control Centers (1 XSF, 2XSF, or 3XSF) to transfer control of the RCS boundary isolation valves, various instruments, and pressurizer heaters from the main CR to the SSF CR.

2. Proceeds from the SSF HVAC room back to the SSF CR one floor below.

3. Emergency starts the SSF DG, aligns the DG to power the SSF electrical system and starts the SSF ASW pump.

4. Starts the SSF RCMU pump in the override mode for the unit requiring both SSF RCMU and SSF ASW. When started in the override mode, the pump suction and discharge flow paths are automatically aligned and the RCMU pump then automatically starts to provide RCP seal cooling when RCS pressure is below the RCMU pump interlock setpoint. Restoration of RCP seal cooling is an existing time critical action (TCA) which must be completed within 20 minutes of a loss of seal cooling (Reference 35).

5. Establishes SSF ASW flow to the affected unit's SG to stabilize RCS pressure and temperature. If the tornado results in a RCS overheating event, establishing SSF ASW flow to the SGs is an existing TCA which must be completed within 14 minutes of a loss of all FDW. If the tornado results in a RCS overcooling event, establishing SSF ASW flow to the SGs may not be required for up to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> (Reference 36).

6. Closes the RCS boundary isolation valves. Closing the inside containment RCP seal return valve is an existing TCA which must be accomplished within 15 minutes. The closing of the other RCS boundary isolation valves is an existing TCA that must be accomplished within 20 minutes.

7. Energizes the Pressurizer (PZR) heaters powered from the SSF. If the tornado results in a RCS overheating event, energizing the PZR heaters is an existing TCA which must be completed within 20 minutes. If the tornado results in a RCS overcooling event, energizing the PZR heaters may not be required for up to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> (Reference 36).

8. Establishes RCS letdown from the SSF.

Note that the TCAs referenced already exist and have been previously licensed for similar scenarios (References 42 and 43).

25

License Amendment Request No. 2018-02 September 14, 2018 As required, one additional licensed operator per unit is dispatched to the SSF from the main CR for each of the other two units along with one SSF qualified non-licensed operator. Four available exits from the AB to the SSF and two entrances into the SSF provide reasonable assurance that the additional operators can access the SSF CR. In addition, there is a partially enclosed steel pathway provided between the radiation protection (RP) building and the south entrance to the SSF. The RP building is connected to the AB between Unit 2 and Unit 3, and is partially protected by the Unit 2 reactor building and the Unit 3 SFP building.

Upon arriving in the SSF CR these additional licensed operators perform similar. actions as described above using SSF EOP for the respective unit.

The operators in the SSF CR will establish communications.

One hour and forty-five minutes after the SSF DG is started, the non-licensed operator locally diverts the discharge from the DG heat exchangers to the yard drains per SSF EOP. This action is performed within the SSF and is an existing TCA which must be completed between one hour forty-five minutes and two hours following the start of the SSF DG.

The Maintenance department is notified to deploy the SSF portable pump and prepare it for operation per SSF EOP. If the gravity flow paths used to replenish the Unit 2 CCW intake piping are unavailable, the discharge piping of the SSF portable pump is aligned to the Unit 2 CCW intake piping and the pump is placed in operation. The deployment and placing of the SSF portable pump in operation is an existing TCA which must be completed within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and 20 minutes of a loss of forced and gravity CCW system flow.

The licensed operators stationed at the SSF place the affected unit(s) in a safe shutdown condition. If the shift manager determines that AC power will not be restored within four hours, an extended loss of all AC power (ELAP) condition will be declared and the EOP will direct the operators to begin implementing the Oconee FLEX strategy in accordance with NEI 12-06, Revision 0, "Diverse and Flexible Coping Strategies (FLEX) Implementation Guide."

While the operators at the SSF are placing the affected unit(s) in SSD the operations shift manager initiates the emergency plan, and activates the technical support center and the operations support center.

Training Licensed operators receive classroom, simulator (including the SSF simulator) and on-the-job training on the EOP and the abnormal procedures (AP) during the initial licensed operator training program. Licensed operators maintain their proficiency with these procedures and their skill in placing the plant in a SSD condition using the simulator through participation in the licensed operator initial and continuing training program. Non-licensed operators receive training on their EOP and the AP related tasks through participation in the non-licensed operator initial and continuing training programs.

All shift licensed operators and non-licensed operators are required to perform quarterly SSF proficiency drills as specified in Operations Management Procedure (OMP) 2-23, Shift Manager Rules of Practice. Licensed operators may perform two of the four quarterly drills on the SSF simulator at the operations training center. Also, licensed and non-licensed operators may be evaluated on SSF time critical tasks using job performance measures (JPMs) during their annual operating exam that is part of the operator requalification program.

26

License Amendment Request No. 2018-02 September 14, 2018 For implementation of this LAR, both shift licensed operators and non-licensed operators will receive training on the modifications associated with the new tornado strategy. Emergency procedures, Abnormal procedures, and the TS bases will be revised to reflect the change in tornado mitigation strategy. Licensed operators will be trained on those procedures as well. All of these changes and training will be completed prior to implementing the new licensing strategy.

Operations Procedures Operations staffs the SSF in preparation of a tornado in accordance with the Natural Disaster AP.

The actions taken by operators in the main CR to achieve and maintain the affected unit(s) in MODE 3 are provided in th~ EOP.

The actions taken by operators at the SSF to achieve and maintain the affected unit(s) in MODE 3 are provided in the SSF EOP.

The current SSF EOP provides guidance to place the unit(s) in a SSD condition following an overheating event and no additional procedure revisions or training will be required.

The SSF EOP will be revised to provide the guidance required to place the tornado affected unit in a SSD condition following an overcooling event. In summary, this procedural guidance will direct the operators to:

Start the SSF RCMU pump to restore RCP seal cooling and makeup to the RCS.

Close the RCS boundary isolation valves to isolate potential RCS diversion paths.

Energize the pressurizer heaters to reheat the pressurizer to saturated conditions when pressurizer level exceeds 90".

Establish SSF ASW flow to the affected SG(s) to stabilize RCS temperature and pressure. This, in turn, will stabilize pressurizer level in order to limit the volume of water in the pressurizer that must be heated to saturated conditions.

When saturated conditions are established in the pressurizer, cycle pressurizer heaters to maintain RCS pressure within a prescribed band, throttle SSF ASW flow to maintain RCS temperature within a prescribed band, and establish SSF letdown to maintain pressurizer level within a prescribed band.

All Oconee EOP and AP procedure changes go through a rigorous verification and validation process governed by OMP 4-02, Verification and Validation Process for APs, EOP, and Support Procedures. The purpose of the verification and validation process is to ensure that the procedures used to mitigate and correct abnormal and emergency conditions meet certain criteria. These criteria include written correctness, accurate technical content, usability, and operational correctness. Procedure verification provides assurance of written correctness and that the procedure is technically accurate, consistent with plant specific operating guidelines, and equipment accessibility. Procedure validation provides assurance that the procedure contains sufficient and understandable operator information and is compatible with plant response, equipment accessibility, plant hardware, and shift manpower. Procedures are validated using a table top setting, in the field, and/or on the training simulator, including the 27

License Amendment Request No. 2018-02 September 14, 2018 SSF simulator for the SSF procedure. Procedure validation also ensures that TCAs can be completed within the required time during validation.

TCAs are managed in accordance with fleet directive NSD-514 (AD-OP-ALL-0205), Control of Time Critical Tasks, which provides guidance on how to identify TCAs and control these actions to assure the required times can be met. Oconee Operations maintains a periodic test procedure listing all TCAs and performs this test procedure at least once every five years to verify the ability to accomplish the actions. The TCAs referenced for actions at the SSF following a tornado already exist and have been previously licensed for similar scenarios (References 42 and 43).

3.4 Other Safety Considerations 3.4.1 Chlorine Gas Tank Rupture A small amount of chlorine (a maximum of four 150-lb cylinders) is stored in compressed gas cylinders located on the east exterior wall of the water treatment room located within the service building. The chlorine cylinders are approximately 500 feet northeast of the Unit 1 main CR and approximately 800 feet northeast of the operator's path to the SSF. If the cylinders are damaged by a tornado, the chlorine gases are assumed to be dispersed by the tornado winds and not impact the operators. Additionally, the straight line wind path between the SSF operator's pathway and the tanks is blocked by the turbine and auxiliary buildings.

3.4.2 Ammonia, Nitrogen, Hydrogen, Liquid Propane (LP), Carbon Dioxide, Welding Gasses and Hydrazine Tank Ruptures Nitrogen tanks and one standard LP tank are located outside the northeast corner of the turbine building. They are approximately 550 feet northeast of the SSF operator pathway. The straight line wind path between the SSF operator pathway and the tanks is blocked by the turbine and auxiliary buildings.

Hydrogen storage tanks are located at the northeast corner of the station site more than 900 feet from the SSF operator path. Several buildings exist between the hydrogen tanks and the SSF operator path including the turbine and auxiliary buildings.

Welding gas tanks are stored at the welding shop located northeast of the maintenance support building more than 700 feet from the SSF operator pathway. The turbine building, maintenance support building and auxiliary building stand between the welding gas storage area and the SSF operator pathway.

The aforementioned gas cylinders are stored in approved containers located in approved chemical storage areas meeting all applicable Occupational Safety and Health Administration requirements. Similar to a chlorine cylinder rupture, if a tornado missile strikes and ruptures a chemical container, it is assumed that the high winds rapidly disperse any chemical releases such that the operators are not impacted. As an added precaution, self-contained breathing apparatuses are available to operators (the Unit 1 and 2 main CRs have six apparatuses, the Unit 3 main CR has three apparatuses, and the SSF has three apparatuses staged near the SSF CR).

28

License Amendment Request No. 2018-02 September 14, 2018 3.5 Corrosion Effects If the SSF is activated due to a tornado, lake water could be introduced to the SGs. The use of lake water during an SSF response does not constitute a change to the ONS LB.

It is noted that the SG tubes and key SG support structures (support plates, tie rods) are constructed of corrosion resistant materials. Specifically, the SG tubes are constructed of Alloy 690 material. The support plates and tie rods are constructed of stainless steel material.

The corrosion-resistant materials used in the construction of the SGs should prevent accelerated corrosion of SG components that might result in tube rupture from such an event.

3.6 TORMIS Methodology The TORM IS analysis provides justification for SSCs required for tornado mitigation that do not meet UFSAR requirements for physical tornado missile protection. This evaluation utilizes the TORMIS analysis methodology reviewed and approved in References 12 - 14, 33, and 34.

Below is a summary of the TORMIS methodology, results, and conclusions. Additional details regarding TORMIS can be found in Attachment 4.

3.6.1 Methodology The TORMIS95 computer code is used to determine the frequency of a damaging tornado missile strike on unprotected plant SSCs that are used to mitigate a tornado. The TORMIS95 code is an updated version of the original TORMIS code developed for the Electric Power Research Institute (EPRI). The methodologies used in the code to evaluate the frequency of damaging tornado missile strikes are documented in References 12, 33, and 34.

The TORMIS code accounts for the frequency and severity of tornadoes that could strike the plant site, performs aerodynamic calculations to predict the transport of potential missiles around the site, and assesses the annual frequency of these missiles striking and damaging structures and other targets of interest.

The analysis requires the development of input data in three broad areas:

1. development of site tornado hazard information.

2. development of site missile characteristics.

, 3. development of target size, location, and physical properties.

The TORMIS methodology seeks to demonstrate that the annual probability of a radioactive release in excess of 1 O CFR 100 resulting from significant missile damage to unprotected SSCs used to mitigate a tornado is less than the acceptance criterion of 1 E-06 per reactor-year (Reference 14). Significant damage as defined in the TORMIS methodology is damage that would prevent meeting a design basis safety function. This also means that the unprotected SSCs are evaluated collectively against the acceptance criterion rather than individually. For a multi-unit site such as Oconee, this criterion is applied to each unit individually.

3.6.2 TORMIS Results Sample size is an important consideration for the TORMIS model solutions. Traditionally, sample sizes of 1000 tornadoes and 500 missiles per tornado were considered adequate for the determination of plant damage frequencies (Reference 34). However, this general conclusion is 29

License Amendment Request No. 2018-02 September 14, 2018 based on relatively large targets such as plant structures and buildings. When smaller targets are evaluated it becomes necessary to increase sample size to produce an acceptable estimate of the mean value.

There is no established standard or criteria for demonstrating convergence for a TORMIS analysis. However, the goal is to produce a frequency estimate that can reasonably assure that the overall mean damage frequency meets the acceptance criteria. Therefore, the solution process begins with smaller samples and is repeated multiple times until the cumulative mean value reaches a stable value that changes minimally with each additional sample run.

Based on previous experience, the solution approach is to run approximately 15 independent runs for each EF scale with 5000 tornadoes and 4000 missiles per tornado (20 million sample size). These 15 sets of runs, representing a total of 1.5 billion missile samples, were averaged to obtain the mean damage frequency contribution from missiles impacting SSF-related targets.

As a final step, the WPR damage frequency adjustments were applied to the SSF targets in the WPR to obtain the final damage frequency results. These results indicate that the overall missile damage frequency becomes relatively stable after about approximately 12-14 runs where the variation is very small relative to the margin *to the acceptance criteria of 1 E-06/yr (Reference 14).

3.6.3 TORMIS Conclusions A site specific analysis of vulnerable tornado mitigation equipment (SSCs) has been conducted using the TORMIS analysis methodology. This includes a characterization of the site tornado hazard and potential tornado-generated missiles developed in a manner consistent with the requirements of the TORMIS95 User's Manual and other TORMIS reference materials.

For each Oconee unit, the mean annual frequency of a damaging tornado missile strike resulting in a radiological release in excess of 1 O CFR 100 limits was determined to be less than 1 E-06/year. The analysis was performed in a manner consistent with the requirements of the EPRI topical reports and with the requirements set forth in the NRC's SE report (Reference 13) and RIS 2008-14 (Reference 31).

3.7 Elimination of SFP Suction for HPI The spent fuel pool suction path to the HPI system currently described in UFSAR Section 3.2.2 is being deleted to eliminate an alternative plant configuration that, when aligned and operated, involves significant operator actions outside of the control room. Availability of the path provides no appreciable benefit with respect to the overall station tornado mitigation capability.

Previously, the BWST was not fully tornado missile protected and the SFP provided another source of HPI suction if the BWST was unavailable. The BWST has since been modified to withstand tornado missiles defined in UFSAR Section 3.5.1.3, such that the SFP is not expected to be needed for the HPI pumps. With the new tornado licensing basis crediting the SSF as the assured mitigation path following a tornado, the HPI system and any affiliated suction source are no longer necessary for meeting the tornado success criteria.

3.8 Passive Civil Features Because a tornado is a design criterion and does not constitute a design basis accident or transient as described in 1 O CFR 50.36(c)(2)(ii), degradation of passive civil features protecting the SSF will not apply to operability under TS LCO 3.10.1, "Standby Shutdown Facility."

30

License Amendment Request No. 2018-02 September 14, 2018 Implementation of UFSAR criteria for tornado wind, ~P, and missiles or approved applications of TORMIS evaluation for tornado missiles will apply as UFSAR commitments outside of the ONS TS. The SSF Bases for TS 3.10.1 will be clarified to address this point when the revised tornado LB is implemented. Duke maintains an administrative process to manage and control the use of passive design features.

3.9 Conclusions The SSF system will be the only assured system to function after a tornado and will be credited to achieve and maintain MODE 3 for the ONS units for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Assurance is provided by a combination of structural protection and TORMIS evaluation results.

Th~ SSF is a seismic Category 1 structure, housing subsystems that provide adequate SSDHR and SSF RCMU to all three units. The SSF structure has been designed for tornado related effects per the requirements of RG 1.76 Revision 0, with exceptions as noted in UFSAR Section 9.6.3.1 and UFSAR Table 9-17. The following structural modifications to the SSF were completed in 2017 and designed QA-1, RG 1.76 Revision 1:

SSF south side canopy.

SSF south side personnel door.

Exterior penetrations in the east side of the SSF.

The portions of the SSF piping and control cables that traverse from the tornado protected SSF structure to the corR are either enclosed in tornado protected trenches or are sufficiently direct buried to prevent tornado damage. The SSF trenches were originally designed to UFSAR Class 1 criteria documented in UFSAR Section 3.8.4. Modifications to the above grade portions of the trench adjacent to the north end of the SSF, above the CT-5 trench, and adjacent to each units' BWST enclosure have been designed in accordance with RG 1.76, Revision 1. The SSF ASW piping is sufficiently direct buried for tornado missiles defined for the SSF per UFSAR Table 9-

17. Modifications completed in 2018 rerouted portions of the SSF ASW piping within the BWST enclosures of each unit. The BWST enclosures were designed for UFSAR Class 1 wind and tornado missiles defined in UFSAR Section 3.8.4 (the enclosures are vented). The WPR and CDTR walls have been physically upgraded to the requirements of RG 1.76 Revision 1 (References 39 and 40) to resist the effects of tornado wind and differential pressure. The existing SSF related piping and control cables routed through the WPR and CDTR, other systems and components necessary for the SSF to function, and the proposed pathway of committed modifications necessary to improve the ability of the SSF to mitigate a tornado are physically protected or are evaluated with TORMIS. The TORMIS evaluation meets the acceptance criteria on a unit specific basis.

Implementation of the proposed tornado LB and the related commitments will clarify and, in some cases, revise the ONS CLB to collectively enhance the station's overall design and safety margin.

31

License Amendment Request No. 2018-02 September 14, 2018 4 REGULATORY EVALUATION 4.1 Applicable Regulatory Requirements/Criteria ONS received its original OL before implementation of the SRP (NUREG 0800) and RG 1.70. The Principle Design Criteria for ONS Units 1, 2 and 3 were developed in consideration of the seventy (70) General Design Criteria for Nuclear Power Plant Construction Permits proposed by the Atomic Energy Commission in a rule-making published for 1 O CFR Part 50 in the Federal Register of July 11, 1967. The following are applicable criteria as currently specified in the ONS UFSAR:

Note that the references cited in this section are UFSAR references unless otherwise noted.

4.1.1 UFSAR Section 3.1 (Conformance with NRC General Design Criteria)

UFSAR Section 3.1.2, Criterion 2 (Performance Standards - Category A) states that those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be designed, fabricated and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. The design basis so established shall reflect: a) appropriate consideration of the most severe of these natural phenomena that have been recorded for the site and the surrounding area and, b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.

2.

Natural Phenomena These essential systems and components have been designed, fabricated and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena. The designs are based upon the most severe of natural phenomena recorded for the vicinity of the site, with an appropriate margin to account for uncertainties in the historical data.

Tornado is listed as a natural phenomenon. Plant features and details related to tornado are specified in UFSAR section 3.2.2.

The proposed changes have no effect on UFSAR Criterion 2. Tornado is still listed as a natural phenomenon and the most severe of natural phenomena recorded for the vicinity of this site is considered.

4.1.2 UFSAR Section 3.1.29 (Criterion 29 - Reactivity Shutdown Capability (Category A))

At least one of the Reactivity Control Systems provided shall be capable of making the core subcritical under any conditions (including anticipated operation transients), sufficiently fast to prevent exceeding acceptable fuel 32

License Amendment Request No. 2018-02 September 14, 2018 damage limits. Shutdown margins greater than the maximum worth of the most effective control rod when fully withdrawn shall be provided.

Discussion The reactor design meets this criterion both under normal operating conditions and under the accident conditions set forth in Chapter 15. The reactor is designed with the capability of providing a shutdown margin of at least 1 percent b.k/k with the single most react,ive control rod fully withdrawn at any point in core life with the reactor at a hot, zero power power condition. (Section 4.3.2.3). Table 4-6 illustrates a shutdown margin calculation for a sample Oconee fuel cycle.

The proposed changes have no effect on criterion 29. Tornado is a design criterion and not a Chapter 15 accident or operational condition, postulation of a stuck rod fully withdrawn is not required. A return to criticality will not occur.

4.1.3 UFSAR Section 3.1.30 (Criterion 30 - Reactivity Hof down Capability (Category B))

At least one of the Reactivity Control Systems provided shall be capable of making and holding the core subcritical under any conditions with appropriate margins for contingencies.

Discussion The reactor meets this criterion with control rods for hot shutdown under normal operating conditions and for shutdown under the accident conditions set forth in Chapter 15 except for the Steam Line Break Analysis. For details of this analysis refer to Section 15.13.

Reactor Shutdown margin is maintained during cooldown by increasing soluble boron concentration. The rate of reactivity compensation from boron addition is greater than the reactivity change associated with the reactor cooldown rate of 100°F/hour. Thus, subcriticality can be maintained during cooldown with the most reactive control rod totally unavailable (Section 4.3.2).

The proposed changes have no effect on criterion 30. Tornado is a design criterion and not a Chapter 15 accident or operational condition, postulation of a stuck rod fully withdrawn is not required. A return to criticality will not occur.

4.1.4 UFSAR Section 3.2.1.1.1 (Classification of Structures, Components, and Systems - Class 1)

Class 1 structures are those which prevent uncontrolled release of radioactivity and are designed to withstand all loadings without loss of function. Class 1 structures include the following:

Portions of the Auxiliary Building that house engineered safeguards systems, control room, fuel storage facilities and radioactive materials.

Reactor Building and its penetrations.

CT-4 Transformer and 4kV Switchgear Enclosures (Blockhouses)

Unit Vent.

33

License Amendment Request No. 2018-02 September 14, 2018 Standby Shutdown Facility.

Protected Service Water Building.

The proposed changes have no effect on the classification of structures, components, and systems. The SSCs listed are Class 1 structures and will continue to be so.

4.1.5 UFSAR Section 3.2.2 (System Quality Group Classification)

This section defines the design criteria used with respect to the loss-of-coolant accident (LOCA), and natural phenomena and also explains the division of components and piping into classifications related to design and function.

These criteria are as follows:

A maximum hypothetical earthquake will not result in a LOCA, but the simultaneous occurrence of these events will not result in loss of function to vital safety related components or systems. The simultaneous occurrence of the maximum hypothetical earthquake and a LOCA is only a design criteria. A LOCA is not postulated to occur simultaneously with a maximum hypothetical earthquake during accident analysis. In addition, pipe failures during a maximum hypothetical earthquake are not postulated as part of the accident analysis.

A tornado will not be allowed to cause a LOCA.

A tornado does not occur simultaneously with or following a LOCA.

A tornado and earthquake do not occur simultaneously.

The proposed changes have no effect on the system quality group classification as it pertains to LOCA, tornado, and earthquake.

4.1.6 UFSAR Section 3.2.2(4) (System Quality Group Classification - Tornado)

The following design objectives result from consideration of the design criteria:

(4) Tornado The Reactor Coolant System will not be damaged by a tornado. A loss of Reactor Coolant Pump (RCP) seal integrity was not postulated as part of the tornado design basis. Capability is provided to shutdown safely all three units.

The Reactor Coolant System, by virtue of its location within the Reactor Building, is protected from tornado damage. A sufficient supply of secondary side cooling water for safe shutdown is assured by Protected Service Water pumps located in the Auxiliary Building and taking suction from Oconee 2 CCW intake piping. Redundant and diverse sources of secondary makeup water are credited for tornado mitigation. These include: 1) the other units' EFW Systems, 2) the PSW pumps, and 3) the SSF ASW pump.

Protected or physically separated lines are used to supply cooling water to each steam generator. The sources of power to the PSW pumps are the Keowee Hydro Station and the Central Tie Switchyard via a 100 kV transmission line to a 100/13.8 kV substation.

34

License Amendment Request No. 2018-02 September 14, 2018 An external source of cooling water is not immediately required due to the large quantities of water stored underground in the intake and discharge CCW piping. The stored volume of water in the intake and discharge lines below elevation 791 ft would provide sufficient cooling water for all three units for at least 30 days after trip of the three reactors.

Although not fully protected from tornadoes, the following sources provide reasonable assurance that a sufficient supply of primary side makeup water is available during a tornado initiated loss of offsite power.

a. The SSF Reactor Coolant Makeup Pump can take suction from the Spent Fuel Pool. The pump can be supplied power from the SSF Diesel.

b. A High Pressure Injection Pump can take suction from either the Borated Water Storage Tank or the Spent Fuel Pool. Either the "A" or "B" High Pressure Injection Pump can be powered from the PSW Switchgear.

Protection against tornado is an Oconee design criteda, similar to the criteria to protect against earthquakes, wind, snow, or other natural phenomena described in UFSAR Section 3.1.2. A specific occurrence of these phenomena is not postulated, nor is all equipment that would be used to bring the plant to safe shutdown comprehensively listed. The statement, "Capability is provided to shutdown safely all three units" is intended to be a qualitative assessment that, after a tornado, normal shutdown systems will remain available or alternate systems will be available to allow shutdown of the plant. It was not intended to imply that specific systems should be tornado-proof. As part of the original FSAR development, specific accident analyses were not performed to prove this judgment, nor were they requested by the NRG. Subsequent probabilistic studies have confirmed that the original qualitative assessments were correct. The risk of not being able to achieve safe shutdown after a tornado is sufficiently small that additional protection is not required.

In addition, there was considerable correspondence between Duke and the NRG in the years post-TM! discussing Oconee's ability to survive tornado generated missiles. Based upon the probability of failure of the EFW and Station ASW systems combined with the protection against tornado missiles afforded by the SSF ASW system, the NRG concluded that the secondary side decay heat removal function complied with the criterion for protection against tornadoes.

The proposed changes will revise this section as specified in Section 2.6 of the LAR. The proposed changes reflect a revised licensing strategy that credits the SSF as an assured SSD path for tornado.

35

License Amendment Request No. 2018-02 September 14, 2018 4.1.7 UFSAR Section 3.3 (Wind and Tornado Loadings)

All Class 1 structures, except those structures not exposed to wind, are designed to withstand the effects of wind and tornado loadings, without loss of capability of the systems to perform their safety functions.

UFSAR Section 3.3.2 (Tornado Loadings)

All Class 1 structures, except those structures not exposed to wind, are designed for tornado loads.

UFSAR Section 3.3.2.1 (Applicable Design Parameters)

Simultaneous external loadings used in the tornado design of Class 1 structures, with the exception of the Standby Shutdown Facility, are:

(a) Differential pressure of 3 psi developed over 5 seconds.

(b) External wind forces resulting from a tornado having a velocity of 300 mph.

The spectrum and characteristics of tornado-generated missiles is covered in Section 3.5.1.3.

Tornado loading parameters for the Standby Shutdown Facility are described in Section 9.6.3.1.

Revision 1 to Regulatory Guide 1.76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," was released in March 2007. Revision 1 to Regulatory Guide 1.76 was incorporated into the plant's licensing basis in the 4th quarter of 2007. The design of new systems (and their associated components and/or structures) that are required to resist tornado loadings will conform to the tornado' wind, differential pressure, and missile criteria specified in Regulatory Guide 1.76, Revision 1.

UFSAR Section 3.3.2.2 (Determination of Forces on Structures)

Tornado wind loadings are calculated in accordance with Section 3.3.1.2, using the tornado wind velocities given in Section 3.3.2.1. The tornado loading combination used for design of Class 1 structures is:

Y = 1/0(1.0D + 1.0W, + 1.0Pi)

Where Y, 0, and Dare as defined in Table 3-14.

W, = Stress induced by design for tornado wind velocity (drag, lift and

_ torsion)

Pi = Stress due to differential pressure Shape factors will be applied in accordance with ASCE Paper 3269. No height or gust factors will be used with tornado loadings.

36

License Amendment Request No. 2018-02 September 14, 2018 UFSAR Section 3.3.2.3 (Effect of Failure of Structures or Components Not Designed for Tornado Loads)

This information is described in Section 3.2.2.

The proposed changes recognize the application of TORMIS as specified in Section 2.6. The proposed changes have no effect on previous tornado loadings.

4.1.8 UFSAR Section 3.5 (Missile Protection)

UFSAR Section 3.5.1.3 (Missiles Generated by Natural Phenomena)

For an analysis of missiles created by a tornado having maximum wind speeds of 300 mph, two missiles are considered. One is a missile equivalent to a 12 foot long piece of wood 8 inches in diameter traveling end on at a speed of 250 mph. The second is a 2000 pound automobile with a minimum impact area of 20 square feet traveling at a speed of 100 mph.

For the wood missile, calculations based on energy principle indicate that because the impact pressure exceeds the ultimate compressive strength of wood by a factor of about four, the wood would crush due to impact. However, this could cause a secondary source of missiles if the impact force is sufficiently large to cause spalling of the free (inside) face. The compressive shock wave which propagates inward from the impact area generates a tensile pulse, if it is large enough, will cause spalling of concrete as it moves back from the free (inside) surface. This spalled piece moves off with some velocity due to energy trapped in the material. Successive pieces will spall until a plane is reached where the tensile pulse becomes smaller than the tensile strength of concrete.

From the effects of impact of the 8 inch diameter by 12 foot long wood missile, this plane in a conventionally reinforced concrete section would be located approximately 3 inches from the free (inside) surface. However, since the Reactor Building is prestressed, there will be residual compression in the free face, as the tensile pulse moves out and spalling will not occur. Calculations indicate that in the impact area a 2 inch or 3 inch deep crushing of concrete should be expected due to excessive bearing stress due to impact.

For the automobile missile, using the same methods as in the turbine failure analysis, the calculated depth of penetration is 1.4 inch and for all practical purposes the effect of impact on the Reactor Building is negligible.

From the above, it can be seen that the tornado generated missiles neither penetrate the Reactor Building wall nor endanger the structural integrity of the Reactor Building or any components of the Reactor Coolant System.

Additional tornado missile requirements were subsequently imposed by NRC post-TM! on Emergency Feedwater Systems. ONS met these requirements based upon the probability of failure of the EFW and station ASW Systems combined with the protection against tornado missiles afforded the SSF ASW System. Subsequently, PSW replaced station ASW relative to this function. See UFSAR Sections 3.2.2 and 10.4.7.3.6 for additional information.

37

License Amendment Request No. 2018-02 September 14, 2018 Revision 1 to Regulatory Guide 1.76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," was released in March 2007. Revision 1 to Regulatory Guide 1.76 was incorporated into the plant's licensing basis in the 4th quarter of 2007. The design of new systems (and their associated components and/or structures) that are required to resist tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Regulatory Guide 1.76, Revision 1.

The proposed changes recognize the application of TORMIS as specified in Section 2.6. The proposed changes have no effect on previous missile protection criteria.

4.1.9 UFSAR Section 5.1.2.4 (Natural Circulation)

Natural circulation provides an acceptable method of energy removal from the core with transfer of energy to the Secondary System through the steam generators. The controlling parameters which determine the magnitude of the natural circulation flow rates, i.e., steam generator liquid level and source of feedwater (emergency or main), produce more than adequate circulation rates under steady conditions. The margins to the limits for acceptable operation are more than adequate for steady-state and expected transients.

Natural circulation cooldown mode of operation is not expected to be undertaken at Oconee Nuclear Station except for SBLOCA events which do not allow continued operation of or restart of reactor coolant pumps. In all other situations, procedures recommend that MODE 3 with average Reactor Coolant temperature

?:525°F be maintained until those systems required for forced circulation are put back into service.

In response to Generic Letter 81-21, Duke has developed a procedure to continuously vent the reactor vessel head to containment during a natural circulation cooldown to Decay Heat Removal System conditions. Venting the upper head area will maintain a cooling water flow through the upper head area and prevent the formation of a steam void in this area. This procedure results in a single steam void in the RCS, i.e, in the pressurizer, and simplifies pressure control during cooldown. NRC Safety Evaluation Report (Reference 1) concurs with Duke that natural circulation cooldown is not a safety concern due to operator training and procedures.

The proposed changes will revise this section as specified in Section 2.6 of the LAR. The changes will clarify that minor reductions in temperature to stabilize the plant do not constitute a natural circulation cooldown requiring the RCS head vents to be open.

4.1.10 UFSAR Section 5.2.3.4 (Steam Generators)

Feedwater line breaks, the tornado event, and other overheating events impose compressive loads on the steam generator tubes as the RCS heats up and/or the steam generator shell cools down. The tornado protection analysis credits a maximum compressive tube-to-shell /1 T of + 105°F while the feedwater line break analysis crediting HPI forced cooling results in a lower compressive tube-to-shell 11T. Analyses have demonstrated that steam generator tube integrity is maintained for these loads for the replacement steam generators.

38

License Amendment Request No. 2018-02 September 14, 2018 Calculations confirm that the steam generator tube sheet will withstand the resulting from a loss-of-coolant accident. The basis for this analysis is a hypothetical rupture of a reactor coolant pipe resulting in a maximum design pressure differential from the secondary side of 1050 psi. Under these conditions there is no rupture of the primary to secondary boundary (tubes and tube sheet).

The proposed changes will revise this section as specified in Section 2.6 of the LAR. The proposed changes reflect a revised licensing strategy that credits the SSF as an assured SSD path for tornado.

4.1.11 UFSAR Section 5.2.3.10.3 (Leakage)

Reactor Coolant System leakage rate is determined by comparing instrument indications of reactor coolant average temperature, pressurizer water level and letdown storage tank water level over a time interval. All of these indications are recorded. The letdown storage tank capacity is 31 gallons per inch of height, and each graduation on the level recorded represents two inches of tank height.

Reactor Coolant System leak detection is also provided by monitoring the Reactor Building normal sump level and the letdown storage tank level. The Reactor Building normal sump capacity is 15 gallons per inch of height, excluding embedded piping. Since the pressurizer level controller maintains a constant pressurizer level, any Reactor Coolant System volume change due to a leakage would manifest itself as a Reactor Building normal sump level change and/or a corresponding letdown storage tank level change. Alarm indication in the control room for the Reactor Building normal sump is provided at a low level of 1 inch of water and a high level of 8 inches of water. For the Letdown Storage Tank, alarm (statalarm) indication is provided at a low level of 60 inches of water and a high level of 90 inches of water. Considering the most adverse initial conditions of a low level in the Reactor Building sump and a high level in the letdown storage tank, a 1 gpm leak from the Reactor Coolant System would initiate a Reactor Building sump high level alarm indication in the control room within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and a letdown storage tank low level alarm indication in the control room within 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br />. A three gpm leak would be detected in 1/3 the time given above for detection of a one gpm leak. Normally, with the Reactor Building sump level and the letdown storage tank level between their high alarm and the low alarm respectively, these detection times would be reduced.

If the leak allows primary coolant into the containment atmosphere, additional leak detection is provided by the Reactor Building Process Monitoring System and the Reactor Building Area Monitoring System. The sensitivity and time for detection of a Reactor Coolant System leak by any of the radioactivity monitoring systems depends upon reactor coolant activity and the location of the leak. Alarm indication for each sample point in these systems is in the control room.

If the leak is in a steam generator, the leak can be detected by a decrease in the level of the letdown storage tank as described above, Secondary Tritium Analysis, Xenon Analysis, and also by main steam line and condenser air ejector off gas radiation monitors. The sensitivity of the radiation monitors for leak detection depends upon the activity of the Reactor Coolant System.

39

License Amendment Request No. 2018-02 September 14, 2018 Class I fluid systems other than the Reactor Coolant System pre:3sure boundary will be monitored for leakage by monitoring the various storage and/or surge

. tanks for the applicable systems. The Radiation Monitoring System for the station will aid in leak detection of systems containing radioactive fluids. In addition to the above, routine Operator and/or Health Physics radiation surveillance will detect leakage in both radioactive and non-radioactive syst!3ms.

Single phase natural circulation can be maintained in the Reactor Coolant System for decay heat removal following a complete loss of station power (Station Blackout Event) if Reactor Coolant System leaks are maintained within limits required for SSF RC makeup system operability. RCS leakage limits are based on the ability of the SSF RC makeup system to prevent RC pump seal failure (Reference resolution to GSl-23) and provide makeup flow for other normal RCS leakage. RCS leakage limits are also based on providing adequate decay heat removal from the RCS using the SSF ASW System. This prevents excessive RCS inventory loss through the pressurizer code safety valves. AC power is assumed available to necessary shutdown equipment within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from an off-site source or a class 1 Eon-site source(s).

The proposed changes have no effect on RCS system leakage and the changes related to natural circulation (section 4.1.9) are addressed in section 2.6.

4.1.12 UFSAR Section 8.3.2.2.4 (Station Blackout Analysis)

Station Blackout (SBO) is the hypothetical case where all off-site power and both Keowee hydro-electric units are lost. Electrical power is available immediately from the battery systems and within 1 O minutes from the SSF diesel generator.

This event was originally included in FSAR section 15.8.3. As documented in the NRG Safety Evaluation Report (SER) dated March 10, 1992 and the NRG Supplemental SER dated December 3, 1992, Oconee Nuclear Station is in compliance with 1 O CFR 50.63 and conforms to the guidance of NU MARC Report 8700 and Regulatory Guide 1.155. This regulation requires that a licensed nuclear power plant demonstrate the ability to achieve safe shutdown from 100% reactor power by ensuring containment integrity and adequate decay heat removal for a calculated duration. The licensee must also. demonstrate that the required equipment be able to withstand the resulting operating environment.

The temperature of the control room and other areas where extensive manual operations occur, shall not exceed habitability requirements of 120°F. Station blackout is not a design basis event. Therefore, the 880 scenario is not concurrent with any design basis event or single failures.

Oconee is capable of coping with a SBO by the following means:

1. The SBO duration is 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> by application of NUMAR(? 8700 guidance.

2. The SSF diesel generator is the alternate AC (AAC) source and is available within 10 minutes. The SSF diesel generator must b~ manually started from the SSF control room, and the capability of plant operators to access the SSF control room, manually start the diesel generator, and supply electric power 40

License Amendment Request No. 2018-02 September 14, 2018 within 10 minutes of recognition of an 880 event has been demonstrated by testing.

3. The S$F Auxiliary Service Water system is the design basis source of decay heat removal. Actuation of the Emergency CCW System is not required since the inventory in the CCW piping is sufficient for 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> operation of the SSF/ASW system.

4. The non-essential inverters (Kl, KU, and KX) are manually stripped from the Vital 125VDC System within 30 minutes to ensure that the Class 1 E batteries have sufficient capacity for the 4-hour 880 coping duration and recovery actions, and to reduce the electrical heat loads of the unit control complex.

Refer to FSAR Selected Licensee Commitment 16.8.1. The resulting temperature in the unit control room does not exceed the habitability requirement of 120°F. Therefore, command and control remain in the unit control room to allow completion of restoration procedures as required in the Supplemental SER dated December 3, 1992.

5. Containment isolation valves fail closed on loss of air or power, can be manually closed, or have diverse closure ability from the SSF as required in NUMARC 8700.

6. Restoration of power is accomplished by manual closure of switchgear breakers at Switchgear control panel.

Stripping the non-essential inverters from the 125VDC system will make power available to the TDEFWP and its associated controls in the unit control room for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Although its operability is limited to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> due to the volume of the

• associated nitrogen supply. Notably, the TDEFWP is not required for the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> coping period since the SSF ASW system is the licensing and design basis commitment for decay heat removal during the 880 event.

The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> coping duration is derived from NUMARC 8700 based on meteorological data, grid stability, switchyard features, and availability/reliability cif emergency power sources. A program to control SSF availability/reliability has been implemented to ensure at least a value of 95% as stated in the Supplemental SER. The program is based on the largest single contributor of SSF unavailability, which is unwatering of Unit 2 CCW intake piping. This is based on the fact that Unit 2 CCW intake piping supplies suction to the SSF Auxiliary Service Water pump, the diesel engine cooling and the SSF HVAC.

SSF availability is also dependent on the reliability of Keowee, the SSF batteries, the SSF diesel generator and supporting systems. Additionally, controls are implemented so that planned maintenance on the SSF and Keowee does not occur simultaneously.

The proposed changes have no effect on Station Blackout.

41

License Amendment Request No. 2018-02 September 14, 2018 4.1.13 UFSAR Section 9.6.2 (SSF-Design Bases -Tornado)

SSF TORNADO DESIGN CRITERIA This is a design criterion for the SSF that was committed to as part of the original SSF licensing correspondence. All parts of the SSF itself that are required for mitigation of the SSF events are required to be designed against tornado winds and associated tornado missiles. This requirement is satisfied through appropriate design of the SSF structure. This requirement does not extend to SSCs that were already part of the plant which SSF relies upon and interfaces with for event mitigation. It is important to note that the SSF was not licensed to mitigate a tornado event or a tornado missile event (Reference 1). Tornado design requirements for the plant itself are addressed in Section 3.2.2. A subsequent issue related to crediting SSF ASW as an alternative for EFW tornado missile protection vulnerabilities is discussed below (see EFW Tornado Missile Design Criteria).

EFW TORNADO MISSILE DESIGN CRITERIA An additional issue that arose after TMI was the capability of the EFW System to withstand the effects of tornado missiles. The design of the EFW System did not include this capability, therefore, Duke Energy requested and NRC approved crediting the SSF Auxiliary Service Water (SSF ASW) System as an acceptable alternative (even though it was recognized that SSF ASW System itself is not completely protected from all tornado missiles). It is important to note that this licensing action did not specify a tornado missile event or define a tornado missile mitigation strategy. Using a probabilistic approach, it solely focused on ensuring that a secondary side heat removal path is adequately designed to withstand the effects of tornado missiles (Reference 4).

The proposed changes will revise this section as specified in Section 2.6 of the LAR. The proposed changes reflect a revised licensing strategy that credits the SSF as an assured SSD path for tornado.

4.1.14 _UFSAR Section 9.6.3.1 (SSF-System Descriptions - Structure)

The Standby Shutdown Facility (SSF) is a reinforced concrete structure consisting of a diesel generator room, electrical equipment room, mechanical pump room, control room, central alarm station (CAS) and ventilation equipment room...

The SSF has a seismic classification of Category 1. The following load conditions are considered in the analysis and design:

6.

Tornado Wind Loads

7.

Tornado Missile Loads WIND AND TORNADO LOADS The design wind velocity for the SSF is 95 mph, at 30 ft. above the nominal ground elevation. This velocity is the fastest wind with a recurrence interval of 100 years. A gust factor of unity is used for determining wind forces. The design 42

License Amendment Request No. 2018-02 September 14, 2018 tornado used in calculating tornado loadings is in conformance with Regulatory Guide 1.76, Revision 0, with the following exceptions:

1. Rotational wind speed is 300 mph.

2. Translational speed of tornado is 60 mph.

3. Radius of maximum rotational speed is 240 ft.

4. Tornado induced negative pressure differential is 3 psi, occurring in three seconds.

The spectrum and characteristics of tornado-generated missiles are covered later in this section.

Revision 1 to RG 1.76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," was released in March 2007. Revision 1 to RG 1.76 was incorporated into the SSF licensing basis in the 4th quarter of 2007. The design of all future changes to and/or analysis of SSF-related systems, structures, and components subject to tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Regulatory Guide 1.76, Revision 1.

MISSILE PROTECTION The only postulated missiles generated by natural phenomena are tornado generated missiles. The SSF is designed to resist the effects of Tornado generated missiles in combination with other loadings. Table 9-17 lists the postulated tornado generated missiles.

Penetration depths are calculated using the modified NDRC formula and the modified Petry formula.

Table 9-18 lists the calculated penetration depths and the minimum barrier thicknesses to preclude perforation and scabbing, hence eliminating secondary missiles.

Revision 1 to Regulatory Guide 1.76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," was released in March 2007. Revision 1 to Regulatory Guide 1.76 was incorporated into the SSF licensing basis in the 4th quarter of 2007. The design of all future changes to and/or analysis of SSF-related systems, structures, and components subject to tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Regulatory Guide 1.76, Revision 1.

The proposed changes recognize the application of TORMIS as specified in Section 2.6. The proposed changes have no effect on previous structure and tornado loading criteria.

4.1.15 UFSAR Section 9.6.5 (Operation and Testing)

The SSF will be placed into operation to mitigate the consequences of the following events:

43

License Amendment Request No. 2018-02 September 14, 2018

1. Flooding

2. Fire

3. Sabotage

4. Station Blackout.

For fire events that require activation of the SSF for the unit affected, following local confirmation of the fire, the operator will staff the SSF and perform the electrical isolation/control transfer of the 600VAC Motor Control Center in the SSF as promptly as possible after confirmation of the fire. Following the control transfer, the operator will establish continuous communications with the Control Room of the unit affected awaiting instructions regarding the need to start and utilize the available SSF Diesel Generator, RCMU system and establish SSF Auxiliary Service Water flow to the steam generators as needed and close all of the Reactor Coolant System isolation valves that are controlled from the SSF.

Additionally, for fire events where SSF activation is required, main steam boundary valves must also be promptly closed to maintain proper control of RCS parameters while the SSF is made operational.

For flooding, sabotage, station blackout and those fire events where the SSF is credited for safe shutdown, operators will be sent to the SSF. When directed by the shift supervisor or procedure, the operator will start the RCM system and establish SSF Auxiliary Service Water flow to the steam generators as needed, as well as close SSF controlled Reactor Coolant System pressure boundary valves.

The proposed changes will revise this section as specified in Section 2.6 of the LAR. The proposed changes reflect a revised licensing strategy that credits the SSF as an assured SSD path for tornado.

4.1.16 UFSAR Section 9.7.1 (PSW-General Description)

The Protected Service Water (PSW) System is designed as a standby system for use under emergency conditions. The PSW System provides added "defense in depth" protection by serving as a backup to existing safety systems and as such, the system is not required to comply with single failure criteria.

The PSW System is provided as an alternate means to achieve and maintain safe shutdown conditions for one, two or three units following certain postulated scenarios. The PSW System reduces fire risk by providing a diverse power supply to power safe shutdown equipment in accordance with National Fire Protection Association (NFPA) 805 safe shutdown analyses. The PSW System requires manual activation and can be activated if normal emergency systems are unavailable...

In order to ensure PSW/HPI mitigating component design temperature limits will not be exceeded during PSW/HPI System operation, alternate cooling water and power to the existing ventilation systems is provided to recover from the potential loss of ventilation to the AB and RB (refer to Section 9.7.3.4.5).

44

License Amendment Request No. 2018-02 September 14, 2018 The proposed changes will revise this section as specified in Section 2.6 of the LAR. The proposed changes reflect a revised licensing strategy that credits the SSF as an assured SSD path for tornado.

4.1.17 UFSAR Section 10.4.7.1 (EFW-Design Bases)

Portions of the EFW System are vulnerable to tornado missiles. Thus, the plant relies upon diverse means to provide feedwater to the SGs in response to the occurrence of a tornado. These diverse means include the SSF ASW System and the PSW System.

The proposed changes will revise this section as specified in Section 2.6 of the LAR. The proposed changes reflect a revised licensing strategy that credits the SSF as an assured SSD path for tornado.

4.1.18 UFSAR Section 10.4.7.3.6 (EFW Response Following Tornado Missiles)

Reference 7 concludes that the Standard Review Plan probabilistic criterion is met based upon the probability of failure of the EFW and station ASW Systems combined with the protection against tornado missiles afforded the SSF ASW System. Subsequently, PSW replaced station ASW relative to this function.

The proposed changes will revise this section as specified in Section 2.6 of the LAR. The proposed changes reflect a revised licensing strategy that credits the SSF as an assured SSD path for tornado.

4.1.19 TORMIS SE (Safety Evaluation Report - Electric Power Research Institute (EPRI) Topical Reports concerning Tornado Missile Probabilistic Risk Assessment (PRA) Methodology)

The NRG concluded that TORMIS is an acceptable probabilistic approach for demonstrating compliance with the requirements of General Design Criteria 2 and 3 regarding protection of safety related plant features from the effects of tornado and high winds generated missiles subject to the additional concerns related to identified input parameters. Further, use of the TORMIS should be limited to the evaluation of specific plant features where additional costly tornado missile protective barriers or alternative systems are under consideration.

The proposed changes will revise the UFSAR as specified in Section 2.6 of the LAR to incorporate TORMIS into the ONS LB. Section 3.6 and Attachment 4 provide details of how the TORMIS analysis was performed and the results.

4.1.20 RIS 2008-14 (Use of TORMIS Computer Code for Assessment of Tornado Missile Protection)

RIS 2008-14 (Reference 31) addresses: 1) the NRG staff position on the use of the TORMIS computer code for assessing nuclear power plant tornado missile protection, 2) issues identified in previous LARs to use the TORMIS computer code, and 3) information needed in LARs using the TORMIS computer code.

The RIS also raises a number of questions the NRG had regarding the 45

License Amendment Request No. 2018-02 September 14, 2018 application of the TORMIS methodology and implementation of the TORMIS computer code.

The proposed changes address RIS 2008-14. Section 3.6 and Attachment 4 provide details of how the TORMIS analysis was performed and the results.

4.2 Precedents

The NRC has previously approved changes similar to the proposed change in this LAR. The.

following plants subm.itted LARs requesting the TORMIS computer code as the methodology used for assessing tornado-generated missile protection of unprotected plant SSCs.

4.2.1 Donald C. Cook Units 1 and 2: Application dated June 8, 2000 (ADAMS Accession No. ML003723707); NRC Safety Evaluation dated November 17, 2000 (ADAMS Accession No. ML003770173).

4.2.2 Joseph M. Farley Units 1 and 2: Application dated June 29, 2000 (ADAMS Accession No. ML003728677); Supplement dated August 31, 2001 (ADAMS Accession No. ML012490009); NRC Safety Evaluation dated September 26, 2001 (ADAMS Accession No. ML012740299).

4.2.3 Fermi 2: Application dated January 11, 2013 (ADAMS Accession No. ML13011A377); Supplement dated September 27, 2013 (ADAMS Accession No. ML13273A467); NRC Safety Evaluation dated March 10, 2014 (ADAMS Accession No. ML14016A487).

4.2.4 Byron Station Units 1 and 2: Application dated October 7, 2016 (ADAMS Accession No. ML 16.281A174); Supplement dated March 20, 2017 (ADAMS Accession No. ML17079A130); NRC Safety Evaluation dated August 10, 2017 (ADAMS Accession No. ML17188A155).

4.3 No Significant Hazards Consideration Duke Energy has evaluated whether a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 1 O CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

Justification: Although a tornado does not constitute a previously-evaluated Updated Final Safety Analysis Report (UFSAR) Chapter 15 design basis accident or transient as described in 1 O CFR 50.36(c)(2), it is a design basis criterion that is required to be considered in design of structure, systems, or components. The possibility of a tornado striking Oconee Nuclear Station is appropriately considered in the UFSAR and Duke Energy has concluded that the proposed changes do not increase the possibility that a damaging tornado will strike the site or increase the consequences from a damaging tornado.

The Standby Shutdown Facility (SSF) structure has been designed for tornado related effects per the requirements of RG 1.76 Revision 1 or RG 1.76 Revision 0, with 46

License Amendment Request No. 2018-02 September 14, 2018 exceptions as noted in UFSAR Section 9.6.3.1 and UFSAR Table 9-17. The portions of the SSF piping and control cables that traverse from the tornado protected SSF structure to the Cask Decontamination Tank room (CDTR) are either enclosed in tornado protected trenches or are sufficiently direct buried to prevent tornado damage. The West Penetration room (WPR) and CDTR walls have been physically upgraded to the requirements of RG 1.76 Revision 1 to resist the effects of tornado wind and differential pressure. The existing SSF related piping and control cables routed through the WPR and CDTR, other systems and components necessary for the SSF to function, and the proposed pathway of committed modifications necessary to improve the ability of the SSF to mitigate a tornado are physically protected or are evaluated with TORMIS. The TORMIS evaluation meets the acceptance criteria on a unit specific b~sis. As a result, there il:; reasonable assurance that a tornado missile will not prohibit the SSF system from fulfilling its tornado licensing basis or other functions.

The spent fuel pool suction path to the HPI system currently described in UFSAR Section 3.2.2 is being deleted from the licensing basis. The existing piping configuration that connects the spent fuel pool suction path to the HPI system will remain, but will no longer be credited. This will eliminate an alternative plant configuration that, when aligned and operated, involves significant operator actions outside of the control room. Availability of the path provides no appreciable benefit with respect to the overall station tornado mitigation capability. Previously, the BWST was not fully tornado missile protected and the SFP provided another source of HPI suction if the BWST was unavailable.' The BWST has since been modified to withstand tornado missiles defined in UFSAR Section 3.8.4, such that the SFP is not expected to be needed for the HPI pumps. With the new tornado licensing basis crediting the SSF as the assured mitigation path following a tornado, the HPI system and any affiliated suction source are no longer necessary for meeting the tornado success criteria.

Overall, the changes proposed will increase assurance that safe shutdown (SSD) can be achieved following a damaging tornado. In conclusion, the changes will collectively enhance the station's overall design and safety margin; therefore, the probability or consequences of accidents previously evaluated are not significantly increased.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

Justification: This LAR credits the SSF as the deterministically protected path for the mitigation of tornadoes. The previously credited spent fuel pool suction path to the HPI system currently described in UFSAR Section 3.2.2 is being removed from the licensing basis. The suction path is not fully protected from the effects of a tornado and this change eliminates an alternative plant configuration that, when aligned and operated, involves significant operator actions outside of the control room. Availability of the path provides no appreciable benefit with respect to the overall station tornado mitigation capability. With the new tornado licensing basis crediting the SSF as the assured mitigation path following a tornado, the HPI system and any affiliated suction source are no longer necessary for meeting the tornado success criteria. The SSF is credited for establishing and maintaining Secondary Side Decay Heat Removal (SSDHR) and 47

License Amendment Request No. 2018-02 September 14, 2018 Reactor Coolant Makeup (RCMU) up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a damaging tornado.

Committ~d modifications improve the ability of the SSF systems to perform their functions following a damaging tornado. The modifications will be designed and installed in accordance with current licensing basis codes/ requirements. Failure analyses will ensure no new failure modes and effects are introduced. This will ensure that no new failure mechanisms, malfunctions or accident initiators not already considered in the design and licensing basis are introduced.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

Justification: The SSF is credited for establishing and maintaining SSDHR and RCMU up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a damaging tornado. Currently, the LB is a combination of probabilistic, diversity, and defense-in-depth strategies addressing the capability to provide SSD of the ONS units. This proposed change establishes the SSF as a deterministic strategy. The previously credited spent fuel pool suction path to the HPI system currently described in UFSAR Section 3.2.2 is being removed from the licensing basis. The suction path is not fully protected from the effects of a tornado and this change eliminates an alternative plant configuration that, when aligned and operated, involves significant operator actions outside of the control room. Availability of the path provides no appreciable benefit with respect to the overall station tornado mitigation capability. With the new tornado licensing basis crediting the SSF as the assured mitigation path following a tornado, the HPI system and any affiliated suction source are no longer necessary for meeting the tornado success criteria. The proposed tornado licensing basis will collectively enhance the station's overall design and safety margin; therefore, the proposed change does not involve a significant reduction in 'a margin of safety.

Based on the above, Duke Energy concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 1 O CFR 50.92(c), and, accordingly, a finding of "no significance hazards consideration" is justified.

4.4 Conclusions Based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by the. proposed revision to the wording in the Updated Final Safety Analysis Report and operation of the unit in the proposed manner, (2) the proposed revision will be implemented in a manner consistent with the Commission's regulations and (3) the issuance of the amendment will not be adverse to the common defense and security or to the health and safety of the public.

5 ENVIRONMENTAL CONSIDERATION Duke Energy has evaluated this License Amendment Request (LAR) against the criteria for

• identification of licensing and regulatory actions requiring environmental assessment in accordance with 1 O CFR 51.21. Duke Energy has determined that this LAR meets the criteria for a categorical exclusion as set forth in 1 O CFR 51.22(c)(9). This determination is based on the fact that this change is being proposed as an amendment to a license issued pursuant to 1 O CFR 50 that changes a requirement with respect to installation or use of a facility component 48

• License Amendment Request No. 2018-02 September 14, 2018 located within the restricted area, as defined in 1 O CFR 20, or that changes an inspection or a surveillance requirement, and the amendment meets the following specific criteria:

(i)

The amendment involves no significant hazards consideration.

As demonstrated in Section 4.3, this proposed change to the Updated Final Safety Analysis Report does not involve a significant hazards consideration.

(ii) There is no significant change in the types or significant increase in the amounts of any effluent that may be released offsite.

The proposed change will not change the types or amounts of any effluents that may be released offsite.

(iii) There is no significant increase in individual or *cumulative occupational radiation exposure.

The proposed change will not increase the individual or cumulative occupational radiation exposure.

Therefore, no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment pursuant to 1 O CFR 51.22(b).

6 REFERENCES

1. Weins, Leonard A., Project Manager, Division of Reactor Projects 1/11, Office of Nuclear Reactor Regulation, to Tucker, H. B., Vice President, Nuclear Production Department, Duke Power Company, "Safety Evaluation report of Effect of Tornado Missiles on Oconee Emergency Feedwater System," dated July 28, 1989.

2. June 28, 1991, the NRG issued GL 88-20, Supplement 4 that requested all licensees perform Individual Plant Examination of External Events (IPEEE).

3. Stolz, Chief, Operating Reactors Branch #4, Division of Licensing, U. S. Regulatory Commission, to Tucker, H. B., Vice President, Nuclear Production Department, Duke Power Company, "Safety Evaluation by the Office of Nuclear Reactor Regulation, Oconee Nuclear Station Standby Shutdown Facility," dated April 28, 1983.

4. NSAC/60, "A Probabilistic Risk Assessment by Oconee Unit 3," Electric Power Research Institute, June 1984.

5. LaBarge, David E., Senior Project Manager, Division of Licensing Project Management, Office of Nuclear Reactor Regulation, "Oconee Nuclear Station, Units 1, 2, and 3 RE:

Review of Individual Plant Examination of External Events (TAC Nos. MA83649, M83650, and M83651)," dated March 15, 2000.

6. Letter to Mr. James Dyer, Director, Office of Nuclear Reactor Regulation, from Henry B.

Barron, Group Vice President and Chief Nuclear Officer, Nuclear Generation, Duke Energy Corporation, "Tornado/HELB Mitigation Strategies and Regulatory Commitments," dated November 30, 2006.

7. Letter from Christopher Miller, Deputy Director, Division of Operating Reactor Licensing, Office of Nuclear Reactor Regulation to Mr. Bruce H. Hamilton, Vice president, Oconee Site, 49

License Amendment Request No. 2018-02 September 14, 2018 Duke Power Company LLC, "Tornado and High-Energy Line Break Mitigation Strategies,"

dated July 12, 2006.

8. Letter from Leonard N. Olshan, Project Manager, Plant Licensing Branch 11-1, Division of Operating Reactor Licensing, USNRC Office of Nuclear Reactor Regulation, to Duke Power Company LLC, "Summary of March 5, 2007, Meeting to Discuss the November 30, 2006, Letter Regarding Oconee High-Energy Line Break (HELB) and Tornado Mitigation Strategies," dated March 28, 2007.

9. Letter from Timothy J. McGinty, Deputy Director, Division of Operating Reactor Licensing, USNRC Office of Nuclear Reactor Regulation, to Bruce H. Hamilton, Oconee Nuclear Station, Units 1, 2, and 3 (Oconee) - Tornado and High-Energy Line Break (HELB)

Mitigation Strategies, dated May 15, 2007.

10. Letter to the U. S. Nuclear Regulatory Commission from Bruce H. Hamilton, Vice President, Oconee Site, "Revision to Tornado/HELB Mitigation Strategies and Regulatory Commitments," dated June 28, 2007.

11. Letter to the U.S. Nuclear Regulatory Commission from Henry 8. Barron, Group.Vice President and Chief Nuclear Officer, Nuclear Generation, Duke Energy Corporation, "Revision to Tornado/HELB Mitigation Strategies and Regulatory Commitments," dated January 25, 2008.

12. Electric Power Research Institute Report - EPRI NP-2005, Volumes 1 and 2, "Tornado Missile Risk Evaluation Methodology," dated August 1981.

13. Memorandum from L. S. Rubenstein to Frank J. Miraglia, "Safety Evaluation Report -

Electric Power Research lnstitu_te (EPRI) Topical Reports concerning Tornado Missile Probabilistic Risk Assessment (PRA) Methodology," dated October, 1983.

14. Letter from Harold R. Dentor, USN RC Memorandum to Victor Stello, "Position on Use of Probabilistic Risk Assessment In Tornado Missile Protection Licensing Actions," dated November 7, 1983.

15. Duke Energy Methodology Report DPC-NE-3003-PA, Oconee Nuclear Station, Mass and Energy Release and Containment Response Methodology, Revision 1. (Safety Evaluations dated March 15, 1995; September 24, 2003).

16. Safety Evaluation by the Office of Nuclear Reactor Regulation Oconee Nuclear Station Standby Shutdown Facility, Docket Nos. 50-269, 50-270, and 50-287, April 28, 1983 (Accession Number 8305200103).

17. Letter from W.O. Parker (Duke Power Company) to H.R. Denton (NRC) dated March 28, 1980, Information in Support of Standby Shutdown Facility (Accession Number ML16134A655).

18. Letter from W.O. Parker (Duke Power Company) to H.R. Denton (NRC) dated February 16, 1981, Response to NRC Request for Information (Accession Number ML152388273).

19. Letter from W.O. Parker (Duke Power Company) to H.R. Denton (NRC) dated March 31, 1981, Response to NRC Request for Information (Accession Number ML152388314).

20. Letter from W.O. Parker (Duke Power Company) to H.R. Denton (NRC) dated April 13, 1981, RAI Response (Accession Number ML152388326).

21. Letter from H.B. Tucker (Duke Power Company) to H.R. Denton (NRC) dated September 20, 1982, RAI Response (Accession Number ML15238A655).

22. Letter from H.B. Tucker (Duke Power Company) to H.R. Denton (NRC) dated December 23, 1982, RAI Response (Accession Number ML15238A727).

50

License Amendment Request No. 2018-02 September 14, 2018

23. Letter from H.B. Tucker (Duke Power Company) to H.R. Denton (NRC) dated July 26, 1985, Proposed Technical Specifications for SSF (Accession Numbers ML15264A327, ML15264A329).

24. NRC letter to Duke Power Company dated January 23, 1987, Inadequacy of Technical Specifications for Safe Shutdown Facility (Accession Number 8702060151).

25. Letter from H.B. Tucker (Duke Power Company) to H.R. Denton (NRC) dated August 14, 1987, Proposed Revised Technical Specifications for SSF (Accession Numbers ML15264A490, ML15264A492).

26. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment Nos. 195, 195, and 191, Adds SSF Technical Specifications, May 11, 1992 (Accession Numbers ML012000400, ML012190128).

27. Safety Evaluation issued by NRC, "SER for Station Blackout - Oconee Nuclear Station,"

March 10, 1992 (Accession Number 9203170114).

28. Supplemental Safety Evaluation "Supplemental SER for Station Blackout - Oconee Nuclear Station," December 3, 1992 (Accession Number 9212110152).

29. Safety Evaluation issued by NRC, "Seismic Qualification of the Emergency Feedwater System," dated January 14, 1987 (Accession Number 8701300192).

30. Letter to the U. S. Nuclear Regulatory Commission from Dave Baxter, Vice President, Oconee Nuclear Station, Duke Energy Carolinas, LLC, "License Amendment Request to Revise Portions of the Updated Final Safety Analysis Report Related to the Tornado Licensing Basis," dated June 26, 2008.

31. Regulatory Issue Summaries 2008-14, "Use of TORMIS Computer Code for Assessment of Tornado Missile Protection," U.S. Nuclear Regulatory Commission, dated June 2008.

32. Regulatory Issue Summaries 2015-06, "Tornado Missile Protection," U.S. Nuclear Regulatory Commission, dated June 10, 2015.

33. Twisdale, L.A., et al. Tornado Missile Risk Analysis. Electric Power Research Institute Report NP-768 and NP-769 (Final Report), May 1978.

34. TORMIS95 User's Manual: Tornado Missile Risk Methodology. Applied Research Associates, Inc. Project 5313 (Draft Report), December 1995.

35. OSS-0254.00-00-4005, Design Basis Specification for Design Basis Events, Revision 31.

36. OSC-11547, High Energy Line Break Relap5 Analysis, Revision O.

37. Letter to the U.S. Nuclear Regulatory Commission from W. R. McCollum, Jr., Vice President, Oconee Nuclear Station, Duke Energy Corporation, "Individual Plant Examination of External Events," dated December 18, 1997.

38. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment Nos.

386, 388, and 387, Implementation of the Protected Service Water System, August 13, 2014 (Accession Number ML14206A790).

39. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment Nos.

360, 362, and 361, "Issuance of Amendments Regarding Use of Fiber-Reinforced Polymer (FRP)," dated February 21, 2008.

40. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to Amendment Nos.

373, 375, and 374, "Issuance of Amendments Regarding Authorizing a Change to the Updated Final Safety Analysis Report Allowing the Use of Fiber Reinforced Polymer on Masonry Brick Walls for the Mitigation of Differential Pressure Created by High Winds,"

dated June 27, 2011.

51

License Amendment Request No. 2018-02 September 14, 2018

41. Letter to the U.S. Nuclear Regulatory Commission from Thomas D. Ray, Vice President, Oconee Nuclear Station, Duke Energy Carolinas, LLC, "Revision to Tornado/HELB Mitigation Strategies and Regulatory Commitments," dated November 15,.2017.

42. Safety Evaluation issued by the Office of Nuclear Reactor Regulation, "Oconee Nuclear Station, Units 1, 2, and 3 - Safety Evaluation Regarding Implementation of Mitigating Strategies and Reliable Spent Fuel Pool Instrumentation RelatE;3d to Orders EA-12-049 and EA-12-051," dated August 30, 2017.

43. Safety Evaluation by the Office of Nuclear Reactor Regulation related to Amendment Nos.

371, 373, and 372, "Oconee Nuclear Station, Units 1, 2, and 3, Issuance of Amendments Regarding Transition to a Risk-Informed Performance-Based Fire Protection Program in Accordance with 1 O CFR 50.48(c)," dated December 29, 201 O.

44. Letter to the U.S. Nuclear Regulatory Commission from Hal B. Tucker, Vice President, Nuclear Production, Duke Power Company, "Re: Oconee Nuclear Station, Docket Nos. 50-269, -270, -287," dated September 15, 1986.

45. Letter to the U.S. Nuclear Regulatory Commission from Hal B. Tucker, Vice President, Nuclear Production, Duke Power Company, "Oconee Nuclear Station, Docket Nos. 50-269, -

270, -287," dated July 17, 1987.

46. Letter to the U.S. Nuclear Regulatory Commission from Hal B. Tucker, Vice President, Nuclear Production, Duke Power Company, "Oconee Nuclear Station, Docket Nos. 50-269, -

270, -287," dated December 19, 1988.

7 ACRONYMS AB AC ASW B&W BWST ccw CDTR CR CRSRO DC DG DNBR Duke Energy EFW HELB HPI Auxiliary Building Alternating Current Auxiliary Service Water r

Babcock & Wilcox Borated Water Storage Tank Condenser Circulating Water Cask Decontamination Tank Room Control Room Control Room Senior Reactor Operator Direct Current Diesel Generator Departure from Nucleate Boiling Ratio Duke Energy Carolinas, LLC Emergency Feedwater High Energy Line Break High Pressure Injection 52

License Amendment Request No. 2018-02 September 14, 2018 HVAC IPEEE.

JPM LAR LB LCO LP MSRVs NDRC NFPA NRC NSSS OL OMP ONS PRA PSW RAI RCMU RCP RCS RG RIS SBO SE SEP SFP SRP SG SSCs SSD SSDHR Heating, Ventilation, and Air Conditioning Individual Plant Examination of External Events Job Performance Measures License Amendment Request Licensing Basis Limiting Condition of Operation Liquid Propane Main Steam Relief Valves NationalDefense Research Committee National Fire Protection Association Nuclear Regulatory Commission Nuclear Steam Supply System Operating License Operations Management Procedure Oconee Nuclear Station Probabilistic Risk Assessment Protected Service Water Request for Additional Information Reactor Coolant Makeup Reactor Coolant Pump Reactor Coolant System Regulatory Guide Regulatory Issue Summary Station Blackout Safety Evaluation Systematic Evaluation Program Spent Fuel Pool Standard Review Plan Steam Generator Structures, Systems, or Components Safe Shutdown Secondary Side Decay Heat Removal 53

License Amendment Request No. 2018-02 September 14, 2018 SSF T-H TCA TMI TORMIS TS UFSAR WPR VAC voe Standby Shutdown Facility Thermal-Hydraulic Time Critical Action Three Mile Island Tornado Missile Probabilistic Methodology Technical Specifications Updated Final Safety Analysis Report West Penetration Room Volts Alternating Current Volts Direct Current 54

ATTACHMENT 1 Regulatory Commitments

License Amendment Request No. 2018-02 September 14, 2018 Regulatory Commitments The following table identifies those actions committed to by Duke Energy in this document. Any other statements in this submittal are provided for information purposes and are not considered to be regulatory commitments. Please direct questions regarding these commitments to Ti mothv Brown, ONS Reoulatorv Projects Group, at (864) 873-3952.

REGULATORY COMMITMENTS DUE DATE Provide missile protection for the outdoor SSF diesel fuel oil tank fill 3 years after and vent lines to prevent shear/perforation of the piping and issuance of the SER.

subsequent rain water intrusion into the underground tank Install a new SSF RCMU pulsation dampener on unit 1 to 01R31.

accommodate operation of the SSF RCMU system at lower-range RCS pressures. Units 2 and 3 have been completed.

Install a new SSF letdown line in each unit to provide SSF CR 3 refueling outages operators with the ability to control the plant at lower-range RCS per unit after pressures.

issuance of the SER.

Install new QA-1 instrumentation or upgrade existing 3 refueling outages instrumentation in the SSF CR for SG pressure, nuclear per unit after instrumentation, core exit thermocouples, pressurizer temperature, issuance of the SER.

and temperature compensated pressurizer level.

ATTACHMENT 2 UFSAR MARKED-UP PAGES

UFSAR Ch pter 3 Oconee fluclear Station

n. Reactor Bu ding penetrations and piping through isolation valves.

o. Siphon Seal er System.

p. Essential Siphon Vacwm System.

q. Electric power for above.

r.

• rogen supply to the EFW control val es FD -315 and FD -316.

seismic des* n of SSF s tems and comP2f!enls is contained in S

.........Af 9... 3. I r a

• t e*

and its components are contained in Section 9.7.

4

. ;:::ader ~aAt ~m \\~ :

~.~ I~ of Reader ~aAl Pmlp {RCP) seal iRtegfity was Rel pestlflated as pat ef the temade desigR hasis.

Capability is ~ed te sootdeo.*.IR safely all ti:iree units.

lhe ReadeF CeelaRt System, by >Jiftlfe ef its looatieA witr.iR the Reactor Buting, is

~ee.tee frem temade damage. A swffieient ~

of seeeRear/ side 688liAg water fer safe sl:lutdot\\'A is assuied by ~acted ServiG& Water Pumps loGated iA tA9 Awaar/ Bu:ildiAg aAd lakiAg 5t:l£ti8R fmm OeeAee 2 CON iRtake piping. Redl:IREfaAt and diVCf5e sel:IFOOS ef seeeooa,y mak~p vmtef are eredited fer temade mitigatieR. These iREMle: 1) the elher URits' EfW Systems. 2) the PSW pumps, and J) ti:ie SSF ASW J30RlP.

Pmteeted er physieal",* sepai:ated lioos are used te swpp&y £08Cing *,t1ateJ te eaeh steam geneFater. +he SEllffeS ef pev,er te Ule PSVJ pumps are the Keei.*tee Hyere S1ati9A aAd the Cefttral Tie Switehyanj via a 100 kV lfansmissieR ~tea 100/IJ.8 kV suhstalieA.

A.IA extemal &91"'9 Qf GOC>iiAg water is oot immediately requi:ed due lo 11:191:uge qual'lli.ties of water stered UAde,gr-oond iR the intake and dismaf§e CON pipiAg. +he stered,J8lume ef er in Iha intake and disc.;Rarge liR9& belo.*.i elevatioo 791ft wouSd p:mlide sufficient eooling water fer all hee URils fer at least JO days after ~

ef the three r-ead81S.

Altoough not fully protected from tomadoes, t1w followis:19 6"QUrces pRWide rea1;.QRable assuFaAee that a Sl:lffieieAl St!PfW.t' ef primary side R-lakoop water is available dURAg a lemade initiated less ef eff5ite pewer.

a. The SSF Reaeter GeelaRt Makeup Pump EaA t.ake sudien ffem the SpeAt Fuel Pool.

The pump EaA be supplied. pawer frnm the SSF Diesel.

b. A Hi~ PlessUFe lfliedieA Pump ean t.ake sudieA frem either the Berated !Na.er Storage Tank er the Spei:lt Fuel~- a'.hef the "A" er "8" High PresstiJe ~

Pm:lp EaA be pg;N&r9d lillm the ~

Si!.ritchgear.

temade preef. As ~

ef the erigiRal FSl'.R Elevelepment, speeitie aaaideAl analyses we,:e A8l pe,-fermed te prew this joogemeAl, A8f wefe they requested by: the NRC.

SuhsequeAl pmhaWistie studies h.we eenfl:med that the eriginal qYalitative assessments v.rere £8R'ed. The 3.2 **

(31 DEC 2GU-)

Oconee Nuclear Station risk ef F10t heiRg able te aehiev~ safe shwiEl'+VR after a teFRaaa is ooffie.ieAlly small lhal addibooal pr.otectioA is not ~Yi~.

IA aEklitieA, there was OOASiderable ceFreSpaAEleRse betweeA Dl:lke aAEi NRG iA lhe yea,s past TMI eisatssiAg OE8Aee's ability te SIWM! t8FAada geAerateEI missiles. Based YpaA the probability ef fuik:ire ef tAO EfW aAEI-StatiaA ASW systems eambiReEI i.wh lhe pr,ateetiaA against temaEla miss~es afferEleEI by the SSf ~-' sy.;tem, the NRG ooAcludeEI that lhe seE8fldar:y side Eleeay heat removal fYAdioo oomplied with lhe sFitefioo far prate&tiaA agaiRst tamadees.

ystem Classifications Plant piping systems, Of portions of systems, are dassified according to their function in meeting design objectives.*

The systems are further segregated depending on the nalure of the contained fluid. FOf those systems Illich noonally contain radioactive fluids or gases, the udear Power Piping Code, USAS B31.7 and Power Piping Code USAS, B3'1.1.0 are used to define material, fabrica ion, and inspection requirements.

Diagrams for each system are included in the FSAR sections where each system is described.

Fabrication and erection of piping, fittings, and valves are in accordance :ith the rules for their respective dasses.

elds bet reen classes of systems (Class I to 11, I to 111, or II to Ill) are performed and inspected in accordance with the rules for the higher class. This preceding sentence does not apply to valves where the class break has been determined o occur at the valve sea and to pipe

• 1" nominal diameter and less.

In-line instrument components such as turbine meters, flow nozzle assembfos, and conlrol valves, etc. are classified

~

their associ3ted piping unless their penetration area is equal to or less than that of a I inch i.d. pipe of appropriate schedule for the system design tempera re and pressure, in

• ch case they are placed in Class Ill. Definitions of the three classes are ted bela.

Class I This class is limited to the Reactor Coolant System (RCS) and Reactor Coolant Branch lines, as described herein. The Reactor Coolant Branch lines indude connecting piping out to and including the first isolation e_ This section of piping is Class I in material, fabrication, erection, and supports and restraints. A Class I analysis of the piping to the first iso&ation valve has been completed for the ollowing systems:

1. High Pressure Injection (Eme<gency Injection)

2. High Pressure Injection (Normal Injection)

3. High Pressure l~ edioo (Letdown)

4. Low Pressure ~edion {Decay Heat Removal Drop-line)

5. Lo Pressure l

• ection Core Flood)

6. Reactor Coolan Drain Lines

7. Pressurizer Spray

8. Pressurizer Relief Valve Nozzles Mod. tea. ions that affect the Reactor Coolant System and the Class I portion of the branch lines must demonstrate impact on e Class I piping is acceptable. The inl)3d may be assessed by peffooning a Class I analysis or by other conservative techniques lo assure Class I le

• its are exceeded. Isolation es can be either stop, re

, or check valves.

Piping 1 inch and less is excluded from Class I.

Class II 3.2

• 5

UFSAR Section 3.2.2, 4. Tornado The Reactor Coolant System, by virtue of its location within the Reactor Building, *11 not be damaged by a tornado. Capa *

• is provided to sh do m safely all three units. T omado is not considered a design basis event (DB or transient for Oconee. Protection against tornado is an Oconee design criterion, similar to the criteria to protect against earthquakes, wind, snow, or other natural phenomena described in UFSAR Section 3.12. A specific occurrence of these phenomena is not pos ed.

The statement, "Capability is provided to shutdown safely aU three units" was intended to be a qualitati e assessment tha after a tornado, nonnal shutdown systems ould remain available or alternate systems woufd be ava able to w sh dcw.n of the plant It was not m ended to imply that specific systems shou d be tornado proof. As part of the original FSAR developmen specific accident analyses ~e not peffonned to prove this judgmen nor were they requested by the RC. Subsequent proba

• stic studies confirmed that the original qualita

• e assessments 'Here CX>fl'ed. The risk of not being able to achieve safe shutdown after a tornado was sufficien sma that additional protection was not required.

In an effort to ensure the

• of not being able to achieve safe shutdown after a tornado is mainta *ned sufticien small, design criteria are ap

• ed to the SSF through physical protection and TORM IS to establish its capabi to mitigate a tornado. The overall tornado mitigation strategy utilizes the de erministica tornado protected SSF for secondary side decay heat removal (SSDHR) and reactor coolan eup (RCMU) following a postulated loss of a normal and emefgency systems.inch usually provide these safety functions.

Successful mitigation of a tornado condi on at Oconee is defined in UFSAR Section 9.6, SSF The SSF and its related equipment have been physically protected to meet tornado requirements or ha e been evaluated using TORN 1S.

Oconee Nuclear Station UFSAR Chapter 3 From the license renewal reView, it was de ennined tha e existing analyses of thermal fatigue of these mechanical systems are a tor e period of e ended operation.

3.2.2.3 System Valve Classifica ion In the absence of de ni e codes, e non-destruc

• tes ng crnena applied to system val es are consistent

• h the in ent of Par. 1-724 of USAS 831.7 udear Power Piping Code (Feb.

1968) and the piping classification applicable to that portion of the system which includes the a e. On this basis, es are grouped

• the same eight classes as shown for piping il Table J...1, and a al e is tn sa e class as e portion of 5'JStem pipilg hich indudes the valve.

Code Applicability: Due o the umerous code references located throughout this UFSAR, no a empt is made to re ise se references as Codes are amended, superseded, or subs

• ed.

Consequently, the station specifica s applicable to a g* en valve should be relied upon o determine applica.bte codes.

3.2.2.4 ystem Component Cla ification In the absence of d

codes, design arteria a ed o pressure retaining system components are genera c:onsistent with the

• ent of Sections Ill and VIII of the ASME Boiler and Pressure Vessel Code, the piping system class tion apprcable to that portion of the system which includes the compon and he required function of the componen Atmospheric water storage ta s

• portan o safe conform to American aterworks Association Standard or Steel pipes, Rese oirs and Elevated Tanks for a er Storage, 0100, or equ* alent Components are listed by system

• component was designed, er imposed by the maximum flYJ'.>OUtel1 seismic analysis.

Code Applicabi *. Due to the numerous code references located throughout the UFSAR, no a empt is made o re *se se re erences as codes are amended, superseded, or subsbMed.

Consequently, the station specifica

• a

• cable o a g* :en component should be reUed upon to determine appplicable codes.

2.

3.

(31 DEC 2041) er dated Ju 6, 1998 o Document Control Desk doption of IS IS E LAS P GE OF E TEXT SECTION 3.2.

5. License Amendment No. XXX, XXX, and XXX (date o issuance -

Month XX, 20.XX ; Tom do M. *gation 3.2 - 7

3.3.1 Wind Loading 3.3.1.1 Design md Velocity he design

• d elocity for al Class 1 s ctures is 95 mp. T

• is largest

• d locity or 100-year occurrence as sh

• Fig re 1(b) o eference !.

3.3.1.2 The ap li d in SCE Paper 3269 which o e dynamic pressure (q) tin es 3.3.2 Tornado Loadings I Class 1 structures, except lhose str res no expo o

, ar d

• ned or tornado toads.

3.3.2.1 Applicable Design Parame ers It.a eous e em k>adings used e tornado esig Class I elCCeptio of e Standby Shut m f ci *, are:

a. o* erential pressure of 3 ps~ e

b. E emal

• d orces r c* of 300 ph.

3.J.2.2 crures (31 DEC 2041) the tornado ign of 3.3-1

UFSAR Chapt& 3 Oconee Nucle:a.- St.ltion Y =i.OD 1.0\\V, +LOP,)

here Y, +. and Oare as defi ed in Table 3-14.

Shape actors

• be used

• ASCE Paper 3269. No 3.3.2.3 Effect of Failure of Structures or Components t ot Designed f<>f" Tornado Loads infrirrn<rt,ion is described in Section 3.2.2 3.3.2.4 Wind Loading for Class 2 and 3 truclure The

• nd loa are determined from the largest nd s own m figu 1(b of Re erence..1. This 95 mp Regu fory Guide 1. 76, -Oesagn-B Pf ts, Re *

• n 1.

T IS IS THE LAST P GE OF THE or a 100.year occurrence as SECTIO 3.3.

3 License Amendmen o XXX, XXX and XXX (da e of issu ce -

onth XX. 20XX); Tornado itigatlon 3..3-2 (31 DEC 21>>+)

Oconee Huclear Station UFSAR Chapter 3 3.5.1.3 Missiles Generated by Natural Phenomena For an analysis of missiles created by a tornado having maximum ~nd speeds of 300 mph, tv.'O missiles are considered. One is a missile equivalent to a 12 foot long piece of v.rood 8 inches in diameter traveling end on at a speed of 250 mph. The second is a 2000 pound automobile with a minimum impact area of 20 square feet traveling at a speed of 100 mph.

For the wood missile, calculations based on energy principle ind' cate that because the impact pressure exceeds the ultimate compressive strength of wood by a factor of about four, the wood

'M)Uld crush due to impact However, this could cause a secondary source of missiles if the impact force is sufftcie large to cause spalling of the free {inside) face. The oompressive shock wave wtuch propagates inward from the impact area generates a tensile pulse, if it is large ~h. *11 cause spalling of concrete as it moves back from the free {inside) surface.

This spalled piece moves off with some elocity due to energy trapped in the material.

Successive pieces

• 11 spall until a plane is reached !here the tensile pulse becomes smaller than the tensile strength of concrete. From the effects of impact of the 8 inch diameter by 12 foot long wood missile, this plane in a conventionally reinforced concrete section :ould be located approximately 3 inches from the free (inside) surface. However, since the Reactor Building is prestressed. there

• be residual compression in the free face, as the tensile pulse moves out and spalling wr not occur. Calculations indicate that in the irrp3ct area a 2 inch or 3 inch deep crushing of concrete should be expected due to excessive bearing stress due to impact For the automobile missile, using the same methods as in the turbine f re analysis, the calculated depth of penetration is % inch and for all practical purposes the effect of impact on the Reactor Builcfrng is negligible.

From the above, it can be seen that the tornado generated missiles neither penetrate the Reactor Building 1a nor endanger the structural integri of the Reactor Building or any components of the Reactor Coolant System.

Additional omado missrle requirements were subsequently imposed IJ'j RC post-T I on Emergency Feedwater Systems. ONS met these requirements based upon the prooabil*

of

• ure of the EFW and station ASW Systems combined rth the protection against tornado missiles affoo:fed the SSF AS/v System. Subsequently, PSW replaced station A'!N/ rela

• e to this function. See UFSAR Sections 3.2.2 and 10.4. 7.3.6 for adoltional

• onnation.

Revision 1 to Regulatory Guide 1. 76. "Design-Basis T omado and T omado :issues for uclear P0"1.-er Plants, was released in March 2007. Revision 1 to Regu ory Guide 1.76 was

• notne1 systems (and their associated components anwer Research Institute (EPR1). ~

nethodoloJies uted in the code 10 evalu.a c~f~cyof magingtom missilesttikesared menlbdin

~feraices9, IO,ll,and 12.

~

TOR.MIS accoun1s for the f,:equency and se'<erity of tormdoes th.at could sui the plant

• pcrfttm.s aerodynamic calculalioas topiulia thettan of paent.i.al missiles aro111d 1~ site, and assesses the amutl f iequency or these rrassiles su* ing aid gi SlrUCtUIICS and a~ 11.rF(S d intu:sL

~

aialysis ~uiles thedevek,pltlClll of inpll d in tla-ce b areu*

I.

de111:lopn-ent d site tornado ha.r.ard information.

2.

de11elopn-en1 of site missile chataeteristics.

3.

de\\elopment d target size, location. and phy1lcal ptq,crties.

TORMIS Modd lnputs

~

TCRMlS mt.thodology seeks o demonscraie that u.aJ piobabilit or a m

ti11e release in u.cess of 10 CFR I OOresulting flDm to niuile daaage to eaed SSCs used to miti tea tCl11ado is less accepwic,ecri

• of IE-06/n-yr. This mans dat the uopl.OleCted SSCs e

cdleai,, ya

• 1 the ac:ciep&aoce aitecioo rather thlo indiwidually. ~r a multi-unit si&e s

uOClaoce, this critierion is applied to each wat individu.ally

~this evaluation. the prc~tiCll << a *release in eu.essof 10CFR 100* is acm lished by escablisting SSD conditions following a b'IUdo stti maintaining these mnditions for up to 72 tours. Tie followi

.ufety functioall are

.:quited:

SetOrl:UrJ Side Decax Heat ~ITICMI.

Reac::IOt C.OOlant Makeup.

Reaaor Coolant SXStem pressure boundaty imecritx.

Thtoucha process of plant walkdO#ns and 11:lliews d clra

p. ca and Olbet iofornwioo., a delailed list of st ruct IRS and eqiapment lac

• g ck:letrraaisaic protecti was de1rek,ped th.at meeu the scope oft TORMlS safety tar u ibed abo1ie.

TORMIS Resul A s.ite sp:icific analysis of wlnerable tornado mitigation equipm:nt (SSCs) 1w tl':ICl'J c

uaed us* g tie TORMIS analysis mettodology This incl s a clwacterizui oft s*

o laz.ard and po(ential tamado~ rrassiles deloeloped in a comislt:lll with tie requirements of I TOR ns t:sefs Olbet TORMIS referen<e ma ials.

UFSAR Chapter 3 Oconee Huclear Station reactions and earthqua e loads

• hout loss of function. The de ections or deformations of structures and supports are checked to assure that the functions of e Reactor Building and engi eered safeguards equipment are not impaired. Missile baniers are designed on the basis of absorbing energy by plas ic yielding.

3.5.3 References

1. Amirikian,

.* Design of Protective Structures. Bureau of Yards d Docks, Oepartmen of e avy, 'AVDOCKS P-51, 1950.

2.

• R. R., and i imson, R.

• "Impact Effect of Fragments S

• ing structura Elements *

3. Regulatory Guide 1.115, Re.ision 1, *Protection Against Low-Tra* ctory Turbine Missi es, dated Ju 19n.

4. I emal D e oomorandum from Robert E. Miller to P.N. al et al,

• ed -rlJfl>ine Missile Properties*. dated June 3, 1970.

5.

UREG 0800, Re i. *on 2, *st dard Re iew Plan", Section 3.5 1.3, dated July 1981.

6. Letter from D.

ootgomeiy {B& ) to

. H. Owen (Du e) regardlng Po en

• Reac or Building *

• es, da ed ovember 14, 1967.

7. calculation B.C-006K-B932 {OSC-8433), Wejgh, Impact Area and Velocity, and n *c Energy of RO SG Miss. es, May 20, 2004, Re.0.

Plants,* Revision 1.

E LAST PAGE OF THE TEXT SECTIO 3 5.

dd Insert 3 3.5 - 8 (31 DEC20U)

INSERT3 Add

References:

9. Electric PowerR.esean:h Institute Report

• EPRI NP-768 and NP-769, "Tornado Missile Risk. Analysis," dated May 1978.

10. Electric Power Research lnstituie Repon - EPRI NP-2005, Volumes I and 2, "TomadoMissile Risk Evaluation Methodology,* dated August 1981.

l l. Applied Research Associates, Inc., Project 5313, "TORMIS95 User's Manual:

Tornado Missile Risk Methodology," dated December 1995.

12. License Amendment No. XXX, XXX, and XXX (date of issuance - Month XX, 20XX); Tornado Mitigation.

13. Regulatory Issue Summary 201S-06, "Tornado Missile Protectiont dated June 10, 2015.

14. Rubenstein, LS. "Safety Evaluation Report - Electric Power Research Institute (EPRI) Topical Reports Concerning Tornado Missile Probabilistic Risk. Assessment (PRA) Method.ology,

• U.S. Nuclear Regulatory Commission letter 10 F. J. Miraglia, dated October 26, I 983.

15. Regulatory Issue Summary 2008-14, "Use of TORMIS Computer Code for Assessment of Tornado Missile Protection," dated June 16, 2008.

Oconee Nuclear Station UFSAR Chapter 5 Natural circulation cooldo<Ml mode of ope("

• n is not expected to be undertaken at Oconee Nuclear Station except for SBLOCA events which do not allow continued operation of or restart of reactor coolant pumps. In all other s* uations, procedures recommend that MODE 3 with average Reactor Coolant temperature ~25*f be maintained until those systems requ*red for forced circulation are put back

• lo service.

In response to Generic letter 61-21, Duke has de eloped a procedure to continuously vent the reactor vessel head lo con ainmen during a natural circulation cooldown to Decay Heat Removal System conditions. Venting the upper head area will maintain a cooling water flO'I.

through the upper head area and prevent the formation of a steam void in this area. This procedure results in a single steam wid in the RCS, i.e. in the pressurizer, and simplifies pressure control during cooldown.

RC Safe Evaluation Report (Reference 1) concurs with Duke that natural circulation cooldown is not a safe concern due to operator training and pr HIS IS THE lAST PAGE. OF THE TEXT SECTION 5.1.

The effects of a tornado may drive a unrt to an average reactor coolant tef'l1)erature less than 525°F. The subsequent minor reductJon in RCS temperature required to compensate for the increase in RCS inventory by the SSF RCMU pump dunng plant stabilization does not constitute a natural circulation cooldown requiring use of the reactor vessel head vent Refer to Reference 2 for addi1Jonal infonnation

2. license Amendment o XXX, XXX, and XXX (date of issuance -

Month XX, 20XX); Tornado Mitigation.

(31 DEC 20-1-11 5.1

• 5

Oconee Nuclear Station UFSAR Chapter 5 compared to data for the original steam genera or research and development reported above, are as follows:

During nonnal heat-up operation of the steam generator, the tube mean temperature should not be more than 80,F higher than the shell mean temperature. The maximum calculated mean tube to shell 6 T at normal operating conditions poses no problems to the structural integrity of the reactor coolant boundary. The effect of loss of reactor coolant would impose tensile stresses on the tubes and cause slight yielding across the tubes.. Such a condition would introduce a small permanent deforma *on in the tubes but :ould in no way violate the boundary integrity.

The rupture of a main steam.line would resu in an overcooling transient in which the steam generator tubes cool down faster than the steam genera or shel. The tubes are then subjected to a tensile load that may cause tube deformation. An analysis of the MSLB accident is performed to determine the input for the steam generator tube stress analysis. The MSLB accident is analyzed with the RETRAN--3D code {Reference ~

- A spectrum of break sizes is analyzed from a full power initial condition. The limiting bre size is a double-ended guillotine rupture since it maximizes the cooloo1.n rate and lhe resulting stresses on the steam generator tubes. Main feedwater is isolated o the affected steam generator on kw, steam line pressure by the Automatic Feedwater Isolation System (AFIS) instrumentation.. This circuit also inhibits the auterstart of or auto-stops the turbine-driven emergency feedwater (EfW) pump. The motor-driven EFW pump to the affected steam generator is tripped by the AFIS circuitry when the rate of depressurization setpoint is exceeded coincident

• low steam ne pressure. For smaller break sizes that do not exceed the rate of depressurization setpoin operator action is credited at 10 minutes to isolate motor-driven EA flow to the affected steam generator.. The results of the RETRAN analysis, including the primary and secondary system pressures and the tu~to--

shell temperature difference :ere used as input for the steam generator structural analysis. This analysis determined a tube axial load o 'l2. 0 f for the MSLB. The applicable tube stress accep1ance criteria are based on the E Code and indusby practice. Specifically, the steam generator tubes shaD re

• a margfl d safely against burst of gross failure of three times normal operating differential pressure, or 1.. 43 times the limiting accident cflfferential pressure. In addition, ASME Section Ill has estabished a. - of the lesser of 24 x Sm, or 0.7 x Su for design loads. The steam generator tubes have been ev_al~ted for the '12.40 Jbf MSLB accident Feed\\At'ater line breaks, Che tem.a el.-eAt; and other overhea *ng events impose compressive loads on the steam generator tubes as the RCS heats up andlor the steam genera or shell cools down. The tomade pmteEtiefl analysis CEedits a maJcimt:m eompressit.1e rube te shell tffef-+ffi§ 0f *,td:lile the feedwater line hFeak aRatjsis aediting Hpj feR:ed ooeliAg r,e,-..Mlls in a te,.ver E8Rlflr-es5we tube te shell AT.. Analyses have demoustrated that steam generator tube integrity is maintained for these loads for the replaoement steam generators.

Calculations confinn that the steam generator tube sheet *1.

11>-ithstand the loading resulting from a loss-of-coolant acciden The basis for this analysis is a hypothetical rupture of a reactor coolant pipe resul *ng in a maximum design pressure cftfferential from the secondary side of 1050 psi. Under these concfrtions there is no rupture of the primary to secondary boundary (tubes and tube sheet).

The maximum primary membrane pk.ls primary bending stress in the tube sheet under these concfrtions is 15.600 psi across the center ligaments which is wel below the AS E Section Ill alloNable limit of 45,000 psi al 6!i(N= Under condtion pos la ed, the stresses in the primary head shov.* only the effect d

• role as a slrudt.-:

restraint on the tube sheet. The stress intensity at the juncture of the spherical head

• the be sheet is 16,100 psi which is (31 DEC 204-1-)

5.2 -23

UFSAR Chapter 9 Oconee Nuclear Station sabotage e ents en normal pla systems may have been damaged or have become unavailable.

Per the original SSF licensing correspond ce as documen ed in the

• 1 28, 1983 SER and corresponding Duke Energy subm*

s (fire and TB flood) e SSF is designed o:

1. Maintain a minimum wa er le el above reactor core, an *ntact Reactor Coolant System, and maintain Reactor Coolant. Pump Seal cooling.

2. Assure natural circulation and core coo(ing by maintaining he primary coolant system fil ed o a su cien level in the pressurizer

• 1e

• taining su cient secondary side coo(ing

3.

4.

water.

T e SSF consists of the following:

1. SSF structure

2. SSF Reactor Coolant MakeuQ

3.

4.

5.

Based on subsequent SSF licensing correspondence, different design criteria may have been applied for new SSF events. Refer to the event specific design bases below for details.

• n Components are listed in Table 9-14. SSF Pnmary Val es are listed in Table 9-SF lnstrumenta ion is listed in Table 9-16.

9.6.2 Design Bases FIRE EVENT (NFPA 805 Fire which supersedes the original F Fire Design Requirements)

Oconee transitioned to FP 805, Performance-Based st ndard for Fire Protection for Ugh ater Reactor Electric Gener *ng ants, 2001 Ed"*

in accord ce 10CFR50.48 c).

FP 805 establ"shes a nudear safi goal at requires reasonable assu nee at a fire dumg any operational mode or plant conf19Uration oo pre ent e

from being mainta* ed

• a safe and stable cond* *

. Sare stable is de as maintaining

<0.99 the RCS at or belo the requ* e for hot standby.

To accomplish this goal, fire protection systems and features must be capable of ensuring at least one success path of equipment re free of damage ti

• g a re

• a. single fire area. For one fire area of Oconee, the SSF provides singte success pa necessary to achie e he FPA 805 nuclear safety goal.

9.6 - 2 (31 DEC 20.UJ

Oconee Uuclear Station UFSAR Chapter 9 250*F a long enn stra egy for reacti *

• decay hea removal and in n ory/pressure control. Long-enn suboooled natural circulation decay heat remo al is provided by supplyilg e

er to e steam generators and steaming o atmosphere. The e ended coping period a these con<f *ons is based on the significant vorume of wa er a ailable for decay heat remo al and reduced need for primary ma eup o only ma ch nominal system losses.

slue rod is not required to be postulated for this e en. Initial cond. ions are 100 power

• su cient decay heat such hat natural circulation can be achie ed. The hypothesjzed

• e is o be considered a

• e ent*. and thus need not be postulated concurre non-fire-related fai ures in safety systems, o er plant accidents, or the most se ere natura phenomena Re erence 31 ).

Dele ed Paragraph(s) per 2015 update.

Dele ed Paragraph(s) per 2012 update.

TURBINE BUILDING FLOOD EVENT The Turbine su* ing Flood was one of e e en s at iden

• ed in the original SSF licens*ng requirements. The SSF is designed to ma* lain the reactor in a safe sh do condition for a period ot 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> folio *og a TB Flood.

o er ooncurr e nt is assumed to occur. The success criteria for this event is to assure natural circuation and core coollng by ma* ta* *og e primary coolan system filled to a s 1cient le el in pressllizer ile ma* ta* *ng su cient secondary side cooling. The reactors al be ma* la ned a least 1% lWk the mos reac

• e rod fullY

• rawn. (Reference !. 10)

ECURITY -RELATED EVENT Security Reta ed E en was one of the events tha was *c1en

• ed in the original SSF licensmg requirements. The SSF is designed to achie e and ma*

in a safe

• utdo,m1 condition for this e enl o other concurrent e en is assumed to occur (Re erence 1) The success

• eria for th*s e is o assure e core *11 not re um to critical

• ea e

• not be uncovered, and long-term natural circulation *n no be halted. (Reference 41)

>'--------&re seismic qualification re *ew of the Oconee EFW S'JS 1980s, the RC ted tha a seism*c even could bre a p.,e and poti cause a flood of he turbine (3 DEC2.M1) 9.6-3

Section 9.6.2. SSF Tornado Design Criteria:

Insert 4 Successful mitigation of a tornado condition at Oconee shall be defined as meeting the following criteria to ensure that the integrity of the core and RCS remains unchallenged:

• The core must remain intact and in a coolable core geometry during the credited strategy period.

• RCS must not exceed 2750 psig (110% of design)

• Minimum Departure from Nucleate Boiling Ratio (DNBR) meets specified acceptable fuel design limits.

• Steam Generator tubes remain intact.

• RCS remains

• in acceptable pressure and temperature llmlts.

The tornado initial conditions are defined for the un* (s) as MODE 1. 102% rated thermal power at end of core rite (690 effective full-power days). The tornado is assumed to leave one unit significantly damaged and a loss of all AC er to all three un* s.

Two analysis were performed. overheating and overcooling. For an overheating e ent the significantly damaged unit is supplied by SSF SW. The other two units wilt be initially supplied by the TDEFWP and subsequently supplied by SSF ASW. For an overcooling event the TDEFWP is conservatively assumed to run until the contents of the Upper Surge Tank are depleted (to maximize the o ercoollog). SSF SW fl is subsequently established to all three units as needed.

The SSF is not required to meet the single failure criterion. Failures in the SSF system will not cause failures or inadve ent operations in other plant systems. The SSF requires manual activation and can be activated if emergency systems are not available.

UFSAR Chapter 9 Oconee t4ucJe r Station bui ding thereby submerging and fairng the EFW pumps. The RC wanted to ensure hat the EAr\\1 System s seismicalfl/ desig ed and could ithstand a sing e fai ure, as e. As a emati e o upgraamg e EFW Sys em, NRC cred* ed the use of the SSF AS System and Pl Feed & Beed (Reference 34). These two decay heat remo al systems are seisnfcally designed and i dependent fromeach other. The e ent postulated by GL 81-14 (a seismic bre

} was a special cond.

• n imposed on ONS to evaluate the EFW design. It was not intended to re-de ine the SSF

• igated B Flood (

ich does no concurrently conside a seismic e en nor does

• impose a s*ng e failure). Although both *e ents" are TB Roods, t ey are two separate licens actions "th different scopes, different acceptance criteria. and d-erent pllfJ)Oses.

The GL 81-14 flood does not have specified i *

• conditions, other mitigation assumptions, or success criteria o be considered because

• is not a even on an EFW design aitefion (Reference M).

EFW TORNADO I

ILE DESIGN CRITERIA Loads fed ro.m ICC PXSF are capabfe of beu,g powered from *

• 2 82 or the SSF 9.6-4 l chgear OTS1. Breakers feeding O S1 are e,Jedocallly power su:pplies to the SSF loads.

(31 DEC

UFSAR Chapter 9 tornado loadings *u conform o specified in Regula oryGuide 1.76, FLOOD DESIGN Flood studies show that La e Koo r d s* n Oconee Nuclear Station contain and control floods. The rst is a general floodng of the ri e s

area due to a rainfall in excess of the Probable

• mum Precipitation (PMP). The FSAR addresses Oconee's location as on a ridge

• e 100' above maximum nown floods. There ore, e emal flooding due to rainf a ecting

• ers and reservoirs is not a problem. The SSF is with"n the site boundary and, therefore. is not su *ect o flooding from e wa ers.

The grade le el en ance of the SSF is 797.0 feet above mean sea le el (msl). In e e ent of flooding due to a brea in the non-seism*c condenser circula ing wa er (CCW) sys em piping located in the Turbine Building, maximum expected ater le el within the site boundary is 796.5 ft. Since he m

• um expeded water le el is belo the eleva ion of e grade e e entrance to e SSF, he structure no be flooded by such an incident.

The SSF 1s provided

• h e emal llood 11a s that protect both e north and south entrances.

The flood wall near the south entrance is equipped

• a ater tight doof. Sta*

ys over the walls provides access to both the north and south entrances. The yard eleva ion at both the north and the sooth entrance to e SSF is 796.0 fee abo e mean sea e el (msl). Aooding due to the poten iaJ failure of the Jocassee Dam is considered in the PRA, but is not considered part of e Oconee licensing basis Ml SILE PROTECTION The only postu ted rmss* es generated by natural phenomena are tornado generated miss es.

The SSF is designed to resist the effects of tornado generated missi es in combination other loadmgs. Table ~

17 lists the postulated omado genera ed miss es Penetration depths are cal ted US!llg e mocr ied ORC formula and the mod. ed Petry formula.

Modified.O.R.C Formula:

JI)

Penetration depth.. (x =

forx d ~ __ o

+ d for X / d 1.0 here:

=

missil e shape fador = 0.72 for nosed bodies, 1.14 for sharp nosed bodies K=

W=

,.. =

0 D =

9.6-6 concre e penetra

• factor = l&O

\\ fc e ective pr()feehle me er =.., 4Ac '

(31 DEC 2041)

Oconee tlucle S tion UFSAR Chapter 9 A, = projectile contact ea *n in 2 Modi ed Peby Form a:

PenetratJon depth,(x)

Where:

K =

=

A =

p

=

A =

C V =

a c.oe lCient depe *ng on the nature of the concrete 0.00426 for norma rein orced concrete of m *sslle per urf of rnpact area W/ A, I pactArea s

• i1g velocity of projectile The design response spectra corre

g. The design response spectra re

• aQ d n e Guide 1.60. he seismjc loads as a resu o a base exc* ation are

• c analysis. The dyna

• ana

• is made

• * *ng the STRUDL-OYNAL computer program.

e base of the struct e

• oonsidered ed.

ith e geomeby nd p,ope es o e mod defined, the model's influence coe cients (

flexibi *

• ) are deteanined.

e contributions of flexure as well as shearing defonnatJoos are c.onsidered.

r ma

• is

• e ed o obta* the s

• ess ma *

• ch is used toge

• to obtain the elgenvalues and associa ed eigen ectors.

Ha ing ies and mode shapes and employing he appropfiate damp(ng

factors, ration for each mode can be obtained from Design Ground response spectra rurves. The s!andard response spectrum technique is used to de erm*

inertial forces, shears mom

• and d.

acements for each mode. The structura response is obtained b'/ com

• the modal contributions of he modes considered. The corn effect

• represen ed b'/

square roo of e sum of e squares.

""""'".... """ used genera e e response spectra at specified ele time thod.

The acceleraoon time his Of'/ of each elevauon IS re

• genera:xm or response spectra re ecting the um acceleration of a sing degree of freedom syshm1 fOf a range of requencies at e respective eleva ion The structure 9.6-7

UFSAR Ch3pter 9 Oconee Nuclear St tion

1. Turbine Building Flood caused by a brea *n e non-seismic condenser circulating wa er (CCW) piping system.

2. Infiltration of normal groundwater.

Regula ory Guide 1.102

!I critelion 9.6.5 Operation and Testing j

The SSF I be placed 11 o operation o ate e consequences of he fo

• ng e en

1. Fl~

ing

-- Note that tornado is a design criterion per

2. Fire Section 3.2 2, but 1s treated similar to an event

'=--=ro-m-a"""d-o-=-. Sabo age in that planned, formalized actions are taken as Station Blackout the result of a reported tornado.

For fire e ents tha abon of the SSF or the unit affected, following local confirmation of e fi e, the operator sta the SSF and perform the e ectrical isolation/control transfer of the 600VAC tor Con ol Center i the SSF as promptly as possible after confirmation of the fire. FoOo

• e control transfer, the opera or

• 11 establish cont11uous communications

• t e Control Room of the

• a ected a iting instructions regarding the need to start and

• e ea ailable SSF Diesel Generator, RC U system and establish SSF Auxiliary se *ce ater o

e steam generators as needed and dose an o the Reactor COOiant System isolation val es that are controlled from e SSF.

Additionally, for fire events mete SSF a tion is required, m *n steam bou dary val es must also be promptly dosed to ma*

• propei:

parameters while the SSF is made operational.

, tornado.

In-service tes *ng of pumps and OM COde excep for the Submersitble embedded condenser drcula

• capabtf

. A r

• c SSF AS pump testilg 9.6.6 Referen ces

1. Safety E uation b Standby Sh down Fa

2. Safety E aoon for sta-and 3 (T CS 1992 9.6-18 be ested consistent Duke Pawe(s Testing directives.

Reactor egulabon Oconee udear Station

_ 50-269, 50-270, and 50-287,

28. 1983 10 CFR 50.63) - Oconee udear Sta., Units 1, 2, 576), Docket Nos. 50-269, 50-270, 50-287. Ma.rch 10, (31 DEC 21>>+1

UFSAR Chapter 9 Oconee Nuclear St tion

26. 0-3202-3 SSF E emal Barrier a s Conue e

27. 10CFR Part 50 Appendix R Secbon IILL ema and Dedica ed S utdown capability

28. NFPA 805, *performance-Based Standard for Fire Protection for Ligh ater Reactor E ectric Genera *ng Plants*, 2001 Edition

29. 10CFR50.48 c), "Fi'e Pro edion"

30. ONS NFP 805 License Amendment Req est 2008-01 (April 14, 2010) 31. NRC Issuance of O S FPA 805 Amendm sand Sa ety E ation (December 29, 2010)

32. Safely E aluation by the O ce of uc ar Reactor Regu tion Rela ed to Amendment No.

346 Amendment

o. 348 o Renewed Facill Operating License DPR-38 to Renewed Facil Operating License DPR-47 Amendment

. 347 to Renewed Facility Operating License DPR-55 Duke Energy Corpora

• Oconee uclear Station, Units 1, 2, and 3 Docket Nos. 50-269, 50-270, and 50-287, IY 12, 2005.

33. Safety E uation by the O

• e of uclear Reactor Regulation Rela ed to Amendment o.

362 to Renewed Facility Opera ng cense o. DPR-38 Amendment o. 364 to Renewed Facility Opera *ng License o. DPR 47 men

o. 363 to Renewed Facility Operating License o. DPR-55 Dl*e Energy caroli s, LLC Oconee uciear Station, Units 1, 2, and 3 Docket os. 50-269, 50-270, and 50-287, October 29, 2008.

34. Safe E aluabon issued by RC, "Seism c OUaii cation of the Emergency Feedwa er Sys em," dated January 14, 1987.

35. Safety E aluation by the O ce of uclear Reactor Regu tion Rela ed to Amendment o 325 to Renewed Facility Operating *cense o. OPR-38 mendment o. 325 to Rene ed Facir Opera *ng License

. DPR 47 end en

o. 326 to Renewed Facility Operating License o. DPR-55 Dt*e Energy C3l"

• LLC Oconee udear Station, Units 1, 2, and 3 Doc et os. 50-269, 50-270, and 50-287, June 11, 2002.

36. Du e Energy letter o NRC, *Se smic licensing Basis,* May 25, 1994.

37. Du e Energy letter o NRC, *Seismic Licensing Basis," ugus.t 18, 1994

38. Safety E aluation issued by NRC, "'SER for StallOll Ba out - Oconee udear Sta *on.*

arch 10, 1992.

39. Supplementa Safety E 1m "SupD1e1rne11da1 B

out - Oconee d ear Sta ion," December 3, 1992.

40. U A

41. OSC-11214. Re 1, *ssF Licensmg S Documents.*

42. License Amendment No XXX. XXX, and XXX (date of issuance -

nth XX, 20XX); Tornado Mitigation.

9.6-20 (31 DEC 204+)

UFSAR Chapter 9 Oconee Nuclear Station Facility (SSF) Electrical Distribution System should the normal and emergency power sources to the SSF be losl The P';!}N System does not provide the prima,y success path for core decay heat removal folk>-,*

• ng design basis events and transients. The Emergency feedwater (EFW) System serves as the primary success path for design basis events and transients in which the normally operating main feedwater system is lost and the steam generators are relied upon for core decay heat removal. The PSW System serves as a backup to the EFW System and adds a layer of defense-in-depth to the SSF Auxiliary Service ater (ASVlf) System, * "ch also serves as a bac up to the EFW System.

The P';!}N System reduces fire risk by providing a diverse OA-1 power supply to power safe shutdo equipment thus enabling the use of plant equipment for mitigation of certain fires as defined by the Oconee Fire Protection Program. For cer1a* scenarios inside the Turbine Building (TB} resulting in loss of 4160V essen

• power. either the SSF or PS System is used for reaching safe shutdown. The PSW System can achieve and maintain safe shutdown cooditions for all three units for an extended period of operation during,_.. *ch time other plant systems required to cool down to MODE 5 concfrtions I be restored and brought into service as required. Similar to the SSF, the Ps-N System is equipped wi a portable pumping system that may be utilized as necessary to replenish wa er o the

• 2 embedded Condenser Cirrulating ater (CCW} piping. The water in the Unit 2 embedded CON piping is used as a suction source: for the PSW System. Electrical power is supplied from the P';!}N electrical system.

The PS# portable pump is located in an onsite storage location. The portable pumping system is not expected to be necessary unless there is a prolonged use of the PSN System to feed the steam generators. Should there be a prolonged use of the PSW System,

3.

4

5.

6.

7.

8.

since lhe es suction off the CON pipe its PSN System consists of the following:

PSW Buikfmg and associated support systems Conduit duct bank from the Keowee Hydroelectric Station underground cable trench to the Building.

uit In the event of a loss of access to coolrng water from Lake Keowee uit due to a dam failure with a subsequent loss of the intake canal submerged weir, the volume of water that remains trapped in the t:leittnc:atccw intake and discharge piping of the three ONS units Is relled upon as an alternative heat sml<. The PSW system can draw on the stored volume of water reta ned m the CCW piping (intake and eml:ieotkldiScharge lines below elevation 791 n.) of all three ONS units. which e is sufficient to provide secondary side decay heat removal for at least 30 days. Operatt0n of the PSW system does not Increase the temperature of the water m the ccw volume beyond the design limits for the PSW system components.

Poroons of trre-~~~r.em..-.;raiearnecn1D-nieeirtJ11:rciaen1SNEro:mt.ige-l'illtlgautxr.S (8.5.b) commitments, which have been incaporated

• cense Secbon H -

.tigation Strategy License Concition.

9.7 -2 (31 DEC 20U)

OconH Nucl4!ar Station UFSAR ChaptH 10 qua e. The piping from e

The effeds o High Energy Line Brea shave been analyzed a addressed n UFS Section 3.6.1.3.

Provisions for ler mer even s e considered cessary due to the se of Once Throug S earn Generators (OTSG) (Re erence ~ ).

Portions the Emergency Feed er sys em are cred d o mee the Ext rtiga

• Strategies (B.5.b) commitments,

• ch ha been incuporated in uclear S lion operating license Section H -

• ga n Strategy Lice se Cond 10.4.7.1.1 Deleted Per 2002 Update 10.4.7.1.2 Deleted Per 2002 Update 10.4.7.1.l Deleted Per 2002 Upd te 10.4.7.1 Deleted Per 2002 Update 10.4.7.1.5 Deleted Per 2002 Update 10.4.7.1.6 Deleted per 1996 Revi ion 10.4.7.1.7 Deleted Per 2002 Update 10.4.7.1.6 Oele ed Per 2002 Update 10..4 - 9

Ocon-Nucle.ir Sbition UFSAR Chapter 10 t. requiring portions of the EFW Sys em (defi ed in UFS R Section 3.2.2 to be capable of

2.

8.3.2.2.4.

10.4.7.3.8 ding a E, and se* mically qua

• ed means o decay heat removal Pl System.

the SSF ASW The SSF SW System, PSW, and Pl forced cooling serve as al emate means of d~a heat remo (lf' some of e Ef\\'V design e.ents descobed in Section 10.4.7.3.

UFSAR Chaptef" 10 Oconee Nuclear St.rtion

15. J.

_ Hampto (Ou e) letter to NRC, Response to

• em 5 of IEB 83-04 Re: Safey-R ated Pump Loss, da ed October 12, 1992.

16. Licens Amendment 386, 388 and 387 or DPR-38, DPR-47, DPR-55 for Oconee uc ar Station Units 1, 2, and 3, respect* e, da ed August 13, 2014.

17. License Amendment 325, 325 and 326 or DPR-38, DPR-47, OPR-55 for Oconee ctear e

18. Ou e Energy le

19. Ou e Energy er to RC, "Seis *c Licensing Bas* : August 18, 1994.

~ ----120. License Amendment No. XXX, XXX. and XXX (da e of issuance -

ooth XX. 20XX), Tornado Mitigation.

THIS IS T E LAST PAGE OF THE EXT SECTION 10.4.

10..4-24

ATTACHMENT 3 UFSAR RETYPED PAGES

UFSAR Chapter 3 Oconee Nuclear Station

n. Reactor Buildrng penetr ions and pt *ng through isolation va es.

o. Siphon Seal a er System.

p. Essential Siphon Vacuum System.

q. Elec ric power for abo e.

r. Nitrogen supply to the EFW control es FDW-315 and FDW-316.

lnformati<>n relating to e seismc design of SSF systems and components is contained in Section 9.6.4.1 and 9.6.4.3. lnfonnat.ion a ng o the seismic design of the PS Sys em and its components are coota* ed in Section 9.7.

4. Tornado The Reactor Coolant System, by

• e of

• location with*n the Reactor Building, wi I not be damaged by a tornado. Capabi

• is pro ided to shm safely all three units. Tornado is not considered a design basis e DBE) Of nsjent for Oconee. Protection against omado is an Oconee design c

• erion, sim. r o e c

• eria o protect against ea hquakes, wind, snow, or other r

phenomena desaibed in UFSAR Section 3.1.2. A specific occurrence of these phenomena is not po lated.

The statemen "C3pabi is pr, ed to safely three units" was in ended to be a qualitative assessmen er a tornado, normal shutdown systems would rema n a ailable or a emate systems d be a ii.ab e o s utdo of the plant.

was no intended to imply at specific systems should be tornado proof. As part of the o *

• FSAR de elopment, specific accident atyses re not performed lo pro e his judgement, nor were they requested Ir/

e RC. Subsequent probabilis *c studies confirmed that the original quatita

• e assessm ere correct.. The fi of no bemg able lo achie e sa e shutdown a er a tornado sufftcien sma hat additional protection was not required.

In an effort to ensure the

• of not be.

mailtained sufficien smatl, design protection and TORMIS to esta

• mitigation strategy

• li2es determinis

• tornado pro ected SSF for secondary side decay hea remo al (SSD R) and reactor cootan eu_p (RCMU) following a postu 1ed loss of all normal and emergeno/ syste usua 'I pro

• e ese safety fu ctions.

a Oconee is de ned in UFSAR Section 9.6, been ysi pro ected to mee tornado S.

3.2.2.1 ystem Classific tion Plant p*ping systems, or portions of systems, are classified according o their function in mee

• design objecti es.

systems are er seg egated depending on the nature of the contained fluid. For those i

coot

• radJOacti e utds or gases, uclear Po r Piping Code, USAS B31 7 and Po*

• ing Code USAS, 831.1.0 are used defi e mate

• t, fabrica ion, and inspection requ1n* 11nc1111c:,

Diagrams for each system are

• F 1es are in accordance

• e ru es for

'JS (Class I to II, I to m, or II to Ill) are rules or the ig er class. This precedfng 3.2. 4 (31 DEC 201X)

-s I

3 s

i:C l

UFSAR Chapter 3 Oconee Nuclear Station Oconee Uuclear Station UFSAR Chapter 3 3.3 Wind and Tornado Loadings I Class 1 structures, excep those structures no exposed to *oo, are designed to °thstand the e eds of *nd and omado loadings, *thout loss of capability of the systems o perform the*r sa e functions.

3.3.1 Wind loadings 3.3.1.1 Design Wind Velocity T

design lind velocrty for a Class 1 structures is 95 mph. This is for a 1 DO-year occurrence as shown in Figure 1 b) of Reference.!.

3.3.1.2 Determination of Applied Forces largest ind velocity ied pressures are computed by e means outbned in SCE P per 3269 mich states e eq

• lent sta *c force on a buikfng is equal o the dyna ic pressure (q) times the drag coe 1cient Co) multiplied by the eleva *on area e dVfla

• c essure is the product one-h e air den

• and the square of the elocity (the

• etic energy per unit otu e of mo a*r). For arr a 15" C a 760 mm Hg: q = 0.002558 v2

• q in psf and V in mph. The drag coe

• ent is based on test data and tabulated

• Reference 1. For ese ig

• nd es,

• s equation may be excessi ely conserva

• e, but no cred is taken for is poss*ble pressure reducfion.

3.3.2 T omado loading Class 1 s ctures, e cept those structures no exposed tow*

• are designed for tornado

s.

J.J.2.1 Applicable Design Parameters S

ltaneous e emal loa<fmgs used in e tornado des of Class I structures, the excep ion of the standby S utdown Facir

• are:

a. ff eren

• pressure of 3 psi developed over 5 seconds.

b. Extem

,ind forces resulti g from a tomado having a e1oc* of 300 mph.

miS!:.nes is co ered Section 3.5.1.3.

sai>ed in Section 9.6.3.1.

3.J.2.2 ings e ca culated in accordance Section 3.3.12, e tornado

• Section 3.3.2.1. The tornado loading com

• used or design of 310EC 2 1 3.3 -1

UFSAR Chapter 3 Oconee tlucle r Station 1

Y =.(l.OD+l.OW, I.OP,)

Where Y,, and Oare as defined in Table 3-14.

W1

=

Stress induced by design tcmado tind velocity (drag, and torsion)

P1

=

Stress due to differential pressure Shape factors

• 1 be a eel in accordance with ASCE Paper 3269.

o height or gust factors will be used 'th tornado loadings.

3.3.2.3 Effect of Failure of tructures or Components Not Designed for T omado loads This informa ion is descnbed in Section 32.2 3.3.2.4 Wind Loading for Class 2 and 3 tructures The wind loads are determined from the largest wind velocity fOf a 100-year occurrence as shown in Figure 1(b) a Reference.1-This is 95 mph at the site.

3.3.3 References

1.

ind Forces on Stroctures, Task Qxnmittee on Wind Forces, ASCE Paper o. 3269.

2 Regulatory Guide 1.76, Design-Basis Tornado and Tornado Missiles for udear Power Plants; Re.sion 1.

3. License Amendment No. XXX, XXX, and XXX (date of issuance -

blth XX. 20XX);

Tornado.. ation.

THIS IS THE LAST PAGE OF THE TEXT SECTIO 3.3.

3.3-2 (31 DEC 201X)

Oconee Uuclear Station UFSAR Ch pter 3 3.5.1.3 Missiles Generated by Natural Phenomena For an analysrs of missiles aea ed by a tornado having maximum wind speeds of 300 mph, tYIO missiles are considered. One is a missile equi ent to a 12 foot long piece of *.IOOd 8 inches in diameter tra eling end on at a speed of 250 mph. The second is a 2000 pound automobile

• a minimt.m impact area of 20 square fee traveling at a speed of 100 mph.

For the wood rrissile, calculations based oo energy principle indicate that because the impact pressure exceeds the ultimate compressive strength of wood by a factor of about four, the wood would crush due to impact However, this could cause a secondary source of missiles if e

impact force is suffteie large to cause spa ling of the free Qnside) face. The compressive shock wa e which propaga es irn d from the impact area generates a tensile pu se, if it is large enough, *u cause spalling o concrete as it moves back from the free {inside) surlace.

This spalled piece moves off some elocity due to energy trapped in e material Success* e pieces w

• sp un a plane is reached where the tensile pulse becomes s er than the tensile strength of conaete. from the effects of impact of the 8 inch cfiameter by 12 foot long wood rrissile, is plane i"I a conven ionally reinforced concrete section YX>Uld be located appro *mately 3 inches from the free (inside) surface. However, since the Reactor Building is prestressed. there

• be residual compression in the free face, as the tens e pulse moves out and spat *ng not ocaJr. Calculations incficate that in the irq>act area a 2 inch or 3 inch deep crushing of c.oncrete shoo1(j be expected due to excessive bearing stress due to impact For the automobi!e missiJe, using the same methods as in the turbine fa ure analysis, the calculated depth of penetration is % inch and for all practical purposes the effect of impact on the Reactor B

• ding is negligible.

From the above, it can be seen t the tornado generated missiles neither penetrate e

Reactor Buikfmg r.1 nor endanger the structural integrity of the Reactor Building or any components of the Reactor Coolant Sys em.

Additiooa.l tornado missile req *rements 'Wefe subsequently imposed by RC post-T oo Emergency feed ter Systems.

S met these requirements based upon the proba o

f

• ure of the EFW and station ~

Systems combined the protection against tornado missiles a orded the SSF PSI-I System. Subsequently, PS replaced station AS/ii r

• e to this function. See UFSAR Sections 3.2.2 and 10.4.7.3.6 for additional infonnation.

Revision 1 to Reg tory Guide 1.76, "Design-Basis Tornado and Tornado ssiles for dear Power Pia

was released in,1arch 2007. Revision 1 to Regulatory Guide 1.76 ras incorporated

• to the plant's licensing basis in the 4th quarter of 2007. The design of 001 systems (and their associa ed components and/or structures) that are required to resist tornado loaamgs con orrn to the tornado ~nd. di erential pressure, and missile aiteria spec* ied in Requla ory Goide 1.76, Revision 1 or be eva ed by TORMIS..

3.5.1.3.1 TORM thodology The TO IS computer code is used to determine the frequency of a damaging tornado msssile stnlce on unprotected plant SSCs tha are used to mtigate a tornado. The TO IS code is an updated rsion of the orignal TOW S code deieloped for the Electric Power Research Institute {EPRJ). The methodologies used in the code to evaluate the frequency of damaging tornado missile

• es are documented in References 9, 10, 11, and 12.

The TO IS code accounts for frequency and severity of tornadoes that coutd e the plant site. peffonns aerodynamic calculations to predict the transpon of pot missles around the

• e. and assesses the annual frequency of these missiles stri ing and damagl~

structures and other targets of interest.

(31 DEC 201x, 3.5 - 7

UFSAR Chapter 3 Oconee Nucle r Station The analysis requires the de elopment of input data in three broad areas:

1. Development of site tornado hazard in oonation.

2. Development of site missile characterisfcs.

3. Development of farge size, location, and physical properties.

TORMIS Model Inputs The TORMIS methodology seeks to demonstrate that the annual probability of a radioac

• e release in excess of 10 CFR 100 re ing from tornado missile damage to unprotected SSCs used to mitigate a tornado is less than the acceptance aiterion of 1E-06/rx-yr. This means tha the unprotected SSCs are evaluated collectively against the acceptance criterion rather than individually. For a mu *

• site such as Oconee, this criterion is applied to each unit individually.

For this evaluation, the prevention of a *release in excess of 10 CFR 100* is accomplished by establishing SSD conditions following a tornado strike and ma*ntaining these conditions fof up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The foffo,1.ing saf functions are required:

Secondary Side Decay Heat Removal.

Reactor Coolant Makeup.

Reactor Coolant System pressure boundary integrity.

Through a process of downs and re *ews of plant dra ~ngs, calculations, and other infom,atioo, a detaiJed list of structures and equipmen lacking deterministic protection *was developed that meets the scoped the TOR IS safe targets described above.

TORMIS Results A site specific analysis of vulnerable tornado mitigation equipment (SSCs) has been conducted using the TORMIS analysis methodology. This includes a characterization of the site tornado hazard and potertial tornado generated missiles developed in a manner consistent with the requirements of the TO S User's and other TORftJ IS reference materials.

For each Oconee e mean annual frequency of a damaging tornado missile e

resulting in a radiological release in excess of 10 CFR 100

• rn1s as determined to be less than the acceptar\\ce mterion of 1E-06. The alysis was pe!fooned in a manner consistent the requirements of the EPRI k>pical reports and

• the req *rements set forth in the RC's SER (Reference 14) and RJS 2008-14 (Re erence 15).

3.5.2 Barrier Design Procedures The Reactor Building and Engineered Sa eguards Systems oomponents are protected by barriers from aed missies :hach might be genera ed from the primary system. local yielding or erosion of barriers is permissible due to or mi e in pact provided there is no general f

• ure.

The final design of missile barrier and equipment support structures inside the Reactor au* ding is reviewed to assu e appf icable pressure loads, jet forces, pipe reactions and loads w loss function. The de ections or deformations of structures and suppons are checked assure that the functions of the Reactor B

• ding and engineered safeguards eq

• are not impaired.

• 1e barriers are designed on the basis of absorbing ene<gy by plastic yielding.

3.5-8 (31 DEC 201X)

Oconee Nuclear Station UFSAR Chapter 3 3.5.3 References

1. Amirikian, A.., Design of Protective Structures, Bureau of Yards and Docks, Department of the Navy, NAVDOCKS P-51, 1950.

2. Alvy, RR., and Wdlimson, RA.., "Impact Effect of Fragments Striking Structural Elements.M

3. Regulatory Guide 1.115. Revision 1, ~Protection Against Lo -Trajectory Turbine Missiles, dated July 19n.

4. Internal Duke Memorandum from Robert E er to P.N. Hall et al, titled 1urbine Missile Properties", dated June 3, 1970.

5. NUREG 0800, Revision 2, "Standard Review PlanM, Section 3.5.1.3, dated July 1981.

6. Letter from D. W. Montgomery (B&

to

. H. Owen (Duke) regarding Potential Reactor Building ssiles, dated No ember 14, 1967.

7. Calculation BWC-006K-8932 (OSC-8433),

eight, Impact Area and Velocity, and Kinetic Energy of ROTSG *ssiles, 20, 2004, Rev.0.

8. Regulatory Guide 1.76, ' Design-Basts Tornado and T omado 1ssiles for Nuclear Power Plants; Revision 1.

9. Electric Power Research Institute Report-EPRJ P-768 and NP-769, 1ornado Missile Risk Analysis: dated May 1978.

10. Electric Power Research Institute Report - EPRI P-2005 Volumes 1 and 2, omado Missile Risk Evaluation Methodology,* dated August 1981.

11. Applied Research Associa: es, Inc., Proiect 5313, "TORMIS95 User's Manual: Tornado Missile Risk Methodology; dated December 1995.

12. License Amendment No. XXX. XXX. and XXX (date of issuance - Month XX. 20.XX);

T omado itigation.

13. Regulatory Issue Surrmaries 2015-06,,omado

• site Protection," dated June 10, 2015.

14. Rubenstein, LS. "Safety E bon Report - Electric Power Research Institute (EPRI)

Topical Reports Concerning T omado

• e Probabilistic Risk Assessment (PRA)

Methodology,* U.S. Nuclear Reg ory Commission letter to F. J. Mirag ia, dated October 26, 1983.

15. Regulatory Issue Summary 2£m.14, "Use of TOR IS Computer Code for Assessment of T omado Missile Protection,* da ed June 16, 2008.

THIS IS THE LAST PAGE OF THE TEXT SECTIO 3.5.

(31 DEC 201X) 3.5 - 9

Oconee Nucle r Station UFSAR Chapter 5 atural circulation cooldown mode of operation is no expected to be undertaken at Oconee uclear Station excep for SBLOCA events

• ch do not allo1 con

• ued operation of or restart of reactor coolan pumps. In an other situ ions, procedures recommend that DE 3 a erage Reactor Coolan temperature ~525.F be ma* tained un *1 those sys ems required for forced circula *on are put back *nto service.

In response to Genenc Letter 81-21, e has developed a procedure o continuously ent the reac or esse head to containment during a na ura circu afion cooldown o Decay Heat Removal System conditions. Ven *ng the upper he d area

• man ta* a coorng water flow ough the upper head area and pre ent fonna on of a steam void in h*s area. This procedure results 111 a single steam id in RCS, i.e. in e pressurizer, and simplifies pressure control during cooldown. NRC Safety E luation Report Reference 1) concurs D

e tha natural circulation eooldo is not a sa ety concern due to opera or training and procedures.

The effects o a omado may dri e a u

• to an average reactor coolan tempera re ess than 525°F. The subsequent minor reduction in RCS emperature req

• ed to compensate for the

• crease m RCS

• entory by the SSF RC pump d

• ion does not cons tute a na ural circulation cooldown requiring use of e reactor vessel head ent. Refer o Reference 2 for additional i oonation.

5.1.3 References

1. Le er from J. F. Stolz ( RC) to H. B. Tucker e) da ed June 5, 1985. Subject RC Safe E a uation Report on Du e Response to Gen *c Le er 81-21 at Circulation Cooldown.

2. license Amendment No. XXX, XXX, and XXX (date of issuance -

Month XX, 20XX);

omado M.

tion.

THIS IS THE LAST PAGE OF THE TEXT SECTIO 5.1 (31 DEC201 5.1. 5

Oconee tluclear Station UFSAR Chap er 5 compared to data for the original s eam generator research and de etopmen reported abo e, are as fol ws:

(31 DEC 201 5.2-23

UF AR Chapter 9 Oconee Nuclear Station sabotage even s en nonnal plan systems may ha e been damaged or have become una *1able Per e original SSF licensing correspondence as documen ed in the

• 1 28, 1983 SER and corresponding Duke Energy subm*

s (fire and TB flood) the SSF ts designed o:

1. Maintain a min*mum wa er e el above the reactor core, an intact Reactor Coolant System, and mamta* Reac or Coolant Pump Seal cooling.

2. Assure na ra ci cu tion and core cooling by ma ntaining he primary coolant system fi ed o a su cien le el i the pressurizer ile maintaimng su cient se<:oodary side coor ng water.

3. Transfer decay heat from e fuel to an ul *mate heat sin.

4.

ai tain e reactor 1*. shutdown

• h the most reacti e rod stuck fu I norm sources of RCS makeup have become unavailable, by pro "ding Reactor Cool eup Pump System ich always supp es ma e of a conce lion. (The stu rod requirement was eliminated for fire e ents was adopted. See Section 9.62)

The SSF consists of the following:

1. SSF Structure

2. SSF Reactor Coolant Ma eup (RCM) Sys em

3. SSF

• iary Selvice ater (ASW) System

4. SSF Electrical P er

5. SSF Support Systems System Components are

• ted in Table !3--14. SSF Primary Va es are listed in Table 9-

15. SSF lnstrumen ion is listed in Table 9-16.

Based on subsequen SSF

• censmg correspondence, different design cri been applied for new SSF events. Refer to the e ent specific design bases be 805 Fire hich super edes the origina To accomplish

• goat, fl e protection sys ems and features must be ca least one success path of

• pment re ins free of re damage ti a

area. For me fire area at Oconee, e SSF provides e single success adlie the FP 805 clear sa:

goal.

safety g of FP 805 does not presaibe a transrhon to cold s folkr.,,,il'llQ a fie; ra er, only that pla be mainta*ned sa e

<0.99 and RCS te ture >I= 250*f for up to a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> coping d 9.6 - 2 F Fire Design of ensuring a in a single re necessary o (31 DEC 201XI

Oconee Uuclear St tion UF AR Ch pter 9 made to achieve a ficensed end state of hot shutdown (Ke <0.99 and RCS temperattre bela 250°F but above 200°F) (Reference 9.5.1.3.2). For the most rmiting fire scenarios, it is anticipated that the end state of the cooldown would be an RCS temperature of approximately 250°F a long tenn strategy for reactivity, decay heat removal and inventorylpressure control. Long-tenn subcooled natural circulation decay heat removal is provided by supplying e

ter to the steam generators and steaming to mosphere. The extended coping period at these conditions is based on the significant volume of water available for decay heat removal and reduced need for primary makeup to only match nominal system losses. A stuck rod is not required to be postulated for this event. Initial conditions are 100".4 power *th sufficient decay heat such that natural circulation can be achieved. The hypothesized fire is to be considered an

• event*. and thus need not be postulated concurrent with non-fire-related failures in safety systems, other plant accidents, or the most severe nattral phenomena Reference.n).

Deleted Paragraph(s) per2015 update.

Deleted Paragraph(s) per 2012 update.

TURBINE BUILDING FLOOD EVENT The Turbine Bu

• ng Flood was one of the events that was iden

• ied in the onginal SSF ficensing req *rements. The SSF is designed to ma*ntain the reactor in a safe shutdown condition for a period of n hours following a TB Flood. No other concurrent event is assumed to occu. The success criteria for this event is to assure natura circulation and core cooling by

• taining the primary coolant system filled to a sufficient level in the pressurizer

• 1e maintaining sufficient secondary side cooling. The reactor sha be maintained at least 1% l\\klk

• the most reactive rod fully withdrawn. (Reference 1.1Q)

ECURITY-RELATED EVENT A Security Rela ed Event was one of the events that was idefl

• ed in the original SSF licensing reqwements. The SSF is designed to achieve and main

• a safe sh dcrMl condrtioo for this even o other concurrent event is assumed to occur. (Reference 1) The success criteria for

• s event is to assu-e the core 'NiU not return to criticality, the active fuel ~JI not be uncovered, and long-term natural circulation 'Nill not be hailed. (Reference.4..1)

TATI

'I BLACKOUT EVENT This event was licensed after the design of the SSF was completed and approved by RC. The SSF was credited as the method the plant would employ to mitigate a SBO even (References 38 and ~

The success criteria is to maintain the core covered for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

o stuck rod is asstmed or this even Initial con<fltions are 100% po'Ner and 100 days of operation.

(Reference ~

F TOR ADO DE IGN CRITERIA This is a design cri erion for the SSF structure that was committed to as part of the original SSF censang correspondence and remains valid. AU parts of the SSF strudure tha are requi--ed for mitiga

• of the SSF events are required to be designed against tornado *11.nts and associa tornado missiles. This requ* ement is satisfied through appropriate design cl the SSF structure.

Origina,

design criterion cfid not extend to SSCs tha were a eady of e plant

• ch SSF r es l4JOO and

• terfaces with for event mitigation. The design criterion is no extended o SSCs are a part of the plant which the SSF relies upon and

• tenaces,,.

• for tornado mitiga.. This is satisfied either ttvough physical protection or ted by T is to note e overall tornado mitigation stra:

izes the SSF to mitiga a

tornado (Reference 42). Tornado design requiremenls for the plant itself are addressed in Sedion 322.

(31 DEC 201X) 9.6. 3

UFSAR Chapter 9 Oconee tJoolear Sta ion Successful m*

• ation of a omado oondition a Oconee shall be defi ed as eebng the fol

• g crite

• o ensure t

e *ntegnty of e core a d RCS remains un enged:

The core must rema* intact and i a coolable core geometry during e cred* ed s ategy period.

RCS must not exceed 2750 psig (110% of design).

n*mum Departure om u eate Boi *ng Ratio (DNBR) meets specified acceptable fu design Ii *.

Steam Generator tubes remain i tac.

9.6 - 4 (31 DEC 201

Oconee Nuclear Station Uf SAR Chapter 9 therefore, Duke Energy requested and NRC appro ed crediting the SSF Auxiliary Service Water (SSF ASW) System as an acceptable alternative (e en though it was recognized that SSF ASN System itself is not completely protected from all tornado missiles). It is important to note that this licensing action did not specify a tornado missile e ent or define a tornado missile mitigation strategy. Using a probabi "stic approach, it solely focused on ensuring that a secondary side heat removal path is adequately designed to vvithstand the effects of t001ado missiles (Reference!).

However, the current o er tornado mitigation strategy utilizes the SSF to mitigate a tornado.

Thus, the plant relies upon the SSF ASW System to provide feedwater to the SGs of the significantly damaged unit after a tornado (Ref. 42). The SSF ASN System is either physically protected ore uated by TORMIS.

EFW SINGLE FAILURE VULNERABILmES During the 1990's and early 2000's, the RC again focused on the design capab* ties of the EFW System. Certain single failure vulnerabilities rere identified after reviev.-s by both Duke Energy and NRC.

RC accepted these vulnerabilities by crediting the existence of mu *p1e alternate paths that could also provide secondary side heat removal. SSF Auxiliary Service Water (SSF PSN) was one o the paths credited for this function (Reference 35).

Deleted Per 2014 Update.

The reactor building spray pumps are described with respect to the waterproofing of e ls between the auxiliary buikfmg and the turbine building. However, Duke did not credit the reactor building spray pumps in the mitigation of the turbine building flood. In addition, the RC did no credit the reactor building spray pumps for the mitigation of the turbine building flood event in the licensing basis or backfit analysis.

ELECTRICAL SEPARATI CRITERJA Selected motor operated es and selected pressurizer heaters are capable of being pa... -ered and controlled from either the normal station electrical systems or the SSF electrical system.

Suitable electrical separation is provided in the fo lowing manner. Electrical distribution of the SSF is identified in Figure 9-40 and Figure 9-41 is p-ovided by the SSF motor cootrol centers (MCC's). Loads fed from :\\CC's '1.XSF. 2XSF, 3XSF, and XSF are capable of being pa1.-ered from either an existing plant load center or the SSF load center through key *nterlocked.

breakers at the MCC's. These breakers provide separation of the power supplies to e SSF loads.

Loads fed from MCC PXSF are capable of being powered from either Unit 2 B2T or lhe SSF Diesel or the alternate PS/\\1 87T via s itchgear OTS1. Breakers feeding OTS1 are electrica intet1ocked and provide separa ion of he po1o*,er supplies to the SSF loads.

During normal operation, these loads are pa.r.-ered from a normal (non-SSF) load center

• the SSF MCC's 1XSF, 2XSF, 3XSF (Group B) or switchgear OTS1 via SSF MCC PXSF {Group C).

During operation of the SSF. these loads are powered from the SSF diesel generator via the SSF load cen er/switchgear and SSf MCC's.

9.6.3 System Descriptions 9.6.3.1 tructUTe The Standby ShtJtdcw. facifity (SSF} is a reinforced concrete structure consisting of a diesel generator room, electrical equipment room, mechanical pump room, control room, central alarm (31 DEC 201XJ 9.6 - 5

UfSAR Chapter 9 Oconee Nuclear Station station (CAS}, and ventilation equipment room. The general arrangement of major equipment and structures is shown in Ftgure 9-30, Figiie 9-31, Figure 9-32, Fagure 9-33 and Figure 9-34.

The SSF has a seismic c1ass* ication of Category 1.

The following load conditions are considered in the analysis and design:

1. Structure Dead Loads

2. Equipment Loads

3. Live Loads

4. Nom1al Wind Loads

5. Seismic Loads

6. Tom ado Wind Loads

7. Tom ado Missile Loads

8. High Pressure Pipe Break Loads

9. T wbine Building Flooding Potential WINO AND TORNADO LOAD The design wind velocity for the SSF is 95 mph, a 30 ft. above the nominal ground elevation.

This velocity is the fastest 'I.ind 'lhith a recurrence interval of 100 years. A gust factor of unity is used for determining wind forces. The design tornado used in calculating tornado loadings is in conformance v.,ith Regula ory Guide 1. 76, Revision 0,

• th the following exceptions:

1. Rotational wind speed is 300 mph.

2. Translational speed of tornado is 60 mph.

3. Radius of maximum rotation speed is 240 fl

4. T omado induced nega

• e pressure d-eren

• is 3 psi, occurring in three seconds.

The spectrum and characteristics of tornado-generated missiles are covered later in this section.

Revision 1 to Regulatory Guide 1. 76, '"Design-Basis T Ol'nado and T omado SS1les for Nuclear Power Plants; was re eased in March 2007. Revision 1 to Regulatory Guide 1. 76 was inco,porated into the SSF licensing basis in the 4th quarter of 2007 _ The design of all future changes to and/or analysis of SSF-r; ed sys ems, structures, and components subject to tornado loadings conform to the tornado

• d, diffe.-ential pressure, and missile criteria specified in Regulatory Guide 1.76, Revision 1 or be evalua ed by TORMIS.

FLOOD DESIGN Rood studies show that lake K~ and Jocassee are designed with adequate margins to contain and control floods. The fll'St is a general flooding of the rivers and reservoirs in the area due to a ra*ntall in excess of the Probable bxirnum Precipitation P). The FSAR addresses Oconee's location as oo a ridgeine 100' above maxwnum knoit.TI floods. Therefore, external floo<fing due to rainf affecting rivers and reservoirs is not a probfem. The SSF is within the site boundary and, therefore, is not subject to flooding from la e wa ers.

The grade le el entrance of SSF is 797.0 feet above mean sea levef (msl). In thee ent of flooding due to a brea in the non-seismic condenser cir;culating water (CCW) system piping 9.6-6 (31 DEC 201X)

Oconee Nuclear Station UFSAR Chapter 9 located in the Turbine Building, the maximum expected water level within the site boundary is 796.5 ft. Since the maximum expected er level is belo the e1e

• on of the grade level entrance to the SSF, the structure

• not be flooded by such an incident The SSF is provided ~th external flood s that protect both the north and sooth entrances.

The flood wall near the south entrance is eq *pped

• a ter tight door. Stairways over the walls provides access to both the north and south entrances. The yard elevation at both the north and the south entrance to the SSF is 796.0 feet above mean sea level (msl). Flooding due to the potential failure of the Jocassee Dam is considered in the PRA. but is not considered part of the Oconee licensing basis.

Ml ILE PROTECTION The only postulated missiles generated by natural phenomena are tornado generated missiles.

The SSF is designed to resist the effects of tornado generated missi es in combination with other loadings. Table 9-17 fists the postula ed tornado generated missiles.

Penetration depths are calculated using the modified DRC formula and the modified Petry formula.

Modified N.D.RC Formula:

Penetrationdepth.(x) = \\ 4KNW forx l d ~ -.0 Ht>

= \\ K)l\\V L~ J +dforx 1d > 2.0 Where:

=

missile shape factor= 0.72 f<<flat nosed bodies, 1.14 for sharp nosed bodies K=

=

V =

0 O=

bir.

f 180 concrete penetra,sty actor =

fi;"

vfc Weight in pounds s

• ing velocity effective projectile diameter =, 4Ac I ;

Ac = projectile contact Area in in Modified Petry Formula:

Penetration

= 12K,J\\, log,(1..,.. \\ 1 215.000) depth,(x)

Where:

K =

a coefficient depending on the

]>

the concrete

=

0.00426 for noon rein.forced ooncrete (31 DEC 201X) 9.6 - 1

UFSAR Ch pter 9 A,=

=

A =

C V=

weight of missile per unit of impact area

\\\\ I A, Impact Area stnlting velocity of projectile Oconee Nuclear St tion Table 9-18 lists the calculated penetration depths and the minimum barrier thicknesses lo preclude perforation and scabbing, hence efimina *ng secondary missiles Revision 1 to Regulatory Guide 1.76, *Design-Basis Tornado and Tornado ssiles for uclear PO'... -er Plants; s released in March 2007. Revision 1 to Regula ory Guide 1.76 was incorporated into the SSF licensing basis in the 4th quarter of 2007. The design of a I future changes to and/or analysis of SSF-related systems, slrud1Xes, and components subiect to tornado loadings *n conform to the tornado

• nd, differential pressure, and missile criteria specified in Regulatory Guide 1. 76, Revision 1 or be evalua ed by TO IS.

El MICOE IGN The design response spectra correspond to the expected maximum bedrock acceleration of 0.1

g. The design response spectra were developed in accordance

• h the procedures of Reg.

Guide 1.60. The seismic loads as a result of a base exci1ation are determined by a dynamic analysis. The dynamic analysis is made utilizmg the STRUOL-0 computer program. The base of the structure is considered fixed.

the geometry and properties of the model defined, the moders mfluence coeffiaents (the fie "bility matrix) are determined. The contributions of flexure as we l as shearing de ormations are considered. The resulting matrix is in erted to obtain e stiffness matrix, :hich is used together mh the mass matrix to obtain the eigenvalues and associated eigenvectors.

Having obtained the frequencies and mode shapes and employing the appropriate damping factors. the spectral acceleration for each mode can be obtained from Design Ground Motion response spectra curves. The standard response spectn.m echnique is used to de ermine inertial forces, shears, moments, and displacements for each mode. The structural response is obtained by combining the modal contributions of the modes considered. The combined e ed is represented by the square root of the SllTl of the squares.

The analytical technique used to generate the response spedra a speci ed e1e tions is the time history method.

The acceleration time history of each ele is retained for the generation of response spectra reflecting the maxunum ac.cek!ration of a single degree of freedom system for a range of frequencies at the respective e1e tion. The structure will

• thstand e specified design conditions without impairment of structtr.31 in egrity or sa e function.

9.6.3.2 Reactor Coolant Makeup (RCM) ystem The SSF RC System is designed to supply bora ed eup to the Reactor Coolant System (RCS) to provide Reactor Coolant Pump Seal cooling and RCS invento,y. An SSF RC Pump foe ed in the Reactor Bu ding of each unit supply eup o the RCS should the normal makeup system and the reactor coolant pumps beoome Rlperabve because of a station blackout con<fition caused by the loss of I other on-site and

-

• e pc71.-er. The system is designed o ensure that sufficient borated 13 er is i1able from the spen fuel pools to the SSF to maintain mode 3 w;\\h an average Reactor Coolant tempera e ~ 525¢F (the 9.6-8 (31 DEC 201X)

NOTE THAT NO ADDITIONAL CHANGES OCCUR IN THIS SECTION; HOWEVER, THE PAGES WILL BE REPAGINATED WHEN RETYPE IS SUBMITTED TO UFSAR EDITOR FOR CHANGE.

Oconee Uuclear Station UFSAR Chapter 9 9.6.5 Operation and Testing The SSF I be placed into operation to mitigate the consequences of the folio *ng events/criterion:

Note that tornado is a design criterion per Section 3.2.2, but is treated similar to an event in that planned, formalized actions are taken as the result of a reported tornado.

1. Floocftng 2 Fire

3. Sabotage

4. Station Blackout

5. Tornado For fire e ents that req

• e activation of the SSF for the unit affected, folio *ng local confrrmation of the f1Te, the operator will staff the SSF and perform the electrical isolation/control transfer of the 600VAC Motor Control Center in e SSF as prom as posstble after confumation of the fire. Following the control transfer, the operator

• 1 es ish coo *nuous communications

• h the Control Room of the unit affected 3'Nailing instructions regarding the need to start and utilize the available SSF Diesel Generator, RC system and establish SSF Auxiliary Service Water flow to the steam generators as needed and close of the Reactor Coolant System isolation valves that are controlled from e SSF.

Additiooally, for fire events where SSF activation is required, main steam boundary valves must also be promp closed to mainta*n proper control of RCS paraine ef'S while the SSF is made operational.

For floo<fmg. sabotage, station blackout, tornado, and those fire events rhere the SSF is credi ed for safe shutdo..,,'rl, operators will be sent to the SSF. When directed by the shift supe,visor or procedure, the operator

• start the RC system and establish SSF Auxiliary Service at.er flow to the steam generators as needed, as as close SSF controlled Reactor Coola S

em pressure boundary Ives.

Deleted Paragraph(s per 2012 update.

lo-SE!fVice testing of pumps and valves will be done in accordance the pro'Vision o AS E OM Code except for the Submersible Pump :hich is used to supply eup er to the Unit 2 embedded condenser circulating piping. This ptmp should be tested e ery other year to verify fb capabi

. A recirculation flow path

• th flow and pressure instrumentation is a

• ble for SSF ASN pump testing.

The electrical pa,.-er s em components *Ji I be tested consistent 'Ii D e Power's Testing Philosophy as descnl>ed in the nuclear station directives.

9.6.6 References

1. Sa e Evaluation by the Office of clear Reactor Regula Oconee udear Station S

dby Shutcbt.n Fawty, Docket Nos. 50-269, 50-270, and 50-287, April 28, 1983 2 Safety Evaluation for Station Blackout (10 CFR 50.63)- Oconee Sta

• Units 1, 2, d 3 (fACS M6857 6857 68576), Docket

. 50-269, 50-270, 50-287, ch 10, 1992 (31 DEC 201XI 9.6-19

UFSAR Ch pter 9 Oconee Huclear Station

3. Safety E uation for Station Blackout (10 CFR 50.63) - Oconee udear Staton, Units 1, 2, and 3 (TACS M685741M68575/M68576), Docket Nos. 50-269, 50-270, 50-287, December 3, 1992

4. Safety Eva uation Report on Effed of Tornado Missiles on Oconee Emergency Feedwater System (f ACS 48225, 48226, and 48227). July 28, 1989

5. Safety Evaluation Report for Implementation of Recommendation for Auxiliary Feed\\ ter Systems, August 25, 1981

6. Evaluation of the Oconee, Units 1,2,&3 Generic Safety Issues (GSl-23 & GSl-105)

Resolution, arch 24, 1995

7. Letter from O Paiker (Du e} to EG Case (NRC}, dated 1/25f78, Response to RC Questions

8. Letter from O Patker (Duke) to EG Case RC). dated 2/1ll8, SSF System Description

9. Letter from O Pa er {Du e) to EG Case (NRC). dated 6/19178, Response to Staff Questions Concerning Oconee Nuclear Station Safe Shutdown System

10. Letter from WO Parker (Duke) to HR Denton (NRC). dated 3128/80

11. Letter from O Parker (Du e) to HR Denton ( RC). dated 2/16181, Response lo RC Request for lnforma *on

12. Letter from O Parker (Duke} to HR Denton ( RC), dated 3/18/81, Modifications Needed lo

~t Appendix R Requirements

13. Letter from WO Parker (Duke) to HR Denton ( RC), dated 3131/81, Response to RC Request for lnforma

• on

14. Letter from WO Parker (Duke) to HR Denton (NRC), dated 4.l30/81, Cable Rou *ng and SeparatJon

15. Letter from O Parker (Duke) to HR Denton ( RC}, dated 1125/82, Response to C

Concerns for Source Range lnstnrnentation and Steam Generator Pressure

16. Letter from HB Tucker (Du e) to HR Denton ( RC), dated 9/20/82. Response to RC Request for lnforma

• on

17. Letter from HB Tucker (Duke) to HR Denton ( RC), dated 12/23182, Requested Supplemental Information

18. Le er from HB T er (Du e) to HR Denton (NRC), da ed 7/15/83, Request for Exemption from 10CFR50 Appendix R, Section III.L2

19. letter from JF Stolz ( RC) lo HB Tucker {Du e), dated 8131/83, Exemp from Source Range Flux and Steam Generator Pressure Instrumentation for the SSf

20. Deleted per 2012 update.

21. Deleted per 2012 update.

22. Deleted per 2012 update.

23. Regulatoy Guide 1.76, Design-Basis Tornado and Tornado MissJes for ""..,...,.,,.r PaNer Plants,. Revision 1

24. OSC-9086, Calculation for the USO Revie of Regulatory Guide 1 76, Revision 1

25. Le er from CA Jurtan ( RC) to B Tucker (Du e), dated 10/4/89, C Inspection Report 9.6-20 (31 DEC 201X)

Oconee Uuclear Station UFSAR Chapter 9

26. 0-320Z-3 SSF External Barner alls Concrete

27. 10CFR Part 50 Appendjx R Section 111.L Merna

• e and Dedicated Shutdown Capabili

28. NFPA 806, "Perfoonance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants", 2001 Edition

29. 10CFR50.48 (c),.Fire Protection"

30. ONS FPA 806 License Amendment Request 2008-01 (April 14, 2010)

31. NRC Issuance of ONS FPA806 Amendments and Safety Evaluation (December 29. 2010

32. Safety Evaluation by e Office of clear Reactor Regulation Related to Amendment No.

346 Amendment

o. 348 to Rene-Ned Fa Operating License DPR-38 to Rene.,,'ed Facility Opera ing License OPR-47 And Amendment No. 347 to Renewed Facility Operating License OPR-55 Du e Energy Corporation Oconee udear Station, Units 1, 2, and 3 Docket Nos. 50-269, 50-270, and 50-287, July 12, 2005.

33. Safety Evaluation by e Office of clear Reactor Regulation Related to Amendment o.

362 to Renewed Facili Operating License No. OPR-38 Amendment o. 364 to Renewed Fae,

• OperatJng License

. OPR 47 and Amendment No. 363 to Renewed Facif Operating License

. OPR-55 Ou e Energy Carol"nas, LLC Oconee Nuclear Station, U -s 1, 2, and 3 Docket Nos. 50-269, 50-270, and 50-287, October 29, 2008.

34. Safety E tion issued by RC, *Seismic Qualification of the Emergency Fooct ter System; dated Janua,y 14, 1987

35. Safe Evaluation by the Office of uclear Reactor Regulation Related to Amendment o.

325 to Renewed Facifi Operating License o. DPR-38 Amendment o. 325 to Renewed Faci

• Operating License No. DPR 47 and Amendment No. 326 to Renewed Fa

• Operating License No. OPR-55 Ou e Energy Carolinas, LLC Oconee uclear Station, Units 1, 2, and 3 Docket Nos. 50-269, 50-270, and 50-287, June 11, 2002.

36. Duke Energy le er to RC, "Seismic Licensing Basis," May 25, 1994.

37. Duke Energy letter to

• "Seismic Licensing Basis," August 18, 1994.

38. Safe E

uation issued by RC, "SER for Station Blackout - Oconee uclear Stallon."

March 10, 1992

39. Supplemen Sae E luat.ion "Supplemental SER for Sta *on Blackout - Oconee udear Station," December 3, 1992

40. NUMARC 87-00. Rev I, "Guidelines and Technical Bases for NUMARC lni1atives Addressing Station Blackout at Lig a e< Reactors," August 1991.

41. OSC-11214, Re 1, "SSF Licensmg SummaryOocumeots."

42 License Amendmen XXX, XXX, and XXX (date of issuance - Month XX. 20XX);

T omado

. lion.

THIS IS THE LAST PAGE OF THE TEXT SECTIO 9.6.

(31 DEC 201XI 9.6

• 21

UFSAR Ch pter 9 Oconee Nuclear Station Facility (SSF) Electrica Distnbution System should the nonnal and emergency pov,.er sources to the SSF be lost.

The PS# System does not provide the prima,y success path for core decay heat removal following design basis events and transients. The Emergency Feedwater (EFW) System se,ves as the primary success pa for design basis events and transients in which the nor operating main feedwater system is lost and e steam generators are relied upon for core decay heat removal. The PSW System serves as a backup to the EFW System and adds a layer of defense-in-depth to the SSF A *

• ry Service ater (AS#) System, which also serves as a backup to the EFW System.

The P'::N'/ System reduces fire risk by providing a diverse QA-1 power supply to power safe shutdown equipment thus enabling the use of plant equ*pment for mitigation of certain fires as defined by the Oconee Fire Protection Program. For certain scenarios inside the Turbine Building (TB) resu *ng in loss of 4160V essential po'Ner, either the SSF or PSW System is used for reaching safe shutdo'1m. The PSW System can achieve and maintain safe shutoo conditions for three units for an extended period of operation during which time other plant systems required to cool OO'Ml to ODE 5 con<frtions lilt be restored and brought into sefVice as required. Similar to the SSF, the PSW System is equipped with a portable pumping system that may be utifized as necessary to replenish r.1ter to e Unit 2 embedded Condenser Circulating Water (CCW} piping. The water tn the Unit 2 embedded CCW piping is used as a suction source for the PSW System. Electrical power is supplied from the PSW eJectrical system. The PSi/11 portable pump is located in an onsite storage location. The portable pumping system is not expected to be necessary unless there is a prolonged use of the PSW System to feed the steam generatOfS. Should there be a prolonged use of the PS

System, the portable pumping system would be used to replenish the water in the CCW piping since the PSW System takes suction off the CCW pipe at its low point in the Unit 2 Auxiliary Build. ng.

In the event of a loss of access to cooling er from lake Keov.1ee due to a dam failure ;ith a subsequent loss of the intake <;anal submerged weir, the volume of water that remains trapped in the CON intake and discharge piping d e three ONS units is relied upon as an a emabve heat si. The PSW system can ci:aw on the stored volume of water retained in the CON piping Qnta e and discharge *nes below ele ion 791 ) of a three S units, which is sufficien to provide secoodary side decay heat removal for at least 30 days. Operation of the PSW system does not increase the temperature of the water in the ccv,.1 olume beyond the design limits for the PSW system components.

The P'::N'/ System consists of the folJc:r.om:19:

1. PS# Bu.lding and assoaated support systems.

2. Conduit duct bank from the Keowee Hydroelectric Station underground cable trench to the P'::N'/ Building.

3. Conduit duc.t and racewa from PSW Building to un* 3 Auxiliary Building {AB).

4. Conduit duct ban from PSW

• ding to SSF trench and from SSF trench to SSF.

5. Electrical power d.

system from breakers at Keowee Hydro Units (KHUs) and from breakers connecting the PS Buiding to the Central I ie Sl.t.'itchyard, and from there to the ABandSSF.

6. P'::N'/ booster punp, PSW pgnary pump, and mechanical piping taking suction from U

• 2 embedded CON System to the Efv. headers supplying cooling r.iter to the respective unit's SGs and HPI pull> motor bearing coolers.

7. PS# portable pumping 9.7 -2 (31 DEC 201X)

NOTE THAT NO ADDITIONAL CHANGES OCCUR IN THIS SECTION; HOWEVER, THE PAGES WILL BE REPAGINATED WHEN RETYPE IS SUBMITTED TO UFSAR EDITOR FOR CHANGE.

Oconee Nucle Station UFSAR Chapter 10 uld be eXl)ected to stand the design basis earthquake. The pipi g rom t e Psis seism*ca ly qua ifled.

Portions of e EFW System are u nerable to tornado missiles. Thus, the plant reties pon the SSF s Sys em to prov* e feedwater to he SGs (see UFSAR Section 9.6.2) a er a tornado.

The Emergency Feedwater System as no desig ed to ithstand the e ects of

• temally genera ed missiles. If such an e ent ere to occur and if main feedwa er YJere una table, the single trail SSF ASW System ~ou d pro ide an assured means of providing heat remova t om the SGs. A detai ed evaluation of the capability o the existing EFW Sys em o tand mis *res s not considered necessary (Reference 1).

The effects of igh Energy Li e Bre s ha e been analyzed as addressed in UFSAR Section 3.6.1.3.

Pro isions fo er hammer e ents are considered unnecessary due to e use of Once Through Steam Generators (OTSG) Re erence _!!).

Po ions of e Emergency Feedwater system are credited to mee the Extens* e Damage

• *gation s teg*es (B.5.b) comm* ents, ich ha e been incorporated in o e Oconee uclear Station oper ng IJcense Section H -

• *gation stra egy License Condition.

10.4.7.1.1 Dele ed Per 2002 Update 10.4.7.1.2 Deleted Per 2002 Update 10.4.7.1.3 Deleted Per 2002 Update 10.4.7.1.

Deleted Per 2002 Update 10 ** 7.1.5 Oele ed Per 2002 Update 10.4.7.1.6 Deleted per 1996 Revi ion 10.4.7.1.7 Oele ed Per 2002 Update 10.4.7.1.8 Delet d Per 2002 Update (31 DEC 201X) 1

-9

Oconee Nuclear Station UFSAR Chapter 10

1. requiring portions of the EFW System (defined s, UFSAR Section 3.2.2) to be capable of withstanding a MHE, and

2. pro "ding altematl e seismically qua i:fted means of decay heat removal with the SSF A&N System and e Pl System.

10.4.7.3.6 EFW Response Follo ing Tornado Missiles Reference I concludes that e standard Re i Plan probabilistic cri erion is met based upon the probability of fai re o the EAN and station Systems combined lh the protection against tornado missiles a <><<fed the SSF AS',

System. Subsequen

• PS replaced station AS rela

• e to this function.

The curren o erall omado m*

tion strategy r es the SSF to mitigate a tornado. Thus, the plant relies upon the SSF AS System o provide feedwa er o e SGs (see UFSAR Section 9.6.2) a er a tornado Ref 20).

10.4.7.3.7 10.4.7.J.8 (31 DEC 201X) 10A - 21

UFSAR Chapter 10 Oconee Nuclear Station

10. OSC-6217, Loss of MFW

• h Anticipatory Reactor rip.

11 L. A eins NRC) letter to J.

p on (0 e). S ety E alualJon Report for Response o Generic Letter 89-19, Steam Generator O I Protection, dated o ember 3, 1993.

12. OSC-2826, Seismic Ouar,ca n Study of Components Associated

• h the Ho ell.

13. OSC-2827, Seismic Ouar,ca* on Study of Compoo

14. OSC-2633, Qualification of Condenser o e Conditions.

d Pia es for Faulted Load 15 J.

ampton (Duke) letter to RC. Response to

• em 5 of IEB 88-04 Re: Safey-Related Pump Loss, dated October 12, 1992.

16. License Amendment 386, 388 and 387 for R-38, DPR-47, OPR-55 for Oconee Nuclear sta ion Units 1, 2, and 3, respect* ely, dated ugust 13, 2014.

17 License Amendment 325, 325 and 326 for DPR-38, DPR-47, DPR-55 for Oconee Nuclear station Units 1, 2, and 3, respecti ely, dated June 11, 2002

18. Du e Energy etter o NRC, "Se*sm1c Licensing Basis,"

25, 19 19 Du e Energy letter o NRC, *5e*sm1c Licensing Basis." ugust 18, 1994.

20. License Amendment No. XXX. XXX, and XXX e of issuance -

Month XX, 20XX);

T omado

• ation.

THIS IS E LAS P GE OF THE SECTION 10.4.

10.4 - 24 (31 DEC 201X)

ATTACHMENT 4 TORNADO MISSILE PROBABILISTIC METHODOLOGY

License Amendment Request No. 2018-02 Tornado Missile Probabilistic Methodology

1.

Introduction This attachment describes the analysis approach and key assumptions used to evaluate the frequency of a damaging tornado missile strike on unprotected plant structures, systems, or components (SSCs) that are used to mitigate a tornado at the Oconee site. Specifically, the analysis provides justification for SSCs required for tornado mitigation that do not meet UFSAR requirements for physical tornado missile protection. This evaluation is documented in References 16, 17, and 18, and utilizes the TORMIS analysis methodology described in References 1 - 6 of this section.

2.

Methodology The TORMIS95 computer code is used to determine the frequency of a damaging tornado missile strike on unprotected plant SSCs that are used to mitigate a tornado. The TORMIS95 code is an updated version of the original TORMIS code developed for the Electric Power Research Institute (EPRI). The methodologies used in the code to evaluate the frequency of damaging tornado missile strikes are documented in References 1, 2, 3, and 4 of this section.

The TORMIS code accounts for the frequency and severity of tornadoes that could strike the plant site, performs aerodynamic calculations to predict the transport of potential missiles around the site, and assesses the annual frequency of these missiles striking and damaging structures and other targets of interest.

The analysis requires the development of input data in three broad areas:

1. development of site tornado hazard information.

2. development of site missile characteristics.

3. development of target size, location, and physical properties:

3.

Oconee Tornado Hazard The tornado hazard is a characterization of the frequency of occurrence and potential for tornadoes to cause damage at a particular location. The latter includes the effective velocity of the tornadoes, the areas over which they cause damage, and the distribution of directions in which they travel.

An analysis was performed (Reference 9) to develop an appropriate set of TORMIS inputs to characterize the tornado hazard for the Oconee site. The tornado hazard was evaluated using data for a broad region and the local area around the Oconee site for the period of 1950 - 2014. A broad 15° x 15° latitude longitude square centered on the Oconee site was used as the starting region. This large area covered 619,052 sq miles of US land and included 18,621 tornadoes in the Storm Prediction Center (SPC) tornado data set. Within this broad region, the tornado risk was quantified for 0.7°, 1 °, 1.4°, and 2° cells. A statistical method, termed Cluster Analysis, was used to determine how the distinct cells group into similar clusters of tornado risk. These procedures were performed separately for the 0.7°,

1°, 1.4°, and 2° grids. The final selected subregion (Figure 1) covers a broad area (115,000 square miles of land) representing 2,866 tornadoes that includes several high risk tornado areas surrounding the Oconee plant.

Page 1

License Amendment Request No. 2018-02 From the subregion data, tornado hazard inputs were developed for input to the TORMIS95 code including frequency, intensity, width, length and direction characteristics. The analysis results reflect the Enhanced Fujita (EF) Scale and specifically account for unreported or misclassified tornadoes and tornado reporting trends over time. The Oconee tornado frequency is presented in Table 1 below.

T bl 1 0 a e -

conee T d w* d S d F orna o In

,pee requenc1es EF _scale Wi11d Exceeda11ce Freqlle11cies frr1)

Willa Speed (111pl1)

Pla11t Poi11t 225 451E-08 330E-09 200 8.81E-07 U9E-07 175 6.62E-06 1.4&E-06 150 2.90E-05 7.26E-06 100 2.78E-04 9.59E-05 73 7.73E-04 4.23E-04 The "Plant" tornado frequencies are used in tornado missile simulations to reflect that a tornado may strike any portion of the plant safety envelope and produce tornado missile effects for one or more target. The plant safety envelope is the specific plant area where safety targets of interest are located. The Oconee safety envelope is illustrated in Figure 2.

Some tornadoes will affect only a few targets within the plant safety envelope, others may pass through the center of the plant and affect many targets, while some large tornadoes may engulf the entire envelope, affecting all targets. Any portion of the tornado path that intersects the plant envelope is assumed to be a tornado strike on the plant.

Figure 3 provides a comparison of the wind speed exceedance probabilities between the Oconee tornado hazard curves (based on Table 1) and the NUREG/CR-4461 results reported for the Oconee site (Reference 10). This comparison shows that the Oconee plant curve is higher than the NU REG curve for all wind speeds and is conservative and appropriate for the Oconee tornado missile analysis.

4.

Oconee Site Missile Characterization The site missile characterization is an estimate of the number, type, and location of missiles on and near the plant site as well as the physical properties of these missiles (Reference 15). This process entails a series of site surveys to identify areas (zones) in which potential missiles can be reasonably characterized as somewhat uniformly distributed, and counting the missiles of each type located in each of the zones. The process is intended to estimate the number of potential missiles that are "minimally restrained," or could become unrestrained.

Note that these potential missiles include debris from structures that are expected to fail due to tornado winds. This debris includes potential missiles from the structure itself or from the contents of the structure. In cases where a potentially failed structure is near plant safety targets, the structure was modeled explicitly and the associated missiles from the debris and contents were modeled as "on top" of the structure and appropriate changes made to the structure height according to the wind capacity of the structure. For structures located further away, the associated missile counts were added together with the other materials in its respective missile zone.

A set of 21 missile zones was defined for the Oconee site with the center of the Unit 2 reactor building located roughly at the center. The outermost boundaries were defined to ensure that the minimum distance to the closest safety-related target is greater than 2000 Page 2

License Amendment Request No. 2018-02 feet. This minimum distance is derived from the original TORMIS research described in EPRI NP-769 Section 2.3.3 (Reference 1) that determined that 2,000 feet is an appropriate distance that would cover the statistically significant missile sources. Within this area, distinct missile zones were defined with areas of reasonably uniform distribution relative to the types of missiles they contain and with smaller zone areas closer to plant safety targets to provide higher resolution for the missile distributions for these more important areas. The Oconee missile zones are overlaid onto a simplified site map and shown in Figure 4.

4.1 Missile Types The TORMIS95 code allows the modeling of 26 basic types of missiles (basic sets) based on their aerodynamic shape and type of material. These 26 basic sets are further broken down into 53 subsets based on their size. TORMIS is programmed with the appropriate parameters for each subset to model the potential transport of this type of missile during a tornado strike.

A site specific missile spectrum for Oconee was developed by conducting a detailed site survey to evaluate the types of missiles, number of missiles, and their locations. A particular focus is placed on items that have the potential to cause damage to tornado mitigation equipment which tend to be rugged or protected by concrete or steel barriers, or by thick masonry walls. Therefore, small debris items that are very likely to be generated from a tornado strike are excluded from consideration because of their inability to cause damage to the targets of interest in the analysis.

The Oconee missiles include the standard TORMIS missiles in EPRI NP-769 (Reference 1),

comprising structural sections, pipes, wood members, other construction materials, and an automobile category. A list of final subsets is provided in Table 2. In many cases, the missiles found at the site matched closely with missiles previously identified and evaluated for other sites. In some cases, however, it was necessary to define unique subsets or adjust particular parameters to account for specific types or sizes of missiles found at the Oconee site. These Oconee specific missile types were characterized either through direct measurement, or were characterized by comparison to other subsets.

Page 3

License Amendment Request No. 2018-02 Table 2 - Missile Subsets for the Oconee TORMIS Analysis Final Missile Weight per Missile Description Material Length Depth Unit Subset (Typical)

L (ft) d (in.)

Length (lb/ft) 1 Rebar Steel 3.00 1.00 2.67 2

Gas Cylinder Steel 5.00 10.02 38.64 3

Drum Tank Steel 5.00 19.98 23.55 4

Utility Pole Wood 35.00 13.50 42.85 5

Cable Reel Wood 1.80 42.21 140.70 6

Pipe 3in Steel 10.00 3.50 7.58 7

Pipe 6in Steel 15.00

'6.63

.18.90 8

Pipe 12in Steel 15.00 12.75 49.60 9

Storaqe Bin Steel 6.00 38.40 112.50 10 Concrete Block Concrete 1.33 8.00 27.00 11 Wood Beam Wood 12.00 11.50 16.67 12 Wood Plank Wood 10.00 11.50 2.71 13 Metal Sidinq*

Steel*

15.00 12.00 1.95 14 Plywood Sheet Wood 8.00 48.00 10.50 15 Wide Flanqe Steel 15.00 13.91 26.00 16 Channel Section Steel 15.00 6.00 13.00 17 Small Equipment Steel 3.00 30.00 129.20 18 Large Equipment Steel 6.00 48.00 225.00 19 Steel Frame Steel 6.00 24.00 12.34 Gratinq 20 Large Steel Frame Steel 16.00 120.00 65.00 21 Vehicle Steel 16.00 66.00 250.00 22 Larqe Tree Wood 40.00 10.00 28.25 23 Small Tree Wood 15.00 6.00 15.80 Minimal Impact Area (in2) 0.79 9.45 311.60 143.10 126.60 2.20 5.60 14.60 40.50 64.00 40.25 11.50 24.00 42.00 7.69 3.83 4.63 15.70 2.22 11.00 2880.00 78.54 28.27

• Note: The length and weight of the metal siding is based on a sheet of aluminum siding folded in half. Conservatively, the damage assessment within the TORMIS95 code is performed assuming steel material.

4.2 Inventory of Missiles The missile zone boundaries are used as the basis for field missile surveys of missile zones to characterize potential missile sources that are typical at the plant. Surveys were conducted both during a plant outage and while all units were at power to account for potential conditions where the site inventory count may be higher than typical. In addition, aerial and ground photographs were used in conjunction with tree density observed during the survey to estimate potential tree missiles in remote zones. Conservatively, the additional outage materials have been added to the total missile count for each zone.

The number of missiles produced from missile source structures depends on the wind speeds experienced by the building. For example, light damage might be expected in 100 mph winds, while catastrophic failure might occur in 200 mph winds. Research performed in the development of the HAZUS wind model (Reference 11) is used to determine the number of missiles available for each building type for each wind speed level considered in the TORMIS runs.

This analysis provides a rational, engineering-based approach to quantify the number of available missiles by building category. These results are conservative considering that all components are assumed to fail and become unrestrained potential missiles, whereas, in Page 4

License Amendment Request No. 2018-02 reality, a large portion of the structural components will generally remain connected to one another or attached to the foundation.

The final missile counts used in the analysis are summarized in Table 3 below.

Table 3 - Oconee Total Missile Count by EF Intensity F-Scale Missile Count EF-1 112,719 EF-2 124,087 EF-3 177,585

---

I EF-4 325,474

---

I EF-5 394,599 5

ANALYSIS 5.1 Scope of Targets The TORMIS methodology seeks to demonstrate that the annual probability of a radioactive release in excess of 1 O CFR 100 resulting from significant missile damage to unprotected SSCs used to mitigate a tornado is less than the acceptance criterion of 1 E-06/Rx-Yr (Reference 6). Significant damage is damage that would prevent meeting the design basis safety function. This also means that the unprotected SSCs are evaluated collectively against the acceptance criterion rather than individually. For a multi-unit site such as Oconee, this criterion is applied to each unit individually.

For this evaluation, the prevention of a "release in excess of 10CFR100" is accomplished by establishing safe shutdown conditions following a tornado strike and maintaining these conditions for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The following safety functions are required for safe shutdown of all three Oconee units for up to 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />s:

Secondary Side Decay Heat Removal (SSDHR).

Reactor Coolant Makeup (RCMU).

Reactor Coolant System Pressure Boundary Integrity.

Oconee has redundant systems normally available for SSDHR which are Emergency Feedwater (EFW), SSF ASW, and the Protected Service Water (PSW) system which is an enhanced replacement for the original Station ASW system. The RCMU function can be provided either by SSF RCMU or by the HPI system. Both systems can provide RCP Seal Cooling while providing RCS makeup. These redundant systems are largely separated but some spatial dependencies exist. However, in order to simplify the analysis, it is conservatively assumed that all other systems besides the SSF and its support systems are unavailable.

Therefore, all unprotected SSCs associated with the SSF required to maintain safe shutdown for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after a tornado are included in the TORMIS evaluation.

Committed plant changes (see Attachment 1) will provide the SSF systems the capability of mitigating overcooling transients events caused by tornado-induced Main Steam line breaks. Therefore, Mairi Steam and Main Feedwater piping is excluded from the scope of targets except where a piping break could cause an adverse environment condition where SSF equipment is located.

Page 5

License Amendment Request No. 2018-02 Thus, in summary, the targets to be considered in the TORMIS model are as follows:

1. unprotected piping or equipment associated with the SSF used to provide decay heat removal, RCMU which includes RCP seal cooling, and the committed modifications associated with the Cask Decontamination Tank room (CDTR) and WPR.

2. unprotected piping or equipment that could (if damaged) indirectly cause failure of SSF equipment or failure of the SSF mitigation strategy.

5.2 Determination of Safety Targets Through a process of plant walkdowns and the review of plant drawings, calculations, and other information, a detailed list of structures and equipment lacking deterministic protection was developed that meet the scope of TORMIS safety targets described above.

The specific targets identified for evaluation in the TORMIS analysis are as follows:

1. Unprotected SSF Mitigation Equipment Electrical Cable Trays & Penetrations in the WPR and CDTR containing SSF-related cabling.

SSF ASW piping in the WPR/CDTR, including connected header piping to the RB penetration.

SSF ASW flow instrumentation in CDTR.

Committed SSF Instrumentation Modifications.

2. Unprotected SSCs that if damaged could fail the SSF Mitigation Strategy Main Steam Relief Valves (MSRVs) - damage preventing adequate steam relief for SSDHR.

Main Steam header in EPR - damage causing pipe rupture affecting SSF equipment in WPR.

Main Feedwater headers in EPA - damage causing pipe rupture affecting SSF equipment in WPR.

Condenser Circulating Water (CCW) Surge Lines - damage to vent lines (crimping/crushing) for SSF ASW suction source.

SSF Trench Vents - damage to vent lines (crimping/crushing) to prevent lifting of trench covers.

SFP Piping - damage causing loss of credited SFP inventory for RCMUP suction.

Normal HPI letdown line (from the containment penetration to isolation valve HP-5).

A number of unprotected targets were reviewed and not included in the Oconee TORMIS model based on the following criteria:

1. Alternate protected systems or components are available to perform the required function, or

2. Analysis or evaluation to show that a postulated tornado missile impact will not result in the loss of a safe shutdown function.

3. Analysis or evaluation (including qualitative evaluation) to show that the failure probability is negligible and does not contribute significantly to the overall missile Page 6

License Amendment Request No. 2018-02 damage probability. If redundant SSCs are being considered, the joint failure probability may be evaluated and applied instead of the independent damage probabilities.

The following SSCs were evaluated qualitatively and were not included in the Oconee TORMIS model.

1. CCW Piping The potential for tornado missile damage to CCW piping (excluding the CCW Surge Lines) was also qualitatively evaluated. This piping provides the SSF ASW suction source and is located in the turbine building basement (elevation 775.0')

and well shielded from potential tornado missiles except for a few specific locations and angles of approach. Although certain CCW piping segments within the basement could be postulated as potential tornado missile targets, Oconee calculation OSC-2322 documents that the SSF ASW system is capable of fulfilling its mission with an assumed initial water level of 766.5' in the embedded CCW piping. This elevation is greater than eight feet below the turbine building basement concrete elevation. Therefore, any missile strike to the CCW piping within the turbine building basement area is inconsequential with respect to the credited function of the SSF ASW and will not result in the loss of the required safe shutdown function.

2. SSF Trench Vent Pipes SSF electrical power and control cables are routed through a reinforced concrete trench to protect the cables from tornado wind and missile damage. The trench has three vent pipes which allow the equalization of air pressure to prevent differential pressure from a tornado lifting the concrete lids on the trench. The vents are very rugged and are widely separated with one near the west buttress of each reactor building where the trench connects to the CDTR below the WPR.

It is postulated that a very severe missile impact such as a vehicle missile could crimp or crush the pipe if struck from certain angles. However, analysis has shown that any 2 vents alone provide adequate venting of the trench if the third vent is not available. This analysis is conservative in 2 significant ways. First, it assumes a differential pressure of 3 psid rather than 1.2 psid as required by Regulatory Guide 1.76 Revision 1 (Reference 7). Second, it does not account for leakage from around the individual trench cover blocks which is expected to be significant based on observation and the relatively small venting flow area required. Because of the rugged design of the vent pipes and their wide spatial separation, the probability of failure of 2 or more vents at the same time by tornado-generated missiles is negligible and may be ignored in the TORMIS analysis model.

3. Spent Fuel Pool (SFP) Liners (Personnel Door Openings)

This specifically pertains _to 3 personnel doors on auxiliary building elevation 844' that have a "line of sight" to the Unit 1 & 2 SFP liner and 3 additional doors with "line of sight" to the Unit 3 SFP liner. The SFP areas are fully protected from missiles by thick concrete walls except for these door openings. The SFP liners are within the scope of analysis because potential tornado missile damage to the liner plate (puncture) below the water level could cause a loss of SFP inventory credited in the SSF design analysis. However, the likelihood of damaging the liner in this manner is negligible based on (1) the robust design of the SFP walls Page 7

License Amendment Request No. 2018-02 and (2) the low probability missiles entering the SFP area through these doors.

Supporting this conclusion are the following factors:

a.)

The dominant missile types striking safety targets are wood plank and metal siding types. These missile types do not have the hardness or strength to significantly damage the SFP walls (3.5' thick reinforced concrete with W' welded steel liner plate).

b.)

Being at approximately 48 feet above plant grade greatly reduces the risk of a missile strike from vehicles or other heavy objects from hitting the doorways.

An incoming missile to any of these doors would first have to penetrate one or more masonry walls that would block missiles or dissipate missile energy. The doors themselves provide additional protection or resistance to missiles. These doors are heavy-duty commercial-grade hollow steel doors that are normally closed vital area doors.

c.)

Each door opening is 3.5' wide and approximately 7' tall (-24.5 ft2 area). The dominant missile types (wood planks and metal siding) and most other missile types are very long compared to the width and height dimensions of the door openings. For missiles with one or more dimensions exceeding the smallest dimension of the door opening, there is a significant probability that the missile will be deflected or become entangled in the door opening and unable to reach the SFP liner.

With these factors taken together, the vulnerability of these door openings to the SFP areas are judged to have a negligible frequency contribution and do not need to be explicitly modeled in the TORMIS analysis.

5.3 Target Modeling A set of analysis models was developed representing the unprotected SSCs that support tornado mitigation ("safety targets") for each respective Oconee unit as well as other plant structures ("non-safety targets") that provide partial protection to safety targets or represent a potential source of damaging missiles.

Since the analysis of the masonry walls in portions of the auxiliary building is not within the damage prediction capability of the TORMIS code, the masonry walls of the East and West Penetration rooms are not modeled explicitly. Only reinforced concrete columns, beams, and floor slabs, or engineered steel barriers are modeled. This approach leaves large openings in between these structural members for the code to track missiles into the room toward the safety targets. Missile damage velocity threshold were established based on either the target's impact capacity or by the assumed impact capacity of the wall that the missile had to penetrate.

Additional frequency adjustments were applied for certain "unmodeled" walls to account for oblique and non-collinear impact orientations that are not expected to penetrate the respective walls (see Section 6 below).

The following subsections provide a summary description of the modeling assumptions used to assess each set of safety targets.

5.3.1 SSF Electrical Cabling in the WPR and CDTR The SSF power and control cables in the WPR are routed in several specific cable trays to a specific set of containment electrical penetrations. These cables were "bundled" into three specific targets or "boxes" around the associated cables and penetrations. For these targets, damage is taken to be impact by a missile greater than a minimum damage velocity (VDAM parameter) for each missile subset which is based on the type of wall that the missile had to Page 8

License Amendment Request No. 2018-02 penetrate. VDAM is the specified impact velocity for each penetrator type missile for a specific target set. To facilitate this evaluation, the analysis for the WPR was "partitioned" into two separate models; one model to evaluate missiles striking WPR targets coming through the corner shield walls and another to evaluate missiles striking the targets through the other walls which consist of concrete beams, columns, and in-fill (double-thick) concrete brick walls. The brick walls are not explicitly modeled but rather are accounted for in the analysis in the selection of a minimum damage velocity (VDAM) and with frequency adjustment factor as described later.

The VDAM parameters for the first case correspond to the estimated capacity (impact velocity) based on an engineering evaluation of the design of the steel barrier installed at the corner wall. In the second case, the VDAM parameters for missiles coming through the double brick walls are set to zero for all missile types except for subset #12 (wood plank)(VDAM = 100 mph) and subset #13 (metal siding)(VDAM = 100 mph). The properties of unreinforced masonry walls and their interaction with high-energy missiles are difficult to determine analytically; however, a limited amount of test data is available for masonry walls which can be used to predict damage velocity values for wooden missiles. Testing conducted at Texas Tech (Reference 13) showed that brick veneer (single row thickness) test panels were able to withstand the impact of a 15 lb 2x4 - 12' feet long traveling at 122 mph with only cracks in the mortar.

The 27 lb wooden plank missile (subset #12) considered in the Oconee missile inventory is potentially very important to the results due to its favorable aerodynamic properties. Given that the kinetic energy imparted by the 15 lb 2x4 at 122 mph is equivalent to that of 27 lb wooden plank at 90 mph, it follows that an impact velocity of at least 90 mph would be required to damage a brick veneer wall. However:, since the WPR masonry walls are double-thickness, it is assumed that the velocity of the wood plank must exceed 100 mph in order to damage the wall and penetrate into the West Penetration Room.

The metal siding missile type (subset #13) which is similar in weight to the wooden plank is also assumed to have a damage velocity of 100 mph. This is justified because compared to the wood plank the metal siding, made of aluminum is less rigid, more deformable and less able to penetrate the masonry wall.

A damage frequency adjustment factor was applied, as described in Section 6 to account for oblique and non-collinear impact orientations that are not expected to penetrate the respective walls. No target size adjustments are applied for these targets inside the WPR/CDTR based on the significant structural interferences that exist in the rooms near the targets. These interferences prevent damaging offset hits by tumbling or non-collinear impact orientations. A vehicle impact on the corner shield wall is conservatively assumed to cause damage to the cables behind the corner wall; however, no target size adjustment is applied to this target because it is constrained between the reactor building wall and the 3x3 foot concrete column at the corner of the room.

5.3.2 SSF ASW Piping in the WPR and CDTR The SSF ASW piping in the WPR and CDTR is protected by the masonry and steel barrier walls described earlier. However, a significant portion of the seismically qualified 6 inch SSF ASW piping is constructed within a 10-inch guard pipe that is comprised of welded Schedule 80 and 120 pipe segments around the 6" SSF ASW line (pipe in a pipe).

The piping segments are conservatively represented as a set of steel "boxes" or cylinders around the piping sections where the appropriate damage criteria can be applied. The modeling of these targets is "partitioned" as described in Section 5.3.1 above to account for Page 9

License Amendment Request No. 2018-02 the different properties of the masonry walls and steel barrier. A damage event is defined as penetration of the steel guard pipe or penetration of the outside wall as appropriate for each piping segment. No target size adjustments are applied for these targets inside the WPR/CDTR based on the ruggedness of the guard piping and based on the significant structural interferences that exist in the rooms near the targets. These interferences prevent damaging off-set hits from tumbling or non-collinear impact orientations.

5.3.3 Main Steam Relief Valves The SSF mitigation strategy requires certain MSRVs to open (at specific lift setpoints) in order for the SSF ASW system to provide adequate decay heat removal. These relief valves are located on the MS headers just outside of the EPR and battery room. Tornado missile impact on the required MSRVs may cause them to fail to open and thus fail the SSF ASW decay heat removal function. Modeling of the required MSRVs also includes concrete and steel structural supports, the MS access platform, and adjacent MSRVs and exhaust stacks.

Conservatively, the missile damage criteria is assumed to be "hit equals damage and the target size is increased from one foot diameter cylinder to three feet diameter to address offset hits. This is considered to be conservative because lower velocity impacts and offset hits should not affect valve operability unless the hit is a direct collinear strike. Also, some prominent missile types such as metal siding are highly deformable and less likely to cause,

sufficient damage.

The assumed success criteria for the MSRVs for tornado mitigation is that one of two lowest pressure relief valves opens (either 1/2/3MS-8 on the 'A' Header or 1/2/3MS-16 on the 'B' Header), and that one relief valve (any one of eight) on the opposite header opens for overpressure protection. This success criteria translates to the following three combinations of MSRV failures (damage events) that are evaluated in the analysis model.

1. Failure of both MS-8 and MS-16, or

2. Failure of all MSRVs on the 'A' MS header (MS-1 through MS-8), or

3. Failure of all MSRVs on the 'B' MS header (MS-9 through MS-16)

The first combination above is straightforward to evaluate using the "intersection" feature of the code by designating the MS-8 and MS-16 target numbers. However, for the second and third items, a conservative simplifying assumption is made that the probability of all eight valves on one header being hit/damaged is bounded by the probability of any pair of valves on the same header. Under this assumption, the second item is conservatively evaluated as damage to both MS-2 and MS-8, and the third item is conservatively evaluated as damage to both MS-1 O and MS-16.

5.3.4 Main Feedwater and Main Steam Piping Damage to the MFW and MS Piping in the EPR is only a concern to the SSF tornado mitigation strategy due to the potential for a pipe rupture that could cause excessive temperatures in the WPR area where SSF electrical cables are routed. The fire and security barriers between the E.PR and WPR are not designed for pipe rupture loads and are conservatively assumed to fail if a MS or MFW line break occurs in the EPR itself. Tornado-induced pipe ruptures in the rooms adjoining the EPR on the turbine building side (east side) are assumed not to fail SSF equipment in the WPR because multiple barriers would have to fail and because the tornado damage would also create steam release paths to the outside.

. Based on this set of assumptions, the scope of high energy piping targets is limited to those segments of MFW and MS piping b-etween the reactor building wall and where the headers enter or exit the EPR.

Each piping segment is modeled as a horizontal steel box or a vertical cylinder as appropriate. The damage criteria is penetration of a steel barrier to an assumed thickness of Page 10

License Amendment Request No. 2018-02 0.25 inches although both the MFW and MS headers have an actual thickness of an inch or greater.

No target size adjustments are applied fot these targets inside the EPRs based on the ruggedness of the piping, exterior walls, and significant structural and other interferences that exist in the rooms (beams, columns, piping, cable trays, supports). These interferences prevent damaging offset hits from tumbling or non-collinear impact orientations.

5.3.5 RCS (Normal) Letdown Line A short segment of the RCS letdown line from the containment penetration to the EPR floor penetration is modeled as an over-sized steel "box" to improve sampling efficiency and then an area ratio applied to correct the damage frequency. Conservatively ignoring its thick steel and lead shielding jacket, a damage event is defined as penetration of 0.276 inch thick steel target which represents 1/2 of the thickness of the 2Y2 inch Schedule XXS piping.

As a very rugged target deep inside the EPR, no target size corrections were applied for the RCS letdown line. The EPR has many structural columns and beams in the room as well as significant amounts of piping, cable trays, and their associated steel supports. These interferences make damaging offset hits from tumbling or non-collinear impact orientations very unlikely.

5.3.6 Spent Fuel Cooling System Piping The SSF RCMUP for each unit utilizes its respective SFP as its suction source; however, it is postulated that tornado damage to Spent Fuel Cooling System piping below certain elevations could drain the SFP below the required inventory for successful SSF mitigation.

The critical elevation for Units 1 & 2 is 840.7 feet and 838 feet for Unit 3. This piping is sufficiently protected in most areas of the auxiliary building but several areas were identified With tornado missile vulnerabilities.

The primary locations of vulnerable SFP piping is in the EPR for each unit near the crossover to the WPRs. The models are configured to address the concern that this target is also vulnerable from missiles coming through the WPR and through the crossover area because the security and fire barrier between the EPR and WPR is not qualified or credited for.tornado missile protection. The damage criteria for the SFP piping conservatively ignores piping thickness.

For Unit 3 only, there is an additional vulnerable area in the 3rd floor change room and the 4th floor cable room where there is a pair of SFP pipes in the northwest corner of the room and another pair of SFP pipes in the southwest corner of the room. In these areas, the piping is enclosed mostly by additional brick walls to provide radiological shielding to plant personnel that work in the area. Because these rooms are shielded by other major structures (U3 RB and SFP), the primary vulnerability to missile strikes is from the east side through the turbine building. For simplification, each pair of SFP lines are modeled as a "box" around the piping with the damage criteria conservatively assumed to be "hit" equals damage.

No target size adjustments are applied for the SFP piping targets based on the ruggedness of the piping and other structural interferences in these areas of the auxiliary building (beams, columns, walls, cable trays, supports). These interferences prevent damaging offset hits from tumbling or non-collinear missile orientations.

5.3.7 CCW Surge Lines The CCW surge lines consists of two 24 inch diameter pipes that provide a vent path for the large CCW pipes beneath the turbine building that provide the suction source for the SSF Page 11

License Amendment Request No. 2018-02 ASW System. The surge piping targets are evaluated for crushing or crimping failure that would prevent adequate vent flow. An evaluation showed that only 44% of the flow area of only one of the 24 inch pipe (one of two for success) is required to provide an adequate vent path. A finite element analysis (FEA) was used to evaluate a set of conservatively assumed damage velocities for the three dominant missile types impacting the surge lines shown in Table 4 below. The FEA showed that greater than 44% of the normal flow area is available for the assumed velocities even at the worst case impact location and orientation. For all other missile types, it was assumed that "hit" equals damage (V > 0).

T bl 4 A

d D V I "f

f CCW S Lines a e -

ssume amaae e oc1 1es or urge Missile Type Subset Assumed Damage Velocity Concrete Block 10 120 fps Wood Plank 12 300 fps Metal Siding 13 300 fps All Other Types

> O fps The CCW surge lines are both very rugged and generally require a direct collinear impact on the pipes to cause significant damage; therefore, target size adjustments are not required for potential offset missile hits. The surge lines are represented as tall vertical cylinders in the TORMIS model but it is noted that the pipes are not actually straight and have several slight angle changes so that the piping can fit around various turbine building structural supports and other interferences. Therefore, to approximately compensate for the additional target surface area the target cylinder diameter is increased from 24 inches to 36 inches.

Because of the redundant lines, the final damage frequency for the CCW Surge Lines is taken as the "intersection" where both targets are damaged at the same time with missile impacts at velocities greater than the damage velocities listed in Table 4.

Direct impacts to the lateral and vertical supports of the surge lines were evaluated and found not to be required to support the lines against winds loads and are not included as safety targets in the TORMIS model. However, it was identified that failure of turbine building columns M39 or M40 adjacent to surge lines could result in the potential collapse of a portion of the turbine building that could potentially crimp the lines. The specific concern for these large steel columns is limited to impacts from very large missiles which are assumed to be missile types 20 (1040 lb large steel frame) and 21 (4000 lb vehicle).

The M39 and M40 failure mode was evaluated in a separate case incorporating two important changes. First, offset hits of these missiles on either column are conservatively assumed to fail the column; and as a result, the target size is increased by 2 feet in each free direction per the NP-769 guidance based on the length (L) of type 21 and 22 missiles which is taken to be 16 feet (UB =2 feet). Second, the damage velocities are set to 540 fps for all missile types except for types 20 and 21 which will remain at 0. The resulting frequency estimate captures the impact by the large missiles of concern and excludes smaller penetrator missile types.

6.

WPR Damage Frequency A~justments The modeling of the WPR targets establishes the frequency of missiles with (1) the proper trajectory to strike the targets, and with (2) sufficient velocity (V>VDAM) to penetrate the outer walls. However, this approach does not account for the angle of incidence with the outer walls or the orientation of the missiles. Therefore, a set of adjustment factors are applied for select targets in the WPR.

Page 12

License Amendment Request No. 2018-02 First, it is recognized that missiles which do not strike the wall at a normal angle to the wall are less likely to penetrate. For the WPR walls, it is assumed that a missile strike at an angle of 35° from normal or greater will ricochet or be unable to penetrate the wall 1* The fraction of missile strikes that hit the wall at a favorable angle varies for each unit based on the relative location of missile sources and the prevailing wind directions of tornadoes.

Second, the probability of a damaging strike on the steel wall is affected by the orientation of the missile at impact. The non-collinear orientation causes the missile impact energy to be distributed over a wider area of the wall and greatly reduces the likelihood of the missile penetrating the wall toward the safety target location. For this analysis it is assumed that missiles striking the shield or brick wall in an orientation of 45° or more from a collinear orientation impact will not result in a wall penetration or target damage. Assuming that any missile orientation is equally likely, the fraction of missiles with a favorable orientation for penetration of the walls is approximately 0.50.

For each unit and set of WPR targets, the locations of missile origin and angles of approach to the WPR target were reviewed to assess the predominate angles of approach. This review considered the most likely direction of tornado winds relative to the surfaces of the WPR walls and obstructions of the wall by adjacent structures and the BWSTs which limit the angles of approach to the walls. Based on these considerations the following overall frequency adjustment factors were applied as shown in Table 5 below.

Table 5 - Frequency Adjustment Factors for WPR Walls Unit WPR Wall Surface Overall WPR Adjustment Factor 1

Corner Shield Wall 0.5 Concrete Brick Wall 0.25 2

Corner Shield Wall 0.5 Concrete Brick Wall 0.25 3

Corner Shield Wall 0.5 Concrete Brick Wall 0.375 A set of sensitivity analyses were performed using alternate modeling approaches to confirm the conservative selection of adjustment factors.

7.

Results and Conclusions 7.1 Model Solution Sample size is an important consideration for the TORMIS model solutions. Traditionally, sample sizes of 1000 tornadoes and 500 missiles were considered adequate for the determination of plant damage frequencies (Reference 4). However, this general conclusion is based on relatively large targets such as plant structures and buildings. When smaller targets are evaluated it becomes necessary to increase sample size to produce an acceptable estimate of the mean value.

1 The significance of oblique impact in significantly reducing missile damage potential has been clearly established in military ordnance testing. This is discussed in detail in Section 4.2.2 of EPRI NP-769 (Reference 1).

Page 13

License Amendment Request No. 2018-02 There is no established standard or criteria for demonstrating convergence for a TORMIS analysis. However, the goal is to produce a frequency estimate that can reasonably assure that the overall mean damage frequency meets the acceptance criteria. Therefore, the solution process begins with smaller samples and is repeated multiple times until the cumulative mean value reaches a stable value that changes minimally with each additional sample run.

Based on previous experience, the solution approach is to run 15 independent runs for each EF scale with 5000 tornadoes and 4000 missiles per tornado (20 million sample size). These 15 sets of runs, representing a total of 1.5 billion missiles samples, were averaged to obtain the mean damage frequency contribution from missiles striking safety targets. As a final step, the frequency adjustment factors from section 6 were applied to the SSF targets in the WPR to obtain the final damage frequency results. These results indicate that the overall missile damage frequency becomes relatively stable after about approximately 12-14 runs where the variation is very small relative to the margin to the acceptance criteria of 1 E-06/yr.

The final results are summarized in Table 6. Verification that a sufficient number of missile samples have been made ("convergence") is addressed in Section 8.3 below.

Table 6 - Oconee Tornado Missile Damage Frequency Results Unit 1 Unit 2 Unit 3 SSF ASW Header in CDTR 3.59E-10 1.09E-10 1.31E-10 SSF ASW Header in WPR 1.92E-08 5.26E-09 1.56E-08 SSF Electrical Cables/Penetrations in WPR/CDTR 1.56E-07 1.53E-07 4.71 E-07 SSF ASW Flow Instrumentation (CDTR) 5.22E-10 2.41 E-09 1.57E-09 Letdown Line 1 2.77E-09 0

2.03E-10 Main Steam Header in EPR 1.48E-10 1.76E-09 1.72E-09 Main Feedwater Header A in EPR 5.66E-10 1.02E-09 9.75E-10 Main Feedwater Header B in EPA 1.55E-1 O 9.64E-11 2.71 E-1 O CCW Surge Line2 2.83E-09 2.83E-09 2.83E-09 Unit 2 TB Support for Protectinq Surqe Lines 4.30E-08 4.30E-08 4.30E-08 Main Steam Relief Valves 8.81 E-09 8.31 E-09 3.99E-08 SFP Piping in Unit 1 EPR3 3.73E-08 3.73E-08 NIA SFP Piping in Unit 2 EPR3 5.55E-09 5.55E-09 NIA SFP Pipinq in Unit 3 EPA & Auxiliary Building NIA NIA 5.90E-08 Unit 1 Unit 2 Unit 3 Total Damage Frequency (per year) 2.77E-07 2.61 E-07 6.37E-07 Notes:

1) Zero values indicate no successful hits or damage in the missile simulations.

2) The CCW Surge Line supports all 3 units and thus is counted in each unit's total frequency.

3) The Unit 1 & 2 Spent Fuel Pool is a common suction source for both the Unit 1 and the Unit 2 SSF RCMU pumps. Since a loss of SFP level would affect both units, the damage frequency of the SFP piping in the Unit 1 EPA is also counted toward Unit 2, and vice versa.

Page 14

License Amendment Request No. 2018-02 7.2 Conclusions A site-specific analysis of vulnerable tornado mitigation equipment (SSCs) has been conducted using the TORMIS analysis methodology. This includes a characterization of the site tornado hazard and potential tornado-generated missiles developed in a manner consistent with the requirements of the TORMIS95 User's Manual and other TORMIS reference materials.

For each Oconee unit, the mean annual frequency of a damaging tornado missile strike resulting in a radiological release in excess of 10 CFR 100 limits was determined to be less than 1 E-06/year. The analysis was performed in a manner consistent with the requirements of the EPRI topical reports and with the requirements set forth in the NRC's safety evaluation report (Reference 5) and RIS 2008-14 (Reference 12). Compliance with requirements is discussed in Section 8 that follows.

8 COMPLIANCE WITH TECHNICAL REQUIREMENTS 8.1 Modeling Conservatism There are many conservatisms in the TORMIS modeling that offset the simplification and limitations of TORMIS computer code. The Oconee TORMIS analysis is conservative for the following reasons:

1. The TORMIS methodology has been judged to be conservative with respect to missile risk analysis (Reference 5), provided tornado wind velocity ranges and the assumed locations and numbers of potential missiles present at the site used in the calculations are appropriate. An Oconee site-specific tornado wind hazard curve was developed which considers both local and regional variations in tornado risk with a series of conservative adjustments made to the tornado data consistent with the TORMIS methodology. A detailed site survey was conducted to characterize the number, type, and location of potential tornado missiles. The results of that survey used a conservative approach to account for outage and non-outage conditions at ONS. The following are specific examples of conservatism in the Oconee site missile estimate:

a. A 100% missile inventory method was used for structure-origin and zone-origin missiles. The approach for structure-origin missiles conservatively assumes that all the structural missiles become minimally restrained for high-intensity winds. A maximum number of 394,599 missiles are simulated for wind speeds of 316 mph or greater.

b. Outage related increases in missile populations were estimated through input from the Oconee staff. These outage related missile populations were conservatively added to the survey results to obtain a conservative missile population estimate for all zone-and structure-origin missiles.

2. In TORMIS, the effects of local obstructions, buildings, and structures are neglected in simulating winds. Thus, for example, wind flows through the auxiliary and turbine buildings without consideration of either terrain/site roughness or blockage/interference of the reinforced concrete and heavy steel frame structures.

3. The tornado wind field parameters in TORMIS were adjusted to increase the wind profile in the lowest 10 m over the original profile in TORM IS as required by the SER for the TORMIS methodology.

4. All of the postulated missiles at ONS were treated as minimally restrained in which each sampled missile is injected near the peak aerodynamic force, thus maximizing the transport range and impact speed and, consequently, the missile hit and damage frequency.

Page 15

License Amendment Request No. 2018-02

5. The missile injection heights used in the study were chosen conservatively to encourage missile flight. For example, missiles located on the ground are assumed to be at least one foot off the. ground. All missiles that originate from structures are injected into the tornado wind field at the appropriate height range above the failing structure to increase wind exposure and improve chances of striking safety targets.

6. The TORMIS transport model produces missile trajectories and missile impact speeds that are conservative when compared to ballistic (drag only) trajectory models. The highest missile speeds attained in TORMIS easily exceed the missile speeds adopted by the USNRC for deterministic design.

7. Metal siding (subset #13) is a prominent missile type at Oconee. This missile type is based on the typical 30 foot length of aluminum siding folded in half (15 foot) to maximize the impact loading. Conservatively, the damage assessment within the TORMIS95 code is also performed assuming the material properties of steel.

8. The size of the safety targets vulnerable to "offset" hits was increased to account for "offset" hits. These safety components were increased in size for each free face in the three-dimensional modeling. This TORMIS modeling approach, therefore, conservatively estimates the damage to these targets for near misses by tumbling tornado missiles.

• With only a few minor exceptions, target siz13 increases were not applied for non-safety (shielding) targets such as auxiliary building columns and beams although offset hits on these structural members would often prevent damage to nearby safety targets.

9. The substantial number of interferences inside the turbine building and auxiliary building from large components, other piping systems, electrical conduits & cable trays, hangers and steel supports, platforms, handrails, and ventilation ductwork are not modeled as shielding targets. Qualitatively, some credit was taken (i.e., no target size increases) in the EPR and WPR for these interferences to prevent offset target hits; however, most of these areas are quite congested and would likely dissipate and stop most missiles from damaging critical piping and equipment.

10. The SFP piping in the Auxiliary Building was modeled conservatively without credit for the pipe thickness to resist damage. In addition, very few of the piping or equipment interferences in these very congested areas were credited in the model. The evaluation also does not consider that makeup to the SFP is a planned, proceduralized recovery action for all SSF accident scenario that may mitigate small SFP piping leaks initiated by tornado missile damag*e to these lines.

11. The finite element analysis supporting the damage velocity values for the CCW surge lines for concrete block, wood plank, and metal siding missiles are based on missile impacts at the worst-case location and at the worst-case angle of incidence. This combination represents only a small fraction of the potential missile interactions and is very conservative for estimating the frequency of damage to the CCW *surge lines.

12. The damage velocities for the CCW surge lines used in the finite element analysis were conservative advisory velocities that demonstrated insufficient damage to prevent adequate vent flow. However, the ability of the CCW surge lines to withstand higher missile velocity impacts was not evaluated. In some important cases such as metal siding missiles, the critical velocities are expected to be higher which would reduce the estimated damage frequency. The damage velocities for all missile types not covered by.

the finite element analysis were conservatively assumed to be zero.

13. The Boolean failure logic for the CCW surge lines conservatively assumes a loss of vent flow area of greater than 44% on both lines but does not consider whether the combined flow area available on both lines might still be greater than the 44% requirement.

14. The Boolean failure logic for the MSRVs uses a conservative simplifying assumption that the frequency of damaging all MSRVs on the "opposite" header is bounded by the frequency of any pair of MSRVs on that header. The actual frequency of all 8 MSRVs on Page 16

License Amendment Request No. 2018-02 a single MS header is expected to be considerably less than the damage frequency of the quantified pair of MSRVs.

15. The MSRV missile damage criteria is assumed to be "hit" equals damage and the target size is increased from 1 foot diameter cylinder to 3 feet diameter to address offset hits.

This criteria is considered conservative given that the dominant impacts are from the highly deformable metal siding missile type at low to moderate velocity.

16. The failure of SSF ASW, MS, MFW, and RCS letdown piping was conservatively modeled assuming penetration depths less than the actual thickness of these steel targets (e.g., 50% of SSF ASW guard pipe thickness, 25% of MS and MFW pipe thicknesses, and 50% of RCS letdown pipe thickness ignoring lead shielding).

17. No credit is given for the potential availability of other systems beyond the SSF and its support systems for tornado mitigation. Although these systems are considered less protected than the SSF systems, the likelihood of a radiological event in excess of 1 O CFR 100 limits is reduced to the extent that these systems are available after a tornado.

The degree of conservatism associated with all of these items considered together has not been quantified. However, the effect of eliminating or reducing these conservatisms is expected to be a notable reduction in the TORMIS methodology estimated tornado missile damage frequencies.

8.2 Concerns from 1983 TORMIS Safety Evaluation Report The NRC stated in Reference 5 (TORMIS SER) that applications using the EPRI methodology are to consider five points and provide appropriate information. Each attribute is listed and discussed in this Section. Reference 5 established the following required attributes:

1. Data on tornado characteristics should be employed for both broad regions and small areas around the site. The most conservative values should be used in the risk analysis or justification provided for those values selected.

An analysis was performed (Reference 9) to develop an appropriate set of TORMIS inputs to characterize the tornado hazard for the Oconee site. The tornado hazard was evaluated using data for a broad region around the Oconee site for the period of 1950 - 2014 (65 years). Statistical analysis was used to identify a homogenous Oconee subregion from within the broader region that include areas of higher tornado frequency from within the region (see Figure 1 ). The analysis results reflect the Enhanced Fujita (EF) Scale and specifically account for unreported or misclassified tornadoes and tornado reporting trends over time.

Figure 3 provides a comparison of the wind speed exceedance probabilities between the Oconee tornado hazard curves (based on Table 1) and the NUREG/CR-4461 results reported for the Oconee site (Reference 10). This comparison shows that the Oconee plant curve is higher than the NU REG curve for all wind speeds and is conservative and appropriate for the Oconee tornado missile analysis.

2. The EPRI study proposes a modified tornado classification, F'-scale, for which the velocity ranges are lower by as much as 25% than the velocity ranges originally proposed in the Fujita, F-scale. Insufficient documentation was provided in the studies in support of the reduced F'-scale. The F-scale tornado classification should therefore be used in order to obtain conservative results.

The 1983 TORMIS SER calls for the use of the F-Scale of tornado intensity in terms of assigning tornado wind speeds to each intensity category (F1-F5). However, the NRC has since adopted the EF-Scale and confirmed in previous discussions on TORMIS that the EF-Page 17

License Amendment Request No. 2018-02 Scale can be used in place of the F-Scale. The use of the EF-Scale is consistent with the recently endorsed positions of NRC Reg. Guide 1.76 Revision 1 (Reference 7).that are based on NUREG/CR-4461 (Reference 10).

3. Reductions in tornado wind speed near the ground due to surface friction effects are not sufficiently documented in the EPRI study. Such reductions were not consistently accounted for when estimating tornado wind speeds at 33 feet above grade on the basis of observed damage at lower elevations. Therefore, users should calculate the effect of assuming velocity profiles with ratios Vo (speed at ground level)N33 (speed at 33 feet elevation) higher than that in the EPRI study. Discussion of sensitivity of the results to changes in the modeling of the tornado wind speed profile near the ground should be provided.

The approach taken for the Oconee TORMIS analysis follows that of DC Cook (Reference

14) and other licensees applying the TORMIS methodology. In this approach, the following parameters defining the velocity profile in Figure 11-12 of NP-2005 (Reference 2) were used:

a= 10

(=30 The velocity profile defined using these values yields a ratio of ground velocity to velocity at 33' of 0.82. This has been found to be acceptable by the NRC in previous TORMIS submittals.

4. The assumptions concerning the locations and numbers of potential missiles presented at a specific site are not well established in the EPRI studies. However, the EPRI methodology allows site specific information on tornado missile availability to be incorporated in the risk calculation. Therefore, users should provide sufficient information to justify the assumed missile density based on site specific missile sources and dominant tornado paths of travel.

A site specific missile inventory was developed for use in the Oconee TORMIS analysis as described earlier in Section 4. This included a survey of structures and areas around the plant and considers the effect of plant outage activities on missile counts.

5. Once the EPRI methodology has been chosen, justification should be provided for any deviations from the calculational approach.

The Oconee TORMIS analysis is compliant with the EPRI methodology although it is noted that the computer code version has been updated slightly from the original EPRI code. Duke Energy uses the TORMIS95 code which is an updated version of the EPRI NP-2005 code obtained from Applied Research Associates, Inc. (ARA) in 1995. The TORMIS95 code is a legacy FORTRAN computer code that has been ported to modern computers and compilers and has had programming corrections and other enhancements since 1981. The updates and enhancements made to TORMIS since 1981 are.documented in ARA TORMIS reports and Code Manuals, and are retained at ARA Offices in Raleigh, N.C. These changes include: porting the legacy code from mainframe to modern computer operating systems; post processing data routines; updates to the random number generation; enhanced output options; and addressing other issues in the legacy code. All code changes have been checked and verified through comparisons to the preceding version.

8.3 Issues from RIS 2008-14 on TORMIS Methodology Subsequent to the original NRC TORMIS SER (Reference 5), the NRC issued Regulatory Issue Summary 2008-14 (Reference 12) to inform licensees of the NRC's experience with Page 18

License Amendment Request No. 2018-02 shortcomings identified in submitted licensee TORMIS analyses. The RIS specifically identified items licensees should address to confirm the TORMIS methodology and computer code have been properly applied and implemented. The issues identified in the RIS are presented below.

1. Licensees did not fully satisfy the first four points identified in the SER approving the TORMIS methodology (identified above). Examples include the following:

a. not providing adequate justification that the analysis used the most conservative value for tornado frequency As discussed in Section 3 and 8.2, the Oconee tornado hazard analysis was conducted in a conservative manner consistent with the EPRI methodology and NRG requirements. Figure 3 provides a comparison of the wind speed exceedance probabilities between the Oconee tornado hazard curves and NUREG/CR-4461 results reported for the Oconee site (Reference 10). This comparison shows that the Oconee plant curve is higher than the NU REG curve for all wind speeds and is conservative and appropriate for the Oconee tornado missile analysis.

b. not including the entire missile spectrum defined for use in the TORMIS computer code as appropriate for the plant The Oconee missile analysis included the missile spectrum (26 missile aerodynamic subsets) developed for use in TORMIS. A total of 23 missiles were used including several plant specific missiles. Some missile types are modified (size or weight) to reflect conditions pertaining to the site. For example, the existing metal siding missile was modified to be plant specific based on the characteristics of the metal siding on the exterior of the turbine building and other structures at the site.

c. not providing adequate explanation for the number and adequacy of tornado simulations and histories Fifteen complete sets of TORMIS replications (5,000 tornado strikes and 4,000 sampled missiles per tornado for each of the five EF Scales) were run with different random number seeds. Thus, a total of 300 million missile simulations were performed for each EF scale, for a total of 1.5 billion missile simulations. The standard deviations (cr) of these replications were computed and the standard error (E) in the aggregate mean probability (µ) was computed from E = cr/(n)0*5* The 95% confidence bounds in the mean probability were conservatively approximated by µ+/- 2*E. The 95% two-sided confidence bounds are illustrated in Figure 5 below to demonstrate that reasonable statistical convergence had been obtained with 15 replications.

Page 19

License Amendment Request No. 2018-02 UX>E-06 UX>E-07 I.OOE-06 l.OOE-07 l.OOE-06

!.OOE-07 Figure 5 Oconee Unit 1 - Damage Frequency Convergence Plot 10 11 TORM IS Replication Number

-.- cummulative Average Frequency Damage Frequency (Individual Run}

Lower Bound Oconee Unit 2 - Damage Frequency Convergence Plot

-.-. cummulative Average Frequency I

6 9

TORMIS Replication Number Damage Frequency (Individual Run) 10 11 Lower Bound Oconee Unit 3 - Damage Frequency Convergence Plot 3

6 10 11 TORM IS Replication Number

--.- cumrnulative Average Frequency Damage Frequency {Individual Run)

Lower Bound Page 20 12 13 14 IS Upper Bound 12 13 14 IS Upper Bound 12 13 14 IS Upper Bound

License Amendment Request No. 2018-02

d. not providing sufficient information regarding the development and use of area ratios No area ratios have been used as a method to adjust the TORMIS results for small targets based on a ratio of damage probabilities from other large targets. Adjusting the final TORMIS results with area ratios is not technically acceptable and may lead to an underestimate* of the multiple missile hit or damage frequency. Instead a variance reductio_n approach is available in the TORMIS95 code and was used for the Oconee analysis that allows for increasing the volume or size of small targets explicitly within the code. The code applies the input variance reduction weight (ka) in the TORMIS scoring equations to adjust the single missile impact probability which is an acceptable approach.

2. Licensees did not fully address the fifth point identified in the SER and explain how the methodology was implemented when the parameters used differed from those specified in the TORMIS methodology. Examples include the following:

a. inappropriately limiting the number of targets modeled The SSCs identified necessary to safely shutdown the Oconee units that are not fully protected by missile barriers designed against the plant's design tornado missiles are designated as "safety targets" in the Oconee TORMIS analysis. The identification and modeling of these safety targets is described in Section 5.

b. failing to address missile tumbling when modeling targets Section 4.3.2 of the EPRI Report NP-769 (Reference 1) discusses consideration of finite missile size in modeling targets. Since TORMIS tracks the missile as a point, missiles that just miss a target are actually likely to have hit the target by virtue of an "offset" hit. The analysis in NP-769 shows that each safety target dimension should be increased by U8 for each free face or direction, where L is the mean length of the missiles. Each shielding target can be increased by U4 in each free direction. Thus, if a safety target has two free faces in the X direction, its actual X dimension would be increased by U8 x 2. This increase in target size accounts for the potential near misses (which are actually "offset" hits) that are not treated in TORMIS.

Each set of Oconee targets were assessed for their vulnerability to offset hits and are described earlier in Section 5.3. The two primary factors considered are the ruggedness of

. the target against offset hits and whether the target location (area) would allow tumbling missiles to strike the target(s). For example, no size increases were applied for targets in the highly congested EPR and WPR because of the significant structural beams, columns, and other non-structural interferences that exist in these rooms. The CCW surge lines are located in a fairly open area of the turbine building, but were not increased in size because of the ruggedness of the piping against the substantial crushing or crimping of the piping that is required to fail its venting function. The targets where a size increase was determined to be required were for the MSRVs (1 foot increase) and the turbine building vertical steel support columns adjacent to the CCW surge lines (2 foot increase). Generally, no size increases were applied to missile shielding targets which is a conservatism in the analysis.

c. failing to properly consider and use the variance reduction techniques and parameters specified by TORMIS Page 21

License Amendment Request No. 2018-02 The Oconee TORMIS analysis used the following variance reduction techniques:

(1)

Tornado Strike Probability (An'alytical Equivalence)

(2)

EF Scale (Stratified Sampling)

(3)

Tornado Offset (Importance Sampling)

(4)

Missile Injection Height (Vz = 2.0)

(5)

Trajectory Termination (Prr = 0.5)

(6)

Target Size (ka by target surface)

The first two techniques are an inherent part of the TORMIS methodology. Techniques 3 through 6 were used for Oconee specifically. Due to the large number of simulations performed, no variance reduction techniques were used for tornado wind speed, tornado direction, missile zone population, missile type, or missile impact orientation. The effectiveness of the application of these variance reduction methods is demonstrated in the calculation convergence data provided in the response to item 1 c above:

d. taking credit for nonstructural members The Oconee TORMIS analysis generally did not take credit for missile resistance for non-structural members. Many important areas of the turbine building and auxiliary building contain a significant number of substantial interferences such as piping, cable trays, ductwork, electrical cabinets and other large components. While these interferences are not modeled or quantified, they are a qualitative factor when considering whether to increase target sizes for the offset hits. As discussed in Section 5, this was a qualitative factor for some Oconee targets in the EPR and WPR.

e. failing to consider risk-significant, non-safety-related equipment Oconee conducted site tornado hazard vulnerability walkdowns as part of the NRC RIS 2015-06 response. The walkdowns were performed in order to identify any potential systems, structures, or components (SSCs) that may have been vulnerable to a tornado missile strike. Safety related and non-safety related targets were considered.

3. Licensees used the TORMIS methodology to address situations for which the methodology was not approved. Examples include the following:

a. proposing the elimination of existing tornado barriers TORMIS is not being used to propose the elimination of tornado missile barriers at Oconee Nuclear Station.

b. proposing technical specification (TS) changes TORMIS is not being used to propose changes to the Oconee Technical Specifications.

c. proposing plant modifications TORMIS is not being used as justification to modify plant features to reduce, eliminate or otherwise engineer the design of existing or new tornado missile protection features. Duke is enhancing the SSF capabilities through modifications implemented by 1 O CFR 50.59. The routing of those modifications has been or will be included in the TORMIS evaluation as required.

Page 22

License Amendment Request No. 2018-02

9. REFERENCES

1. Twisdale, L.A., et al. Tornado Missile Risk Analysis. Electric Power Research Institute Report NP-768 and NP-769 (Final Report), May 1978.

2. Twisdale, L.A., et al. Tornado Missile Simulation and Design Methodology, Volume 1:

Simulation Methodology, Design Applications, and TORMIS Computer Code. Electric Power Research Institute Report NP-2005, Vol. 1 (Final Report), August 1981.

3. Twisdale, L.A., et al. Tornado Missile Simulation and Design Methodology, Volume 2:

Missile Simulation and Design Methodology. Electric Power Research Institute Report NP-2005, Vol. 2 (Final Report), August 1981.

4. TORMIS95 User's Manual: Tornado Missile Risk Methodology. Applied Research Associates, Inc. Project 5313 (Draft Report), December 1995.

5. Rubenstein, L.S. "Safety Evaluation Report-Electric Power Research Institute (EPRI)

Topical Reports Concerning Tornado Missile Probabilistic Risk Assessment (PRA)

Methodology". US Nuclear Regulatory Commission letter to F.J. Miraglia, (ML080870291 ), October 26, 1983.

6. Denton, Harold R., "Position on Use of Probabilistic Risk Assessment In Tornado Missile Protection Licensing Actions", USNRC Memorandum to Victor Stello, (ML080870287),

November 7, 1983.

7. "Design Basis Tornado for Nuclear Power Plants1'. US Nuclear Regulatory Commission Regulatory Guide 1.76, Revision 1, March 2007.

8. Texas Tech University (TIU), A Recommendation for an Enhanced Fujita Scale -

Submitted to The National Weather Service and Other Interested Users, January 26, 2006. Wind Science and Engi_neering Center, Texas Tech University, Lubbock, Texas.

9. L.A. Twisdale and M. Faletra, ONS Tornado Hazard Analysis, Applied Research Associates, Inc., Project Number ARA-00272800272800001, Revision 0, September 26, 2017.

1 O. Ramsdell, J.V. and Rishel, J.P., Tornado Climatology of the Contiguous United States.

US Nuclear Regulatory Commission Report NUREG/CR-4461, Revision 2, February' 2007.

11. "MultiHazard Loss Estimation - Hurricane Model, HAZUS MH MR3 Technical Manual,"

Federal Emergency Management Agency, Mitigation Division, Washington, D.C., 2007.

12. Regulatory Issue Summary (RIS) 2008-14, Use of TORMIS Computer Code for Assessment of Tornado Missile Protection, USNRC, ADAMS Accession No. ML080230578, June 16, 2008

13. Carter, Russell R. Wind-Generated Missile Impact on Composite Wall Systems, MS Thesis, Department of Civil Engineering, Texas Tech University, LubboQk, TX. Ma,y 1998.

14. Donald C. Cook Units 1 and 2: Application dated June 8, 2000 (ADAMS Accession No. ML003723707); NRC Safety Evaluation dated November 17, 2000 (ADAMS Accession No. ML003770173).

15. Duke Energy Calculation OSC-8859, "Oconee Tornado Missile Inventory," Revision 3, May 2018.

16. Duke Energy Calculation OSC-9307, "Evaluation of Tornado Missile Damage Frequency for Oconee Unit 1," Revision 2, June 2018 Page 23

License Amendment Request No. 2018-02

17. Duke Energy Calculation OSC-9308, "Evaluation of Tornado Missile Damage Frequency for Oconee Unit 2," Revision 2, June 2018

18. Duke Energy Calculation OSC-8860, "Evaluation of Tornado Missile Damage Frequency for Oconee Unit 3," Revision 5, June 2018 Page 24

License Amendment Request No. 2018-02

-90°

-89°

-88°

-87"

-86°

-85°

-84°

-83"

-82°

-81°

-80°

-79°

-78°

-11*

-76°

-75° 42° 41° 40° 39*

38° 37° 36° 35*

34*

33*

32*

30° 29° 28° 27°

-91 °

-90°

-89°

-88°

-87°

-86"

-85°

-84* -sJ* -B2*

-81'

-so*

-79"

-78°

-11*

-76"

-1s*

Figure 1 - Oconee Subregion Area Page 25 42° 41*

40° 39*

38° 37° 36° 35*

34*

33*

32° 31° 30° 29*

28" 27°

License Amendment Request No. 2018-02 Not Drawn To Scale Figure 2 - Plant Safety Envelope Page 26

License Amendment Request No. 2018-02 i: 1.

-0.

~

?; -

.:0

_a

1.

-OS e

Oi.

• '-' Ii

°Q I

1.

-06 Figure 3 - Oconee Tornado Hazard Comparison Page 27

License Amendment Request No. 2018-02 Figure 4. Tornado Missile Zones for Oconee Nuclear Station Page 28

ATTACHMENT 6 THERMAL-HYDRAULIC MODELS FOR STANDBY SHUTDOWN FACILITY TRANSIENT ANALYSIS [NON-PROPRIETARY]

License Amendment Request No. 2018-02 Thermal-Hydraulic Models for Standby Shutdown Facility Transient Analysis - Methods

[Non-Proprietary]

Note: Text that is within brackets is proprietary to Duke Energy or Framatome. The subscripts D or F, respectively, are used to identify the appropriate company.

The thermal-hydraulic (T-H) analyses for an Standby Shutdown Facility (SSF) mitigated tornado event described in the license amendment request (LAR) Enclosure have been performed using Duke Energy's RELAP5/MOD2-B&W Oconee Nuclear Station (ONS) T-H model. Duke Energy's RELAP5/MOD2-B&W ONS model has previously been approved for use in the ONS Updated Final Safety Analysis Report (UFSAR) Chapter 6 Loss of Coolant Accident (LOCA) mass and energy release analyses (Reference 1 ). The Oconee RELAP5 model is designed primarily for use with small and large break LOCA applications. This model has been modified to include additional detail and features required to perform these analyses described in Attachment 7.

RELAP5/MOD2-B&W is derived from RELAP5/MOD2 Cycle 36.05, which is an advanced T-H computer code developed by EG&G Idaho for the Nuclear Regulatory Commission (NRC). The code was originally developed to provide the NRC with a tool for auditing licensing analyses of both large and small break LOCAs. Babcock & Wilcox (B&W) (now Framatome) modified RELAP5/MOD2 by including the evaluation model correlations and methods required by 10 CFR 50 Appendix K. This NRC approved code is described in Reference 1 and in BAW-10164P-A, Revision 4 (Reference 6).

RELAP5/MOD2 is selected for these analyses based on the potential for two-phase conditions in the RCS piping. The MSLB analysis results in sufficient overcooling and leads to two-phase conditions in the RCS piping which can potentially interrupt natural circulation. To accurately predict this phenomena the RELAP5/MOD2 code was selected to perform this analysis. The FWLB tornado analysis does not result in two-phase conditions, indicating that RETRAN based methods could be used to perform the analysis. However, for consistency the RELAP5/MOD2 method was used to analyze both events.

Overheating Analysis Description This analysis represents the plant transient response following a loss of all feedwater event due to tornado-induced damage to the Main Feedwater piping, and the 4160VAC and 6900VAC switchgear for all three Units. The tornado causes an immediate and complete loss of Main Feedwater from Hot Full Power (HFP) conditions, as well as a total loss of AC power due to the loss of the 4160VAC and 6900VAC switchgear. The primary objective of the analysis is to demonstrate the SSF is capable of meeting the proposed tornado mitigation acceptance criteria for a limiting overheating event.

For performing the overheating analysis for an SSF mitigated tornado event, the RELAP5/MOD2-B&W ONS T-H model has been modified to: 1) include ambient heat losses from the pressurizer after the time of peak RCS pressure, 2) improve its capability to model thermal stratification of fluid in the pressurizer region, and 3) eliminate the Main Feedwater piping to conservatively minimize liquid added to the steam generators.

Overcooling Analysis Description This analysis evaluates the plant transient response to a single or double MSLB and loss of the 4160VAC Engineered Safeguards and 6900VAC switchgear due to a tornado that results in damage to the switchyard and other equipment in the turbine building. The tornado causes either a single or double MSLB, an immediate loss of all AC power, a reactor trip, a turbine trip, 1

License Amendment Request No. 2018-02 a trip of the reactor coolant pumps (RCPs}, and a trip of all condensate and Main Feedwater pumps. The primary objective of the analysis is to demonstrate the SSF is capable of meeting the proposed tornado mitigation acceptance criteria for a limiting overcooling event.

For performing the overcooling analysis for an SSF mitigated tornado event, the RELAP5/MOD2-B&W ONS T-H model has been modified to: 1) include ambient heat losses from the pressurizer, 2) improve its capability to model thermal stratification of fluid in the pressurizer region, 3) add portions of the condensate and feedwater system piping to represent the fluid volumes anticipated to flash and contribute mass to the steam generators, and 4) add detailed steam line modeling to capture the effects of liquid entrainment.

Model Modifications The aforementioned modifications to Duke Energy's RELAP5/MOD2-B&W ONS T-H models are described in more detail below. The modified RELAP5/MOD2-B&W ONS T-H models have been developed specifically for performing overheating and overcooling transient analysis of an SSF mitigated tornado event. Duke Energy does not intend to apply these models or modifications to the ONS UFSAR Chapter 6 accident analyses. Therefore, a revision to Duke Energy's NRC approved methodology report, DPC-NE-3003-PA (Reference 1 }, will not be made. Should the need arise, Duke Energy intends to use the modified RELAP5/MOD2-B&W ONS T-H models in future SSF mitigated tornado event analyses to evaluate changes to the plant and operator guidance.

While these modifications have been developed and applied for the analysis of an SSF mitigated tornado event, Duke Energy considers the modifications to be equally suitable for use in analysis of other SSF mitigated events.

Ambient Heat Losses The existing RELAP5/MOD2-B&W ONS T-H model exterior heat structures (or conductors) on the RCS and pressurizer components are modeled with [

]oa,c The heat structure inputs are selected to [

]oa,c To model ambient heat losses from a region of the RCS, the associated heat structures are converted to [

Within the RELAP5/MOD2-B&W ONS models used for the overheating and overcooling analysis for an SSF mitigated tornado event, ambient heat losses are [

]oa,c This change is considered an enhancement to the existing models since it allows more accurately modeling of the impact of real phenomena on the pressurizer response for longer duration events associated with the SSF. Ambient heat losses from the pressurizer are modeled in the overheating (after the peak RCS pressure occurs) and overcooling analyses. Ambient heat losses from the other RCS structures are not modeled in the overheating and overcooling analyses. This is conservative for overheating analyses, and consistent with the approach described in References 1, 2 and 3. Ambient heat losses from the RCS do not play a significant role during relatively short duration overcooling events.

2

License Amendment Request No. 2018-02 Reactor Vessel Head Axial Conduction For the RELAP5/MOD2-B&W ONS T-H model described in Reference 1, the reactor vessel upper head region is divided into [

]oa,c Due to nodalization limitations, the top-most reactor vessel upper head node is effectively a dead-ended volume.

During a transient, the fluid conditions in this node can be affected by the nodalization. This is non-physical since buoyancy effects would cause circulation and mixing of the RCS fluid in this region. If the dead-ended node were to become voided due to depressurization, the dead-ended volume effect would impact the nature of subsequent condensation and refill. In the overcooling analysis, to mitigate this non-physical behavior [

]oa,c The reactor vessel upper head includes numerous axial structures, a portion of which are modeled to allow heat transfer across node boundaries.

Pressurizer Nodalization for Thermal Stratification of Pressurizer Fluid As described in the Enclosure, the SSF has been credited in the ONS licensing basis for mitigation of a variety of events and conditions. Many of these events can be generically classified as RCS overheating or overcooling transients. The pressurizer plays a significant role in regulating RCS pressure during these events, and experiences several important phenomena for both overcooling and overheating conditions.

In general, for overheating events, there is an initial insurge of subcooled liquid into the pressurizer from thermal expansion of the RCS inventory. If the overheating transient is short lived, the presence of subcooled liquid in the pressurizer has little impact on the immediate response. This is because there is little mixing in the fluid region under these conditions and buoyancy (density) effects cause the colder liquid in the pressurizer to remain near the bottom of the vessel, while the hotter (originally saturated) liquid remains near the top of the water column and in contact with the vapor space. Thermal stratification of the pressurizer liquid helps limit the amount of steam condensation that occurs at the steam-liquid interface during these pressure excursions.

For RCS overcooling transients, saturated liquid in the pressurizer flashes to steam, expands, and limits the depressurization rate of the RCS. Subsequently when the pressurizer refills, insurges of subcooled liquid to the pressurizer can limit the ability of the pressurizer to regulate subsequent depressurizations of the RCS. For more severe overcooling events, the pressurizer may empty as a result of the initial overcooling, but subcooled liquid will refill the pressurizer once operators restore RCS pressure or pressurizer level to the specified operating range. In the longer term recovery phase, operator actions to. stabilize pressurizer level and pressurizer heaters are able to re-saturate the fluid in the pressurizer and restore RCS pressure to a desired range.

For SSF mitigated events with limited pressurizer heater capacity, the ability to re-saturate the subcooled liquid in the pressurizer is greatly diminished. Additionally, pressurizer ambient heat losses can cause condensation of the vapor space on internal structural surfaces. Continued condensation of the vapor space leads to a reduction in RCS pressure and increases in pressurizer level. As the vapor space collapses, the continual insurge of subcooled liquid challenges the ability of the pressurizer heaters to re-saturate the fluid. Should the pressurizer eventually refill to a water-solid condition, RCS pressure control is provided by balancing makeup and letdown flow with the SSF letdown line. It should be noted the current tornado analyses are not predicted to evolve to water-solid conditions due to the boundary conditions assumed in these analyses.

3

License Amendment Request No. 2018-02 In order to evaluate longer duration SSF events, it is important that the T-H models be capable of capturing the effects from thermal stratification and ambient heat losses in the pressurizer.

Modifications for modeling ambient heat losses are described above. To improve the modeling capability for thermal stratification of fluid in the pressurizer region, a finer nodalization is required.

Section 2.1 of Reference 1 describes the original pressurizer modeling approach in the RELAP5/MOD2-B&W ONS model. The RELAP5/MOD2-B&W pressurizer is modeled with [

]oa,c In order to increase the spatial resolution of axial temperature gradients that can establish in longer duration SSF events, [

]oa,c as well as improved predictions of thermal stratification of the liquid region during insurges, outsurges, and large pressure drops.

Main Feedwater and Condensate System Nodalization Section 2.1 of Reference 1 describes the Main Feedwater piping included in the RELAP5/MOD2-B&W ONS T-H model. The ONS model nodalization includes the Main Feedwater piping between the last check valve and the steam generator. This enables modeling flashing of the Main Feedwater in the piping if the steam generator pressure decreases low enough for the flashing to occur. Should this occur additional hot water will be expelled into the steam generator with the potential to increase secondary to primary heat transfer, which is conservative for LOCA mass and energy release calculations. This additional modeling detail is necessary to accurately model the Main Feedwater boundary condition.

For overheating events, it is conservative to minimize the amount of feedwater that can enter the steam generators. For the SSF mitigated tornado event overheating analysis, the Main Feedwater piping included in the ONS RELAPS base model is removed to conservatively minimize liquid added to the steam generators.

For overcooling events, it is conservative to maximize the amount of feedwater that can enter the steam generators. For the SSF mitigated tornado event overcooling analysis, the portions of the condensate and feedwater system piping that are anticipated to flash due to the depressurization and contribute mass to the steam generators are included in the model. The Main Feedwater control valves are assumed to remain open to allow the maximum amount of feedwater to enter the steam generator.

Main Steam System Nodalization The RELAP5/MOD2-B&W ONS T-H model described in Section 2.1 of Reference 1 represents the Main Steam piping from the steam generator to the turbine with a single volume for each loop: This level of nodalization is acceptable for performing mass and energy release calculations where the turbine stop valves are assumed to close immediately without delay upon break initiation and the turbine bypass valves are assumed to be unavailable, and other Main Steam branch lines (2nd stage reheat, etc.) are also assumed to be isolated. Therefore, the secondary coolant is isolated in the steam generators and steam lines and is available to transfer energy to the primary fluid. The secondary steam release is characterized by the Main Steam relief valves.

For overheating events, the nodalization included in the RELAP5/MOD2-B&W ONS T-H model is conservative to represent the heat transfer and steam release from the steam generators.

4

License Amendment Request No. 2018-02 For overcooling events, additional phenomena are present that potentially impact the ability to remove heat from the steam generators. These phenomena are associated with the rapid depressurization due to postulated Main Steam piping breaks. The rapid depressurization will initially cause a liquid level swell and entrainment due to high steam velocities. The steam generator outlet nozzles installed in the Replacement Once Through Steam Generators (ROTSG) serve to limit the blowdown mass flow rate. Entrained liquid droplets in the steam flow may become de-entrained in the vertical portions of the steam line piping downstream of the steam generators. Modeling the vertical piping enables a liquid level in this section of steam line that could impact conditions within the steam generator. Additional detail that preserves flow area and elevation change is included in the steam line nodalization used for the SSF mitigated tornado event overcooling analysis to allow the analysis to capture these effects.

Steam Generator Modeling Section 2.1 of Reference 1 describes the steam generator modeling approach in the RELAP5/MOD2-B&W ONS model. This approach provides conservative modeling of primary to secondary heat transfer for small and large break LOCA applications.

The RELAP5/MOD2-B&W EFW heat transfer model described in Reference 6 is used to model SSF ASW flow for the overheating and overcooling analysis; this model has been approved for use in licensing calculations for Once Through Steam Generator (OTSG) designs (Reference 1 and Reference 6). The RELAP5/MOD2-B&W ONS EFW model consists of [

]F To use this model, the OTSG tubes are modeled with [

]F Reference 1 includes a conservative modeling approach based on the experimental results referenced in Reference 5. The Safety Evaluation Report for the Babcock and Wilcox Owners Group CRAFT2 small break loss of coolant accident evaluation model (Reference 4), includes a re-evaluation of the effectiveness of EFW, the technical bases for the steam generator level requirements during SBLOCA conditions, and a review of the appropriate operating guidelines and utility operating procedures.

Reference 5 describes the steam generator model included in Reference 4. Reference 5 discusses EFW modeling and benchmarks, and provides [

]oa,c,e.F This supports the [

]oa,c assumed in Reference 1 for performing LOCA mass and energy release calculations, as appropriate for minimizing steam generator heat transfer.

Reference 5 also indicates [

5

License Amendment Request No. 2018-02 For overheating events, the limiting peak RCS pressure occurs prior to SSF ASW being aligned to the steam generators for cooling. The RELAP5/MOD2-B&W ONS T-H model is modified [

]oa,c This selection conservatively represents SG heat transfer and is appropriate for representing the cooldown phase of the event.

For overcooling events, the wetted tube fraction is increased to maximize the high-elevation heat transfer. The RELAP5/MOD2-B&W ONS T-H model is modified [

Boundary Condition Modeling The overheating and overcooling analyses for SSF mitigated tornado events include several boundary conditions that were not described in Reference 1. These boundary conditions require additional modeling features to be included in the RELAP5/MOD2-B&W ONS model to facilitate the analyses. These modeling features include the steam line atmospheric dump valves (ADVs),

SSF ASW, turbine driven EFW, secondary steam loads, and the SSF letdown line. The modeling approach for several of these features considers the impact of asymmetric loop conditions on the performance of the individual boundary condition. These modeling features are applied in a manner to ensure appropriate boundary conditions are specified for each analysis.

SSF ASW is available at 14 minutes for SSF mitigated analyses. SSF ASW is assumed to be available at 14 minutes in the overcooling analysis, but is not aligned to the SGs at this time due to the overcooling. The peak RCS pressure in the overheating analysis is defined by the pressurizer safety relief valve characteristics as the PORV is not available. With an immediate reactor trip, the rate of RCS pressurization is such that pressurization does not continue after the PSVs begin to lift. Thus, the peak RCS pressure results obtained are not contingent on the timing of SSF ASW flow.

The steam line ADVs (or other steam flow paths) are included in the overcooling analysis for examining long term recovery actions for single MSLB cases, and are not credited in the mitigation phase of the analysis.

RELAP5/S3K Reactivity Evaluation The RELAPS core response is determined with a point kinetics model which is generally recognized as providing a conservative power response relative to the response obtained using 30 methods. To ensure that an_ appropriate transient reactivity is calculated for the overcooling analysis, SIMULA TE-3K (S3K) 30 core models are used to assess the RE LAPS reactivity calculation. A comparison is performed between RELAPS and S3K to ensure a conservative (i.e., higher return to power) power response is obtained. The process used is based on the MSLB methodology described in Duke Energy's NRC approved methodology report DPC-NE-3005-PA "UFSAR Chapter 15 Transient Analysis Methodology" (Reference 2) with exceptions as discussed below.

The process begins by selecting bounding reactivity parameters as inputs to the RELAPS point kinetics reactivity calculation. Time dependent T-H parameters from the RELAPS calculation are provided for input to S3K for a cycle-specific calculation using consistent thermal/hydraulic forcing functions. Then, to remove excess conservatism in the predicted reactivity, an input parameter to the RELAPS point kinetics model is adjusted that impacts the magnitude of the 6

License Amendment Request No. 2018-02 reactivity, without altering the overall response shape. In the tornado overcooling analysis, the parameter.selected for adjustment is the trippable rod worth.

The objective of the S3K calculation is to demonstrate that the RELAPS reactivity calculation remains conservative for a specific Oconee core, and the RELAPS power response bounds (is greater than) that obtained by S3K.

The MSLB methodology described in DPC-NE-3005-PA (Reference 2) uses SIMULA TE-3P to demonstrate the RETRAN reactivity calculation is conservative. For the overcooling analysis performed with RELAPS, S3K is selected instead of S1MULATE-3P based on the anticipation of nodal voiding at the limiting return to power statepoint. S3K incorporates thermal-hydraulic models capable of calculating nodal voiding and its impact on reactivity and power distributions which are not included in the PWR version of S1MULATE-3P. However, the limiting case with a return to power included highly subcooled fluid conditions in the core at the statepoint. As an additional check, S1MULATE-3P was used to confirm the RELAPS reactivity at the limiting state point. The use of this code is acceptable because of the slow progression of the transient and subcooled core conditions. The results confirmed the S3K calculation that the reactivity inserted by RELAPS was conservative (i.e. greater than that produced by either S1MULATE-3P or S3K).

S3K was approved to model the very fast control rod ejection transient ( < 10 seconds) in Reference 2, DPC-NE-3005-PA "UFSAR Chapter 15 Transient Analysis Methodology". S3K was used here to model the much slower MSLB transient (40+ minutes). Both transients model a control rod scram, with the most reactive rod stuck fully withdrawn, with the MSLB scram initiated from HFP conditions at time zero. The MSLB transient models time-dependent input moderator temperature & inlet moderator flow rate, along with time-dependent boron concentration and core pressure. Trippable control rod worth was conservatively reduced by a 10% uncertainty in rod worth, an allowance for control rod depletion, and by assuming control bank rods were initially at their rod insertion limit. The fission product distribution during the course of the transient is modeled to account for its impact on core reactivity and power distribution. However, modeling the time dependent fission product distribution had no noticeable effect on the parameters of interest (i.e. core power, k-effective, reactivity), except for an increase of < 10% in xenon concentration during the modeled time. The only other S3K-specific feature exercised for the MSLB transient that was not exercised in Reference 2 was the modeling of the four time-dependent parameters listed above.

The results of this comparison demonstrate the RELAPS calculation is conservative relative to the S3K calculation performed for the selected core design. The S3K calculation follows the guidance described in References 2 and 7 for assumptions such as 10% rod worth uncertainty and most reactive single stuck rod. This comparison is incorporated as a reload check into future Oconee core designs.

For tornado, the SSF is not required to meet the single failure criterion or the postulation of the most reactive rod stuck fully withdrawn. While not required, the analysis assumes the most reactive rod is stuck fully withdrawn to ensure a conservative transient response.

A Departure from Nucleate Boiling (DNB) Ratio evaluation performed using VIPRE demonstrates a large amount of DNB margin exists for the statepoint at the peak heat flux. The VIPRE methodology used is described in the Duke Energy NRC approved methodology report DPC-NE-3000-PA (Reference 3).

7

License Amendment Request No. 2018-02 References

1.

Duke Energy Methodology Report DPC-NE-3003-PA, Oconee Nuclear Station, Mass and Energy Release and Containment Response Methodology, Revision 1. (Safety Evaluations dated March 15, 1995; September 24, 2003)

2.

Duke Energy Methodology Report DPC-NE-3005-PA, Oconee Nuclear Station, UFSAR Chapter 15 Transient Analysis Methodology, Revision 5. (Safety Evaluations dated October 1, 1998; May 25, 1999; September 24, 2003; October 29, 2008; July 21, 2011; and April 29, 2016)

3.

Duke Energy Methodology Report DPC-NE-3000-PA, Oconee Nuclear Station, McGuire Nuclear Station, Catawba Nuclear Station, Thermal-Hydraulic Transient Analysis Methodology, Revision 5. (Safety Evaluations for Oconee Nuclear Station dated August 8, 1994 (Accession Number ML16293A840); October 14, 1998 (Accession Number 9810190223); September 24, 2003 (Accession Number ML032670816); October 29, 2008 (Accession Number ML082800408); and July 21, 2011 (Accession Number ML~ 1137A150)).

4.

Letter J. F. Stolz (NRC) to H. B. Tucker (Duke),

Subject:

NUREG-0737 ITEM II.K.3.30, SMALL BREAK LOCA METHODS, Re: Oconee Nuclear Station, Units 1, 2 and 3, Dated: July 29, 1985. (Safety Evaluation Report for the BABCOCK AND WILCOX OWNERS GROUP SMALL BREAK LOSS-OF-COOLANT ACCIDENT EVALUATION MODEL, CRAFT2 (REV. 3) (BAW-10092P, REV. 3 AND BAW-10154))

5.

Evaluation of SBLOCA Operating Procedures and Effectiveness of Emergency Feedwater Spray for B&W-Designed Operating NSSS, Document No. 77-1141270-00, Babcock & Wilcox, Lynchburg, Virginia, February 1983.

6.

BAW-10164P-A, Revision 4, "RELAP5/MOD2-B&W-An Advanced Computer Program for Light-Water Reactor LOCA and Non-LOCA Transient Analysis", Framatome ANP, November 2002.

7.

ONS Reload Design Methodology, NFS-1001-A, Duke Energy, SE dated July 21, 2011.

8

ATTACHMENT 7 THERMAL-HYDRAULIC TRANSIENT ANALYSIS OF TORNADO INDUCED OVERHEATING AND OVERCOOLING EVENTS MITIGATED USING THE STANDBY SHUTDOWN FACILITY

License Amendment Request No. 2018-02.

Thermal-Hydraulic Transient Analysis of Tornado l_nduced Overheating and Overcooling Events Mitigated Using the Standby Shutdown Facility 1.0 Tornado Mitigation - Methods For tornadoes that are postulated to create a Main Steam line break (MSLB) or Main Feedwater line break (FWLB), thermal-hydraulic (T-H) analyses were performed using Duke Energy's RELAP5/MOD2-B&W Oconee Nuclear Station (ONS) T-H model. The RELAP5/MOD2-B&W ONS models and analysis methods are described in Duke Energy's NRC approved methodology report DPC-NE-3003-PA (Reference 1) and have been modified to include additional detail and features required to perform these analyses, as described in Attachments 5 and 6. Attachment 5 includes Duke Energy proprietary information that is identified by brackets.

In accordance with 1 O CFR 2.390, Duke Energy requests that this information be withheld from public disclosure. Attachment 6 contains the non-proprietary (redacted) version of this content.

RELAP5/MOD2 is selected for these analyses based on the potential for two-phase conditions in the Reactor Coolant system (RCS) piping. The MSLB analysis results in sufficient overcooling to produce two-phase conditions, indicating that RETRAN based methods could be used to perform the analysis. The methods.selected are discussed further in Attachment 5.

2.0 Tornado Mitigation - Analysis Acceptance Criteria The new acceptance criteria will be as follows:

Successful mitigation of a tornado condition at Oconee shall be defined as meeting the following criteria to ensure that the integrity of the fuel and RCS remains unchallenged.

The following criteria are validated for the overheating analysis to demonstrate acceptable results.

The core must remain intact and in a coolable core geometry during the credited strategy period.

Minimum Departure from Nucleate Boiling Ratio (DNBR) meets specified acceptable fuel design limits.

RCS must not exceed 2750 psig pressure (110% of design).

In addition to the criteria specified above, the following criteria are validated for the overcooling analysis to demonstrate acceptable results.

The steam generator tubes remain intact.

RCS remains within acceptable pressure and temperature limits.

3.0 Tornado Mitigation - Overheating Analysis The Standby Shutdown Facility (SSF) auxiliary service water (ASW) is credited with providing an alternate means of establishing steam generator heat removal should emergency feedwater (EFW) be lost, including the ability to align EFW from an unaffected unit. This analysis evaluates the ONS RCS response to a rupture in the Main Feedwater piping with a loss of the 4160VAC Engineered Safeguards and 6900VAC switchgear due to a tornado. This break location is upstream of the Main Feedwater line check valves such that a break in this location results in a complete loss of Main Feedwater to both SGs.

A new analysis has been performed to evaluate the ONS RCS response to a loss of Main Feedwater and the 4160VAC Engineered Safeguards and 6900VAC switchgear for all three 1

License Amendment Request No. 2018-02.

units due to a tornado that also damages the switchyard and other equipment in the turbine building. The primary objective of the analysis is to demonstrate the SSF is capable of meeting the proposed tornado mitigation acceptance criteria for a limiting overheating event.

The transient begins with an immediate and complete loss of Main Feedwater from Hot Full Power (HFP) conditions, as well as a loss of the 4160VAC switchgear and the 6900VAC switchgear. This causes an immediate reactor trip and trip of the reactor coolant pumps (RCPs) due to the loss of power. The motor driven EFW pumps are powered from the 4160VAC switchgear and are not available due to the loss of power. The turbine driven EFW pump is assumed to be unavailable. Since portions of the integrated control system (ICS) are unprotected from tornado damage, the pressurizer PORV is assumed to be unavailable. Single failure criterion is not applied to the SSF. Steam generator (SG) pressure increases rapidly to the Main Steam relief valve (MSRV) lift setting following turbine trip. SG pressure cycles on the lowest lifting MSRV bank until the SG liquid inventory has boiled away. At this point, SG pressures stabilize just below the lift setpoint of the lowest lifting MSRV bank until the operators establish SSF ASW flow.

The combination of high end of cycle (EOC) decay heat and delayed SSF ASW flow to the SGs causes a large overheating event in the primary system and a rapid increase in RCS pressure.

Since the pressurizer PORV is unavailable, RCS pressure increases to the pressurizer safety valve (PSV) lift setting and the PSVs cycle to control RCS pressure until operators establish SSF ASW flow. SSF ASW is available at 14 minutes for SSF mitigated analyses. The peak RCS pressure in the overheating analysis is defined by the pressurizer safety relief valve characteristics as the PORV is not available. With an immediate reactor trip, the rate of RCS pressurization is such that pressurization does not continue after the PSVs begin to lift. The maximum pressure observed remains below the 2750 psig limit. Thus, the peak RCS pressure results obtained are not contingent on the timing of SSF ASW flow.

Actual pressurizer level increases with increasing RCS temperatures and eventually goes off scale high. However, the pressurizer never transitions to a water-solid condition and there is no liquid relief through the PSVs. In the longer term response, operators use SSF ASW to increase SG levels to promote sustained natural circulation flow in the RCS, and use the SSF controlled pressurizer heaters and SSF letdown line to control RCS pressure and pressurizer level, respectively.

Successful mitigation of a tornado condition at Oconee shall be defined as ensuring that the integrity of the fuel and RCS remains unchallenged. For the overheating analysis the fuel integrity is ensured by the reactivity added by control rod insertion and the core remains covered. A minimum DNBR evaluation is not required for this analysis since the transient does not include a return to power. RCS integrity is demonstrated by verifying the RCS pressure remains below the 2750 psig limit.

In summary, the results of the analysis demonstrate that the SSF is capable of ensuring peak RCS pressure remains below the 2750 psig limit. Additionally, the results demonstrate there is sufficient decay heat removal and primary coolant makeup to keep the core covered and maintain the RCS in MODE 3 with an average temperature ~ 525°F for the duration of the event.

4. Tornado Mitigation - Overcooling Analysis The primary objective is to demonstrate adequate core cooling and establish a basis for mitigation strategies using the SSF for establishing and maintaining safe shutdown conditions for MSLBs.

2

License Amendment Request No. 2018-02.

This analysis evaluates the plant transient response to a single or double MSLB and loss of the 4160VAC Engineered Safeguards and 6900VAC switchgear for all three units due to a tornado that results in damage to the switchyard and other equipment in the turbine building.

This analysis determines the plant transient response to a MSLB event mitigated with SSF equipment and without credit for automatic feedwater isolation (AFIS). The initiating event causes a single or double MSLB, an immediate loss of 4160VAC and 6900VAC power, a reactor trip, a turbine trip, a trip of the reactor coolant pumps (RCPs), and a trip of all condensate and Main Feedwater pumps. The motor driven EFW pumps are not available due to the loss of 4160VAC power. The turbine driven EFW pump is assumed to be available which is conservative for maximizing the overcooling. Single failure criterion is not applied to the SSF.

This scenario is intended to bound the consequences resulting from a tornado event.

The primary objective of this analysis is to demonstrate that the plant will achieve a steady state condition where the RCS is in natural circulation flow conditions with SSF ASW providing a heat sink, SSF Reactor Coolant (RC) makeup flow providing seal injection flow, RCS pressure being maintained with SSF powered pressurizer heaters, and pressurizer level being controlled by operation of the SSF letdown line and/or SSF ASW.

Upon initiation of the single or double MSLB, RCS pressure, hot and cold leg temperature, SG pressure and pressurizer level rapidly decrease due to the overcooling and contraction of the RCS. The RCS saturates and pressurizer level goes off scale low. The turbine driven EFW pump is assumed to automatically start and run without being throttled until the contents of the upper surge tank are delivered to the SGs. The SSF RC makeup pump is started to restore RCP seal cooling and makeup to the RCS. SSF ASW flow is available at 14 minutes, but not aligned to the SGs at this time due to the overcooling.

The minimum RCS pressure reached is a function of the number of broken steam lines. With a single MSLB, after the RCPs coast down, RCS flow in the intact loop stagnates and allows primary coolant in the intact loop to flash, limiting the RCS depressurization. This void formation in the intact loop allows the affected RCS loop to remain full and circulating. For the single MSLB cases, RCS pressure remains above 600 psig, preventing boron from the core flood tanks (CFT) from entering the RCS. The sustained overcooling in the affected loop is sufficient to result in a minimal return to power ( <0.1 % power). The core remains covered and subcooled during the return to power, with adequate departure from nucleate boiling (DNB) margin. The overcooling continues until shortly after the turbine driven EFW pump stops feeding the SGs.

The limiting core response obtained with a single MSLB is evaluated further by a sensitivity case that does not credit boron added by the SSF RC makeup pump. The maximum core power level reached in this sensitivity case is 2.4% power at 1501 seconds. The indicated core exit subcooling between 1200 and 1800 seconds is greater than 120°F, and consistently greater than 60°F subcooled during the return to power.

The RELAP5 core response is determined with a point kinetics model which is generally recognized as providing a conservative power response relative to the response obtained using 30 reactor core physics methods. To ensure that the appropriate transient reactivity is calculated, a SIMULATE-3K (S3K) 30 core model is used to assess the RELAP5 reactivity calculation. The results of this comparison demonstrate the RELAP5 calculation is conservative (i.e., higher return to power) relative to the S3K calculation performed for the selected core design. The S3K calculation follows the guidance described in the NRC approved methodology defined in Reference 3, DPC-NE-1006-PA "Oconee Nuclear Design Methodology Using CASM0-4 I SIMULATE-3", Reference 4, DPC-NE-3005-PA "UFSAR Chapter 15 Transient Analysis Methodology", and Reference 5, NFS-1001-A "ONS Reload Design Methodology.

This comparison is incorporated as a reload check into future Oconee core designs.

3

License Amendment Request No. 2018-02.

• A DNBR evaluation performed using VIPRE and the EPRI and Modified Barnett CHF correlations demonstrates a large amount of DNB margin exists for the statepoint at the peak heat flux. The VIPRE methodology used is described in the Duke Energy NRG approved methodology report DPC-NE-3000-PA (Reference 2).

The EPRI CHF correlation is used to identify the limiting critical heat flux and DNBR statepoints.

The Modified Barnett CHF correlation is then used to evaluate the limiting statepoints identified with the EPRI correlation and the peak heat flux statepoint. The Modified Barnett correlation is the current licensed correlation used for low pressure (steam line break) events for Oconee and B-HTP fuel. The minimum DNBR determined using the EPRI CHF correlation is 5.45 which is compared to the 1.15 correlation limit. The minimum DNBR determined using the Modified Barnett CH F correlation is greater than 6.00 which is compared to the 1.135 correlation limit and the 1.305 Duke design limit.

For a double MSLB, the RCS depressurization and shrinkage causes a reactor vessel (RV) head void that expands into the hot legs. This interrupts RCS loop flow to the steam generators, and limits the cooldown of the core. While hot leg flow is interrupted, recirculating liquid flow through the RV internal vent valves ensures the core remains cooled. When primary loop flow stagnates, heat transfer to the SGs is interrupted. RCS pressure increases as the liquid in the reactor vessel absorbs the core decay heat and expands, raising the liquid level in the hot legs until a spillover event occurs. Each spillover transfers hot liquid into the SG tubes and returns cool fluid from the bottom of the SG to the cold legs. Spillovers cause the liquid circulating in the RV to cool, and results in a decrease in RCS pressure. As RCS pressure decreases below 600 psig, the two core flood tanks inject additional borated inventory into the RCS. The core remains covered throughout the overcooling transient. While a brief recriticality is indicated by the RELAP5 point kinetics model, the resulting fission power obtained is not significant (less than one Watt). The overcooling continues until shortly after the turbine driven EFW pump stops feeding the SGs.

After the overcooling has terminated, the RCS begins to slowly reheat and swell, and pressurizer level returns on scale. The SSF powered pressurizer heaters are manually energized when level in the pressurizer exceeds 90 inches. SSF ASW flow is established to the SGs to stabilize pressurizer level in order to limit the volume of water in the pressurizer that must be heated to saturated conditions. Saturated conditions are established in the pressurizer approximately three hours into the event at which point the steam bubble in the pressurizer begins to increase RCS pressure. Pressurizer heaters are then cycled to maintain RCS pressure stable. Stable subcooled natural circulation conditions are also achieved approximately three hours into the event.

The overcooling T-H analyses will be used to inform operator guidance for the SSF. The analysis assumes operators initially control SSF ASW flow to stabilize pressurizer level, which effectively precludes the pressurizer from developing into a water solid condition. SSF ASW flow is controlled by the operator to prevent the RCS from re-heating and pressurizing to the nominal hot zero power set of conditions maintained in the overheating analysis. By controlling SSF ASW to stabilize either RCS pressure or pressurizer level, the operator manages the liquid insurge to the pressurizer and allows the pressurizer liquid to become saturated. A minor RCS temperature reduction is required to accommodate the continued RC makeup flow rate.

This goal of the operator guidance assumed in the analysis is to stabilize the plant to between 325°F - 350°F and 650 psig - 700 psig. Operationally, there are several advantages to this set of conditions.

The RCS would be in natural circulation with a subcooled margin consistent with the normal natural circulation guidance (150°F indicated subcooling).

4

License Amendment Request No. 2018-02.

SSF ASW would be controlled to maintain a constant cold leg temperature with pressurizer heaters and SSF letdown available to control RCS pressure.

Below 350°F, RCP seal integrity would not be readily challenged should seal injection flow be interrupted.

Remaining above 600 psi allows time to isolate the CFTs and prevent nitrogen injection.

Should the pressurizer become water solid at these conditions, there is a significant amount of margin to lifting the pressurizer code safety valves.

The compressive tube stress analytical limit is defined by the RCS at 550°F and the SG shell at 212°F. The cooldown to below 350°F will provide margin to prevent tube deformation.

During the cooldown, sufficient boron is added to ensure the core remains subcritical down to 200°F without credit for Xenon.

Successful mitigation of a tornado condition at Oconee shall be defined as ensuring that the integrity of the fuel and Reactor Coolant System (RCS) remains unchallenged. For the overcooling analysis the fuel integrity is demonstrated by the DNBR analysis described above.

RCS integrity is demonstrated by determining the limiting SG tube compressive and tensile stresses remain with design limits, and that the RCS pressure and temperature remains* within the acceptable cooldown limits duririg the event. The time dependent SG tube and SG shell temperatures are determined using a linear average to determine if the temperature differences remain within the SG design limits. The results indicate the SG tube stress remains well within the established limits for the duration of the event. The cooldown performed through operator control of SSF ASW to below 350°F will provide margin to prevent tube deformation.

RCS pressure and temperature are plotted versus each other to examine the time dependent response. These results indicate significant margin is maintained to the acceptable cooldown limits during the event.

This analysis demonstrates that a single or double MSLB can be mitigated using SSF equipment. In summary, the overcooling analysis demonstrates that for either a single or double MSLB tornado scenario, the following acceptance criteria are satisfied:

The core remains intact and in a coolable geometry, Minimum DNBR meets specified acceptable fuel design limits, The steam generator tubes remain intact, RCS pressure does not exceed 2750 psig, and RCS remains within acceptable pressure and temperature limits.

5.0 References

1.

Duke Energy Methodology Report DPC-NE-3003-PA, Oconee Nuclear Station, Mass and Energy Release and Containment Response Methodology, Revision 1. (Safety Evaluations dated March 15, 1995; September 24, 2003)

2.

Duke Energy Methodology Report DPC-NE-3000-PA, Oconee Nuclear Station, McGuire Nuclear Station, Catawba Nuclear Station, Thermal-Hydraulic Transient Analysis Methodology, Revision 5. (Safety Evaluations for Oconee Nuclear Station dated August 8, 1994 (Accession Number ML16293A840); October 14, 1998 (Accession Number 9810190223); September 24, 2003 (Accession Number ML032670816); October 29, 2008 (Accession Number ML082800408); and July 21, 2011 (Accession Number ML11137A150)).

3.

Oconee Nuclear Design Methodology Using CASM0-4 / SIMULATE-3, DPC-NE-1006-PA, Duke Energy, SE dated August 2, 2011.

5

License Amendment Request No. 2018-02.

4.

Duke Energy Methodology Report DPC-NE-3005-PA, Oconee Nuclear Station, UFSAR Chapter 15 Transient Analysis Methodology, Revision 5. (Safety Evaluations dated October 1, 1998; May 25, 1999; September 24, 2003; October 29, 2008; July 21, 2011; and April 29, 2016).

5.

ONS Reload Design Methodology, NFS-1001-A, Duke Energy, SE dated July 21, 2011.

6