ML12194A218

Response to NRC Request for Additional Information on Proposed Technical Specifications (TS) and Bases Amendment TS and Bases 3.7.8, Nuclear Service Water System (Nsws)

ML12194A218
Person / Time
Site:	Catawba
Issue date:	07/09/2012
From:	Glover R Duke Energy Carolinas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
TAC ME7659, TAC ME7660
Download: ML12194A218 (72)

Text

Duke DUKE CatawbaENERGY CAROLINAS, Nuclear Station LLC Lc Energy 4800 Concord Road York, SC 29745 Carolinas July 9, 2012 10 CFR 50.90 U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, D.C. 20555

Subject:

Duke Energy Carolinas, LLC (Duke Energy)

Catawba Nuclear Station, Units 1 and 2 Docket Numbers 50-413 and 50-414 Proposed Technical Specifications (TS) and Bases Amendment TS and Bases 3.7.8, Nuclear Service Water System (NSWS)

Response to NRC Request for Additional Information (RAI)

(TAC Nos. ME7659 and ME7660)

References:

1. Letter from Duke Energy to the NRC, same subject, dated November 22, 2011.

2. Letter from the NRC to Duke Energy, "Request for Additional Information (RAI) Regarding License Amendment Related to Request to Revise Technical Specification (TS) 3.7.8, Nuclear Service Water System (NSWS)", dated May 11, 2012.

In Reference 1, Duke Energy requested amendments to the Catawba Facility Operating Licenses and TS to modify the subject TS and Bases to allow single discharge header operation of the NSWS (Duke Energy designation "RN") for a time period of 14 days.

The requested change will facilitate future maintenance of the Unit 2 NSWS discharge headers in the Auxiliary Building. In Reference 2, the NRC transmitted RAls associated with this amendment request. The purpose of this letter is to provide responses to these RAIs. The attachment to this letter provides the responses. The format of each response is to restate the RAI question, followed by the associated response.

The original regulatory evaluation contained in Reference 1 is unaffected as a result of this RAI response supplement. As discussed in a telephone conference call between Duke Energy and the NRC on May 3, 2012, there is one regulatory commitment associated with this RAI response supplement. This commitment is discussed on page 49 of the attachment.

Pursuant to 10 CFR 50.91, a copy of this RAI response supplement is being sent to the appropriate State of South Carolina official.

www.duke-energy comr

U.S. Nuclear Regulatory Commission Page 2 July 9, 2012 Inquiries on this matter should be directed to L.J. Rudy at (803) 701-3084.

Very truly yours, R. Michael Glover Interim Site Station Manager LJR/s Attachment

U.S. Nuclear Regulatory Commission Page 3 July 9, 2012 R. Michael Glover affirms that he is the person who subscribed his name to the foregoing statement, and that all the matters and facts set forth herein are true and correct to the best of his knowledge.

R, Michael Glover, Interim Site Station Manager Subscribed and sworn to me: 7'-79-"L ("Z-t Date Notary Pv My commission expires: 21 " 2.--2..--

Date SEAL

U.S. Nuclear Regulatory Commission Page 4 July 9, 2012 xc (with attachment):

V.M. McCree Regional Administrator U.S. Nuclear Regulatory Commission - Region II Marquis One Tower 245 Peachtree Center Ave., NE Suite 1200 Atlanta, GA 30303-1257 G.A. Hutto, III Senior Resident Inspector (Catawba)

U.S. Nuclear Regulatory Commission Catawba Nuclear Station J.H. Thompson (addressee only)

NRC Project Manager (Catawba)

U.S. Nuclear Regulatory Commission One White Flint North, Mail Stop 8-G9A 11555 Rockville Pike Rockville, MD 20852-2738 S.E. Jenkins Manager Radioactive & Infectious Waste Management Division of Waste Management South Carolina Department of Health and Environmental Control 2600 Bull St.

Columbia, SC 29201

ATTACHMENT RESPONSE TO NRC REQUEST FOR ADDITIONAL INFORMATION (RAI)

REQUEST FOR ADDITIONAL INFORMATION (RAI)

BY THE OFFICE OF NUCLEAR REACTOR REGULATION REGARDING LICENSE AMENDMENT RELATED TO REVISION OF THE TECHNICAL SPECIFICATION (TS) 3.7.8 TO ALLOW SINGLE DISCHARGE HEADER OPERATION OF THE NUCLEAR SERVICE WATER SYSTEM (NSWS) FOR A TIME PERIOD OF 14 DAYS CATAWBA NUCLEAR STATION, UNITS 1 AND 2 (CATAWBA 1 AND 2)

DOCKET NOS. 50-413 AND 50-414 By letter dated November 22, 2011, (Agencywide Document Access and Management System Accession No. ML11327A149), Duke Energy Carolinas, LLC (Duke Energy or the licensee), submitted a proposed license amendment request (LAR) in the form of changes to the Technical Specifications (TSs) for Catawba 1 and 2. The proposed LAR would revise TS 3.7.8 to allow single discharge header operation of the NSWS [Nuclear Service Water System] (Duke Energy designation "RN") for a time period of 14 days.

To complete its review, the U.S. Nuclear Regulatory Commission (NRC) staff requests the following additional information:

1. According to the LAR, the licensee concludes that "the NSWS single discharge header alignment supports operation in this configuration ... [and] the increase in risk ... is minimal and acceptable." Provide the quantitative results that are being compared against the Regulatory Guide (RG) 1.177 and RG 1.174 acceptance guidelines.

Duke Energy Response:

RG 1.177 Acceptance The baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) for the Catawba PRA model used in the supporting analysis are 1.83E-05/yr and 1.27E-06/yr, respectively. When the NSWS is placed in the operating configuration to support single discharge header operation, the CDF and LERF increase to 2.05E-05/yr and 1.36E-06/yr, respectively. The increase in risk is attributed to the change in the loss of NSWS frequency when the system is in the single discharge header alignment.

A CDF = (2.05E-05/yr - 1.83E-05/yr) = 2.20E-06/yr A LERF = (1.36E-061yr - 1.27E-06/yr) = 9.OOE-08/yr Assuming a capacity factor of 0.9, Attachment Page 1

Incremental Conditional Core Damage Frequency (ICCDF) = 2.20E-06 / 0.9 =

2.44E-06/rx-yr (or 6.69E-09/day)

Incremental Conditional Large Early Release Frequency (ICLERF) = 9.OOE-08 / 0.9 = 1.OOE-07/rx-yr (or 2.74E-1 0/day)

Therefore, for each 14-day TS Condition duration, Incremental Conditional Core Damage Probability (ICCDP) = (6.69E-09/day)

(14 days) = 9.37E-08 Incremental Conditional Large Early Release Probability (ICLERP) = (2.74E-10/day) (14 days) = 3.84E-09 It is anticipated that Catawba will enter this TS Condition for the full 14 days twice (once per train) initially and then in subsequent refueling cycles enter the TS Condition on a decreasing duration and frequency. Therefore, assuming a maximum of two full entries per year, the ICCDP and ICLERP are:

ICCDP = (9.37E-08) x 2 = 1.87E-07 ICLERP = (3.84E-09) x 2 = 7.68E-09 Thus, the guidelines for RG 1.177 of IE-06 (ICCDP) and 1E-07 (ICLERP) are met for this configuration.

RG 1.174 Acceptance First, converting the baseline CDF and LERF to reactor years, CDF =[ 1.83E-05 / 0.9 = 2.03E-05/rx-yr LERF = 1.27E-06 / 0.9 = 1.41 E-06/rx-yr And the corresponding CDF and LERF when entering the TS Condition are, CDF = 2.05E-05 / 0.9 = 2.28E-05/rx-yr LERF = 1.36E-06 /,0.9 = 1.51 E-06/rx-yr Calculating the new CDF and LERF with added unavailability from entering the TS Condition a maximum of twice in one reactor year, CDFnew = [2.03E-05/rx-yr x (337 / 365)] + [2.28E-05/rx-yr x (28 / 365)]

= 2.05E-05/rx-yr LERFnew = [1.41 E-06/rx-yr x (337 / 365)] + [1.51 E-06/rx-yr x (28 / 365)]

Attachment Page 2

= 1.42E-O6/rx-yr Therefore, the CDF and LERF would be expected to increase by a maximum of, A CDF = 2.05E 2.03E-05 = 2.OOE-07/rx-yr A LERF = 1.42E 1.41E-06 = 1.OOE-08/rx-yr Thus, the guidelines for RG 1.174 of IE-06 (A CDF) and 1E-07 (A LERF) are met for this configuration.

2. RG 1.200 states "A peer review is needed to determine if the intent of the requirements in the standard is met." The standard referred to is the American Society of Mechanical Engineers (ASME) and American Nuclear Society (ANS) probabilistic risk assessment (PRA) standard that provides both process and technical requirements for an at-power Level 1 and limited Level 2 PRA for internal events, internal flood, internal fire, seismic, wind, external flood and other external events. RG 1.200 also states that "The results of the peer review and/or self-assessment, and a description of the resolution of all the peer review or self-assessment findings and observations are included."

a) The submittal does not address an independent peer review according to the ASME/ANS PRA Standard, for any of the hazard groups, including internal events. The NRC staff expects applications to have had PRA peer reviews of all potentially significant hazard groups for an application.

Please indicate what were the findings and observations of these reviews and how they were dispositioned for this application.

Duke Energy Response:

a) In March 2002, the Catawba PRA initially received an internal events full scope peer review by an industry team of knowledgeable PRA practitioners. A detailed list addressing the findings and observations of the peer review is provided in the response to Part c) of this question.

Since the performance of this peer review, the industry has utilized the American Society of Mechanical Engineers (ASME) process to develop a standard identifying the requirements associated with PRA. RG 1.200 endorses the ASME PRA Standard as an acceptable method for demonstrating the technical adequacy of a PRA, provided various clarifications are made as identified in the regulatory guide.

Subsequently in 2008, Duke Energy conducted a self-assessment of the Catawba internal events PRA in accordance with NEI-00-02 against the ASME PRA Standard through addenda RA-Sc-2007.

Duke Energy has updated this assessment against the 2009 Attachment Page 3

Standard. The Catawba PRA self-assessment included the Risk Assessment Technical Requirements listed in Part 2 of the 2009 ASME PRA Standard. This self-assessment evaluated the PRA with respect to Capability Category (CC) II. For those requirements of the standard that have not been met, a justification of why it is acceptable that the requirement has not been met was created. A summary of these outstanding items was provided to the NRC by Duke Energy in its November 22, 2011 LAR submittal.

Regarding external hazards, the key is to determine whether these hazards can be considered as "potentially significant hazard groups" for the LAR configuration of concern. Duke Energy has reviewed the impacts from seismic events, fires, floods, and tornado/high wind events and has determined that the contribution of these risks for the requested Completion Time of 14 days is acceptable. The details of these analyses are provided in the responses to Questions 3 through 6 below and demonstrate that these hazards are not potentially significant.

b) The licensee states that the "[self] assessment indicated that 231 of the 306 Supporting Requirements (SRs) for Rev. 1 were fully met [but] 24 of the SRs were not applicable to Catawba [1 and 2] at all". However, only 10 SRs were actually considered to have an impact on the PRA model and were addressed in the submittal. Please provide a detailed list addressing all SRs that were not met in the self assessment.

Duke Energy Response:

b) As stated in the submittal, Duke Energy reviewed 306 Supporting Requirements (SRs) for Rev. 1. Of these, 231 were fully met. For the remaining 75 SRs, 24 were not applicable to Catawba at all, either because the referenced techniques were not used in the PRA or because the SR was not required for CC II. For the remaining SRs, 41 required enhanced documentation but none were expected to have a significant impact on the PRA results or insights. The remaining 10 items were of a technical nature and were dispositioned in the November 22, 2011 LAR submittal. Each of the items was either found to be addressed for the requested application or was not expected to have any significant impact on the application.

A detailed list addressing all applicable SRs that were not met in the updated self-assessment is provided below. SRs listed in ()refer to the 2007 Standard nomenclature.

Attachment Page 4

Title Description of Gap Applicable Current Expected Impact on SRs Status/Comment Application Phenomenological effects are already Accident sequence notebooks Open. considered in the and system model notebooks Phenomenological model. No technical should document the effects are considered issues were Gap #1 phenomenological conditions AS-B3 in the model, although identified for this pheatenomenooicacoendti these considerations item. This is a created by the accident sequence progression. are not always documentation documented. only and there isissue no impact on this application.

The industry documents used to generate the Open. SSC and Catawba PRA unavailability database (such as NUREG/CR-6928) boundaries, SSC failure define the Revise the data calculation to modes and success compnent Gap #2 discuss component DA-Al criteria are used boundaries. No boundaries definitions. (DA-Ala) consistently across technical issues analyses; however, werinifiedufo too bewere theseneed these need bethsgpTissa identified for formally documented. this gap. This is a documentation issue only and there is no impact on this application.

Open. Partitioning the This is a refinement failure rates represents to the equipment a refinement to the data failure rates.

Revise the data calculation to analysis process. However, since most group standby and operating Previously, generic data components are Gap #3 component data. Group DA-B1 sources often did not grouped components by service provide standby and appropriately, the condition to the extent operating failure rates. overall impact will be supported by the data. NUREG/CR-6928 does small and is not provide more of this expected to have a data, and will be used significant impact on going forward. this application.

Open. As part of the Bayesian update process, checks are Enhance the documentation to performed to assure None. No technical Enhane thedcumentaion toe that the posterior issues were inluea icusono tedistribution is identified for this Gap #4 specific checks performed on DA-D4 reason iv the gap Ti is theBaesan-pdte daaasreasonable given the gap. This is a required by this SR. prior distribution and documentation issue plant experience, only.

These checks need to be formally documented.

Attachment Page 5

Title Description of Gap Applicable Current Expected Impact on SRs Status/Comment Application Open. Generic CCF probabilities are considered for Provide documentation of the applicability to the None. No technical comparison of the component plant. CCF probabilities issues were boundaries assumed for the are consistent with issues were Gap #5 generic CCF estimates to DA-D6 plant experience and iefe fhis those assumed in the PRA to component boundaries, gap. This is a issue documentation ensure that these boundaries although the CCF only.

are consistent. documentation needs to be enhanced to discuss component boundaries.

Open. Based on evaluations using the EPRI HRA calculator, calibration errors that result in failure of a single channel are Recent modeling expected to fall in the updates for Oconee 10-3 range. Relative to support the position Gap #6 the potential for calibration HR-A2 post-initiator HEPs, that calibration errorst equipment random errors are not failure rates and expected to have a maintenance significant impact on unavailability, this application.

calibration HEPs are not expected to contribute significantly to overall equipment unavailability.

Attachment Page 6

Title Description of Gap Applicable Current Expected Impact on SRs Status/Comment Application Open. Based on evaluations using the EPRI HRA calculator, calibration errors that result in failure of multiple channels are expected to fall in the This gap is not 10"5 (or smaller) range. expected to Identify maintenance and Relative to post-initiator significantly impact calibration activities that could HEPs, latent human the base case PRA simultaneously affect error probabilities, model and should Gap #7 equipment in either different HR-A3 equipment random have even less trains of a redundant system failure rates and impact on this oradiverse ofae ts. e maintenance application, which or diverse systems. unavailability, involves a single calibration HEPs and discharge header misalignment of alignment.

multiple trains of equipment are not expected to contribute significantly to overall equipment unavailability.

Open. Pre-initiator Mean values for HEPs are generally set HEPs were used in to relatively high the supporting Gap #8 Develop mean values for pre- HR-D6 screening values, which analysis; therefore, initiator HEPs. bound the measvalue mean values.hee initiatr HE~s boundShe Even so, pre-initiator addressed for this HEPs are not significant addresediorh contributors to risk. application.

Attachment Page 7

Applicable Current Expected Impact on Title Description of Gap SRs Status/Comment Application The current Catawba model of record used the HRA methodology developed by SAROS. Beginning, with the 2011 Oconee PRA update, Duke Energy now Open. Performance uses the HRA shaping factors are calculator method.

accounted for in the Document in more detail the Based upon the development of human influence of performance Oconee update Gap #9 HR-G3 error probabilities, shaping factors on execution results using HRA although detailed human error probabilities. calculator, the documentation is not current Catawba always available for HRA results using every HRA input.

SAROS are considered to be conservative and therefore bounding.

Thus, this gap is considered to be a documentation issue only with no impact

- I I on this application.

Open. T/H analyses, simulator runs, and operator interviews are used in developing the time available to complete operator Enhance HRA documentation actions. The time at which the cue to take See the response to Gap #10 of the time available to HR-G4 action is received is Gap #9.

complete actions.

specified in the HEP quantification.

However, the HRA documentation needs to be enhanced to provide a traceable path to all analysis inputs.

Document a review of the Open. HFEs are HFEs and their final HEPs reviewed by relative to each other to knowledgeable site Gap #11 confirm their reasonableness HR-G6 personnel to assure given the scenario context, high quality. However, Gap #9.

plant history, procedures, this review needs to be operational practices, and better documented.

experience. betterdocumented.

Attachment Page 8

Title Description of Gap Applicable Current Expected Impact on SRs Status/Comment Application Mean values for Open. The use of mean HEPs were used in Develop mean values for post- HR-G8 values for HEPs instead the supporting Gap #12 initiator HEPs. (HR-G9) of lower probability analysis; therefore, median values can this issue has been affect the PRA results. addressed for this application.

Open. Operator recovery actions are credited only if they are Develop more detailed feasible, as determined documentation of operator by the procedural cues, relevant performance guidance, cues, Gap #13 shaping factors, and HR-H2 performance shaping See the response to availability of sufficient factors, and available Gap #9.

manpower to perform the manpower. As noted actionn for HR-G3, G4, and G6 above, the documentation of these considerations needs to be enhanced.

Attachment Page 9

Title TIt Description of Gap Applicable Current Expected Impact on DecitonoIa SRs Status/Comment Application Document:

• a structured, systematic identification of initiating events

" a review of generic Open. No technical analyses of similar plants issues are identified, No impact to this

• the systematic evaluation just a need to enhance application. This is a of the potential for failure the documentation. documentation issue of each system, including The list of Catawba PRA only. No technical support systems, to result initiating events is issues were in an initiating event IE-A1 consistent with that of identified for this

• the inclusion of initiators its sister plant, McGuire gap.

resulting from common IE-A4 Nuclear Station, as well cause equipment failures (IE-A3a) as with those found in As a matter of and from routine system analyses for similar comparison, the alignments IE-A5 plants, such as those initiator assessment

• the disposition of events (IE-A4) contained in the calculation recently that have occurred at Pressurized Water performed for the conditions other than at- IE-A6 Reactor Owner's Group Oconee PRA and the power operation for their (IE-A4a) PSA Model and Results McGuire PRA potential to result in an Comparison Database. updates included initiator while at power IE-A7 The Catawba initiating detailed

• plant personnel input in (IE-A5) events analysis is documentation of the Gap #14 determining whether revised with each PRA initiator selection potential initiating events IE-A8 update to ensure that it process. The analyst have been overlooked (IE-A6) remains consistent with noted no significant

" a review of plant-specific industry operating issues between the precursor events for their IE-A9 experience as well as updates and their potential to result in (IE-A7) current plant design, previous versions.

initiating events operation and Given that the

• a structured, systematic IE-B1 experience. In addition, initiator analysis for initiating events grouping calculation CNC- the current Catawba process that facilitates IE-B2 1535.00-00-0114, PRA model of record accident sequence PotentialInternal was performed using definition and IE-B3 InitiatingEvents for the the same personnel, quantification Catawba PRA, has been methods, and

• that initiators are grouped IE-D3 performed to address procedures, the by similarity of plant the IE supporting analyses are response, success criteria, requirements. consistent and this timing, and effect on However, this analysis gap is a operators and relevant needs to be documentation issue systems; or events can be incorporated into the only.

subsumed within a base case PRA model.

bounding group

" the initiating events analysis assumptions and sources of uncertainty Attachment Page 10

Title Description of Gap Applicable Current Expected Impact on SRs Status/Comment Application This item is relevant Various enhancements to the to applications that internal flood analysis: include internal flood

" Identify the release initiators. The lone significant internal characteristic and capacity signifing entfond associated with each flood IFSO-A5 flooding event found source. (IF-B33) in the cut sets Discuss flood mitigative generated for this features. IFSN-A5 Open. An update of the application involves feAddress the potential for (IF-C2c) flood analysis to meet the Auxiliary the Standard's Shutdown Panel.

spray, jet impingement, and IFSN-A6 requirements is planned However, this event

" Provide more analysis of (IF-C3) for 2011. For McGuire, does not dominate Gap #15 Catawba's sister plant, the results (see flood propagation IFSN-A8 the internal flooding section below flowpaths. Address potential structural failure (IF-C3b) analysis has already entitled of doors or walls due to been upgraded to meet 'Internal/External ofldoon loralls ndu to IFQU-A9 the Standard's Floods PRA' which flooding loads and the (IF-E6b) requirements. confirms no potential for barrier sgiiatipc unavalabiity.significant impact unavailability. n/a from internal Address potential indirect (IF-F2) flooding events).

effects. Teeoe hsie

" Enhance the documentation Therefore, this item to address all of the SR is not expected to details, have a significant impact on this application.

Open. This issue Small LOCAs Explicitly model RCS affects certain small contribute less than depressurization for small LOCAs. However, since 2% to LERF for the Gap #16 LOCAs and perform the LE-C7 the small LOCA LAR configuration.

dependency analysis on the (LE-C6) contribution to LERF is Therefore, this item HEPs. small, there is no does not have a significant impact on significant impact on the PRA results. this application.

No impact to this LE-G3 application. This is a Various enhancements to the documentation issue Gap #17 LERF documentation. LE-G5 Open. only. No technical issues were LE-G6 identified for this gap.

Attachment Page 11

Title Description of Gap Applicable Current Expected Impact on SRs Status/Comment Application Open. Since Catawba and McGuire are sister plants, in practice, their results are often Perform and document a compared. Also, comparison of PRA results comparisons performed with similar plants and identify for the Mitigating No impact to this causes for significant LE-F3 Systems Performance application. This is a causenes. frIgentifinthe EIndex and other documentation issue Gap#18differences. Identify the Gap #18 contributors to LERF and QU-D4 programs help identify only. No technical characterize the LERF (QU-D3) causes for significant issues were uncertaintiesuncrtiniescositen consistent withwthto differences. However, fully meet this SR, identified for this gap.

the applicable ASME Standard the mel the model requirements.

quantification documentation needs to be enhanced to provide a results comparison.

Perform and document nla No impact to this sensitivity analyses to (LE-F2) Open. This is application. This is a determine the impact of the addressed with each only. No technical assumptions and sources of LE-G4 Surveillance Test issues were model uncertainty on the Interval assessment. isues were results. QU-E4 identified for this gap.

No impact to this Open. These SRs application. This is a Expand the documentation of QU-F2 pertain to the model documentation issue Gap #20 the PRA model results to quantification only. No technical address all required items. QU-F6 documentation. issues were identified for this gap.

Open. Success criteria are developed to No impact to this address all of the application. This is a Improve the documentation on modeled initiating documentation issue Gap #21 the T/H bases for all safety SC-A3 events. However, the only. No technical function success criteria for (SC-A4) documentation of issues were all initiators. success criteria needs issues were to be improved to i f ot include initiator gap.

information.

Attachment Page 12

Title Description of Gap Applicable Current Expected Impact on SRs Status/Comment Application Open. Catawba success criteria are consistent with those of No impact to this sister plants included in application. This is a Provide evidence that an the PWROG PSA documentation issue Gap #22 acceptability review of the T/H SC-B5 database. However, to only. No technical analyses is performed. fully meet success this SR, the criteria succes issues were crieriaidentified for this documentation needs gap.

to be enhanced to include a results comparison.

No impact to this Expand the documentation of application. This is a Expadthe s scumeriat o SC-Cl Open. These SRs documentation issue Gap #23 the success criteria pertain to the success only. No technical development to address all SC-C2 criteria documentation. issues were required items. identified for this gap.

Open. To support system model development, No impact to this Enhance the system walkdowns and plant application. This is a documentation to include an personnel interviews documentation issue Gap #24 up-to-date system walkdown SY-A4 were performed. only. No technical checklist and system engineer However, issues were review for each system. documentation of an identified for this up-to-date system gap.

walkdown is not gap.

included with each system notebook.

Attachment Page 13

Title Description of Gap Applicable Current Expected Impact on SRs Status/Comment Application Open. Basic event component boundaries utilized in the systems analysis are consistent with those in the data analysis. In addition, component boundaries are consistent with those defined in the generic failure rate No impact to this source such asdocuments, NUREG/CR- application. This is a Enhance the systems analysis documentation issue Gap #25 documentation to discuss SY-A8 6928. Dependencies only. No technical component boundaries, among components, issues were such as interlocks, are explicitly modeled, i f ot consistent with the gap.

Duke PRA Modeling Guidelines workplace procedure (XSAA-115).

There is no evidence of a technical problem with component boundaries, just a need to improve the documentation.

Attachment Page 14

Title Description of Gap Applicable Current Expected Impact on T SRs Status/Comment Application Open. There is no evidence of a technical problem associated with the screening of components or component failure modes, just a need to document a quantitative screening. It is expected that conversion to a more quantitative approach would not change decisions about whether or not to exclude components or failure modes. A review of our qualitative screening process No impact to this confirms this application. This is a expectation. For documentation issue Gap #26 Provide quantitative SY-A15 example, transfer failure only. No technical evaluations for screening. (SY-A1 4) events for motor- issues were operated valves (MOVs) identified for this with 24-hr exposure gap.

times may not be modeled unless probabilistically significant with respect to logically equivalent basic events. For Catawba, the MOV transfers failure probability is less than 1% of the MOV fails to open on demand failure rate. In cases like this, not including the relatively low probability failure mode in the PRA model does not have an appreciable impact on the results.

Attachment Page 15

Title Description of Gap Applicable Current Expected Impact on SRs Status/Comment Application Per Duke's PRA modeling guidelines (XSAA-115), ensure that a walkdown/system Open. As noted for SY-engineer interview checklist is A4, walkdowns (which included in each system look for spatial and notebook. Based on the environmental hazards)

Gap #27 results of the system have been performed, See response to Gap walkdown, summarize in the SYB8 although up-to-date #24.

system write-up any possible walkdown spatial dependencies or documentation is not environmental hazards that included with each may impact multiple systems system notebook.

or redundant components in the same system.

Open. The impact of adverse environmental conditions on SSC reliability is considered but is not always No impact to this documented. However, Nopimatto This Document a consideration of there is no evidence of application.

documentation This is a issue Gap #28 potential SSC failures due to SY-B14 a technical problem only. No technical adverse environmental (SY-B15) associated with issues were conditions. components that may identified for this be required to operate in conditions beyond gap.

their environmental qualification, just a need to improve the documentation.

No impact to this Enhance system model application. This is a documentation to comply with Open. This SR pertains documentation issue Gap #29 all ASME PRA Standard SY-C2 to the systems analysis only. No technical requirementst documentation. issues were identified for this gap.

Attachment Page 16

C) In this risk-informed submittal, the licensee makes use of a self assessment that should only be used if it builds off of an independent full scope peer review. To use this self assessment, the license would need to describe and provide the results of (and disposition of) any findings from the full scope peer review. Furthermore, if there has been a PRA upgrade (as defined in the NRC-endorsed ASME/ANS-RA-Sa-2009) since the latest full scope peer review, a focused scope peer review of the upgraded areas would be needed. Please provide information regarding any full-scope independent peer review findings and dispositions relevant to this LAR. Also, if there have been any upgrades to the PRA since the last full scope independent peer review, please describe the upgrades and provide information on the associated focused scope peer review, including findings and dispositions relevant to this LAR.

Duke Energy Response:

c) As described in the response to part a) above, the Catawba PRA initially received an internal events full scope peer review by an industry team of knowledgeable PRA practitioners in March 2002.

Based on the PRA peer review report, the Catawba PRA received no Fact and Observations (F&O) with the significance level of "A" and 32 F&O with the significance level of "B". The "B" findings were reviewed and prioritized for incorporation into the PRA. Their current status is summarized on the following pages.

In 2005, the Catawba PRA was updated and included an upgrade to the LERF model. A focused-scoped peer review was not performed for this LERF model; however, for this application, LERF is not a significant contributor (- 1E-08) to risk.

Attachment Page 17

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team Status Although [procedure] states that a review of plant systems was performed to search for support initiators, documentation of the review was not located. Each system notebook includes a section indicating whether or not it was determined that loss of that system leads to an initiating event.

However, there was no discussion in [procedure] or the system IE-3 notebooks to indicate that the process followed was sufficiently CLOSED structured to capture potential initiators across various system alignments and support system alignments, and to consider initiating event precursors.

Document the disposition of consideration of loss of each support system, and loss of other systems when in alternate alignments, if appropriate, as a potential initiating event.

The initiating event frequency for a stuck open PORV or safety valve is taken from NUREG/CR-5750 but is conservative for the following reasons. The NUREG assigned a value to these events based on a non-informative prior updated with 0 events and the total number of critical reactor years in the study.

IE-4 In the case of a spurious opening of a primary safety valve, the model CLOSED should address the potential for the valve to close as the pressure decreased, effectively terminating the loss of coolant. The evaluation of the subsequent reclosure of the PORV is not as straightforward.

The cause of the opening PORV would need to be addressed.

However, either the PORV could be closed or the block valve could be closed.

Attachment Page 18

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team Status The Loss of HVAC initiator was removed, because operators may shut down the plant from remote locations (the Auxiliary Shutdown Panel and the SSF) if the Control Room is incapable of maintaining inventory control. This is an inadequate reason to omit an IE. If loss OPEN of HVAC causes a plant trip and requires SSD from the ASP, that sequence should be identified and modeled. Note that the switchgear Loss of HVAC is not expected to be a significant contributor to core IE-6 room may also be affected by failed HVAC. A particular example is damage. However, since documentation providing justification for this the possibility that the switchgear chiller is working, in which case the position cannot be located, it needs to be redeveloped. This is therefore operators may not diagnose the situation in time. considered to be a documentation issue with no direct impact on this application.

Perform and document additional evaluation of the impact of loss of switchgear room HVAC and, if appropriate, develop a new event tree to analyze loss of switchgear room cooling.

The estimation of the frequency of the loss service water (RN) is incorrect in the application of common cause factors. A "mission time" of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is used to describe the failure of all four pumps in the calculation of a yearly frequency. The equation used is basically:

Lambda*72 hours

• Beta

• Gamma

• Delta. OPEN Note that Lambda*72 hours is the frequency of a pump failing to run for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The CCF factors are dimensionless and represent the The Catawba analysis uses an exposure time based on an estimated IE-8 failure of the other three pumps. mean time to repair. While other approaches are possible, there is not currently a consensus among the industry on recommended exposure The equation above calculates the frequency times for common-cause failure events associated with initiators.

period. The "mission time" must be consistent with the frequency being calculated. That is, one would expect the frequency for an 18 month period (a refueling cycle) to be 1.5 times the frequency for a year. The current equation would provide the same frequency for a year, a refueling cycle, or the life of the plant. Ignoring a plant availability factor, the annual frequency is given by:

Attachment Page 19

Status Team by Peer Review and Recommendations Summary! of Catawba WOG Peer Review "B" Fact and Observations F&O Observations F&O Observations and Recommendations by Peer Review Team I Status Lambda*8760 hours

• Beta

• Gamma

• Delta.

Given the set of MGL parameters, the current equation underestimates the frequency by a factor of 365/3 - 122.

One upper bound is provided by NUREG/CR-5750, which estimates the frequency at about 1E-3 per critical operating year. This value is based on individual unit critical years, and may not be appropriate for cases where the failure is a station failure, not a single unit failure. An alternative approach is to develop, via NUREG/CR-4780 techniques, more realistic MGL parameters that deal with loss of a system as an initiating event not as a design basis function.

Note the discussion does not question the MGL parameters. The point being made is the use of the parameters in calculating the frequency.

One upper bound is provided by NUREG/CR-5750, which estimates the frequency at about 1E-3 per critical operating year. This value is based on individual unit critical years, and may not be appropriate for cases where the failure is a station failure, not a single unit failure. An alternative approach is to develop, via NUREG/CR-4780 techniques, more realistic MGL parameters that deal with loss of a system as an initiating event not as a design basis function.

[Duke calc.] SAAG 427 describes the ATWS event tree analysis.

Section 4, event B, describes how main feedwater is recovered after an ATWS. The probabilities used for main feedwater recovery are .05, AS-1 following a T2 (Loss of Load) and .2 following a T4 (Loss of MFW). CLOSED In the non-ATWS analysis, the following non-recoveries (From SAAG 427) are:

T1 non-rec = .05 T4 - non-rec .1 Attachment Page 20

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team Status Considering that the critical time for FW to come on line in an ATWS event involving a loss of main feedwater is very short, even for conditions of favorable MTC, the use of non-recovery probabilities of this magnitude does not appear to be justified without supporting analyses.

Remove recovery for MFW in ATWS events initiated by a loss of feedwater.

There were several observations on the modeling of event D3 in the SGTR tree:

Event D3 is generally defined as the event to cooldown to RHR conditions using 2/3 SG for depressurization. D3 includes the HEP YAGRCOLDHE, which is directed by [procedures].

1. D3 is defined as "primary system cooldown via secondary system depressurization". Primary system depressurization must be accomplished in some sequences (YDlD2D3, YOD3, YUOD3), by either PORV, aux spray, or main spray. These functions are not AS-4 included in D3. CLOSED

2. Sequence YUOD3 needs a T/H justification that D3 can actually prevent core damage in this circumstance. This sequence has no injection and no SG isolation. This is "core cooling recovery" with an unisolated SGTR. ECA3 specifies cool down at less than 100F/hr. The core cannot be maintained covered for the amount of time it takes to cooldown to RHR conditions at 1OOF/hr. Suggested resolution is to use a separate function for this heading, using an operator action directed by [procedure] and without RCP operating.

Attachment Page 21

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O] Observations and Recommendations by Peer Review Team jSau

3. Sequence YUD1QD3. comment #2 applies to this sequence as well.

This is a stuck open relief PORV with no injection.

1. Add functions to D3 for primary system depressurization.

2. Find specific procedure for D3 given the multiple uses in sequences.

3. Add a new operator action for D3 if in some sequences, the operator action will be called by a different procedure and then [procedures].

The success criteria for AFW for SGTR is 1 CA pump to 2 steam generators. The ruptured SG is assumed to be one of the two steam generators that supply steam to the turbine-driven AFW pump. In the Catawba Rev. 2b fault tree model, however, the dependency of the TDP on the SGTR initiator is not modeled. Thus, the TDP supply is AS-7 not degraded by the initiating event in the model logic, so the model is CLOSED incorrect.

Correct the SGTR AFW pump logic in the Catawba Rev 3 update as planned. Check that initiating event impact logic is also correct in sequences for other events (e.g., T6 - SLBI).

Success Criteria (Level 1 and Level 2) for some systems and sequences are supported by MAAP runs with MAAP 3b, Version 16.

This version of MAAP has been found to have limitations which can impact conclusions and results. In particular for the Catawba PRA, the TH-1 simple pressurizer model likely impacts the analyses that involve RCS The success criteria are in general agreement with those used at similar cooldown and depressurization using SG heat removal by permitting plants. Few changes are expected and the overall impact is expected to RCS depressurization to match RCS cooldown for transients, without be small.

the possible need for pressurizer PORVs, spray or aux spray.

Consideration should be given to re-running selected analyses with a Attachment Page 22

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team Status later version of MAAP code that has an enhanced pressurizer model to determine extent of impact. Duke PRA personnel indicated that they are currently developing a MAAP 4.0 model, which would be suitable for this purpose and for future analyses supporting the PRA.

Success Criteria analyses were not done for the range of possible plant conditions to which they are applied. For example, MLOCA success criteria analyses are done for a 3.5 inch break, while the MLOCA is defined as a 2 to 5 inch break. The combinations of systems and operator recoveries that are defined as success at 3.5 inches may not be success at 2 inches or at 5 inches. This issue also applies to large LOCA (8.25 ft2 break analyzed) vs. a break range down to 6 inches, and small LOCA (1 inch break analyzed) vs. break sizes from' 3/8 to 2 inches.

Further, it was not clear that the MLOCA MAAP runs adequately match the accident sequence being modeled in the PRA. Cases in OPEN TH-3 [procedure] do not appear to disable accumulators when defining the minimum ECC requirements, but accumulators are not required by the No problems with the appropriateness of the success criteria have been resulting MLOCA success criteria, identified. There are no impacts to this application.

Also, MAAP is not an appropriate code to use in performing analyses for rapid blowdown events such as large and some medium LOCAs.

One possible approach would be to perform success criteria analyses for a range of possible conditions, including the limiting break sizes.

Check the MLOCA analyses to determine whether the accumulator injection makes a significant difference in the results and conclusions.

Also, a code other than MAAP should be used if success criteria dealing with the blowdown phases of large and medium LOCAs are being defined.

TH-5 The HEP worksheets do not clearly refer to success criteria analyses to OPEN

_ _ support timing for operator actions. Although most worksheets Attachment Page 23

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team Status include an estimate of the time available for completion of an action, This F&O is considered to be a documentation issue.

and some refer generally to information from MAAP analyses, specific references to MAAP (or other analysis) cases are not The current Catawba model of record used the HRA methodology provided, developed by SAROS. Beginning with the 2011 Oconee PRA update, Duke now uses the HRA calculator method. Based upon the Oconee Review success criteria analyses to determine whether they adequately update results using HRA calculator, the current Catawba HRA results reflect modeled scenarios, including expected operator actions. using SAROS are considered to be conservative and therefore bounding.

Thus, this is considered to be a documentation issue only with no impact on this application.

There is no room heatup analysis notebook / evaluation of loss of HVAC to equipment rooms for the Catawba PRA, and apparently no OPEN retrievable room heatup calculations or documentation to support the assumption that room cooling need not be modeled in the PRA. Other Loss of UVAC is not expected to lead to core damage. However, PRAs have found that room cooling is required for some rooms such documentation that justifies this position needs to be developed.

as electrical equipment rooms and small rooms housing critical pumps.

Incidentally, this F&O is under evaluation as part of the in-progress TH-6 Perform an evaluation, with equipment room-specific calculations, if McGuire PRA model update. A similar analysis for room heat-up at possible, of the potential for, and magnitude of the room heatup for Oconee concluded that a loss of HVAC will not result in equipment rooms housing electrical equipment, pumps, and other key equipment failures. Engineering judgment is that any potential impact from credited in the PRA. Document the basis for any determinations that HVAC failures at McGuire would be small. Given the similarity of equipment will survive the anticipated room heatups, and model loss plantudes a t McGuire and.Caawbathislite is of room cooling as a failure mode in the system fault trees (with plant design and layout between McGuire and Catawba, this item is recoveries as appropriate) for equipment that may not survive the expected to have little or no impact on Catawba as well.

anticipated heatup for the PRA mission time.

System success criteria are specified in the system notebooks in sufficient detail to describe the overall fault tree top events, but no basis is provided in the system notebooks for the number of pumps or CLOSED flow rate requirements. The Reference section 18.1 does not contain a link to an appropriate success criteria calculation. For example, in the KC notebook, it is stated without a source reference that both pumps Attachment Page 24

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O I Observations and Recommendations by Peer Review Team Status and the associated heat exchanger in a train are required for success when the ND (RHR) heat exchanger is required. Similarly, in Section 12 of the RN notebook, it is stated that the top events simply represent "failure to provide sufficient flow" to components requiring cooling without defining a flow rate or number of pumps (in Section 13 of the notebook it does state that failure to provide flow requires failure of all four pump trains). The CA (AFW) notebook has a similar statement without a tie to a specific basis.

A reference should be provided in Section 12 of the system notebooks for each of the stated top event success criteria. The reference could be to a design basis analysis, or to a specific MAAP calculation or some similar best-estimate analysis method. Section 12 in the NI System Notebook file CR3NI.doc provided for the reviewers contains references to specific MAAP runs that serve as the basis for success criteria, and can be used as an example.

In the Component Cooling System Notebook, there is no basis provided in Section 11.3 for excluding the failure to isolate the Non-Essential Reactor Building Header from the fault trees. In discussion with the PRA engineer responsible for the notebook update, it was determined that three valves need to fail to close for flow diversion to CLOSED take place, but there could be a common cause failure of these valves that was not justified to be excluded.

Justify excluding this potential diversion flowpath in the system notebook or include it in the fault tree.

For Catawba, there was no evaluation of the ability of non-qualified OPEN SY-6 (non-EQ) equipment to survive in a degraded environment following an accident such as a steam line of feedwater line break outside of Primarily a documentation issue. (Peer Review F&O L2-2. Level of containment. Significance = C on VX fans is a specific example of another question Attachment Page 25

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team Status on survivability of equipment in degraded environment.)

Perform an evaluation of potential adverse effects on equipment operation due to degraded environmental conditions resulting from accidents in the PRA model.

Workplace Procedure is the primary data gathering procedure. It is supplemented by [procedure], Catawba PRA Revision 3 Failure Rate And Maintenance Unavailability Data, and [procedure], the CCF analysis report. Also, noteworthy is attachment 3, which includes the CCF checklist. Additional details are provided by Rev. 2b Summary Report and the Rev 2 Summary Report.

The data guidance is generally adequate; however it does not address OPEN component boundaries. Component boundaries are apparent from the data as in the specific example in F&O DA-02, i.e., the incoming This F&O is considered to be a documentation issue.

breaker and panelboard BLF. However, these should be defined in the guidance. The industry documents used to generate the Catawba PRA database (such as NUREG/CR-6928) define the component boundaries.

Consider revising guidance documents to address the treatment of component boundaries. Possible guidance sources for this include:

NUREG-5497, Common Cause Failure Parameter Estimates EPRI TR-100382, A Database of Common-Cause Events for Risk and Reliability Applications NUREG/CR 5500, Reliability Study: Emergency Diesel Generator Power Systems 1987-1993 Some of the generic data from SAROS is quite dated, including OPEN WASH-1400, NUREG/CR-2815, Zion PRA, and NUREG/CR-4550.

DA-2 More recent generic data should be pursued. Use of more recent equipment operating experience data is desirable.

Component failures should be defined such that they encompass only However, the current generic data is deemed to provide adequate those failures that would disable the component over the PRA mission estimates of generic equipment failure rates. In addition, these failure time. It appears that this has not been considered. Specific examples rates are Bayesian-updated with plant-specific data.

Attachment Page 26

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team IStatus of less than adequate reliability data characterization were identified through review of Tables 1 and 3 in [procedure], Catawba PRA Rev. 3 Failure Rate and Maintenance Unavailability Data. First, repeat events in a short duration, where there was insufficient component repair should be counted as one event. An example is PIP nos. 2-C97-2481 and 2-C97-2637 on 7/29/97 and 8/12/97 for incoming breaker 2CXI-5C. The first failure occurred "for no apparent reason", but the second failure was attributed to a failed relay. The first event should be omitted as a component failure as the component was left in the degraded condition. Second, component degradation that results in failure to meet normal criteria (e.g., to avoid component life degradation), may not impact the component mission for the PRA.

For example, PIP no. 0-C98-2057 involved a 6/7/98 event for trouble alarms for VI compressor F, and the compressor motor was found smoking. The evaluation addressed concern with overheating and insulation breakdown, but did not address whether ran to failure would survive PRA mission. Similar pump failures due to routine vibration testing exceeding limits were found (LPR 2B & IA, WO 93020502 & PIP 1-C93-1124).

More recent generic data sources should be pursued. Reliability data characterization should include evaluation of the applicability of individual component failures to the PRA model.

The unavailabilities computed for the basic events for PORV block valve closure, RNC031BDEX, 033ADEX, and 035BDEX, assume that each PORV is closed one week per quarter. However, there is no DA-5 history of PORV closures for any extended period of time in the last CLOSED few years.

While this does use plant-specific data, the benefit derived from it is limited due to the highly conservative assumption regarding PORV Attachment Page 27

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team Status out of service time.

As the data is updated, it should be reviewed for excess conservatisms and revised to be more realistic.

In [procedure], there is development of a failure probability for the rupture of an MOV. The type code for this event is MVR. This type code is used in the calculation of the ISLOCA frequency. In the DA-6 SAROS database, this distribution is composed of three equally CLOSED weighted distributions. The three distributions have error factors of close to 10.0. The error factor assigned to MVR is -2.6. This is impossible - the error factor should be close to ten.

Another example of conservatism is the SBO following trip event, PACBOFTDEX. This event in the top 100 cutsets, has a 1E-3 DA-8 probability, and has not been updated since the IPE. CLOSED Review the dominant sequences for conservative values and update them.

A screening value of 3E-3 was initially used for all pre-initiator HEPs. OPEN There were 7 HEPs quantified in more detail, because the HEP importance was too high. However, there were 7 Latent Human Error This observation does not necessarily have a large impact on the PRA HR-2 events with a 3E-3 probability in the top 100 importance events in the results. However, per the HR subtier criteria (HLR-HR-D & HR-D2),

CR2b quantification. screening HEPs should not be used for actions appearing in significant contributors.

Provide more detailed quantification of more pre-initiator HEPs.

The operating staff at the plant had some input to the HRA in the beginning, but it is not obvious a thorough review of the dominant OPEN HR-4 operator actions by the plant staff had been done, nor was it obvious there had been any feedback of their comments into the analysis. This F&O is considered to be a documentation issue. See the response The level of detail and relation to the operating procedures is sparse. to F&O TH-5 above.

In some instances, the procedural steps are not mentioned. In some Attachment Page 28

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team Status places, the reference to the procedure is incorrect.

Get operating staff more involved in the HRA.

In the Catawba HRA notebook for PRA Rev 2b (and similarly in the McGuire Rev 3 HRA notebook), the documentation of the bases for the HEPs is not sufficiently specified to assure that the analysis is reproducible. Specifically, the sequence context (e.g., previous failures in the event sequence, concurrent activities, environmental factors, etc.) and procedural steps applicable to each HEP are not consistently provided. Thus, even though there is evidence that the HEP worksheet information is being reviewed by plant Operations personnel, it is not clear that they would have sufficient supporting information with which to make an effective assessment of the HRA. OPEN Similarly, the timing, PSF, stress level, and all other contributing HR-5 factors to the HEP were printed, but the basis was not provided. It This F&O is considered to be a documentation issue. See the response would not have been possible for another analyst to determine the same factors and derive the same number. to F&O TH-5 above.

The lack of such information in the documentation of the HRA limits the ability to verify and reproduce the results, and to determine their applicability in specific scenarios.

Enhance the HRA documentation to address the above items. Consider developing, for each important HEP, a timeline showing all important cues and events. Reference specific steps in each procedure for each action, and estimate the time at which the step would be reached during an accident.

Inconsistency among timing for similar HEPs. OPEN 1R-9 There are four important times for HCR calculations:

T(avail) - total time available for an action to be completed from the Primarily a documentation and consistency issue; not expected to first event which starts the demand for the action. significantly impact risk results. See the response to F&O TH-5 above.

Attachment Page 29

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O IObservations and Recommendations by Peer Review Team IStatus T(execute) -amount of time needed to execute the actions after diagnosis T(1/2) - the median amount of time needed to diagnose and initiate an action.

T(window) - the time window for diagnosis T(w) = T(a) - T(e).

The HCR forms used for Catawba only have an entry form for T(window) and T(1/2).

The timing for the following important events is shown below; EVENT HYDBACKDHE NNVSSFADHE NNVSSFBDHE TRECIRCDHE TFBLD01DHE T(avail)40 45 30 18 20 T(exec) 15 2 7 0 0 T(window) 25 43 23 18 20 T(1/2) 3 5 2 3 5 TO 10 EVENT NDORWSTDHE KKCSTNDDHE POPXC02DHE POPXCONDHE T(avail) 18 10 90 90 T(exec) 0 0 0 0 T(window) 18 10 90 90 T(1/2) 5 3 30 30 The following observations are made:

1) In order to be useful to prevent seal LOCA, POPXCOiDHE must be connected by 30 minutes. If the T1/2 is 30min, there is no chance for success. There must be some execution time for this action, which means there is insufficient time for this action.

2) NNVSSFBDHE should be done in 15 minutes to be consistent with the WOG ERG guidelines about restoration of seal cooling.

Attachment Page 30

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team I Status

3) NNVSSFBDHE and NNVSSFADHE should have the same T (1/2), because they are similar actions with similar facilities, just under different conditions.

4) TRECIRCDHE and NDORWSTDHE are essentially the same event. They should have the same t(1/2). If TRECIRCDHE uses 5 minutes, the HCR jumps to .014.

Define the four time parameters for all HEPs Document the basis for all four times for each HEP Make similar HEPs consistent with each other.

Requantify HEP with new time data.

No specific guidance is given regarding modeling of system dependencies in the system notebooks; however, a highly knowledgeable analyst could reproduce the given results. A dependency matrix is provided but contains little detailed explanation of how dependencies were determined. OPEN DE-1 The Internal Flood Analysis does not seem to provide the detail This is a documentation issue which has been addressed in a revision to required to reproduce the results except by a highly knowledgeable a workplace procedure. Note that the F&O states that a knowledgeable analyst. analyst could reproduce the results.

Consider providing guidance for treatment of dependencies, including types of dependencies treated in the model, approaches used to model dependencies, and important considerations regarding how dependencies may affect the model and results.

HVAC cooling of the essential switchgear rooms is stated as being OPEN required. The IPE quantitative analysis does not provide adequate DE-4 success criteria. For example, the following are not specified: Loss of HVAC is not expected to lead to core damage. However, temperature limits of equipment, minimum number of Air Handling documentation that justifies this position needs to be developed.

Units, or minimum number of chillers. The evaluation also states Attachment Page 31

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O IObservations and Recommendations by Peer Review Team IStatus there is no concern within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provided that only those loads needed to provide core cooling are operated. There is no discussion of electrical load shedding for those loads not required, and of the human interface to execute load shedding. The human interface can be complex, involving both a discovery process (control room annunciators, or in the case of a local AHU failure, discovery through operator walkaround), and procedures and training to direct operation actions.

A conservative estimate of essential switchgear room HVAC cooling failures could be pursued to establish the system importance.

However, if moderate importance is observed, more detailed heatup calculations, recovery actions, and equipment models would be desirable for a realistic system model.

The PRA flooding analysis builds on a plant calculation that determines flood levels in the plant. That calculation only determines flood levels; it does not address the effects of water on equipment.

The effects of spray and the effects of water on electrical equipment are not addressed. Further, it is not evident that flood propagation OPEN impacts were addressed, nor that probabilistic failure of flood barriers DE-6 Spray effects and flood propagation past flood barriers are not expected (e.g., doors) was considered.

to be significant interactions. This is a more of a completeness /

documentation issue.

Obtain the site calculation relating to spray effects and use that to develop information for incorporation in the PRA.

Consider flood propagation impacts, and treat flood barrier failure probabilistically.

The truncation limit of the baseline CDF at 1E-9 is not low enough to QU-1 defend convergence toward a stable result. This is shown on page 12 CLOSED of [procedure]. Use of the lE-9 truncation limit yields 4485 cutsets, while the 1E-10 truncation limit yields 31512 cutsets. Thus, although Attachment Page 32

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team Status the PRA runs using 1E-9 are capturing about 85% of the CDF predicted with a cutoff of 1E-10, they are capturing only 13% of the cutsets using the 1E-10 truncation limit.

The Duke PRA staff uses a high performance quantifier, FORTE.

Quantification speed should not be a significant challenge. One option to improve post-processing speed is to recode the recovery rules and deleted events as a fault tree. Other options (e.g., sensitivity studies at lower cutoffs to confirm the acceptability of the 1E-9 cutoff for particular applications) may also be appropriate.

The IE's for certain support system failures (RN, KC) are not input in the top event logic as a Boolean equation, but rather as a point estimate whose value is derived by solution of the IE fault tree.

However, failures that cause the IE may also affect the mitigating OPEN system, such that there is a dependency between the initiating event QU-2 and the available mitigation. Examples are an electrical bus that failed Modeling initiators with logic instead of point estimates would one train of KC and could fail one train of mitigating equipment.

Another example is the operator error in the loss of KC to start the improve the accuracy of the model, although it is not expected to standby train of KC (KKCSTNBDHE). The HRA notebook states this significantly alter the results or conclusions of the analyses.

event has dependencies with HYDBACKDHE.

One way to resolve this is to Input the IE as a Boolean equation.

More guidance or creation of a procedure is needed to address the quantification steps. For example, there is no desktop guide or procedure as there is for developing system fault trees.

QU-4 Develop quantification guidance for PSA analysts. This should CLOSED include information on the quantification codes and the run parameters. Standards for quantification commensurate with the application type should be included.

Attachment Page 33

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team Status Event NDORWSTDHE: This is a recovery action to terminate the NV and NI pumps in the event of failure of ND to provide recirculation after a SL. The event was quantified on the basis of tripping the pumps within 18 minutes. RWST refill was assumed to occur (from undescribed source) and pumps were restarted to continue injection.

This recovery event is applied to:

a) loss of KC pumps b) SNSDRNVLHE - drain plug blockage c) CCF of ND pumps.

The recovery event is intended to provide injection flow for the long QU-5 term commensurate with the RWST make-up capability. The time of CLOSED some of these failure is 20 minutes, when injection requirements are beyond the make-up capability of the RWST. Secondly, there are cutsets representing heat removal that cannot be recovered by continued injection of HHSI. The sequence needs continuous injection of HHSI and heat removal from containment.

Carefully define the purpose of event NDORWSTDHE.

Define the RWST make-up capacity and when it is effective.

Distinguish heat removal sequences from injection sequences and do not recover injection sequences Requantify HEP to include failure to provide RWST refill.

Documentation of mutually exclusive events is limited to the text file, OPEN cr2b rul.txt.

QU-8 This is considered to be a documentation issue and can be addressed in The rule recovery file allows different numbers of max recoveriesmodel integration notebook.

___depending on the combinations in question. ____________________________

Attachment Page 34

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team Status There is no documentation regarding how the max recoveries were established for each set of events. Examples of the content of the file are DBLMAINT, DELSEQ, and NSHEATEX, which function as recoveries set to 0.0 Note that this applies to recovery events as well as deleted combinations.

Create a basis document for the deleted combinations and include examples. Establish a review process for changes to the deleted combinations. Document the review of the max recoveries.

A document containing an overview of the deleted combinations and why would make this portion of the model more clear. In addition, these files should be reviewed to ensure quality of the content.

The Conditional core damage Probability of several Initiators from the CR2b results were evaluated. The results are:

8.30E-03 Loss Of RN 8.38E-03 Loss Of KC 5.04E-03 Small LOCA QU- 2.30E-04 Secondary Line Break Inside Containment 12 5.47E-05 LOOP CLOSED 9.54E-06 FDW Line Break Outside Containment 2.26E-06 Loss Of Main Feedwater 2.89E-06 SGTR 7.75E-07 Loss Of Load 5.01E-07 Reactor Trip These results show a discrepancy between Small LOCA and SGTR Attachment Page 35

Summary of Catawba WOG Peer Review "B" Fact and Observations F&O Observations and Recommendations by Peer Review Team Status that is not consistent with what is normally seen in PRAs in the industry. The CCDP for small LOCA and SGTR are usually in the same order of magnitude because the initiators have similar mitigation functions such as safety injection, secondary side heat removal, primary cooldown and depressurization, and long term injection if cooldown and depressurization are not successful. A difference of 3 orders of magnitude is unusual. Also, the CCDP value for the Loss of Instrument Air probability is identical to the Inadvertent SS Actuation probability (to 3 significant figures), which seemed surprising.

Review and explain the contributors to inadvertent SI, Loss Instr. Air 1.24E-05 Inadvertent SS Actuation 1.24E-05 Loss Of Instrument Air 1.04E-05 Steamline Break Outside Containment and Tube rupture.

Attachment Page 36

3. According to the submittal, the seismic analysis of the NSWS components and piping caused "the seismic [core damage frequency] CDF [to show] only a modest increase using very conservative bounding assumptions ... [due to] a sensitivity study [that] was performed to conservatively bound the impact of having a NSWS discharge line unavailable during a seismic event." Please provide a description of the change in seismic analysis and the resulting seismic CDF and [large early release frequency] LERF for this application.

Duke Energy Response:

As indicated in Duke Energy's November 22, 2011 submittal, the current Catawba seismic PRA model of record was last updated as part of Revision 3 of the Catawba PRA model. The current methodology used is the same as that described in detail in the IPE submittal and Section 3 of the IPEEE submittal, both of which have been previously reviewed by the NRC. The reader is referred to those references for additional details of the seismic analysis.

The current seismic PRA contains the technical elements given in Section 1.2.6 of RG 1.200, Rev. 2 as part of its current methodology. The plant-specific seismic PRA analysis consists of four steps, each of which is described below:

1. The Catawba site was evaluated to obtain the seismic hazard in terms of the frequency of occurrence of ground motions of various magnitudes. The site-specific hazard analysis was performed using the Seismicity Owners Group (SOG) methodology developed by EPRI for seismic hazard analysis of nuclear power plant sites in the Central and Eastern United States (CEUS) and is documented in EPRI document RP101-53. Uncertainties were addressed in the hazard analysis. Furthermore, Duke Energy has been actively following developments related to GI-199. In 2008, Risk Engineering Inc. performed preliminary comparisons of the EPRI-2008 seismic hazards and EPRI-1989 seismic hazards for the Duke plants. Their results indicated no significant impact to Catawba.

2. From the site-specific seismic hazard curve, the capacities of important plant structures and equipment to withstand seismic events were evaluated to determine conditional probabilities of failure as a function of ground acceleration for significant contributors (i.e., SSCs). These are commonly referred to as 'fragilities' or the site-specific fragility curves. Plant walkdowns were conducted, the most recent ones consistent with the guidelines of EPRI NP-6041.

3. An event tree was developed along with supporting top logic and system fault trees to reflect plant response to seismic events. These modified logic models were then solved to obtain Boolean expressions for the seismic event sequences of interest.

4. The Boolean expressions were quantified by convolving the probabilistic site seismicity and the fragilities for the plant structures and equipment obtained in steps I and 2. The resulting sequence frequencies were then integrated Attachment Page 37

into the overall Catawba PRA risk results, resulting in final quantitative results.

Since the IPEEE submittal, changes have been made to the seismic model such as:

• A comprehensive review and revision of the seismic analysis documentation write-up

• The addition of component/structure fragility information to support values used in analysis

• Updated Human Reliability Analysis (HRA) data

• Updated common cause data

• Editorial and logic changes to the fault tree

• Updated quantitative results table The impact of this LAR on the seismic CDF was also reviewed. Per the Catawba seismic PRA documentation, components with median seismic capacities in excess of 2g were screened out of the seismic fault tree models due to their low probability of failure. Likewise, structures were eliminated from consideration when their seismic capacities were in excess of 2.5g. Among those components and structures screened out were the Standby Nuclear Service Water Pond Dam, the NSWS pumps, and all qualified piping and valves. Therefore, the NSWS components and piping are considered to be seismically-rugged and thus do not impact this analysis.

However, since the NSWS components and structures were screened out of the model, a sensitivity study was performed to conservatively bound the impact of having an NSWS discharge line unavailable during a seismic event. Using the current Catawba analysis, the following safety system trains were considered unavailable (i.e., set to '1') in the seismic cut sets:

• Auxiliary Feedwater Motor-Driven Pump 'B' (CA MDP 'B')

• Safety Injection Train 'B' (NI 'B')

" Emergency Diesel Generator 'B' (D/G 'B')

• Component Cooling Train 'B' (KC 'B')

• Residual Heat Removal Train 'B' (ND 'B')

The standby trains of these systems were made available (i.e., set to '0') in the seismic cut sets.

The cut sets were then processed using Duke Energy's seismic analysis code

('SEISM') to calculate a new seismic CDF of 1.35E-05/yr. With a current baseline Catawba seismic CDF of 1.14E-05/yr, this represents an increase of 2.1E-06/vr (which equates to 8.1 E-08 per 14-day period). The current Catawba seismic model does not include LERF; however, based on the most recent seismic LERF analysis performed for the Oconee station, it is expected to be about one order of Attachment Page 38

magnitude less than the CDF. Again, this is a conservative bounding value since both trains of each safety system would normally be available while an NSWS discharge line is out of service. It is expected that the actual seismic CDF would be smaller than this value. In addition, there were no new failure modes introduced and consideration of the seismic impact is thus not a factor for this assessment.

In accordance with the discussion in this section and the results of the conservative bounding analysis above, Duke Energy considers inclusion of the seismic results as insignificant to the overall results and is not considered to be a potentially significant hazard. It is judged that the analyses assessing the influence of seismic events provide an acceptable evaluation of the contribution of the seismic risk for the requested Completion Time of 14 days.

4. Please provide a description of the internal fire PRA analysis and resulting change in internal fire CDF and LERF for this application.

Duke Energy Response:

The current Catawba fire PRA model analysis and methodology used in the model of record is the same analysis and methodology as described in the IPE submittal; Section 4 and Appendix B of the IPEEE submittal; and as discussed in the Supplemental IPEEE Fire Analysis Report, all of which have already been reviewed by the NRC.

The plant-specific fire PRA analysis consists of four steps, each of which is described below:

1. The Catawba site and plant areas were analyzed to determine critical fire areas and possible scenarios for the possibility of a fire causing one or more of a predetermined set of initiating events. Screening criteria were defined for those fire areas excluded from the fire analysis.

2. If there was a potential for an initiating event to be caused by a fire in an area, then the area was analyzed for the possibility of a fire causing other events which would impact the ability to shutdown the plant. These were identified by reviewing the impact on the internal event analysis models.

3. Each area was examined with an event tree fire model to quantify fire damage probabilities. The event tree related fire initiation, detection suppression, and propagation probabilities to equipment damage states.

4. Fire sequences were derived and quantified based on the fire damage probabilities and the additional failures necessary for a sequence to lead to a core melt. The additional failures were quantified by the models used in the internal events analysis.

The major changes to the current fire analysis that have been made since the IPEEE submittal deal with implementation of changes from the Supplemental Attachment Page 39

IPEEE Fire Analysis Report and revised base case fire initiating event frequencies.

Since the Catawba fire PRA model is integrated into the overall PRA model, quantitative fire risk insights can be obtained for the LAR. The cut sets generated for the analysis presented in Question I above were reviewed to determine the contribution level of the fire initiating events. Internal fire events contributed approximately 10% of the CDF and 3% of the LERF. Whereas fire-induced loss of NSWS events are included in the PRA model, they did not appear in any core damage or large early release sequences (above the respective truncation limits).

Furthermore, in comparing the delta risk cut sets created in support of the LAR analysis (i.e., those cut sets whose values showed an increase in the LAR configuration when compared to their values in the 'base case' configuration), no internal fire sequences of any type appeared in the core damage and large early release results. Therefore, the contribution from fire events for the LAR configuration impacting the NSWS is deemed negligible.

Finally, from a deterministic standpoint, consider that the NSWS essential header discharge valves and the discharge valve to the Standby Nuclear Service Water Pond (SNSWP) will remain open during the requested 14-day Completion Time with power removed. Therefore, fire events affecting power to these valves cannot cause their spurious operation and thus would have no effect on the NSWS discharge alignment during the Completion Time.

Given the negligible influence of fires on the NSWS for the LAR configuration, fires are not considered to be a potentially significant hazard. It is judged that the analyses assessing the influence of internal fire events provide an acceptable evaluation of the contribution of the fire risk for the requested Completion Time of 14 days.

5. Please provide a description of the internal/external floods PRA analysis and resulting change in internal flooding CDF and LERF for this application.

Duke Energy Response:

Flooding events at Catawba have been assessed via the IPE process and are noted in Sections 3.3.5 and 3.4 of the IPE submittal. Internal flooding events are primarily caused by plant piping ruptures while external floods are mostly caused by very heavy precipitation events. The external events portion is recreated in Section 5.2 of the IPEEE report. As mentioned above, the IPE and IPEEE submittals have already been reviewed by the NRC.

Per the Design Basis Document for external flooding, flood levels for the site were analyzed for the following flood producing phenomena:

1. Probable Maximum Flood (PMF) resulting from the Probable Maximum Precipitation (PMP) positioned appropriately over the Catawba River Basin.

Attachment Page 40

2. Probable Maximum Flood (PMF) resulting from the Probable Maximum Precipitation (PMP) positioned appropriately over the tributary area of the SNSWP.

3. Standard Project Flood (SPF) passing through Lake Wylie (positioned over each Catawba River basin drainage area) combined with the failure of one of the upstream dams because of an Operating Basis Earthquake (OBE). The SPF is considered equal to one-half of the PMF.

4. Surge and seiche effects caused by probable maximum hurricane.

5. Coincident wave runup due to a 40 mph wind.

6. Local intense precipitation (PMP) occurring over the immediate project site.

In the IPEEE report, it was concluded that the contribution to plant risk from external flooding would be insignificant compared to the risk from internal flooding.

The plant-specific Catawba internal flooding analysis was performed in six steps:

1. Identification of the critical flood areas

2. Calculation of flood rates

3. Development of flood probabilities

4. Identification of critical flood levels

5. Assessment of human response for flood isolation

6. Development and quantification of the flood core damage cut sets The major change made to the current internal flood analysis since the IPE and IPEEE submittals deals with the installation of concrete flood walls in the Turbine Building basement to protect essential 4160V ac switchgear against large flooding events. As a result, flooding initiator probabilities which would result in either a reactor trip or a loss of the transformers have been significantly reduced.

As with the fire analysis, the Catawba internal flooding PRA model is integrated into the overall PRA model; therefore, quantitative flood risk insights can be obtained for the LAR. The cut sets generated in the response to Question 1 above were reviewed to determine the contribution level of the flooding initiating events.

Internal flooding events comprise approximately 2% of the CDF and less than 1%

of the LERF. The majority of this contribution comes from a flooding event in the Auxiliary Building which results in a loss of the Auxiliary Shutdown Panel.

As indicated previously, the NSWS discharge piping associated with this LAR resides in the Auxiliary Building; thus, it could be postulated that this area could be more susceptible to flooding risk during the Completion Time. Duke Energy Nuclear System Directives require the station to give consideration to plant configurations which could potentially cause internal flood hazards resulting in a failure of risk significant structures, systems, and components. Furthermore, the manual and motor operated valves installed in this portion of the NSWS are Attachment Page 41

Fisher Posi-Seal butterfly valves. When these valves are closed, there is not a credible failure that would cause them to change position or catastrophically come apart. In the closed position, the operator gearbox will hold the valve disc still. The gearbox operators are manufactured by Limitorque and have locking gear sets that will not move even during a seismic event. Therefore, exposing the isolated NSWS discharge piping during the 14-day Completion Time is considered to have a negligible impact on flooding risk in the Auxiliary Building. As a sensitivity study, the value for the Auxiliary Building flood initiator in the PRA model was increased by its error factor (7.5) from 5.5E-06 to 4.13E-05. As a result, the CDF for the Completion Time configuration increased by only 9.8% and the corresponding LERF increased by only 2.2%. Thus, the impact on internal flooding is considered insignificant.

Given the negligible influence of flooding events for the LAR configuration, floods are not considered to be a potentially significant hazard. It is judged that the analyses assessing the influence of these events provide an acceptable evaluation of the contribution of the flood risk for the requested Completion Time of 14 days.

6. Please provide a description of the tornado/high winds PRA analysis and resulting change in the tornado/high winds CDF and LERF for this application.

Duke Energy Response:

As with earthquakes, fires, and floods, an assessment for tornados and other high wind events at Catawba has been performed via the IPE process as well as with the IPEEE process.

The plant-specific Catawba tornado/high wind analysis was performed in three steps:

1. Calculation of occurrence frequency

2. Tornado missile analysis

3. Tornado wind analysis The major changes to the tornado analysis since the IPE and IPEEE submittals include the following:

• enhancements to the diesel generator building modeling

• addition of the upper surge tank, condensate storage tank, and portable instrument air diesel compressor

• revised switchyard strike frequency As with the fire and flooding analyses, the Catawba tornado PRA model is integrated into the overall PRA model; therefore, quantitative tornado risk insights can be obtained for the LAR. The cut sets generated in response to Question 1 above were reviewed to determine the contribution level of the tornado initiating events. The cut sets generated for the LAR analysis were reviewed to determine Attachment Page 42

the contribution level of the tornado initiating events. Only one event (Tornado Causes a Loss of Offsite Power) contributed to the CDF (- 3%) and the LERF (~

4%). Typically, these cut sets include a loss of the diesel generators and either Auxiliary Feedwater or the Standby Shutdown Facility. A review of the delta risk cut sets created in support of the LAR analysis found that, while tornado events were a significant contributor to the ICCDP, this contribution comes from the increased tornado frequency value ('seasonal factor') used in the risk assessment to account for historic increased tornado activity during the months of March, April, and May, rather than from interactions with the NSWS configuration.

Furthermore, even though the NSWS provides cooling to the diesel generators as well as the assured source of Auxiliary Feedwater, functionality of the NSWS following a tornado event is governed by the operability of the diesel generators and would not be altered per the configuration found in the 14-day Completion Time. Therefore, the impact of tornados and high wind events is negligible.

Given the negligible influence of tornado and high wind events on the NSWS for the LAR configuration, they are not considered to be a potentially significant hazard. It is judged that the analyses assessing the influence of these events provide an acceptable evaluation of the contribution of the tornado and high wind risk for the requested Completion Time of 14 days.

7. Background The guidelines of RG 1.177 state that one of the elements of consistency with defense-in-depth philosophy is maintaining "defenses against potential common-cause failures (CCFs).... " In the proposed new Condition C for TS 3.7.8 only one path of NSWS discharge flow to the standby nuclear service water pond (SNSWP) is available when one NSWS header is isolated between 1RPN-19 to 1RN63A or between 1 RPN-20 to 1 RN58B and flow is blocked to Lake Wylie.

Issue If the only operable NSWS discharge header, as described above, had a pipe break or became blocked or became inoperable, all NSWS cooling could stop.

Request a) Discuss your contingency plans, training, procedures, and compensatory measures to restore NSWS and maintain core and spent fuel pool cooling, in the event that this sole return to the SNSWP unexpectedly breaks/cracks or becomes flow blocked causing a total loss of NSWS cooling.

Duke Energy Response:

If the in service flowpath to the SNSWP were to become blocked or to become unavailable for any other reason, the Operator Aid Computer, control room annunciators, and control room indications are all available Attachment Page 43

to aid the operator in determining if a loss of flowpath were to occur.

Procedures will aid the operators in determining the nature of the event, and will direct the operators to realign the NSWS back to Lake Wylie if appropriate. NSWS valves I RN57A and 1 RN843B are the in-series return isolations to Lake Wylie. These valves will be closed per procedure when the NSWS is aligned in the single discharge header configuration.

However, power will not be removed from these valves and they are motor-operated valves that can be repositioned, as directed by procedure, from the control room. Operators are trained on existing procedures for plant flooding and loss of the NSWS. Operators will receive additional training on the NSWS single discharge header alignment prior to implementation.

b) Discuss any other possible CCF and associated contingency plans, training, procedures and compensatory measures or discuss why other CCF's do not exist.

Duke Energy Response:

The NSWS alignment for the single discharge header configuration was developed with PRA guidance. First, the NSWS is aligned to the ultimate heat sink (the SNSWP), which eliminates the possibility of the worst case single failure of the NSWS, the loss of one train during a swap from Lake Wylie to the SNSWP. Additionally, the return header motor-operated crossover valves 1 RN53B and I RN54A are tagged open with power removed to ensure a flowpath for the in service Unit I NSWS train. The motor-operated discharge isolation valve for the out of service NSWS train is tagged closed with power removed. Additional measures to ensure that the valve disc on the out of service NSWS train does not reposition are discussed in the response to Question 10a. The motor-operated discharge isolation valve for the in service NSWS train is tagged open with power removed to ensure it cannot be inadvertently repositioned. If the manually-operated isolation valves IRNP19 and IRNP20 were to leak due to disc or valve seat failure, there are redundant isolation valves that can be repositioned to isolate the failure. Note that the piping coating work and the valve isolation boundaries are in the same room in the Auxiliary Building on the same elevation. Any problem with failures or flooding would be immediately apparent to the personnel performing the work. The NSWS single discharge header alignment and the associated isolation valves will be controlled by procedure and by the Safety Tagging Program.

Operators are trained on existing procedures for plant flooding and loss of the NSWS. Operators will receive additional training on the NSWS single discharge header alignment prior to implementation.

8. Backqround Proposed new Condition C defines a new TS Condition statement where a NSWS discharge header is inoperable. This condition makes the associated NSWS train for Catawba 1 inoperable, causing a condition that does not meet Attachment Page 44

the limiting condition for operation (LCO). Cases 1 and 2 as shown in the LAR on attachment 1, page 17, describe initial conditions for new Condition C.

Issue The licensee is additionally placing a Catawba 2 diesel generator (DG) and a Catawba 2 NSWS pump out of service as an initial condition and calling this a single failure. Single failures are normally failures that are postulated to occur after a design basis accident, not as initial conditions.

Request Please explain:

a) Why are DGs and NSWS pumps placed out of service for maintenance and called single failures? [in the initial conditions and Note 9 of cases 1 and 2]

Duke Energy Response:

The wording in the supporting calculation has been revised to remove the words "single failure" from the description and simply say that the DGs and NSWS pumps are out of service for maintenance. The reason that the Unit 2 DG and U2 NSWS pump are assumed to be out of service for maintenance is described below in the response to Question 8b.

b) Since DGs 2A and 2B can discharge to the SNSWP downstream of 1RN63A and 1 RN58B, and apparently do not have to be out of service, why are they assumed to be unavailable?

Duke Energy Response:

When a unit is shut down, it is typical to perform maintenance on the associated unit's NSWS pumps and DGs. The proposed single discharge header alignment will only be allowed when Unit 2 is in Mode 5, 6, or No Mode. The submittal and associated PRA assumes that the NSWS pump and DG on the associated train is out of service for maintenance. For example, when aligned in the single discharge header configuration with the Train A discharge header to the SNSWP out of service, the Unit 2 Train A NSWS pump and the Unit 2 Train A DG are assumed to be out of service.

9. Background

The licensee is proposing a single discharge header alignment to allow a portion of each of the NSWS return headers in the Auxiliary Building to the SNSWP to be removed from service for cleaning, repairing, coating and inspecting. The licensee has stated these activities "will ensure the long-term reliability of the NSWS."

Attachment Page 45

Issue The proposal addresses the short length of NSWS piping in the Auxiliary Building, while most of the NSWS discharge piping to the NSWSP and Lake Wylie is outside the Auxiliary Building.

Request a) Explain how the work on the short length of piping in the Auxiliary Building ensures long term reliability of the NSWS, when most of the pipe is outside the Auxiliary Building.

Duke Energy Response:

With the exception of this piping, the NSWS piping in the Auxiliary Building with a diameter greater than 30 inches has been coated with epoxy. The NSWS piping in the Auxiliary Building with a diameter of 30 inches and smaller has been replaced with a corrosion resistant, superaustenitic nickel stainless steel alloy, commonly called AL6XN.

The buried NSWS piping is discussed in the response to Question 9b.

b) What will be done to clean, repair, coat and inspect the NSWS piping outside the Auxiliary Building?

Duke Energy Response:

The buried carbon steel NSWS piping from Lake Wylie to the NSWS pumphouse has been cleaned and coated with epoxy. The buried carbon steel NSWS piping from the NSWS pumphouse to the Auxiliary Building has been cleaned and coated with epoxy. The buried carbon steel piping to and from the Unit I and Unit 2 DGs was replaced with high density polyethylene (HDPE) and AL6XN. The buried carbon steel NSWS piping from the Auxiliary Building that discharges to Lake Wylie has been cleaned and coated with epoxy.

The buried NSWS piping from the SNSWP to the NSWS pumphouse and the NSWS piping from the Auxiliary Building to the SNSWP has not been coated. The normal alignment for the NSWS is to have the suction and discharge aligned to Lake Wylie, and the NSWS piping in this flowpath has been cleaned and coated with epoxy or replaced.

The NSWS piping from and to the SNSWP is not the normal flowpath and previous inspections have shown that this piping has not experienced the corrosion and degradation seen in the piping that is normally in service.

This piping is inspected per the Service Water Piping Inspection Program and the Buried Piping Program, which are part of the Service Water Piping Corrosion Program described in the Aging Management Programs and Attachment Page 46

Activities section in the Catawba UFSAR, Section 18.2.24, Service Water Piping Corrosion Program.

10. Background During the proposed single discharge header lineups, valves 1 RN63A, 1RN58B, 1RPN19A and 1RPN20 isolate the pipe to be worked and form single valve barriers from Lake Wylie and the SNSWP to the Auxiliary Building.

Issue Failure of any of the valves or personnel error could allow flooding into the Auxiliary Building.

Request a) Discuss the elevation of the work boundaries 1 RN63A, 1 RN58B, 1RPN19A and 1RPN20 as compared to the maximum elevation of the SNSWP and the maximum elevation of discharge pipes to the SNSWP.

Describe design features that will prevent the SNSWP and/or NSWS discharge piping from draining into the Auxiliary Building if work boundaries failed/leaked or personnel error breached the work boundary.

Duke Energy Response:

The normal SNSWP top-of-pond elevation is approximately 574.0 feet Mean Sea Level (MSL). The centerline elevation of the 42 inch SNSWP return Train A and Train B NSWS piping in the Auxiliary Building is 581.25 feet MSL. Therefore, it is not possible to siphon the SNSWP back into the Auxiliary Building if valve I RN63A or I RN58B were to fail open and there was not a simultaneous Probable Maximum Precipitation (PMP) event.

As described in Catawba UFSAR Section 3.4, "Water Level (Flood) Design",

during a PMP event, the elevation of the SNSWP could reach approximately 583.5 feet MSL. Therefore, if the valve failure were to occur simultaneously with a PMP event, it would be possible to siphon the SNSWP into the Auxiliary Building. A PMP event would only occur due to a major weather event, and the NSWS single discharge header alignment will have procedural requirements to verify that no severe weather is in the forecast prior to implementation.

The NSWS discharge piping to the SNSWP in the yard does have a high point of 594.75 feet MSL centerline elevation. If 1 RN63A or 1 RN58B were to fail open, this water could flood the Auxiliary Building. Measures will be taken to prevent these valves from repositioning, and these measures are discussed below.

Any passive valve seat leakage on valves I RN63A or I RN58B will be addressed depending on the amount of leakage. To enable personnel to Attachment Page 47

work in the adjacent piping, the system must be drained and depressurized, and released for work through the Safety Tagging Program.

If there is excessive seat leakage such that the system cannot be drained and depressurized, the NSWS could not be opened and released for work until the leakage is controlled.

To prevent inadvertent repositioning of valves I RN63A or I RN58B, the valves will be controlled by procedure and by the Safety Tagging Program.

Additionally, to prevent the possibility of the valve discs on I RN63A or IRN58B repositioning and causing Auxiliary Building flooding, the valves will be inspected and gagged if required. From a review of the Operating Equipment Database and the industry failures concerning this type of butterfly valve, the primary failure mode which could enable the valve disc to reposition is a failure of the disc to valve stem pins. To preclude this failure mode, the valve to disc pins will be verified to be installed. If the pins cannot be verified to be installed, a mechanical gag will be installed to prevent the valve disc from repositioning. These measures are intended to preclude the possibility of Auxiliary Building flooding and possible siphoning of the SNSWP due to the valve disc repositioning.

Valves 1RNP19 and 1RNP20 are manually-operated butterfly valves. The centerline elevation of the 42 inch piping adjacent to valves 1RNPI9 and 1 RNP20 is 585.75 feet MSL. If these valves were to reposition or have a seat or disc failure resulting in leakage, there are redundant isolation valves that can be closed to isolate the failure and mitigate flooding. To prevent inadvertent repositioning, these valves will be controlled by procedure and by the Safety Tagging Program.

b) Discuss additional backup isolation features and compensatory measures to prevent internal flooding.

Duke Energy Response:

As described in the response to Question 10a, the position of valves I RN63A or 1 RN58B will be controlled by procedure and by the Safety Tagging Program. Additionally, to prevent the possibility of the valve discs on 1RN63A or 1RN58B repositioning and causing Auxiliary Building flooding, the valves will be inspected and gagged if required.

To prevent inadvertent repositioning of valves IRNP19 and IRNP20, the valves will be controlled by procedure and by the Safety Tagging Program.

Additionally, if these valves were to reposition or have a seat or disc failure resulting in leakage, there are redundant isolation valves that can be closed to isolate the failure and mitigate flooding.

11. Background The LAR describes two cases of single discharge header operation, i.e. a) pipe between 1 RPN63A and 1 RPN 19 is isolated, and b) pipe between 1RPN58B and Attachment Page 48

1RPN20 is isolated. In each case NSWS return header crossover valves are open with power removed; the NSWS return isolation valve to the SNSWP is open (power removed); NSWS suction is aligned to the SNSWP; and Lake Wylie discharge isolation valves are closed.

The updated facility safety analysis report (UFSAR) refers to the NSWS discharge headers as the A header and the B header, each serving both units.

The LAR description and the proposed new Insert 2 for the proposed TS Bases refer to both headers as the Catawba 2 discharge headers.

New Condition C of the proposed TS refers to them individually as one NSWS Auxiliary Building discharge header.

Issue The above descriptions of the NSWS discharge headers in the TS Bases and new Condition C are unclear without reading the LAR. New Condition C and the Bases (Insert 3) do not define which portion of the discharge is allowed to be inoperable and the special lineup for safety that is described in the LAR.

Therefore, operators may be inconsistent in plant configuration when entering new Condition C. Inspectors may not be able to know valid Condition C lineups.

Request Explain the licensee's intent to adequately define single discharge header operation in the UFSAR, new Condition C, and TS Bases, so that operators can align the plant to meet new Condition C as defined in the LAR when allowed, and inspectors can know the required discharge header alignment when in new Condition C.

Duke Energy Response:

For this response, please refer to the revised reprinted TS and TS Bases that are included at the end of this attachment. As indicated in the May 3, 2012 telephone conference call between Duke Energy and the NRC, the TS Bases for new Condition C have been expanded to define the lineup for the single Auxiliary Building discharge header alignment. As discussed in the conference call, this level of detail is not necessary for inclusion in the TS itself. Finally, as indicated in the conference call, Duke Energy commits to include corresponding detail regarding the single Auxiliary Building discharge header alignment in the UFSAR following NRC approval of this amendment request. THIS CONSTITUTES A REGULATORY COMMITMENT.

12. Background Insert 2 of the proposed TS Bases describes the NSWS operating in the single discharge header alignment. This places Catawba 1 in new Condition C of the proposed TS which describes a condition where LCO 3.7.8 is not met. However, Insert 2 also says that each NSWS train is operable.

Attachment Page 49

Issue a) The licensee has placed the proposed Insert 2 for the single discharge header lineup in the LCO section of the TS Bases. However, as stated above, the single discharge header lineup does not meet the LCO.

b) Insert 2 states that each NSWS train is operable. Yet, Insert 2 describes Condition C which does not meet the LCO. Therefore, not all NSWS trains would be operable. Throughout the LAR, the licensee lists either NSWS 1A or 1B train as inoperable when in the single discharge header lineup. Thus Insert 2 conflicts with the background/technical evaluation in the LAR.

Request Explain the inconsistencies in the location of Insert 2 in the TS Bases and the content of Insert 2 as described above in a) and b) and correct Insert 2 as appropriate.

Duke Energy Response:

For this response, please refer to the revised reprinted TS and TS Bases that are included at the end of this attachment. The primary function of Insert 2 in the original submittal was to clarify the conditions under which the Unit 1 required NSWS trains could be considered to be operable while the NSWS is operating in the single Auxiliary Building discharge header alignment. It is acknowledged that while operating in this alignment, the LCO is not met. However, since Unit 2 must be in Mode 5, 6, or No Mode while in this alignment, the train related NSWS pump associated with the Auxiliary Building discharge header that is removed from service may also be removed from service. With the exception of the Auxiliary Building discharge header that is inoperable per Condition C, this does not otherwise impact the operability of the two NSWS trains required for Unit

1. This Bases discussion was relocated under Condition C, where it is more appropriate. (For consistency, the similar Bases discussion for single supply header alignment was also relocated under Condition B, where it is more appropriate.) In addition, this Bases discussion was modified to clarify that it is applicable to single Auxiliary Building discharge header alignment, since only the Auxiliary Building portion of the discharge header may be inoperable per Condition C.

When in the single Auxiliary Building discharge header alignment with the NSWS Train A discharge header inoperable, the NSWS piping between valves IRNP19 and IRN63A is isolated. With the piping between IRNP19 and I RN63A isolated, Unit 1 and Unit 2 do not have their train-related flowpath to the SNSWP available. Therefore the Unit 1 Train A NSWS discharge header is inoperable due to the single Auxiliary Building discharge header alignment. In the single Auxiliary Building discharge Attachment Page 50

header alignment, Unit 2 must be in Mode 5, 6, or No Mode, and the TS for the NSWS is not applicable in these modes.

Likewise, when in the single Auxiliary Building discharge header alignment with the NSWS Train B discharge header inoperable, the NSWS piping between valves IRNP20 and 1RN58B is isolated. With the piping between I RNP20 and I RN58B isolated, Unit I and Unit 2 do not have their train-related flowpath to the SNSWP available. Therefore the Unit I Train B NSWS discharge header is inoperable due to the single Auxiliary Building discharge header alignment. In the single Auxiliary Building discharge header alignment, Unit 2 must be in Mode 5, 6, or No Mode, and the TS for the NSWS is not applicable in these modes.

13. Background When in a single discharge header lineup, the background/technical sections of the LAR state that Catawba 2 must be in Mode 5, 6 or no Mode.

Issue New Condition C of the TS as proposed in Insert 1 does not specifically require that Catawba 2 be in Mode 5, 6 or no Mode.

Request Explain why new Condition C of the TS does not require that Catawba 2 be in Mode 5, 6, or no Mode.

Duke Energy Response:

For this response, please refer to the revised reprinted TS and TS Bases that are included at the end of this attachment. Note 1 of new Condition C has been expanded by adding the following statement: "Entry into this Condition shall not be allowed while Unit 2 is in MODE 1, 2, 3, or 4." This statement was deemed preferable to a statement requiring Unit 2 to be in Mode 5, 6, or No Mode for two reasons: 1) the term "No MODE" is not utilized in TS, and 2) the chosen statement is consistent with other Notes in TS governing Mode prohibitions, which are typically stated in the negative.

14. Background Insert 3 of the LAR states"... Condition C is only allowed to be entered in support of planned maintenance or modification activities associated with the Auxiliary Building discharge header that is taken out of service. An example of a situation for which entry into this Condition is allowed is refurbishment of an Auxiliary Building discharge header. Entry into this Condition is not allowed in response to unplanned events or for other events involving the NSWS."

Attachment Page 51

The LAR cover letter and description describes the proposed scope to be for the NSWS discharge header to be removed from service for cleaning, coating and follow-up inspections.

Issue Insert 3 defines the allowed entry into Condition C to be much broader than the scope delineated in the rest of the LAR.

Request Explain how you will modify Insert 3 to be consistent with the rest of the LAR.

Duke Energy Response:

The original scope of activities that warranted the submission of this LAR were associated with removing the Auxiliary Building portion of a NSWS discharge header from service for cleaning, coating, and follow-up inspections. This submittal specifically excludes emergent work as a situation under which Condition C may be entered. However, there may be other pre-planned maintenance or modification activities in the future that are appropriate for entry into Condition C that have not yet been anticipated. Over the years, several one-time TS change requests were submitted and approved which supported pre-planned maintenance activities associated with the NSWS supply headers at Catawba. In an effort to avoid additional one-time requests, Duke Energy submitted, and the NRC approved, a permanent TS change to allow the NSWS supply headers to be removed from service for pre-planned maintenance activities. This submittal for the NSWS Auxiliary Building discharge headers is therefore consistent with previous Catawba submittal/approval history. The TS Bases are written specifically enough to only allow pre-planned maintenance activities, without being overly specific so as to disallow future unanticipated types of these activities. Therefore, no changes to the TS Bases are being proposed in response to this question.

15. Background The guidelines of RG 1.177 state that the licensee "should consider... whether there are appropriate restrictions in place to preclude simultaneous equipment outages that would erode the principles of redundancy and diversity," and "whether compensatory actions to be taken when entering the modified

[completion time] CT for preplanned maintenance are identified."

When operating in a single discharge header as proposed by the LAR, one NSWS train is inoperable. NSWS is a support system. In accordance with TS 3.0.6, the corresponding supported systems are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability. Supported systems include Emergency Core Cooling System, Containment Spray System, Containment Valve Injection Water System, Auxiliary Feedwater, Component Cooling Water, Control Room Area Ventilation Attachment Page 52

System, Auxiliary Building Filtered Ventilation Exhaust System, and Emergency Diesel Generators.

Issue The licensee has not identified any inoperable systems that are supported by NSWS in the LAR. The licensee has not expressed any compensatory measures to ensure the redundant trains of supported systems are protected to reduce the risk of loss of safety function. The licensee has not described any evaluation required by LCO 3.0.6 to perform an evaluation in accordance with TS Administrative Control 5.5.15, "Safety Function Determination Program (SFDP)"

for supported systems.

Request Identify all inoperable supported systems as a result of each inoperable NSWS train. Identify all compensatory measure to protect the redundant system as determined by TS Administrative Control 5.5.15.

Duke Energy Response:

The TS systems supported by the NSWS include the following:

TS 3.4.6, RCS Loops - MODE 4 (cascade required only when all NSWS cooling is inoperable per Note 2 in TS 3.7.8, Required Action A.1)

TS 3.5.2, ECCS - Operating TS 3.5.3, ECCS - Shutdown TS 3.6.6, Containment Spray System TS 3.6.17, Containment Valve Injection Water System (CVIWS)

TS 3.7.5, Auxiliary Feedwater (AFW) System TS 3.7.7, Component Cooling Water (CCW) System TS 3.7.11, Control Room Area Chilled Water System (CRACWS)

TS 3.8.1, AC Sources - Operating (DGs) (cascade required only when all NSWS cooling is inoperable per Note I in TS 3.7.8, Required Action A.1)

Per the requirements of LCO 3.0.6, the Conditions and Required Actions associated with the supported systems are not required to be entered.

Only the support system LCO Actions are required to be entered. TS 5.5.15, Safety Function Determination Program, ensures that a loss of safety function is detected and appropriate actions are taken.

While the NSWS is aligned in the single Auxiliary Building discharge header configuration, procedures will direct compensatory measures. The procedures for aligning the NSWS in the single Auxiliary Building discharge header configuration will include the following measures:

• Verify flood barriers in the Turbine Building basement prior to implementation.

• Verify no severe weather is in the forecast prior to implementation.

Attachment Page 53

• Limit discretionary maintenance in Unit I and Unit 2.cable rooms, on available DGs, on Unit 1 turbine-driven AFW pump, on plant Drinking Water System (which provides backup cooling to the Train A centrifugal charging pump), and on Standby Shutdown System (including standby makeup pump) during implementation.

• Implement roving fire watch in Unit I and Unit 2 cable rooms during implementation.

Attachment Page 54

NSWS 3.7.8 3.7 PLANT SYSTEMS 3.7.8 Nuclear Service Water System (NSWS)

LCO 3.7.8 Two NSWS trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One NSWS train A.1 --------- NOTES------

inoperable. 1. Enter applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources-Operating," for emergency diesel generator made inoperable by NSWS.

2. Enter applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops-MODE 4," for residual heat removal loops made inoperable by NSWS.

Restore NSWS train to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OPERABLE status.

(continued)

Catawba Units 1 and 2 3.7.8-1 Amendment Nos. 243/237

NSWS 3.7.8 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. -------- NOTES----- B.1 Restore NSWS supply 30 days

1. Entry into this header to OPERABLE Condition shall only status.

be allowed for pre-planned activities as described in the Bases of this Specification.

2. Immediately enter Condition A of this LCO if one or more NSWS components become inoperable while in this Condition and one NSWS train remains OPERABLE.

3. Immediately enter LCO 3.0.3 if one or more NSWS components become inoperable while in this Condition and no NSWS train remains OPERABLE.

One NSWS supply header inoperable due to NSWS being aligned for single supply header operation.

(continued)

Catawba Units 1 and 2 3.7.8-2 Amendment Nos.

NSWS 3.7.8 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. -------- NOTES----- C.1 Restore NSWS Auxiliary 14 days

1. Entry into this Building discharge header Condition shall only to OPERABLE status.

be allowed for Unit 1 and for pre-planned activities as described in the Bases of this Specification. Entry into this Condition shall not be allowed while Unit 2 is in MODE 1, 2, 3, or 4.

2. Immediately enter Condition A of this LCO if one or more Unit 1 required NSWS components become inoperable while in this Condition and one NSWS train remains OPERABLE.

3. Immediately enter LCO 3.0.3 if one or more Unit 1 required NSWS components become inoperable while in this Condition and no NSWS train remains OPERABLE.

One NSWS Auxiliary Building discharge header inoperable due to NSWS being aligned for single Auxiliary Building discharge header operation.

(continued)

Catawba Units 1 and 2 3.7.8-3 Amendment Nos.

NSWS 3.7.8 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> associated Completion Time of Condition A, B, AND or C not met.

D.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.8.1 ----------------------- NOTE --------------

Isolation of NSWS flow to individual components does not render the NSWS inoperable.

Verify each NSWS manual, power operated, and In accordance with automatic valve in the flow path servicing safety related the Surveillance equipment, that is not locked, sealed, or otherwise Frequency Control secured in position, is in the correct position. Program SR 3.7.8.2 -------------------- NOTE -----------------

Not required to be met for valves that are maintained in position to support NSWS single supply or discharge header operation.

Verify each NSWS automatic valve in the flow path that In accordance with is not locked, sealed, or otherwise secured in position, the Surveillance actuates to the correct position on an actual or simulated Frequency Control actuation signal. Program SR 3.7.8.3 Verify each NSWS pump starts automatically on an In accordance with actual or simulated actuation signal. the Surveillance Frequency Control Program Catawba Units 1 and 2 3.7.8-4 Amendment Nos.

NSWS B 3.7.8 B 3.7 PLANT SYSTEMS B 3.7.8 Nuclear Service Water System (NSWS)

BASES BACKGROUND The NSWS, including Lake Wylie and the Standby Nuclear Service Water Pond (SNSWP), provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation, and a normal shutdown, the NSWS also provides this function for various safety related and nonsafety related components. The safety related function is covered by this LCO.

The NSWS consists of two independent loops (A and B) of essential equipment, each of which is shared between units. Each loop contains two NSWS pumps, each of which is supplied from a separate emergency diesel generator. Each set of two pumps supplies two trains (1A and 2A, or 1 B and 2B) of essential equipment through common discharge piping.

While the pumps are unit designated, i.e., 1A, 1B, 2A, 2B, all pumps receive automatic start signals from a safety injection or blackout signal from either unit. Therefore, a pump designated to one unit will supply post accident cooling to equipment in that loop on both units, provided its associated emergency diesel generator is available. For example, the 1A NSWS pump, supplied by emergency diesel 1A, will supply post accident cooling to NSWS trains 1A and 2A.

One NSWS loop containing two OPERABLE NSWS pumps has sufficient capacity to supply post loss of coolant accident (LOCA) loads on one unit and shutdown and cooldown loads on the other unit. Thus, the OPERABILITY of two NSWS loops assures that no single failure will keep the system from performing the required safety function.

Additionally, one NSWS loop containing one OPERABLE NSWS pump has sufficient capacity to maintain one unit indefinitely in MODE 5 (commencing 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> following a trip from RTP) while supplying the post LOCA loads of the other unit. Thus, after a unit has been placed in MODE 5, only one NSWS pump and its associated emergency diesel generator are required to be OPERABLE on each loop, in order for the system to be capable of performing its required safety function, including single failure considerations.

Additional information about the design and operation of the NSWS, along with a list of the components served, is presented in the UFSAR, Section 9.2.1 (Ref. 1). The principal safety related function of the NSWS is the removal of decay heat from the reactor via the CCW System.

Catawba Units 1 and 2 B 3.7.8-1 Revision No. 5

NSWS B 3.7.8 BASES APPLICABLE The design basis of the NSWS is for one NSWS train, in conjunction SAFETY ANALYSES with the CCW System and a containment spray system, to remove core decay heat following a design basis LOCA as discussed in the UFSAR, Section 6.2 (Ref. 2). This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied to the Reactor Coolant System by the ECCS pumps.

The NSWS is designed to perform its function with a single failure of any active component, assuming the loss of offsite power.

The NSWS, in conjunction with the C.CW System, also cools the unit from residual heat removal (RHR), as discussed in the UFSAR, Section 5.4 (Ref. 3), from RHR entry conditions to MODE 5 during normal and post accident operations. The time required for this evolution is a function of the number of CCW and RHR System trains that are operating. Thirty six hours after a trip from RTP, one NSWS train is sufficient to remove decay heat during subsequent operations in MODES 5 and 6. This assumes a maximum NSWS temperature, a simultaneous design basis event on the other unit, and the loss of offsite power.

The NSWS satisfies Criterion 3 of 10 CFR 50.36 (Ref. 4).

LCO Two NSWS trains are required to be OPERABLE to provide the required redundancy to ensure that the system functions to remove post accident heat loads, assuming that the worst case single active failure occurs coincident with the loss of offsite power.

While the NSWS is operating in the normal dual supply and discharge header alignment, an NSWS train is considered OPERABLE during MODES 1, 2, 3, and 4 when:

a. 1. Both NSWS pumps on the NSWS loop are OPERABLE; or

2. One unit's NSWS pump is OPERABLE and one unit's flowpath to the non essential header, AFW pumps, and Containment Spray heat exchangers are isolated (or equivalent flow restrictions); and

b. The associated piping, valves, and instrumentation and controls required to perform the safety related function are OPERABLE.

Catawba Units 1 and 2 B 3.7.8-2 Revision No. 5

NSWS B 3.7.8 BASES LCO (continued)

The NSWS system is shared between the two units. The shared portions of the system must be OPERABLE for each unit when that unit is in the MODE of Applicability. Additionally, both normal and emergency power for shared components must also be OPERABLE. If a shared NSWS component becomes inoperable, or normal or emergency power to shared components becomes inoperable, then the Required Actions of this LCO must be entered independently for each unit that is in the MODE of applicability of the LCO, except as noted in a.2 above for operation in the normal dual supply header alignment. In this case, sufficient flow is available, however, this configuration results in inoperabilities within other required systems on one unit and the associated Required Actions must be entered. Use of a NSWS pump and associated diesel generator on a shutdown unit to support continued operation (> 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) of a unit with an inoperable NSWS pump is prohibited. A shutdown unit supplying its associated emergency power source (1 EMXG/2EMXH) cannot be credited for OPERABILITY of components supporting the operating unit.

APPLICABILITY In MODES 1, 2, 3, and 4, the NSWS is a normally operating system that is required to support the OPERABILITY of the equipment serviced by the NSWS and required to be OPERABLE in these MODES.

In MODES 5 and 6, the requirements of the NSWS are determined by the systems it supports.

ACTIONS A. 1 If one NSWS train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, the remaining OPERABLE NSWS train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE NSWS train could result in loss of NSWS function. Due to the shared nature of the NSWS, both units are required to enter a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Action when a NSWS Train becomes inoperable on either unit. Required Action A.1 is modified by two Notes. The first Note indicates that the applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources-Operating," should be entered if an inoperable NSWS train results in an inoperable emergency diesel generator. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops-MODE 4," should be entered if an inoperable NSWS train results in an inoperable decay heat removal train Catawba Units 1 and 2 B 3.7.8-3 Revision No. 5

NSWS B 3.7.8 BASES ACTIONS (continued)

(RHR). An example of when these Notes should be applied is with both units' loop 'A' NSWS pumps inoperable, both units' 'A' emergency diesel generators and both units' 'A' RHR systems should be declared inoperable and appropriate Actions entered. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this time period.

B._1 While the NSWS is operating in the single supply header alignment, one of the supply headers is removed from service in support of planned maintenance or modification activities associated with the supply header that is taken out of service. In this configuration, each NSWS train is considered OPERABLE with the required NSWS flow to safety related equipment being fed through the remaining OPERABLE NSWS supply header. While the NSWS is operating in the single supply header alignment, an NSWS train is considered OPERABLE during MODES 1, 2, 3, and 4 when:

a. The associated train related NSWS pumps are OPERABLE; and

b. The associated piping (except for the supply header that is taken out of service), valves, and instrumentation and controls required to perform the safety related function are OPERABLE.

If one NSWS supply header is inoperable due to the NSWS being aligned for single supply header operation, the NSWS supply header must be restored to OPERABLE status within 30 days. Dual supply header operation is the normal alignment of the NSWS. The Completion Time of 30 days is supported by probabilistic risk analysis. While in Condition B, the single supply header is adequate to perform the heat removal function for all required safety related equipment for both safety trains.

Due to the shared nature of the NSWS, both units are required to enter this Condition when the NSWS is aligned for single supply header operation. In order to prevent the potential for NSWS pump runout, the single NSWS pump flow balance alignment is prohibited while the NSWS is aligned for single supply header operation.

Catawba Units 1 and 2 B 3.7.8-4 Revision No. 5

NSWS B 3.7.8 BASES ACTIONS (continued)

Condition B is modified by three Notes. Note 1 states that entry into this Condition shall only be allowed for pre-planned activities as described in the Bases of this Specification. Condition B is only allowed to be entered in support of planned maintenance or modification activities associated with the supply header that is taken out of service. An example of a situation for which entry into this Condition is allowed is refurbishment of a supply header. Entry into this Condition is not allowed in response to unplanned events or for other events involving the NSWS. Examples of situations for which entry into this Condition is prohibited are emergent repair of discovered piping leaks and other component failures. For unplanned events or other events involving the NSWS, Condition A must be entered. Note 2 requires immediate entry into Condition A of this LCO if one or more NSWS components become inoperable while in this Condition and one NSWS train remains OPERABLE. With one remaining OPERABLE NSWS train, the NSWS can still perform its safety related function. However, with one inoperable NSWS train, the NSWS cannot be assured of performing its safety related function in the event of a single failure of another NSWS component. The most limiting single failure is the failure of an NSWS pit to automatically transfer from Lake Wylie to the SNSWP during a seismic event. While the loss of any NSWS component subject to the requirements of this LCO can result in the entry into Condition A, the most common example is the inoperability of an NSWS pump. This occurs during periodic testing of the emergency diesel generators. Inoperability of an emergency diesel generator renders its associated NSWS pump inoperable. Note 3 requires immediate entry into LCO 3.0.3 if one or more NSWS components become inoperable while in this Condition and no NSWS train remains OPERABLE. In this case, the NSWS cannot perform its safety related function.

C.1 While the NSWS is operating in the single Auxiliary Building discharge header alignment, one of the Unit 2 Auxiliary Building discharge headers is removed from service in support of planned maintenance or modification activities associated with the Auxiliary Building discharge header that is taken out of service. In this configuration, each NSWS train is considered OPERABLE with the required NSWS flow to safety related equipment being discharged through the remaining OPERABLE NSWS Auxiliary Building discharge header. While the NSWS is operating in the single Auxiliary Building discharge header alignment, an NSWS train is considered OPERABLE during MODES 1, 2, 3, and 4 when:

Catawba Units 1 and 2 B 3.7.8-5 Revision No. 5

NSWS B 3.7.8 BASES ACTIONS (continued)

a. The associated train related NSWS pumps are OPERABLE (except that for the Auxiliary Building discharge header that is removed from service, its associated train related NSWS pump may also be removed from service); and

b. The associated piping (except for the Auxiliary Building discharge header that is taken out of service), valves, and instrumentation and controls required to perform the safety related function are OPERABLE.

When in the single Auxiliary Building discharge header alignment with the NSWS Train A discharge header inoperable, the NSWS piping between valves 1RNP19 and 1RN63A is isolated. Likewise, when in the single Auxiliary Building discharge header alignment with the NSWS Train B discharge header inoperable, the NSWS piping between valves 1 RNP20 and 1RN58B is isolated.

Operation of the NSWS in the single supply header alignment and the single Auxiliary Building discharge header alignment at the same time is prohibited.

If one NSWS Auxiliary Building discharge header is inoperable due to the NSWS being aligned for single Auxiliary Building discharge header operation, the NSWS Auxiliary Building discharge header must be restored to OPERABLE status within 14 days. Dual Auxiliary Building discharge header operation is the normal alignment of the NSWS. The Completion Time of 14 days is supported by probabilistic risk analysis.

While in Condition C, the single Auxiliary Building discharge header is adequate to perform the heat removal function for all required safety related equipment for its respective safety train. Due to the design of the NSWS, only the operating unit is required to enter this Condition when the NSWS is aligned for single Auxiliary Building discharge header operation. Pre-planned activities requiring entry into this Condition are only performed with Unit 2 in an outage (MODE 5, 6, or defueled).

Condition C is modified by three Notes. Note 1 states that entry into this Condition shall only be allowed for Unit 1 and for pre-planned activities as described in the Bases of this Specification. Condition C is only allowed to be entered in support of planned maintenance or modification activities associated with the Auxiliary Building discharge header that is taken out of service. An example of a situation for which entry into this Condition is allowed is refurbishment of an Auxiliary Building discharge header. Entry into this Condition is not allowed in response to unplanned events or for other events involving the NSWS. Examples of situations for which entry Catawba Units 1 and 2 B 3.7.8-6 Revision No. 5

NSWS B 3.7.8 BASES ACTIONS (continued) into this Condition is prohibited are emergent repair of discovered piping leaks and other component failures. For unplanned events or other events involving the NSWS, Condition A must be entered. In addition, Note 1 states that entry into this Condition shall not be allowed while Unit 2 is in MODE 1, 2, 3, or 4. Entry into this Condition is only allowed while the LCO is not applicable to Unit 2. Note 2 requires immediate entry into Condition A of this LCO if one or more Unit 1 required NSWS components become inoperable while in this Condition and one NSWS train remains OPERABLE. With one remaining OPERABLE NSWS train, the NSWS can still perform its safety related function. However, with one inoperable NSWS train, the NSWS cannot be assured of performing its safety related function in the event of a single failure of another NSWS component. While the loss of any NSWS component subject to the requirements of this LCO can result in the entry into Condition A, the most common example is the inoperability of an NSWS pump. This occurs during periodic testing of the emergency diesel generators.

Inoperability of an emergency diesel generator renders its associated NSWS pump inoperable. Note 3 requires immediate entry into LCO 3.0.3 if one or more Unit 1 required NSWS components become inoperable while in this Condition and no NSWS train remains OPERABLE. In this case, the NSWS cannot perform its safety related function.

D.1 and D.2 If the NSWS train cannot be restored to OPERABLE status within the associated Completion Time, if the NSWS supply header cannot be restored to OPERABLE status within the associated Completion Time, or if the NSWS Auxiliary Building discharge header cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

Catawba Units 1 and 2 B 3.7.8-7 Revision No. 5

NSWS B 3.7.8 BASES SURVEILLANCE SR 3.7.8.1 REQUIREMENTS This SR is modified by a Note indicating that the isolation of the NSWS components or systems may render those components inoperable, but does not affect the OPERABILITY of the NSWS.

Verifying the correct alignment for manual, power operated, and automatic valves in the NSWS flow path provides assurance that the proper flow paths exist for NSWS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to being locked, sealed, or secured. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.7.8.2 This SR verifies proper automatic operation of the NSWS valves on an actual or simulated actuation signal. The signals that cause the actuation are from Safety Injection and Phase 'B' isolation. The NSWS is a normally operating system that cannot be fully actuated as part of normal testing. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that states that the SR is not required to be met for valves that are maintained in position to support NSWS single supply or discharge header operation. When the NSWS is placed in this alignment, certain automatic valves in the system are maintained in position and will not automatically reposition in response to an actuation signal while the NSWS is in this alignment.

SR 3.7.8.3 This SR verifies proper automatic operation of the NSWS pumps on an actual or simulated actuation signal. The signals that cause the actuation are from Safety Injection and Loss of Offsite Power. The NSWS is a normally operating system that cannot be fully actuated as part of normal Catawba Units 1 and 2 B 3.7.8-8 Revision No. 5

NSWS B 3.7.8 BASES SURVEILLANCE REQUIREMENTS (continued) testing during normal operation. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 9.2.

2. UFSAR, Section 6.2.

3. UFSAR, Section 5.4.

4. 10 CFR 50.36, Technical Specifications, (c)(2)(ii).

Catawba Units 1 and 2 B 3.7.8-9 Revision No. 5