ML17264A031: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(Created page by program invented by StriderTol)
Line 86: Line 86:
3.0 EVALUATION The NRR staff reviewed the licensing and design bases history of the ONS single failure criterion for analyzing electrical failure vulnerabilities between medium-voltage AC power systems and low voltage DC circuits. This review involved examination of NRC correspondence with the licensee, safety evaluations for license amendments, the CDBI inspection report,   
3.0 EVALUATION The NRR staff reviewed the licensing and design bases history of the ONS single failure criterion for analyzing electrical failure vulnerabilities between medium-voltage AC power systems and low voltage DC circuits. This review involved examination of NRC correspondence with the licensee, safety evaluations for license amendments, the CDBI inspection report,   
- 10 -  Oconee UFSAR Section 8.0, and the licensee's letters dated May 11, and August 7, 2015, and August 15, 2016.
- 10 -  Oconee UFSAR Section 8.0, and the licensee's letters dated May 11, and August 7, 2015, and August 15, 2016.
History of ONS Licensing Basis for Electric Power Systems and Associated Interfacing Systems  The Duke Power Company, by application dated November 28, 1966, and as subsequently amended, requested a license to construct and operate three pressurized-water reactors, identified as Units 1, 2, and 3 in Oconee County, South Carolina. In supplement 1 to the Oconee construction application dated April 1, 1967 prior to the issuance of construction permits November 6, 1967, Oconee stated conformance to the "Proposed IEEE Criteria for Nuclear Power Plant Protection Systems," see ADAMS Accession No. ML15215A125. This standard was issued as IEEE Std. 279-1968. The AEC reported the results of its review prior to construction in a safety evaluation dated August 4, 1967 (ADAMS Accession No. ML15212A648). On June 2, 1969, Duke Power filed the FSAR required by 10 CFR 50.34(b) for each unit. The AEC regulatory staff's review of the FSAR, as amended, considered all three ONS units. However, Unit 1 was the only unit whose state of completion warranted issuance of an operating license at that time and the safety evaluation report (SER)for Unit 1 was published on December 29, 1970 (ADAMS Accession No. ML12276A270). Section 8.0, "Instrumentation, Control, and Power Systems," of the SER states, in part, that "[t]he adequacy of the reactor protection system instrumentation for Oconee Unit 1 was evaluated by comparison with the Commission's Proposed General Design Criteria published July 11, 1967 [(32 FR 10213)], and the proposed IEEE Criteria for Nuclear Power Plant Protection Systems (IEEE Std. 279) dated August 28, 1968."  Since the original regulatory staff's review of ONS, Unit 1, a supplemental review of the plant emergency core cooling systems (ECCS) was performed in accordance with the criteria described in an Interim Policy Statement issued on June 25, 1971, and published in the Federal Register on June 29, 1971 (36 FR 12247). The safety evaluation based upon this review was issued on March 24, 1972, as Supplement No. 1 to the SER for ONS, Unit 1 (ADAMS Accession No. ML13179A044). On July 6, 1973, the AEC staff issued the SER for ONS, Units 2 and 3 (ADAMS Accession No. ML12276A272). The safety evaluation and conclusions presented in Supplement No. 1 are applicable to ONS, Units 2 and 3. The staff's safety review with respect to issuing operating licenses for Units 2 and 3 was based on the applicant's FSAR (Amendment 7) and subsequent Amendments 8 through 41 inclusive (Amendments 1 through 6 were related to the construction permit review).  
History of ONS Licensing Basis for Electric Power Systems and Associated Interfacing Systems  The Duke Power Company, by application dated November 28, 1966, and as subsequently amended, requested a license to construct and operate three pressurized-water reactors, identified as Units 1, 2, and 3 in Oconee County, South Carolina. In supplement 1 to the Oconee construction application dated April 1, 1967 prior to the issuance of construction permits November 6, 1967, Oconee stated conformance to the "Proposed IEEE Criteria for Nuclear Power Plant Protection Systems," see ADAMS Accession No. ML15215A125. This standard was issued as IEEE Std. 279-1968. The AEC reported the results of its review prior to construction in a safety evaluation dated August 4, 1967 (ADAMS Accession No. ML15212A648). On June 2, 1969, Duke Power filed the FSAR required by 10 CFR 50.34(b) for each unit. The AEC regulatory staff's review of the FSAR, as amended, considered all three ONS units. However, Unit 1 was the only unit whose state of completion warranted issuance of an operating license at that time and the safety evaluation report (SER) for Unit 1 was published on December 29, 1970 (ADAMS Accession No. ML12276A270). Section 8.0, "Instrumentation, Control, and Power Systems," of the SER states, in part, that "[t]he adequacy of the reactor protection system instrumentation for Oconee Unit 1 was evaluated by comparison with the Commission's Proposed General Design Criteria published July 11, 1967 [(32 FR 10213)], and the proposed IEEE Criteria for Nuclear Power Plant Protection Systems (IEEE Std. 279) dated August 28, 1968."  Since the original regulatory staff's review of ONS, Unit 1, a supplemental review of the plant emergency core cooling systems (ECCS) was performed in accordance with the criteria described in an Interim Policy Statement issued on June 25, 1971, and published in the Federal Register on June 29, 1971 (36 FR 12247). The safety evaluation based upon this review was issued on March 24, 1972, as Supplement No. 1 to the SER for ONS, Unit 1 (ADAMS Accession No. ML13179A044). On July 6, 1973, the AEC staff issued the SER for ONS, Units 2 and 3 (ADAMS Accession No. ML12276A272). The safety evaluation and conclusions presented in Supplement No. 1 are applicable to ONS, Units 2 and 3. The staff's safety review with respect to issuing operating licenses for Units 2 and 3 was based on the applicant's FSAR (Amendment 7) and subsequent Amendments 8 through 41 inclusive (Amendments 1 through 6 were related to the construction permit review).  


ONS AEC GDC and UFSAR Section 1.3, "Principal Design Criteria," of the ONS FSAR dated August 11, 1970, states:  "The principal design criteria for Oconee Units 1, 2, and 3 were developed in consideration of the 70 General Design Criteria for Nuclear Power Plant Construction Permits proposed by the AEC in a proposed rule-making published for 10 CFR 50 in the Federal Register of July 11, 1967 [32 FR 10213]."
ONS AEC GDC and UFSAR Section 1.3, "Principal Design Criteria," of the ONS FSAR dated August 11, 1970, states:  "The principal design criteria for Oconee Units 1, 2, and 3 were developed in consideration of the 70 General Design Criteria for Nuclear Power Plant Construction Permits proposed by the AEC in a proposed rule-making published for 10 CFR 50 in the Federal Register of July 11, 1967 [32 FR 10213]."
Line 174: Line 174:
The NRC staff's letter issuing the license amendments, and the safety evaluation supporting the amendments, stated that the staff did not review or approve the as-installed PSW electrical system cable configurations. Duke Energy made changes to the PSW electrical system configurations and installed the PSW electrical cables and power supplies under the provisions of 10 CFR 50.59; therefore, those parts of the system were not included in the scope of the NRC staff's review for these amendments.   
The NRC staff's letter issuing the license amendments, and the safety evaluation supporting the amendments, stated that the staff did not review or approve the as-installed PSW electrical system cable configurations. Duke Energy made changes to the PSW electrical system configurations and installed the PSW electrical cables and power supplies under the provisions of 10 CFR 50.59; therefore, those parts of the system were not included in the scope of the NRC staff's review for these amendments.   


3.1 Response to Requested Actions  TIA Question 1 1. What are the ONS licensing basis, design basis, and NRC regulations and requirements for analyzing electrical failure vulnerabilities (single failure or otherwise) between medium voltage AC power and low voltage DC circuits as presented in this TIA?                                                  4 The licensee's requested change to its licensing basis was not compelled by a new or modified NRC requirement, or interpretation of an existing NRC requirement. Therefore, under the principle described in footnote 2 of the July 14, 2010, General Counsel's letter to the Nuclear Energy Institute (NEI) (ADAMS Accession No. ML101960180), the NRC staff could apply new requirements to the ONS which would not be considered backfitting under 10 CFR 50.109.   
3.1 Response to Requested Actions  TIA Question 1
: 1. What are the ONS licensing basis, design basis, and NRC regulations and requirements for analyzing electrical failure vulnerabilities (single failure or otherwise) between medium voltage AC power and low voltage DC circuits as presented in this TIA?                                                  4 The licensee's requested change to its licensing basis was not compelled by a new or modified NRC requirement, or interpretation of an existing NRC requirement. Therefore, under the principle described in footnote 2 of the July 14, 2010, General Counsel's letter to the Nuclear Energy Institute (NEI) (ADAMS Accession No. ML101960180), the NRC staff could apply new requirements to the ONS which would not be considered backfitting under 10 CFR 50.109.   
- 22 -  Response to TIA Question 1  The ONS licenses for Units 1, 2, and 3 require Duke Energy to meet the conditions and requirements pursuant to Section 104b of the Act and 10 CFR Part 50, "Domestic Licensing of Production and Utilization Facilities," to possess, use, and operate the facility. Accordingly, the following requirements are applicable to ONS.   
- 22 -  Response to TIA Question 1  The ONS licenses for Units 1, 2, and 3 require Duke Energy to meet the conditions and requirements pursuant to Section 104b of the Act and 10 CFR Part 50, "Domestic Licensing of Production and Utilization Facilities," to possess, use, and operate the facility. Accordingly, the following requirements are applicable to ONS.   
: 1. The regulation at 10 CFR 50.54(jj) which requires that "[s]tructures, systems, and components subject to the codes and standards in 10 CFR 50.55a must be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety function to be performed."  Note:  As indicated in 36 FR 11423 (June 12, 1971), quality standards means "that protection systems (electrical and mechanical sensors and associated circuitry) should, as a minimum, be designed to meet the criteria developed by the Institute of Electrical and Electronics Engineers (IEEE)."   
: 1. The regulation at 10 CFR 50.54(jj) which requires that "[s]tructures, systems, and components subject to the codes and standards in 10 CFR 50.55a must be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety function to be performed."  Note:  As indicated in 36 FR 11423 (June 12, 1971), quality standards means "that protection systems (electrical and mechanical sensors and associated circuitry) should, as a minimum, be designed to meet the criteria developed by the Institute of Electrical and Electronics Engineers (IEEE)."   
Line 190: Line 191:
§ 50.59 but not previously submitted to the Commission."  _______________ 1  Effects of changes includes appropriate revisions of descriptions in the FSAR such that the FSAR (as updated) is complete and accurate.
§ 50.59 but not previously submitted to the Commission."  _______________ 1  Effects of changes includes appropriate revisions of descriptions in the FSAR such that the FSAR (as updated) is complete and accurate.
In addition to the above, ONS' licensing basis included the elements described in Section 3.0.
In addition to the above, ONS' licensing basis included the elements described in Section 3.0.
TIA Question 2.a 2. Within [ONS's] licensing basis:
TIA Question 2.a
: 2. Within [ONS's] licensing basis:
a. Are medium voltage power cables that are intended to provide emergency power to the RPS/ESPS equipment as well as provide the motive force to the actuated ESPS equipment during a chapter 15 event within the scope of IEEE Standard 279-1971?
a. Are medium voltage power cables that are intended to provide emergency power to the RPS/ESPS equipment as well as provide the motive force to the actuated ESPS equipment during a chapter 15 event within the scope of IEEE Standard 279-1971?
* Must such power cables be considered under Section 3 "Design Basis" item 7 for transient conditions?
* Must such power cables be considered under Section 3 "Design Basis" item 7 for transient conditions?
Line 306: Line 308:
- 2 -  Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response standards at the time of initial ONS licensing, Duke Energy, with awareness by the Atomic Energy Commission (AEC), developed its own single failure criterion, using correspondence from the AEC and available mechanical and electrical codes at the time. In addition, ONS has not adopted IEEE Standard 379 or the use of the NRC-referenced version of SRP 8.2 in any subsequent ONS-related licensing basis docketed correspondence.
- 2 -  Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response standards at the time of initial ONS licensing, Duke Energy, with awareness by the Atomic Energy Commission (AEC), developed its own single failure criterion, using correspondence from the AEC and available mechanical and electrical codes at the time. In addition, ONS has not adopted IEEE Standard 379 or the use of the NRC-referenced version of SRP 8.2 in any subsequent ONS-related licensing basis docketed correspondence.
The NRC has been aware of the ONS approach to satisfying single failure criteria as a result of decades of specific NRC review of related documents and Duke Energy submittals to the NRC. As an example, ONS specification OSS-254.00-00-4013, "Design Basis Specification for the Oconee Single Failure Criterion (Ref. 4)," provides the overall site guidance on the application of the single failure criterion. The ONS licensing basis is stated in Section 3.2.1.4.1, "Credible Failures," which states, "Application of the single failure criterion does not require that all failures be assumed. Only those failures with a credible chance of occurring must be considered in evaluations of system design bases...."  As discussed throughout this enclosure, ONS has consistently determined that certain failures, which the NRC relies on, are not credible. The staff's Technical Evaluation focused on standards and did not address the design features that preclude the failure mechanisms raised by the TIA.
The NRC has been aware of the ONS approach to satisfying single failure criteria as a result of decades of specific NRC review of related documents and Duke Energy submittals to the NRC. As an example, ONS specification OSS-254.00-00-4013, "Design Basis Specification for the Oconee Single Failure Criterion (Ref. 4)," provides the overall site guidance on the application of the single failure criterion. The ONS licensing basis is stated in Section 3.2.1.4.1, "Credible Failures," which states, "Application of the single failure criterion does not require that all failures be assumed. Only those failures with a credible chance of occurring must be considered in evaluations of system design bases...."  As discussed throughout this enclosure, ONS has consistently determined that certain failures, which the NRC relies on, are not credible. The staff's Technical Evaluation focused on standards and did not address the design features that preclude the failure mechanisms raised by the TIA.
Furthermore, NRR undertook a formal review of the ONS Electrical Distribution System (EDS) in August 1995.  [A request for additional information (RAI)] response (Ref. 5)stated, in part, that, "In general, only those systems or components with a credible chance of failure are assumed to fail. ONS is not aware of a requirement that all possible failures must be assumed. Also, components are assumed the referenced version of the SRP Section 8.2 is not part of the ONS licensing basis. The TIA relied on the ONS AEC GDC; included in the UFSAR IEEE Std. 279-1968 and single failure criteria requirements in IEEE Std. 279-1971 as discussed in the Evaluation section.
Furthermore, NRR undertook a formal review of the ONS Electrical Distribution System (EDS) in August 1995.  [A request for additional information (RAI)] response (Ref. 5) stated, in part, that, "In general, only those systems or components with a credible chance of failure are assumed to fail. ONS is not aware of a requirement that all possible failures must be assumed. Also, components are assumed the referenced version of the SRP Section 8.2 is not part of the ONS licensing basis. The TIA relied on the ONS AEC GDC; included in the UFSAR IEEE Std. 279-1968 and single failure criteria requirements in IEEE Std. 279-1971 as discussed in the Evaluation section.
The NRC agrees that only credible failures need to be addressed. In this TIA, as discussed in the Evaluation section, the NRC believes that the failure modes in question are credible and must be considered. The NRC does not believe that the ONS design features (bronze shielding) precludes the failure mechanisms.   
The NRC agrees that only credible failures need to be addressed. In this TIA, as discussed in the Evaluation section, the NRC believes that the failure modes in question are credible and must be considered. The NRC does not believe that the ONS design features (bronze shielding) precludes the failure mechanisms.   
- 3 -  Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response to fail only in a credible failure mode."  The necessity that the failure mode be credible forms the basis for ONS' decisions regarding separation, which are at issue. In its final report (Ref. 6), NRR acknowledged that, "Because Oconee was not licensed to 10 CFR 50, Appendix A, the plant specific single failure definition for Oconee remains valid and in effect with no additional requirements on the electrical power systems [as a result of 10 CFR 50.46 or 10 CFR 50, Appendix K]." (p. 113)  Therefore, the staff erred in its reliance on IEEE-379 in making its conclusion. This error appears in multiple locations within the document. Comment No. 4 The wording in the May 13, 1976 (Ref. 7), letter states that "the Oconee onsite emergency [alternating current (AC)] and [direct current (DC)] power systems conform to the single failure requirements of IEEE 279-1971."  The single failure requirements are contained in Section 4.2 of that standard. ONS did not commit to the rest of IEEE 279-1971 (Ref. 8) nor did it imply to do so in any subsequent correspondence. For the TIA to now reference other sections of IEEE 279-1971 (Ref. 8) and portray them as being within the ONS licensing basis (i.e., applicable to ONS) incorrectly portrays the commitment Duke Energy made in its May 13, 1976 letter. Duke is correct in asserting that the 1976 Parker letter stated, "The design of the Oconee onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE 279-1971" (emphasis added). The NRC will correct the error in the TIA response; however, the staff notes that single failure requirements are included in Sections 4.2, 4.7, 4.11, and 4.17 of IEEE Std. 279-1971. As stated in the TIA response, the design basis of the Oconee onsite emergency AC and DC power systems requires conformance to the single failure requirements of IEEE Std. 279-1971. Single failure requirements are specifically addressed in response to questions 2a, 2b, 2c, 2d and 2f. The basic definition and requirement for single failure criterion in Section 4.2 of IEEE Std. 279-1971 is adequate to maintain staff's position for the responses in this TIA. However, Section 4.7 is part of the single failure criteria and helps to understand the intent of 'separation/isolation criterion' and how to ensure that single failure vulnerabilities do not have adverse impact on related or redundant system. Section 4.7.2 elaborates on examples of credible failures and potential failures of isolation devices. Section 4.7.3 elaborates Yes   
- 3 -  Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response to fail only in a credible failure mode."  The necessity that the failure mode be credible forms the basis for ONS' decisions regarding separation, which are at issue. In its final report (Ref. 6), NRR acknowledged that, "Because Oconee was not licensed to 10 CFR 50, Appendix A, the plant specific single failure definition for Oconee remains valid and in effect with no additional requirements on the electrical power systems [as a result of 10 CFR 50.46 or 10 CFR 50, Appendix K]." (p. 113)  Therefore, the staff erred in its reliance on IEEE-379 in making its conclusion. This error appears in multiple locations within the document. Comment No. 4 The wording in the May 13, 1976 (Ref. 7), letter states that "the Oconee onsite emergency [alternating current (AC)] and [direct current (DC)] power systems conform to the single failure requirements of IEEE 279-1971."  The single failure requirements are contained in Section 4.2 of that standard. ONS did not commit to the rest of IEEE 279-1971 (Ref. 8) nor did it imply to do so in any subsequent correspondence. For the TIA to now reference other sections of IEEE 279-1971 (Ref. 8) and portray them as being within the ONS licensing basis (i.e., applicable to ONS) incorrectly portrays the commitment Duke Energy made in its May 13, 1976 letter. Duke is correct in asserting that the 1976 Parker letter stated, "The design of the Oconee onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE 279-1971" (emphasis added). The NRC will correct the error in the TIA response; however, the staff notes that single failure requirements are included in Sections 4.2, 4.7, 4.11, and 4.17 of IEEE Std. 279-1971. As stated in the TIA response, the design basis of the Oconee onsite emergency AC and DC power systems requires conformance to the single failure requirements of IEEE Std. 279-1971. Single failure requirements are specifically addressed in response to questions 2a, 2b, 2c, 2d and 2f. The basic definition and requirement for single failure criterion in Section 4.2 of IEEE Std. 279-1971 is adequate to maintain staff's position for the responses in this TIA. However, Section 4.7 is part of the single failure criteria and helps to understand the intent of 'separation/isolation criterion' and how to ensure that single failure vulnerabilities do not have adverse impact on related or redundant system. Section 4.7.2 elaborates on examples of credible failures and potential failures of isolation devices. Section 4.7.3 elaborates Yes   
Line 313: Line 315:
The ONS SER dated Dec. 29, 1970 (Ref. 11), (page 54, Section 8.5, "Cable and Equipment Separation and Fire Prevention"), endorses the staff's acceptance of Oconee's cable separation design through the following statements:  "We have reviewed the applicant's design and provisions and installation arrangement plans relating to (1) the preservation of the independence of redundant safety equipment by means of identification and separation, and (2) the prevention of fires spreading through derating of power cables and proper tray loading. We have found these design provision and installation arrangements acceptable." The staff also notes that until 2010, in this FSAR section, the final sentence of this paragraph stated:  "With this type construction fire stops as such are not required."  This indicates the intent of using metallically armored and protected cable systems was as a fire protection feature to eliminate the use of fire stops, not for physical separation of trains. This sentence was deleted by an FSAR change 09-51.
The ONS SER dated Dec. 29, 1970 (Ref. 11), (page 54, Section 8.5, "Cable and Equipment Separation and Fire Prevention"), endorses the staff's acceptance of Oconee's cable separation design through the following statements:  "We have reviewed the applicant's design and provisions and installation arrangement plans relating to (1) the preservation of the independence of redundant safety equipment by means of identification and separation, and (2) the prevention of fires spreading through derating of power cables and proper tray loading. We have found these design provision and installation arrangements acceptable." The staff also notes that until 2010, in this FSAR section, the final sentence of this paragraph stated:  "With this type construction fire stops as such are not required."  This indicates the intent of using metallically armored and protected cable systems was as a fire protection feature to eliminate the use of fire stops, not for physical separation of trains. This sentence was deleted by an FSAR change 09-51.
The licensee referenced the AEC's approval of "five inches rail-to-rail space between all vertical trays."  The licensee did not identify any part of the TIA response that is inconsistent with the AEC's approval. The licensee referred to the NRC's approval of ONS SER dated December 29, 1970. The licensee did not identify how the portion of the NRC approval referenced by the licensee relates to the discussion of cable separation in Section 3.0, Staff's Technical Evaluation, on page 14 of the TIA response.   
The licensee referenced the AEC's approval of "five inches rail-to-rail space between all vertical trays."  The licensee did not identify any part of the TIA response that is inconsistent with the AEC's approval. The licensee referred to the NRC's approval of ONS SER dated December 29, 1970. The licensee did not identify how the portion of the NRC approval referenced by the licensee relates to the discussion of cable separation in Section 3.0, Staff's Technical Evaluation, on page 14 of the TIA response.   
- 6 -  Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response Comment No. 8  (Staff discussion of history of ONS licensing basis for electric power systems and associated interfacing systems) The staff's interpretation of the ONS licensing basis with respect to the applicability of IEEE 603 and IEEE 379 to systems beyond [reactor protection system/engineered safeguards protection system (RPS/ESPS)] is inconsistent with licensing commitments made by ONS to the NRC. The ONS commitment to these standards is limited to the "new digital" portion of the RPS/ESPS upgrade. The January 2008 [license amendment request (LAR)] (Ref. 14)stated that "IEEE Standard 603-1991 applies only to portions of the RPS/ESPS affected by the design change."  Furthermore, the ONS [failure modes and effects analysis (FMEA)] calculation (Ref. 15) that was reviewed and referenced in the January 2010 SER (Ref. 16) for LAR 2007-09 (Ref. 14) clearly states that IEEE-Standard 603 is only applied to the digital components. The NRC agrees that amendment Nos. 366, 368, and 367 for ONS Units 1, 2, and 3 for LAR 2007-09 (ADAMS Accession No. ML100220016) incorporated IEEE Std. 603-1998 and 379-1994 as the licensing basis criteria for the single-failure criterion, independence and separation requirements of the portion of the RPS/ESPS affected by the design change. However, the ONS FMEA for the digital RPS/ESPS includes consideration of impacts of cable faults on the digital RPS/ESPS circuits. These standards are part of the ONS licensing basis for the FMEA for the digital components. The TIA has been revised to clarify this position. Yes 3.1, "Response to Requested Actions"  Comment No. 9  (Ref: TIA Question 1) As discussed in several Duke Energy Comments in this enclosure, it appears the draft TIA response incorrectly describes the ONS licensing basis in that the draft TIA response does not recognize elements of the licensing basis and/or it incorrectly expands aspects of the licensing basis to systems and components beyond that which was identified in licensee commitments. The staff disagrees with the comment. The staff has performed an extensive examination of all the NRC correspondence with Duke Energy, all relevant safety evaluations for license amendments, the CDBI inspection report, all applicable sections of the ONS UFSAR, and the background information provided by the CDBI inspection team in the TIA, including Duke Energy letters dated May 11, 2015 (ADAMS Accession No. ML15139A049), and August 7, 2015 (ADAMS Accession No. ML15224A370), and the NRC independent review team's feedback. Based on the review of these documents, the staff has correctly assessed what the ONS licensing basis is and has documented that in Section 3.0 of the draft TIA response. No Comment No. 10  (Ref: TIA Question 2.a) Because ONS was issued construction permits on November 6, 1967 (Ref. 17), "protection systems must be consistent with their licensing basis" in order to satisfy the requirements of 10 CFR 50.55a(h)(2). As noted in Duke Energy Comment #4, the only portion of IEEE Standard 279-1971 that is a part of the ONS licensing basis for the onsite AC and DC emergency power systems are The staff agrees that the single failure criteria requirements of IEEE Std. 279-1971 is part of the ONS licensing basis. IEEE Std. 279 1971 Section 4.2, "Single Failure Criterion," states, "'Single failure' includes such events as the shorting or open-circuiting of interconnecting signal or power cables."  Yes   
- 6 -  Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response Comment No. 8  (Staff discussion of history of ONS licensing basis for electric power systems and associated interfacing systems) The staff's interpretation of the ONS licensing basis with respect to the applicability of IEEE 603 and IEEE 379 to systems beyond [reactor protection system/engineered safeguards protection system (RPS/ESPS)] is inconsistent with licensing commitments made by ONS to the NRC. The ONS commitment to these standards is limited to the "new digital" portion of the RPS/ESPS upgrade. The January 2008 [license amendment request (LAR)] (Ref. 14) stated that "IEEE Standard 603-1991 applies only to portions of the RPS/ESPS affected by the design change."  Furthermore, the ONS [failure modes and effects analysis (FMEA)] calculation (Ref. 15) that was reviewed and referenced in the January 2010 SER (Ref. 16) for LAR 2007-09 (Ref. 14) clearly states that IEEE-Standard 603 is only applied to the digital components. The NRC agrees that amendment Nos. 366, 368, and 367 for ONS Units 1, 2, and 3 for LAR 2007-09 (ADAMS Accession No. ML100220016) incorporated IEEE Std. 603-1998 and 379-1994 as the licensing basis criteria for the single-failure criterion, independence and separation requirements of the portion of the RPS/ESPS affected by the design change. However, the ONS FMEA for the digital RPS/ESPS includes consideration of impacts of cable faults on the digital RPS/ESPS circuits. These standards are part of the ONS licensing basis for the FMEA for the digital components. The TIA has been revised to clarify this position. Yes 3.1, "Response to Requested Actions"  Comment No. 9  (Ref: TIA Question 1) As discussed in several Duke Energy Comments in this enclosure, it appears the draft TIA response incorrectly describes the ONS licensing basis in that the draft TIA response does not recognize elements of the licensing basis and/or it incorrectly expands aspects of the licensing basis to systems and components beyond that which was identified in licensee commitments. The staff disagrees with the comment. The staff has performed an extensive examination of all the NRC correspondence with Duke Energy, all relevant safety evaluations for license amendments, the CDBI inspection report, all applicable sections of the ONS UFSAR, and the background information provided by the CDBI inspection team in the TIA, including Duke Energy letters dated May 11, 2015 (ADAMS Accession No. ML15139A049), and August 7, 2015 (ADAMS Accession No. ML15224A370), and the NRC independent review team's feedback. Based on the review of these documents, the staff has correctly assessed what the ONS licensing basis is and has documented that in Section 3.0 of the draft TIA response. No Comment No. 10  (Ref: TIA Question 2.a) Because ONS was issued construction permits on November 6, 1967 (Ref. 17), "protection systems must be consistent with their licensing basis" in order to satisfy the requirements of 10 CFR 50.55a(h)(2). As noted in Duke Energy Comment #4, the only portion of IEEE Standard 279-1971 that is a part of the ONS licensing basis for the onsite AC and DC emergency power systems are The staff agrees that the single failure criteria requirements of IEEE Std. 279-1971 is part of the ONS licensing basis. IEEE Std. 279 1971 Section 4.2, "Single Failure Criterion," states, "'Single failure' includes such events as the shorting or open-circuiting of interconnecting signal or power cables."  Yes   
- 7 -  Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response the single failure requirements in Section 4.2. The staff is incorrect in stating that Section 3, "Design Basis," of the standard applies to the ONS power cables. Furthermore, as noted in Duke Energy Comment #8, it is also incorrect to apply IEEE Standard 603-1991 requirements to the ONS power cables that are the subject of this TIA. In addition, IEEE Standard 279-1971 does not include the term "multiphase."  The Note in IEEE 279-1971 Section 4.2 references "shorting or open-circuiting or interconnecting signal or power cables" and "credible malfunctions."  A multiphase fault can occur at either end of the subject cables, since that is the location where all three phases come together at a common connection point.
- 7 -  Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response the single failure requirements in Section 4.2. The staff is incorrect in stating that Section 3, "Design Basis," of the standard applies to the ONS power cables. Furthermore, as noted in Duke Energy Comment #8, it is also incorrect to apply IEEE Standard 603-1991 requirements to the ONS power cables that are the subject of this TIA. In addition, IEEE Standard 279-1971 does not include the term "multiphase."  The Note in IEEE 279-1971 Section 4.2 references "shorting or open-circuiting or interconnecting signal or power cables" and "credible malfunctions."  A multiphase fault can occur at either end of the subject cables, since that is the location where all three phases come together at a common connection point.
For faults at other locations, ONS' position on a "shorting" malfunction resulting in "multiphase" faults for the single-conductor medium voltage bronze tape power cables is as follows:
For faults at other locations, ONS' position on a "shorting" malfunction resulting in "multiphase" faults for the single-conductor medium voltage bronze tape power cables is as follows:

Revision as of 00:24, 29 March 2018

Draft Response to Task Interface Agreement 2014-05 to Licensee Oconee Design Analysis for Single Failure/Integration of Class 1E Direct Current Control Cabling in Raceways with High Energy Power Cabling (CAC Nos. MF4626, MF4627, MF4628)
ML17264A031
Person / Time
Site: Oconee  Duke Energy icon.png
Issue date: 09/29/2017
From: Benner E J
Special Projects and Process Branch
To: Gody A T
NRC/RGN-II
Johnston J, 415-1349
Shared Package
ML17264A030 List:
References
CAC MF4626, CAC MF4627, CAC MF4628
Download: ML17264A031 (69)
v • d • e


Text

Revised Draft September 2017 CONTACT: Jeanne D. Johnston, NRR/DORL 301-415-1349

MEMORANDUM TO: Anthony T. Gody, Director Division of Reactor Safety Region II FROM: Eric J. Benner, Deputy Director Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation SUBJECT: OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3 - FINAL RESPONSE TO TASK INTERFACE AGREEMENT 2014-05, DESIGN ANALYSIS FOR SINGLE FAILURE AND THE INTEGRATION OF CLASS 1E DIRECT CURRENT CONTROL CABLING IN RACEWAYS WITH HIGH ENERGY POWER CABLING (CAC NOS. MF4626, MF4627, AND MF4628)

By memorandum dated October 16, 2014 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML14290A136), U.S. Nuclear Regulatory Commission (NRC)

Region II requested assistance from the Office of Nuclear Reactor Regulation (NRR) to provide answers to several questions related to the compliance of cable configuration in certain recently installed underground raceways at Oconee Nuclear Station, Units 1, 2, and 3 (ONS), with the ONS licensing basis, design basis, and NRC regulations and requirements. These questions were specifically related to trench 3 and Protected Service Water Modifications discussed in Unresolved Item 05000269/2014007-05, 05000270/2014007-05, 05000287/2014007-05, Potential Unanalyzed Condition Associated with Emergency Power System. By letters dated May 11 and August 7, 2015 (ADAMS Accession Nos. ML15139A049 and ML15224A370, respectively), Duke Energy Carolinas, LLC (Duke Energy, the licensee), voluntarily submitted supplemental information to the NRC on the issues associated with Task Interface Agreement (TIA) 2014-05. In addition, in accordance with the NRR TIA Office Instruction, COM-106, Revision 5, "Control of Task Interface Agreements" (ADAMS Accession No. ML15219A174), on August 2, 2016, the NRC provided the licensee with the draft TIA 2014-05 response (ADAMS Accession No. ML16214A003) for a fact check. The licensee's letter dated August 15, 2016, provided its response (ADAMS Accession No. ML16231A451).

Developing a response to this TIA was extremely challenging for many reasons. These include (1) the licensee's challenges in accurately maintaining licensing basis documentation that contributed to a lack of specificity in ONS's licensing basis as it pertains to this issue; (2) challenges in establishing a clear regulatory position on the applicability on what constitutes single failure for the modification that was the source of the TIA; (3) efforts to address the A. Gody - 2 - supplemental information submitted by Duke Energy related to the substantial number of issues raised in the TIA; and (4) determining what constitutes a credible event as it pertains to this cable configuration. The NRC staff has completed its review of the licensee's response dated August 15, 2016, and made a number of clarifying changes in response to the licensee's fact check. However, the NRC's overall conclusions in the draft TIA response remain relatively unchanged. The staff's resolution to these comments is provided as an attachment to the enclosed final TIA response.

The NRC staff concludes that the ONS as-modified design does not comply with the licensing bases as it pertains to placing safety related cables in close proximity to high energy non-safety related energy sources in trench 3 and Protected Service Water Modifications discussed in Unresolved Item 05000269/2014007-05, 05000270/2014007-05, 05000287/2014007-05, Potential Unanalyzed Condition Associated with Emergency Power System. Furthermore, the staff is concerned that these modifications may have introduced potential failure modes that were not adequately analyzed. It is recognized by the NRC staff that the licensee has taken a number of actions to address the concerns raised in the TIA. The NRC staff has not yet assessed these actions. However, this TIA response is an important document as it clarifies but does not change the staff's position related to several key aspects of the licensing bases for ONS Units 1, 2, and 3.

Enclosure:

TIA 2014-05 Final Response Enclosure FINAL RESPONSE TO TASK INTERFACE AGREEMENT 2014-05, DESIGN BASES AND LICENSING BASIS FOR UNDERGROUND CABLE CONFIGURATIONS DUKE ENERGY CAROLINAS, LLC OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3 DOCKET NOS. 50-269, 50-270, AND 50-287 1.0 INTRODUCTION By memorandum dated October 16, 2014 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML14290A136), the U.S. Nuclear Regulatory Commission (NRC) Region II office requested the Office of Nuclear Reactor Regulation (NRR) to provide answers to the following Task Interface Agreement (TIA) questions regarding the licensing basis, design basis, and NRC regulations and requirements of the Oconee Nuclear Station (ONS), Units 1, 2, and 3, underground cable configurations, with emphasis on the following subjects:

1. What are the ONS licensing bases, design bases, and NRC regulations and requirements for analyzing electrical failure vulnerabilities (single failure or otherwise) between medium voltage [alternating current (AC)]

power and low voltage [direct current (DC)] circuits, as presented in this TIA? 2. Within [ONS's] licensing basis: a. Are medium voltage power cables that are intended to provide emergency power to the [reactor protection system/engineered safeguards protection system (RPS/ESPS)] equipment, as well as provide the motive force to the actuated ESPS equipment during a chapter 15 event within the scope of [Institute of Electrical and Electronics Engineers (IEEE) Standard] IEEE-279-1971?

  • Must such power cables be considered under Section 3 "Design Basis" item 7 for transient conditions?
  • Must potential multiphase short circuits or ground faults from such power cables be considered under Section 3, "Design Basis" item 8 for unusual events, etc.-?

- 2 - b. Do 3-phase medium voltage power cables, intended to provide Class 1E[1] emergency power to the RPS/ESPS equipment, represent "interconnecting signal or power cables," as discussed in 4.2 of IEEE-279? c. Can the timing of electrical failures assumed in analyses be limited to reduce the consequential damage as described in the "single failure memo to file (internal memo to file)"?

  • How is single failure timing applied to the commercial Fant power feeders and the QA-1 power feeders from the [Keowee Hydro Unit generators (KHUs)] to the [protected service water (PSW)] different than the Class 1E power feeders to the CT-4 transformer? d. Can ONS staff make any distinctions between passive and active electrical single failures as described in the "single failure memo to file"? e. Is the ONS staff required to analyze for combinations of multi-phase short circuits, as well as ground faults within trench 3 in order to be compliant with the regulations and/or the current licensing basis for ONS? f. Is the licensee required to analyze for consequential damage from electrical failures to the adjacent Class 1E safety systems?
  • Is the licensee required to assume that AC circuits could short to DC circuits?
  • If so, are the installed ONS 125 [Volts direct current (Vdc)] protective devices sufficient to mitigate the effects of AC voltages ranging from 2.5 [kiloVolt alternating current (kVac)] to 13.8kVac to prevent these voltages from propagating throughout the DC systems? g. Are all commercial, non-quality related (i.e., not QA-1 or QA-5) electrical components assumed to fail in the most limiting way possible?
  • Does the failure of one of these commercial components represent a "single failure" in the context of the ONS licensing basis? h. Can unrestrained cable whip in trench 3 be assumed to cause cable damage leading to secondary short circuits that could cause damage to the DC systems; should these effects of cable whip be analyzed? 1 Class 1E - The safety classification of the electric equipment and systems that are essential to emergency reactor shutdown, containment isolation, reactor core cooling, and containment and reactor heat removal, or are otherwise essential in preventing significant release of radioactive material to the environment. Note: For the purposes of this TIA, the terms Class 1E and "safety related" are interchangeable.

- 3 - i. Are overload currents as well as short circuit currents required to be evaluated to determine the most limiting results from electrical faults and component failures?

  • Do the results of such an analysis influence the required component separation to meet regulatory requirements and the ONS licensing basis? j. Can cable shielding or armor prevent short circuits or limit faulted currents and voltages?
  • Can the two wraps of bronze shielding tape in the licensee's current power cable configuration be considered equivalent to the steel interlocked armored cable described in the test report MCM-1354.00-0029.001?
  • Are the results of test report MCM-1354.00-0029.001 sufficient to demonstrate that electrical faults cannot propagate from one cable to another as described in the single failure [design basis document (DBD)], Section 3.3.6.1? k. Does the interconnected nature of the Class 1E DC systems in the ONS KHU start panels, and the Keowee hydro-station KHU start panels' present vulnerabilities where DC to DC interactions could disable the Keowee emergency power systems? 2.0 BACKGROUND COMPONENT DESIGN BASIS IINSPECTION FINDINGS On June 27, 2014, Region II documented the results of a Component Design Basis Inspection (CDBI) at ONS (Inspection Report 05000269/2014007; 05000270/2014007; 05000287/2014007) (ADAMS Accession No. ML14178A535). In that report, the CDBI team identified an unresolved item involving cable configurations in certain underground cable raceways that may not comply with the ONS licensing basis, design basis, and NRC regulations and requirements. Specifically, the CDBI team identified that in certain underground raceways, the licensee had implemented plant modifications to install Class 1E and non-Class 1E DC protection and control circuits adjacent to high-energy medium-voltage AC power cables. The circuits in question are coupled with and interrelated with the KHU emergency power, PSW, ESPS, RPS, and the KHU supervisory control systems. The CDBI team was concerned that the licensee did not appropriately consider all of the electrical system design requirements for vulnerabilities such as single failures, consequential failures, common cause failures, and circuit protection from short circuits and ground faults when implementing plant modifications to their onsite power systems. The licensee determined that it could perform the plant modifications under the provisions of Title 10 of the Code of Federal Regulations (10 CFR) 50.59, "Changes, tests and experiments," and thus those parts of the plant modifications were not evaluated or approved by the NRC staff. This is noted explicitly in Amendment Nos. 386, 388, and 387 dated August 13, 2014, for ONS, Units 1, 2, and 3 (ADAMS Accession No. ML14206A790).

- 4 - The CDBI team reviewed the electrical cable configurations (including power, protection, and control circuits) between the 87,500 KVA KHUs and the ONS emergency power transformer CT-4, between the KHUs and the PSW switchgear, and between the 100 kVac Fant line from alternate power system switchyard and the PSW switchgear. The CDBI team observed that there is one 4,000-foot-long raceway, identified as Trench #3, between the Keowee Hydro Station (KHS) and transformer CT-4 at ONS, and a new PSW raceway that extends another 2,000 feet past CT-4 and around the ONS site to the new PSW building, thus connecting each system through underground interconnected raceways. The CDBI team identified that these raceways contained 13.8-kVac power cabling, 4.16-kVac power cabling, Class 1E 125-Vdc cabling, and associated non-Class 1E 125-Vdc cabling adjacent to one another, in close proximity, along the entire route of raceways. The as-installed configuration contained Class 1E and non-Class 1E power cables mixing with protection and control cables of onsite power systems.

The CDBI team identified that the KHU 13.8-kVac power system was installed with a high impedance grounded system, which limits ground fault currents to approximately 17.5 amps. However, the commercial 13.8-kVac power feeders from the Fant line between the alternate power system switchyard and the PSW switchgear, located in the PSW raceway, were not protected against potentially catastrophic faults generated from the Fant 13.8-kVac line power feeders. The CDBI team identified that most of the Class 1E and associated non-Class 1E 125-Vdc cabling was connected directly or indirectly to the Class 1E DC busses at ONS and KHS. The DC system protective devices are not designed to mitigate the effects from medium voltage AC power short-circuiting to the 125-Vdc circuits.

Based on its review of the ONS licensing basis, the CDBI team could not determine the separation requirements for medium-voltage power cables, control cables, and safety-related and non-safety related cables in common raceways.

In addition, the CDBI team was concerned that a multi-phase power cable short circuit or a phase-to-ground power cable fault in the Fant line power feeders could result in:

  • A release of energy sufficient to damage or destroy adjacent cables in the affected raceway;
  • A medium voltage pulse resulting from the short circuit in the raceway and transmitted through the Class 1E and/or non-Class 1E 125-Vdc cables could damage and potentially destroy Class 1E components and systems at both ONS and KHU; and
  • Cable forces and resulting whiplash could result in consequential damage to adjacent cables in the affected raceway, and possible consequential short circuits and circuit interconnections The licensing basis of ONS assumes a limiting single failure in the safety related systems.

Non-safety related systems are not credited in accident analysis unless they are uniquely identified for specific events. The CDBI team postulated that, upon a limiting single failure such as a three-phase power cable fault in the13.8-kVac or 4.16-kVac safety system or a single line to ground fault on the 13.8-kVac Fant line, the Class 1E and associated non-Class 1E DC protection and control cables could transmit the medium voltages throughout the control systems and damage connected components and equipment. The CDBI team noted that since the 13.8-kVac Fant line is non-Class 1E, a worst-case fault on the

- 5 - non-safety-related Fant line source that is routed with the Class 1E power system could be postulated in addition to a single failure in the Class 1E system, consistent with NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition" (SRP) Section 8.2, "Offsite Power System," and IEEE Standard 379-2000.2 The CDBI team reviewed the ONS single-line power feeder diagrams, control wiring interconnection diagrams, and control system elementary diagrams and observed that clear electrical pathways exist that could transmit the voltages from the above mentioned failures to the three ONS 125-Vdc safety systems, to the Keowee 125-Vdc safety systems, and to the PSW 125-Vdc systems. The CDBI team was concerned that this damage and the resulting consequences could potentially impact most of the systems connected to the Class 1E 125-Vdc instrumentation and control power panel boards 1DIA, 1DIB, 2DIA, 2DIB, 3DIA, and 3DIB, and the associated batteries.

The DC power panel boards supply power to important components and safety systems such as the controls and lockouts for the alternate emergency power source through CT-5 transformer, the digital reactor protection system which includes reactor trip and engineered safeguards control, circuits for plant isolation from all offsite power, connections to the control room operator panel boards, boron dilution controls, excore nuclear instrumentation, and component cooling water controls. Any exposure of faulted medium-voltage AC to the digital protection and control systems, direct or indirect, could potentially permanently disable them. In addition, the CDBI team noted that abnormal operating procedure AP/0/A/2000/002, "Keowee Hydro Station - Emergency Start," Revision 15, step 5.15, directs the operators to realign the redundant KHU from the overhead path to the underground path if overhead path equipment experiences a trip. The CDBI team was concerned that this procedural step could cause further damage to any undamaged components from a fault or short circuit in the underground raceways.

Additionally, the CDBI team postulated failures where DC to DC electrical interactions could disable the emergency power system because of interconnections between the two KHUs and the three ONS units. The three ONS units consolidated their ESPS emergency power starting system wiring into two ESPS start trains (A and B). Each ESPS train must be able to start both KHUs, and the supervisory controls for each KHU must enable and operate the same KHU start circuits, governors, and field controls as the ESPS trains. All of these circuits are interconnected at KHS and between KHS and ONS. The operators' flexibility to choose the available paths to feed the plant safety busses could therefore become inoperable from a single failure. ONS Licensing Basis - CDBI Team's Observation The CDBI team noted that the ONS staff considered the licensing basis applicable to electrical single failures as documented in an ONS "internal memo to file" written on January 12, 1993. The CDBI team noted that the memo was erroneously dated January 12, 1992. This memorandum was neither docketed nor evaluated by the NRC staff. It also does not appear that this memorandum was treated by the licensee as documentation which the NRC requires to be retained in order to demonstrate compliance with the NRC's requirements (as evidenced by its status as an "internal memo to file"). Finally, the information in the ONS internal memo to file was not ultimately reflected in any NRC-controlled documentation such as the final safety analysis report (FSAR) or technical specifications. For these reasons, the 2 Institute of Electrical and Electronics Engineers, IEEE Std. 379-2000, "IEEE Standard Application of the Single-Failure Criterion to Nuclear Power Generating Station Safety Systems," Piscataway, NJ.

- 6 - CDBI team determined that it is not part of the ONS licensing basis. In the ONS internal memo to file, the licensee stated, in part, that:

This document establishes that the Oconee licensing basis only requires consideration of single failures "immediately on demand" for emergency power1;Section I below details licensing basis issues. Correspondence and numerous reports have been reviewed to identify the licensing basis for Oconee with regard to the timing of single failures. This review indicates that nothing within the Oconee licensing basis specifically requires consideration of single failures at times other than "immediately on demand" (vs T = 0, or coincident with the event).

_______________

1 The licensing basis review focused on single failure issues related to emergency power. Expanding the scope to include all mechanical systems will require further review.

Note 3 of the ONS internal memo to file states, in part, that:

10 CFR [Part 50], Appendix A, the General Design Criteria [(GDCs)], is interpreted by the NRC staff in SECY 77-439[3] to require that there be no distinction between active and passive failures for electrical equipment. The GDCs are not part of the Oconee licensing basis. Therefore, for Oconee, a distinction can be made between active and passive failures.

Section I, "LICENSING BASIS," of the ONS internal memo to file, under Subsection I.A, "Discussion," states, in part, that: This FSAR Revision as well as previous and subsequent revisions did include several system single failure analyses. Review of these analyses shows that each single failure evaluated occurred immediately on demand4. Note 4 of the ONS internal memo to file states:

This conclusion is simply based on the fact that had the analyses considered single failures occurring at any time other than immediately on demand, the results would have been unacceptable. Subsection I.B, "Relevant Guidance not within the Oconee Licensing Basis," of the ONS internal memo to file, under SECY-77-439, "Single Failure Criterion," states:

The staff states that a single failure evaluation "- proceeds on the proposition that single failures can occur at any time." The Oconee position is in direct contradiction to this portion of the guidance. However, the SECY paper concludes that "the single failure criterion has served well in its use as a licensing review tool to assure reliable systems as one element of the defense in depth approach to reactor safety." 3 U.S. Nuclear Regulatory Commission, SECY-77-439, "Single Failure Criterion," dated August 17, 1977 (ADAMS Accession No. ML060260236).

- 7 - Section III, "CONCLUSIONS," of the ONS internal memo to file, states, in part, that: It is clear that there is no requirement within the Oconee licensing basis to analyze for "smart" single failures.

The CDBI team reviewed licensing and regulatory documents such as the ONS GDC or principal design criteria requirements, technical specifications, generic communications, regulatory guides, Standard Review Plan, Branch Technical Positions, and IEEE Std. 279-1971 to verify the technical basis of the ONS internal memo to file on single failure criteria. The CDBI team could not substantiate any assumptions or basis of the position taken by the licensee. The licensee could not identify any communication from the NRC staff approving the contents of the ONS internal memo to file such that the licensee could establish the timing of postulated electrical failures, make distinctions between passive and active electrical failures, and also limit the magnitude and potential damage that could occur from electrical failures. The CDBI team could not find the term "smart" single failures, as described in the internal memo to file, in any part of the ONS licensing basis. The CDBI team identified that ONS GDC 39 specified active component failures, one in each of the onsite and offsite power systems concurrently, but IEEE Std. 279-1971 specified single failures and did not distinguish between active or passive components. The CDBI team noted that a letter from Duke Power Company to the NRC, dated May 13, 1976 (ADAMS Accession No. ML16030B569), stated that the ONS onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE Std. 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations." These systems are limited to IEEE Std. 279-1971, Section 1, "Scope," which states, in part, that the "protection system encompasses all electric and mechanical devices and circuitry (from sensors to actuation device input terminals) involved in generating those signals associated with the protective function." Of all the standards and NRC reports the licensee evaluated in the prompt determinations of operability, IEEE Std. 279-1971 was the only licensing basis document evaluated for electrical single-failure-proof design. However, the licensee did not appear to consider the example in the note of IEEE Std. 279-1971, Section 4.2, "Single Failure Criterion," describing the shorting of electrical power cables as a single failure as applicable.

The updated FSAR (UFSAR) Section 8.3.1.2, "Analysis," for onsite AC Power Systems stated that "the basic design criterion for the electrical portion of the emergency electric power system of a nuclear unit, including the generating sources, distribution system, and controls is that a single failure of any component, passive or active, will not preclude the system from supplying emergency power when required." Based on the above, the CDBI team could not verify that the installed cable configurations in trench 3 and the PSW raceway were acceptable. During the inspection, the licensee indicated that the bronze tape shield on medium-voltage cables was equivalent to interlocked armor cable. The CDBI team could not find any technical basis for the equivalency that the licensee was crediting in the single failure DBD test report MCM-1354.00-0029.001. Therefore, the CDBI team was concerned that the licensee's analyses appeared to be non-conservative. The analyses appeared to inappropriately establish the timing of electrical failures to instances that could limit the magnitude of potential damages. The CDBI team could not conclude that safe shutdown capability was maintained after an electrical single failure of the underground cabling systems between ONS, the KHS,

- 8 - and PSW building. The CDBI team reviewed the following regulatory requirements to evaluate the design of the cabling systems:

  • TS 3.3.21, "Emergency Power Switching Logic Keowee Emergency Start Function"
  • Atomic Energy Commission (AEC) GDCs 19, 20, 21, 22, 23, 24, 31, and 39
  • Paragraph (h)(2), "Protection systems," of 10 CFR 50.55a, "Codes and standards"
  • 10 CFR Part 50, Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," Criterion III, "Design Control" ONS Design Basis - CDBI Team's Observation The CDBI team noted several concerns in the ONS design basis criteria applicable to electrical single failures documented in design basis specification OSS-0254.00-00-4013, Rev. 4, "Design Basis Specification for the Oconee Single Failure Criterion," Rev. 4 (the single failure DBD).

Specifically, Section 3.2.1.3, "Single Failure Licensing Basis for Electrical Systems," referenced the "internal memo to file" as the definitive document outlining the ONS licensing basis for single failure timing. The DBD, stated, in part, that "Per Reference 4.3.1.1, single failures in electrical systems shall only be postulated to occur on initial demand (i.e., failure is coincident with the time the component is initially required to perform its design function in response to an event)," and that "the criteria in [10 CFR Part 50] Appendix A are not part of Oconee's licensing basis, and a distinction between active and passive failures is made for Oconee electrical systems (see Reference 4.3.1.1)." Section 3.3.6.1, "Cabling," of the DBD references cable testing that was performed by the licensee in 1977 and was documented in MCM-1354.00-0029.001, which determined that cable faults in armored multi-conductor cabling could not propagate to adjacent cabling. The DBD stated, in part, that: "[a]rmored electrical cabling will not be subject to a single failure in one cable propagating to another cable;" and that "[t]his exception is only applicable to armored cables." The CDBI team was concerned that the DBD referenced the "internal memo to file" to justify the limited evaluations of single failures based on specific timing and distinguished between active and passive failures as previously discussed. The CDBI team was concerned that the licensee's design philosophy for plant modifications appeared to incorporate the "internal memo to file" into plant design specifications and procedures. In addition, the CDBI team could not verify that the referenced cable test report, MCM-1354.00-0029.001, supported the claim that "armored electrical cabling will not be subject to a single failure in one cable propagating to another cable." The CDBI team noted that ONS was using this test report to envelope the configuration of both the safety and non-safety related 13.8-kVac power cables. The licensee asserted that two wraps of 10 mil bronze shielding tape was equivalent to the armor described in the test report. The CDBI team's specific concern was that the testing did not envelope the cable designs in the underground raceways. The test report indicated that the testing was limited to 6.9-kVac power cables with steel interlocked armor that were drilled and vented. In addition, only two phases were shorted instead of three phases in the test, which limited the energy released from the cables. In AC circuits, three-phase short circuits provide the maximum energy

- 9 - released in arc flashes and maximum electromagnetic forces. The CDBI team noted that a high impedance ground scheme, such as the one on the KHUs, was not simulated during these tests. A high impedance grounded system would contribute to the magnitude of energy release during AC arc flashes. The CDBI team could not verify from its review of the test report that two layers of 10 mil bronze tape was equivalent to the steel interlocked armor subjected to the test conditions. In addition, the CDBI team could not verify that the tests supported the licensee's conclusion that armored cables (steel interlocked or otherwise) would prevent the propagation of electrical failures between cables.

Licensee's Actions - CDBI Team's Review To address the CDBI team's concerns, ONS prepared three problem investigation program documents (O-14-02965, O-14-03190, and O-14-05125) and performed prompt determinations of operability for each problem investigation program. In addition, on March 23, 2014, the licensee reported these conditions to the NRC under 10 CFR 50.72(b)(3)(ii) in Licensee Event Report 269/2014-01, Rev. 0 (ADAMS Accession No. ML14149A476). The licensee's current position is that electrical failures addressed as single failures cannot occur at any time, but must only occur explicitly at the actuation of a device to provide its safety function. Additionally, ONS staff stated that short circuits between shielded power cables are not credible events and thus do not have to be postulated. The licensee stated that it has properly routed the Class 1E and associated non-Class 1E DC protection and control circuits with the high-energy 13.8-kVac cables and that this configuration does not compromise the single-failure-proof design of the emergency power system or the Class 1E protection system. Also, the licensee concluded that offsite commercial grade electrical protective equipment (relays, circuit breakers, lightning arrestors, etc.) is adequate to assure the protection of the adjacent Class 1E and associated non-Class 1E DC protection and control circuits.

In letters dated May 11, 2015 (ADAMS Accession No. ML15139A049) and August 7, 2015 (ADAMS Accession No. ML15224A370), the licensee provided additional information on the issues associated with TIA 2014-05. This information reiterated the licensing basis of the plant for NRR review of TIA 2014-05 and provided information related to cable testing performed to evaluate the physical strength of the cables installed in the trench associated with Keowee power system. In addition, the letters provided information such as types of cables installed at ONS, separation criteria related to heat dissipation, overfill of cable trays, types of faults that can be postulated concurrent with design basis events, and the excess margin in design of power cables in trench 3. ONS has also provided risk-informed analysis information for external fire events. The Region II staff reviewed the information provided in the letters and determined that the additional information did not contain any new details on the adequacy of the design and installation of cables in trench 3. Based on the review, the Region II staff recommended that the TIA questions remain unchanged. The NRR staff considered all of the licensee's supplemental information in its technical evaluations of Region II TIA questions.

3.0 EVALUATION The NRR staff reviewed the licensing and design bases history of the ONS single failure criterion for analyzing electrical failure vulnerabilities between medium-voltage AC power systems and low voltage DC circuits. This review involved examination of NRC correspondence with the licensee, safety evaluations for license amendments, the CDBI inspection report,

- 10 - Oconee UFSAR Section 8.0, and the licensee's letters dated May 11, and August 7, 2015, and August 15, 2016.

History of ONS Licensing Basis for Electric Power Systems and Associated Interfacing Systems The Duke Power Company, by application dated November 28, 1966, and as subsequently amended, requested a license to construct and operate three pressurized-water reactors, identified as Units 1, 2, and 3 in Oconee County, South Carolina. In supplement 1 to the Oconee construction application dated April 1, 1967 prior to the issuance of construction permits November 6, 1967, Oconee stated conformance to the "Proposed IEEE Criteria for Nuclear Power Plant Protection Systems," see ADAMS Accession No. ML15215A125. This standard was issued as IEEE Std. 279-1968. The AEC reported the results of its review prior to construction in a safety evaluation dated August 4, 1967 (ADAMS Accession No. ML15212A648). On June 2, 1969, Duke Power filed the FSAR required by 10 CFR 50.34(b) for each unit. The AEC regulatory staff's review of the FSAR, as amended, considered all three ONS units. However, Unit 1 was the only unit whose state of completion warranted issuance of an operating license at that time and the safety evaluation report (SER) for Unit 1 was published on December 29, 1970 (ADAMS Accession No. ML12276A270). Section 8.0, "Instrumentation, Control, and Power Systems," of the SER states, in part, that "[t]he adequacy of the reactor protection system instrumentation for Oconee Unit 1 was evaluated by comparison with the Commission's Proposed General Design Criteria published July 11, 1967 [(32 FR 10213)], and the proposed IEEE Criteria for Nuclear Power Plant Protection Systems (IEEE Std. 279) dated August 28, 1968." Since the original regulatory staff's review of ONS, Unit 1, a supplemental review of the plant emergency core cooling systems (ECCS) was performed in accordance with the criteria described in an Interim Policy Statement issued on June 25, 1971, and published in the Federal Register on June 29, 1971 (36 FR 12247). The safety evaluation based upon this review was issued on March 24, 1972, as Supplement No. 1 to the SER for ONS, Unit 1 (ADAMS Accession No. ML13179A044). On July 6, 1973, the AEC staff issued the SER for ONS, Units 2 and 3 (ADAMS Accession No. ML12276A272). The safety evaluation and conclusions presented in Supplement No. 1 are applicable to ONS, Units 2 and 3. The staff's safety review with respect to issuing operating licenses for Units 2 and 3 was based on the applicant's FSAR (Amendment 7) and subsequent Amendments 8 through 41 inclusive (Amendments 1 through 6 were related to the construction permit review).

ONS AEC GDC and UFSAR Section 1.3, "Principal Design Criteria," of the ONS FSAR dated August 11, 1970, states: "The principal design criteria for Oconee Units 1, 2, and 3 were developed in consideration of the 70 General Design Criteria for Nuclear Power Plant Construction Permits proposed by the AEC in a proposed rule-making published for 10 CFR 50 in the Federal Register of July 11, 1967 [32 FR 10213]."

  • The following are the applicable AEC proposed principal design criteria (32 FR 10213; July 11, 1967): Introduction. Every applicant for a construction permit is required by the provisions of § 50.34 to Include the principal design criteria for the proposed facility in the application. These General Design Criteria are intended to be used as guidance in establishing the principal design criteria for a nuclear power plant.

The General Design Criteria reflect the predominating experience with water

- 11 - power reactors as designed and located to date, but their applicability is not limited to these reactors. They are considered generally applicable to all power reactors. Under the Commission's regulations, an applicant must provide assurance that its principal design criteria encompass all those facility design features required in the interest of public health and safety. There may be some reactor cases for which fulfillment of some of the General Design Criteria may not be necessary or appropriate. There will be other cases in which these criteria are insufficient, and additional criteria must be identified and satisfied by the design in the interest of public safety. It is expected that additional criteria will be needed particularly for unusual sites and environmental conditions, and for new and advanced types of reactors. Within this context, the General Design Criteria should be used as a reference allowing additions or deletions as an individual case may warrant. Departures from the General Design Criteria should be justified.

The criteria are designated as "General Design Criteria for Nuclear Power Plant Construction Permits" to emphasize the key role they assume at this stage of the licensing process. The criteria have been categorized as Category A or Category B. Experience has shown that more definitive information is needed at the construction permit stage for the items listed in Category A than those in Category B.

I. OVERALL PLANT REQUIREMENTS Criterion 1-Quality Standards (Category A). Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be identified and then designed, fabricated, and erected to quality standards that reflect the importance of the safety function to be performed. Where generally recognized codes or standards on design, materials, fabrication, and inspection are used, they shall be identified. Where adherence to such codes or standards does not suffice to assure a quality product in keeping with the safety function, they shall be supplemented or modified as necessary. Quality assurance programs, test procedures, and inspection acceptance levels to be used shall be identified. A showing of sufficiency and applicability of codes, standards, quality assurance programs, test procedures, and inspection acceptance levels used is required.

Criterion 20-Protection Systems Redundancy and Independence (Category B). Redundancy and independence designed into protection systems shall be sufficient to assure that no single failure or removal from service of any component or channel of a system will result in loss of the protection function.

The redundancy provided shall include, as a minimum, two channels of protection for each protection function to be served. Different principles shall be used where necessary to achieve true independence of redundant instrumentation components. Criterion 21-Single Failure Definition (Category B). Multiple failures resulting from a single event shall be treated as a single failure.

- 12 - Criterion 22-Separation of Protection and Control Instrumentation Systems (Category B). Protection systems shall be separated from control instrumentation systems to the extent that failure or removal from service of any control instrumentation system component or channel, or of those common to control instrumentation and protection circuitry, leaves intact a system satisfying all requirements for the protection channels.

Criterion 23-Protection Against Multiple Disability for Protection Systems (Category B). The effects of adverse conditions to which redundant channels or protection systems might be exposed in common, either under normal conditions or those of an accident, shall not result in loss of the protection function.

Criterion 24-Emergency Power for Protection Systems (Category B). In the event of loss of all offsite power, sufficient alternate sources of power shall be provided to permit the required functioning of the protection systems. Criterion 39-Emergency Power for Engineered Safety Features (Category A). Alternate power systems shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning required of the engineered safety features. As a minimum, the onsite power system and the offsite power system shall each, independently, provide this capacity assuming a failure of a single active component in each power system.

  • UFSAR Principal Design Criteria: The following ONS UFSAR sections set forth the relevant ONS design criteria and the principal design criteria that apply to electric power systems, which were derived from the AEC's proposed 1967 GDC: UFSAR Section 3.1.19, Criterion 19, "Protection Systems Reliability (Category B)" Protective Systems shall be designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

Discussion The Protective Systems design meets this criterion by specific instrument location, component redundancy, and in-service testing capability. The major design criteria stated below have been applied to the design of the instrumentation.

1. No single component failure shall prevent the protective systems from fulfilling their protective function when action is required.
2. No single component failure shall initiate unnecessary protective system action, provided implementation does not conflict with the criterion above.

- 13 - Test connections and capabilities are built into the protective systems to provide for:

1. Pre-operational testing to give assurance that the protective systems can fulfill their required functions.

2. On-line testing to assure availability and operability (Section 7.1.2.1). UFSAR Section 3.1.20, Criterion 20, "Protection Systems Redundancy and Independence (Category B)" Redundancy and independence designed into Protective Systems shall be sufficient to assure that no single failure or removal from service of any component or channel of a system will result in loss of the protective function. The redundancy provided shall include, as a minimum, two channels of protection for each protective function to be served. Different principles shall be used where necessary to achieve true independence of redundant instrumentation components.

Discussion Reactor protection is by four channels with 2/4 coincidence, and engineered safeguards features are by three channels with 2/3 coincidence. All Protective System functions are implemented by redundant sensors, instrument strings, logic, and action devices that combine to form the protective channels. Redundant protective channels and their associated elements are electrically independent and packaged to provide physical separation. For Unit(s) with the digital RPS/ESPS not installed, the Reactor Protective System will initiate a trip of the protective channel involved when modules or equipment are removed (Section 7.1.2.1).

For Unit(s) with the digital RPS/ESPS installed, the Reactor Protective System will determine action to be taken based on the type of module removed. These actions could range from indication of trouble within the system to a protective channel trip. UFSAR Section 3.1.21, Criterion 21, "Single Failure Definition (Category B)" Multiple failures resulting from a single event shall be treated as a single failure.

Discussion The Protective Systems meet this criterion in that the instrumentation is designed so that a single event cannot result in

- 14 - multiple failures that would prevent the required protective action (Section 7.3). UFSAR Section 3.1.22, Criterion 22, "Separation of Protection and Control Instrumentation Systems (Category B)" Protective Systems shall be separated from control instrumentation systems to the extent that failure or removal from service of any control instrumentation system component or channel, or of those common to control instrumentation and protective circuitry, leaves intact a system satisfying all requirements for the protective channels.

Discussion The Protective Systems' input channels are electrically and physically independent. Shared instrumentation for protective and control functions satisfies the single failure criteria by the employment of isolation techniques to the multiple outputs of various instrument strings.

UFSAR Section 3.1.23, Criterion 23, "Protection against Multiple Disability for Protection Systems (Category B)" The effects of adverse conditions to which redundant channels or Protective Systems might be exposed in common, either under normal conditions or those of an accident, shall not result in a loss of the protective function.

Discussion The Protective Systems are designed to extreme ambient conditions. The Protective Systems' instrumentation will operate from 40 [degrees Fahrenheit (°F)] to 140°F and sustain the loss-of-coolant building environmental conditions, including 100 percent relative humidity, without loss of operability. Out-of-core neutron detectors, however, will withstand 90 percent relative humidity. The Protective Systems' instrumentation will be subject to environmental (qualification) testing as required by the proposed IEEE "Criteria for Nuclear Power Plant Protection Systems," IEEE No. 279, dated August, 1968. Protective equipment outside the Reactor Building (control room and cable room) is designed for continuous operation in an ambient temperature and relative humidity representative of loss-of-coolant accident conditions (Section 7.1.2.1). The [Teleperm XS (TXS)]

RPS / ESPS systems are also subject to IEEE Std 603-1998, "IEEE Standard Criteria for Safety Systems for Nuclear Power Generating Stations".

- 15 - UFSAR Section 3.1.24, Criterion 24, "Emergency Power for Protection Systems (Category B)" In the event of loss of all off-site power, sufficient alternate sources of power shall be provided to permit the required functioning of the Protective Systems.

Discussion In the event of loss of all off-site power to all units at Oconee or to any unit alone, sufficient power for operation of the Protective Systems of any unit will be available from either of two on-site independent hydroelectric generators. Details of the Emergency Power Generation System are described in Section 8.3.1.1.1. Redundant battery power is provided for vital instrumentation and control.

UFSAR Section 3.1.39, Criterion 39, "Emergency Power for Engineered Safety Features (Category A)" Alternate power systems shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning required of the engineered safety features.

As a minimum, the on-site power system and the off-site power system shall each, independently, provide this capacity assuming a failure of a single active component in each power system. Discussion The electrical systems meet the intent of the criterion as discussed in Chapter 8.

Three alternate emergency electric power supplies are provided for the station from which power to the engineered safety feature buses of each unit can be supplied. These are the 230 KV switching station with multiple off-site interconnections and two on-site independent 87,500 kVA hydroelectric generating units.

Each nuclear unit can receive emergency power from the 230 KV switching station through its start-up transformer as a preferred source. Each unit can receive emergency power from one hydroelectric generating unit through a 13.8 KV underground connection to standby transformer CT4. The other hydroelectric generating unit serves as a standby emergency power source and can supply power to each unit's startup transformer when required. Both on-site hydroelectric generating units will start automatically upon loss of all normal power or upon an engineered safety feature action.

Two additional sources of alternate power are available, as each nuclear unit is capable of supplying any other unit through the

- 16 - 230 KV switching station. In addition, a connection to the 100 KV transmission network is provided as an alternate source of emergency power whenever both hydroelectric generating units are unavailable.

UFSAR Chapter 7, "Instrumentation and Control" Section 7.1.1, "Identification of Safety-Related Systems," states that:

The protective systems, which consist of the Reactor Protective Systems, the Engineered Safeguards System and the Automatic Feedwater Isolation System perform important control and safety functions. The protective systems extend from the sensing instruments to the final actuating devices, such as circuit breakers and pump or valve motor contactors.

Section 7.1.2.1, "Design Bases," states that:

The protective systems are designed to sense plant parameters and actuate emergency actions in the event of abnormal plant parameter values. They meet the intent of the Proposed IEEE "Criteria for Nuclear Power Plant Protection Systems" dated August, 1968. (IEEE No. 279). The [Teleperm XS (TXS)]

RPS/ESPS also meets the intent of IEEE Std 603-1998.

Protective system equipment located in the Control Room, Cable Room, and Aux Building is designed for a mild environment, not LOCA [loss-of-coolant] conditions (i.e. 59 psig, 273°F). Note: The UFSAR Chapter 7 identifies the Keowee Emergency Start cables, which are a subject of this TIA, as part of the ESPS. In addition, the DC circuits, which are a subject of this TIA, are electrically interconnected with the RPS and ESPS.

UFSAR Chapter 8, "Electric Power" Section 8.3.1.2, "Analysis," states, in part, that:

The basic design criterion for the electrical portion of the emergency electric power system of a nuclear unit, including the generating sources, distribution system, and controls is that a single failure of any component, passive or active, will not preclude the system from supplying emergency power when required. Section 8.3.1.4.6.2, "Cable Separation," states, in part, that:

Control, instrumentation, and power cables are applied and routed to minimize their vulnerability to damage from any source

-Power and control cables for redundant auxiliaries or services are run by different routes to reduce any probability of an accident disabling more than one piece of redundant equipment.

- 17 - Section 8.3.2.2, "Analysis," states, in part, that: The 125 Volt DC Instrumentation and Control Power System and the 125 Volt AC Vital Power System are designed such that upon loss of power supplies no interactions exist between Reactor Protection Systems, Engineered Safeguards Protection Systems, and control systems that would preclude these systems from performing their respective functions. Section 8.3.2.2.2, "Single Failure Analyses of the 125 Volt DC Keowee Station Power System," states:

The 125 Volt DC Keowee Station Power System is arranged such that a single fault within either unit's system does not preclude the other unit from performing its intended function of supplying emergency power.

UFSAR Chapter 15 "Accident Analyses" Section 15.14.3.3.6 "ECCS Performance and Single Failure Assumption," states, in part that

-[T]he ECCS configuration was analyzed with the CRAFT2-based evaluation model (Reference 1) to determine the worst single failure in addition to the assumption of the loss of offsite power for each LOCA (Reference 33). Historically, the worst single failure for a LOCA is the loss of one bus of emergency power which results in the loss of one train of HPI and one train of LPI. The failure of transformer CT-4 has been identified as a more limiting single failure for the large break LOCA. The failure of transformer CT-4 results in a longer delay until delivery of ECCS fluid to the RCS. However, two ECCS trains are available with this single failure. Reference 33 demonstrates that having two ECCS trains injecting at a later time is more limiting than having one ECCS train injecting at an earlier time. The Keowee hydro unit will start up and accelerate to full speed in 23 seconds or less (Section 6.3.3.3). The failure of transformer CT-4 results in an additional 10 second delay before power is available to the ECCS pumps. The time delay between breaker closure and valve/pump motors operating at rated voltage/speed is 5 seconds..." -A SBLOCA does not progress as rapidly as a large break LOCA. Thus, for a SBLOCA, the timing of ECCS injection is not as significant as with a large break LOCA. For this reason, the worst single failure for a SBLOCA remains the loss of one bus of emergency power-

- 18 - Relevant ONS Licensing Actions from 1974-Onward The following sections describe the licensing basis changes submitted for NRC review and approval that affect the independence and electric separation requirements specified in the ONS UFSAR sections above for the electric power systems.

Subsequent to the issuance of the operating licenses for ONS, Appendix K to Part 50, "ECCS Evaluation Models," was issued to define the Required and Acceptable Features of Evaluation Models (39 FR 1003; January 4, 1974). All licensees, including the licensee for ONS, were required to perform the evaluation. On August 5, 1974 (ADAMS Accession No. ML16030B220), Duke submitted an evaluation of ECCS cooling performance calculated in accordance with an evaluation model developed by the Babcock and Wilcox Company. On December 27, 1974, the Commission issued an Order for the Modification of the Oconee Licenses pertaining to the proposed TS which were submitted pursuant to Section 50.46 and Appendix K to 10 CFR Part 50, dated September 20, 1974, finding the licensee's ECCS evaluation deficient (ADAMS Accession Nos. ML15216A221 and ML15210A064). The order required the submission of a reanalysis in conformance with the order along with any request for authorization for any core reloading. During the subsequent reviews on April 6, 1975, the NRC staff asked Duke to describe the design of the ECCS actuation system and identify any non-conformance of this design with the single failure requirements of IEEE Std. 279-1971 (ADAMS Accession No. ML15212A336). By letter dated May 13, 1976 (ADAMS Accession No. ML16008A753), the licensee stated, in part, that:

The design of the Oconee Nuclear Station Engineered Safeguards Protective System (ESPS) is described in FSAR Section 7.1.3. The ESPS includes the Emergency Core Cooling System in addition to the Reactor Building Isolation, Spray and Cooling Systems. The system logic for the ESPS is described in FSAR Section 7.1.3.2.1, and the specific discussion for the ECCS components is provided in FSAR Section 7.1.3.2.2. The safety evaluation for the ESPS is provided in FSAR Section 7.1.3.3. The Oconee ECCS actuation system conforms to the single failure requirements of IEEE 279-1971.

Similarly, the licensee was asked to describe the design of the onsite emergency power system, AC and DC and to identify any non-conformance of this design with the single failure requirements of IEEE Std. 279-1971. By letter dated May 13, 1976, Duke Power stated, in part, that:

The Oconee Nuclear Station onsite emergency AC power sources and distribution system are described in FSAR Section 8.2.3. The emergency power distribution through the switchboards is described in FSAR Sections 8.2.2.4, 8.2.2.5, and 8.2.2.6. The onsite emergency DC power system is described in FSAR Section 8.2.2.7. A single failure analysis of these systems is provided in Table 8.7.

The design of the Oconee onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE 279-1971.

By letter dated March 25, 1976 (ADAMS Accession No. ML011970076), the ONS licenses were amended based upon an acceptable ECCS evaluation model conforming to the requirements of

- 19 - 10 CFR 50.46, and the operating restrictions imposed by the Commission's December 27, 1974, Order for Modification of License were terminated. The ONS ECCS reanalysis was accepted in safety evaluation reports dated June 30, 1976, and October 22, 1976 (ADAMS Accession Nos. ML012190455 and ML012190305, respectively). As documented in letter from licensee dated May 13, 1976, the licensee stated that the Oconee ECCS actuation system conforms to the single failure requirements of IEEE Std. 279-1971. The licensee committed to all single failure requirements not limited to those in Section 4.2. Additional single failure requirements are contained in other sections of IEEE Std. 279-1971 including but not limited to Sections 4.2, 4.7, 4.11 and 4.17. Although ONS's original licensing basis included IEEE Std. 279-1968, for single failure requirements, ONS later adopted IEEE Std. 279-1971.

IEEE Standard 279-1971 provides the minimum criteria for the safety-related functional performance and reliability of protection systems for stationary land-based nuclear reactors producing steam for electric power generation. The standard provides definitions of some unique terms used, the design basis and minimum performance requirements of the protective systems. The following elements from the specific sections of the Standard are pertinent to the discussion and responses to the TIA questions.

Section 3 "Design Basis" details on conditions that can result in failures requiring protective function actions.

(7) the range of transient and steady-state conditions of both the energy supply and the environment (for example. voltage, frequency, temperature. humidity, pressure. vibration etc. during normal. abnormal. and accident circumstances throughout which the system must perform. (8) the malfunctions, accidents or other unusual events (for example, fire, explosion, missile lightning. flood, earthquake. wind, etc.) which could physically damage protection system components or could cause environmental changes leading to functional degradation of system performance, and for which provisions must be incorporated to retain necessary protective action: (9) minimum performance requirements including the following: a) system response time:

b) system accuracies:

c) ranges (normal. abnormal. and accident conditions) of the magnitudes and rates of change of sensed variables to be accommodated until proper conclusion of the protective action is assured. Section 4 "Requirements" states "The nuclear power generating station protection system shall, with precision and reliability, automatically initiate appropriate protective action whenever a condition monitored by the system reaches a preset level. This requirement applies for the full range of conditions and performance enumerated in Sections 3(7). 3(8), and 3(9). 4.2 Single Failure Criterion. Any single failure within the protection system shall not prevent proper protective action at the system level when required. NOTE: "Single failure" includes such events as the shorting or open circuiting of interconnecting signal or power cables. It also includes single credible malfunctions or events that cause a number of consequential component, module, or channel failures. For eu1mple. The overheating of an amplifier module is a "single failure" even though several transistor failures result. Mechanical damage to a mode switch would be a "single failure" although several channels might become involved.

- 20 - The ONS Digital RPS/ESPS License Amendment Request (LAR) 2007-009, Enclosure 1, "Evaluation of Proposed Change," dated January 31, 2008 (ADAMS Accession No. ML080730339), Section 3, "Technical Evaluation," Subsection 3.2.1.2, "Duke Design Criteria," stated, in part, that:

The new digital RPS/ESPS equipment is required to conform with both IEEE Std 279-1971 and IEEE Std 603-1991-. Duke considers the 1998 revision to IEEE Std 603 more appropriate for referencing since it clarifies the application of the standard to computer-based safety system. Since the 1998 revision to IEEE Std 603 does not change any IEEE Std 603-1991 requirements, Duke has evaluated the digital RPS/ESPS for compliance to IEEE Std 603-1998.

The LAR Section 3.3.1, "Single-Failure Criterion" stated, in part, that: [Regulatory Guide (RG)] 1.53, "Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems," Revision 2, November 2003, indicates that conformance with the requirements of IEEE Std 379-2000, "Application of the Single-Failure Criterion to Nuclear Power Generating Station Safety Systems," provides methods acceptable to the NRC staff for satisfying the NRC's regulations with respect to the application of the single-failure criterion to the electrical power, instrumentation, and control portions of nuclear power plant safety systems. The protective features of the RPS/ESPS meet the single failure criterion as contained in IEEE Std 603-1991 (and IEEE Std 603-1998) and IEEE Std 279-1971. IEEE Std 603-1991 applies only to portions of the RPS/ESPS affected by the design change. Otherwise, IEEE Std 279-1971 continues to apply. In addition, application of the single failure criterion is further delineated in IEEE Std 379-2000.

Note: ONS UFSAR Chapter 7 identifies the Keowee Emergency Start cables, which are a subject of this TIA, as part of the ESPS. In addition, the DC circuits, which are a subject of this TIA, are electrically interconnected with the RPS and ESPS.

The NRC staff's safety evaluation for LAR 2007-009 dated January 28, 2010 (ADAMS Accession No. ML100220016), Section 3.4.2.1, "IEEE Std 603-1998, Clause 5.1 Single-Failure Criterion," stated, in part, that In IEEE Std. 603-1991, Clause 5.1, "Single Failure," was revised (in 1998) to clarify that a single failure could occur prior to, or at any time during, the design basis event for which the safety system is required to function. This clarification is acceptable; the proposed alternative (i.e., - 1998) provides an acceptable level of quality and safety.

The NRC staff's safety evaluation for LAR 2007-009, Section 3.4.2.6.1, "IEEE Std. 603-1998, Clause 5.6.1, Between Redundant Portions of a Safety System," stated, in part, that:

Based on the review document in these sections and in the paragraphs above, the NRC staff determined that there is sufficient independence between redundant portions of the digital RPS/ESPS such that the redundant portions are

- 21 - independent of and physically separated and, therefore, the digital RPS/ESPS meets the requirements of Clause 5.6.1.4 The LAR Section 3.7, "Failure Modes and Effects Analysis" (FMEA), Subsection 3.7.1, "Methodology," stated, in part, that The ONS RPS/ESPS FMEA was performed using guidance contained in RG 1.53 to verify that the design satisfies the single-failure criterion of IEEE Std 603-1998. IEEE Std 603-1998 references IEEE Std 379-1994 as providing a method acceptable to the NRC staff for satisfying the NRC's regulations with respect to the application of the single failure criterion. The ONS FMEA conforms with the specification requirements of IEEE 379-2000.

Note: The ONS RPS/ESPS FMEA states that the impact of external cables was evaluated based on the current configuration. At that time, the ESPS cables were directly buried, were not subject to failures from other cables, met the separation criteria and, therefore, cable failures of concern to this TIA were not evaluated. For the cables, the single failure requirements of IEEE Std. 279-1971 continues to apply and IEEE Std. 603-1998 applies only to portions of the RPS/ESPS affected by the digital design change including the ONS FMEA. On August 13, 2014, the NRC issued Amendment Nos. 386, 388, and 387 for the ONS, Units 1, 2, and 3, respectively (ADAMS Accession No. ML14206A790). The amendments consisted of changes to the ONS operating licenses, TSs, and UFSAR. The amendments added a license condition and revised the TSs and UFSAR for ONS, Units 1, 2, and 3, to add the new PSW system to the plant's licensing basis. Under the amendments, the PSW is an additional method of achieving and maintaining safe shutdown of the reactors in the event of a high-energy line break or a fire in the Turbine Building, which is shared by all three units.

The NRC staff's letter issuing the license amendments, and the safety evaluation supporting the amendments, stated that the staff did not review or approve the as-installed PSW electrical system cable configurations. Duke Energy made changes to the PSW electrical system configurations and installed the PSW electrical cables and power supplies under the provisions of 10 CFR 50.59; therefore, those parts of the system were not included in the scope of the NRC staff's review for these amendments.

3.1 Response to Requested Actions TIA Question 1

1. What are the ONS licensing basis, design basis, and NRC regulations and requirements for analyzing electrical failure vulnerabilities (single failure or otherwise) between medium voltage AC power and low voltage DC circuits as presented in this TIA? 4 The licensee's requested change to its licensing basis was not compelled by a new or modified NRC requirement, or interpretation of an existing NRC requirement. Therefore, under the principle described in footnote 2 of the July 14, 2010, General Counsel's letter to the Nuclear Energy Institute (NEI) (ADAMS Accession No. ML101960180), the NRC staff could apply new requirements to the ONS which would not be considered backfitting under 10 CFR 50.109.

- 22 - Response to TIA Question 1 The ONS licenses for Units 1, 2, and 3 require Duke Energy to meet the conditions and requirements pursuant to Section 104b of the Act and 10 CFR Part 50, "Domestic Licensing of Production and Utilization Facilities," to possess, use, and operate the facility. Accordingly, the following requirements are applicable to ONS.

1. The regulation at 10 CFR 50.54(jj) which requires that "[s]tructures, systems, and components subject to the codes and standards in 10 CFR 50.55a must be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety function to be performed." Note: As indicated in 36 FR 11423 (June 12, 1971), quality standards means "that protection systems (electrical and mechanical sensors and associated circuitry) should, as a minimum, be designed to meet the criteria developed by the Institute of Electrical and Electronics Engineers (IEEE)."
2. The regulation at 10 CFR 50.55a(h)(2), "Protection systems," which states, in part, that "[f]or nuclear power plants with construction permits issued before January 1, 1971, protection systems must be consistent with their licensing basis or may meet the requirements of IEEE Standard 603-1991 and the correction sheet dated January 30, 1995." Construction Permits for ONS, Units 1, 2, and 3 were issued on November 6, 1967 (ADAMS Accession Nos. ML012130043, ML011940386, and ML012190373, respectively). 3. Criterion III, "Design Control," of Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," to 10 CFR Part 50, "Domestic Licensing of Production and Utilization Facilities," states, in part, that the "design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculation methods, or by the performance of a suitable testing program."
4. The regulation at 10 CFR 50.59, "Changes, tests and experiments," paragraph (c), which states, in part, that:

(1) A licensee may make changes in the facility as described in the final safety analysis report (as updated), make changes in the procedures as described in the final safety analysis report (as updated), and conduct tests or experiments

- 23 - not described in the final safety analysis report (as updated) without obtaining a license amendment pursuant to Sec. 50.90 only if: (i) A change to the technical specifications incorporated in the license is not required, and (ii) The change, test, or experiment does not meet any of the criteria in paragraph (c)(2) of this section. (2) A licensee shall obtain a license amendment pursuant to Sec. 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would: (i) Result in more than a minimal increase in the frequency of occurrence of an accident previously evaluated in the final safety analysis report (as updated); (ii) Result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component (SSC) important to safety previously evaluated in the final safety analysis report (as updated); (iii) Result in more than a minimal increase in the consequences of an accident previously evaluated in the final safety analysis report (as updated); (iv) Result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the final safety analysis report (as updated); (v) Create a possibility for an accident of a different type than any previously evaluated in the final safety analysis report (as updated); (vi) Create a possibility for a malfunction of an SSC important to safety with a different result than any previously evaluated in the final safety analysis report (as updated); (vii) Result in a design basis limit for a fission product barrier as described in the FSAR (as updated) being exceeded or altered; or (viii) Result in a departure from a method of evaluation described in the FSAR (as updated) used in establishing the design bases or in the safety analyses.

5. 10 CFR 50.71, "Maintenance of records, making of reports," Section (e) requires, in part:

Each person licensed to operate a nuclear power reactor under the provisions of § 50.21 or § 50.22, and each applicant for a combined license under part 52 of this chapter, shall update periodically, as provided in paragraphs (e) (3) and (4) of this section, the final safety analysis report (FSAR) originally submitted as part of the application for the license, to assure that the information included in the report contains the latest information developed. This submittal shall contain all the changes necessary to reflect information and analyses submitted to the Commission by the applicant or licensee or prepared by the applicant or

- 24 - licensee pursuant to Commission requirement since the submittal of the original FSAR, or as appropriate, the last update to the FSAR under this section. The submittal shall include the effects1 of all changes made in the facility or procedures as described in the FSAR; all safety analyses and evaluations performed by the applicant or licensee either in support of approved license amendments or in support of conclusions that changes did not require a license amendment in accordance with

§ 50.59(c)(2) or, in the case of a license that references a certified design, in accordance with § 52.98(c) of this chapter; and all analyses of new safety issues performed by or on behalf of the applicant or licensee at Commission request. The updated information shall be appropriately located within the update to the FSAR. (1) The licensee shall submit revisions containing updated information to the Commission, as specified in § 50.4, on a replacement-page basis that is accompanied by a list which identifies the current pages of the FSAR following page replacement.

(2) The submittal shall include (i) a certification by a duly authorized officer of the licensee that either the information accurately presents changes made since the previous submittal, necessary to reflect information and analyses submitted to the Commission or prepared pursuant to Commission requirement, or that no such changes were made; and (ii) an identification of changes made under the provisions of

§ 50.59 but not previously submitted to the Commission." _______________ 1 Effects of changes includes appropriate revisions of descriptions in the FSAR such that the FSAR (as updated) is complete and accurate.

In addition to the above, ONS' licensing basis included the elements described in Section 3.0.

TIA Question 2.a

2. Within [ONS's] licensing basis:

a. Are medium voltage power cables that are intended to provide emergency power to the RPS/ESPS equipment as well as provide the motive force to the actuated ESPS equipment during a chapter 15 event within the scope of IEEE Standard 279-1971?

  • Must such power cables be considered under Section 3 "Design Basis" item 7 for transient conditions?
  • Must potential multiphase short circuits or ground faults from such power cables be considered under Section 3, "Design Basis," item 8 for unusual events, etc.?

Response to TIA Question 2.a Yes. The medium-voltage safety related power cables that are intended to provide emergency power to the RPS/ESPS equipment as well as provide the motive force to the actuated ESPS

- 25 - equipment during an UFSAR Chapter 15 event are within the scope of the single failure criteria of IEEE Std. 279-1971 as part of the ONS licensing basis and as described in UFSAR Chapters 8.3.1.2 and 15.14.3.3.6. The licensee's letter dated May 13, 1976, states, in part, that "the design of the Oconee onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE Std. 279-1971." Consistent with IEEE Std. 279-1971, the short circuiting of safety related power cables is considered as a single failure that may occur at any time with respect to the events described in Chapter 15 of the ONS UFSAR - meaning before, during, or after an event. The medium voltage power cables at ONS are installed in the concrete raceway routed along with cables for automatic and manual controls for both KHUs and a train of ESPS cables that are electrically connected to both KHUs and all three ONS units. The NRC staff has determined that the licensee must demonstrate that any single failure within the protection system shall not prevent proper protective action at the system level when required. Based on the above standards and ONS current licensing basis, the staff has determined that the criterion established for single failure criteria in IEEE Std. 279-1971 is applicable to the safety related medium voltage power cables and cable configurations at ONS.

Response to TIA Question 2.a (first bullet)

The ONS original licensing basis includes IEEE Std. 279-1968. Section 3 "Design Basis" items (g) for transient conditions of IEEE 279-1968 are equivalent to Section 3 "Design Basis" item 7 of IEEE Std. 279-1971 for transient and steady state conditions. Therefore, the medium voltage safety related power cables must meet the requirements in IEEE Std. 279-1968, Section 3, Item (g). Response to TIA Question 2.a (second bullet)

The ONS original licensing basis includes IEEE Std. 279-1968. Section 3 "Design Basis" items (h) for malfunctions, accidents, or other unusual events of IEEE Std. 279-1968 are equivalent to Section 3 "Design Basis" item 8 of IEEE Std. 279-1971. Therefore, the medium voltage safety related power cables must meet the requirements in IEEE Std. 279-1968, Section 3, Item (h).

Medium voltage power cables used in the context of this TIA are located in Trench #3 and Manhole #6 and identified as:

1) Safety related cables a) 13.8 kVac Emergency power from KHU to Transformer CT4 b) 4.16 kVac CX Auxiliary Power from Transformer CT4 switchgear to KHU c) 125 Vdc supervisory cables A d) 125 Vdc control and power cable for A and B trains 2) Non-safety related cables a) 13.8 kVac PSW Power Cables from KHU to Transformer CT6 and CT7 b) 13.8 kVac PSW Power Cables from Fant line The NRC staff concludes that the medium-voltage power cables that are intended to provide emergency power to the ONS, Units 1, 2, and 3 safety systems are within the scope of IEEE Std. 279-1968 and the single failure requirements of IEEE Std. 279-1971.

- 26 - TIA Question 2.b Does 3-phase medium voltage power cables, intended to provide Class 1E emergency power to the RPS/ESPS equipment, represent "interconnecting signal or power cables," as discussed in Section 4.2 of IEEE-279?

Response to TIA Question 2.b Yes. The single failure criteria requirement of IEEE Std. 279-1971 is part of the ONS licensing basis and is described in UFSAR Chapters 8.3.1.2. The 13.8 kVac three phase emergency power medium voltage power cables from KHU to Transformer CT4 intended to provide Class 1E emergency power to the RPS/ESPS equipment do represent "interconnecting signal or power cables" as discussed in Section 4.2, "Single Failure Criterion," of IEEE Std. 279-1971. The NRC staff determined that IEEE Std. 279-1971, to which the licensee is subject for the reasons discussed above, provides that the licensee should evaluate cable failures that result in the short circuiting of interconnected power cables and any resultant damage and additional failures as a single failure. The staff concludes that the evaluation of short circuits between shielded power cables are credible single failures that must be evaluated as part of the ONS design and licensing basis. This means that short circuits, three phase or otherwise, are considered credible single failures.

See the following applicable guidance and requirements.

Criterion 20, Protection Systems Redundancy and Independence, of the draft GDC proposed by the AEC on July 11, 1967 (32 FR 10213), stated that: Redundancy and independence designed into protection systems shall be sufficient to assure that no single failure or removal from service of any component or channel of a system will result in loss of the protection function. The redundancy provided shall include, as a minimum, two channels of protection for each protection function to be served. Different principles shall be used where necessary to achieve true independence of redundant Instrumentation components.

The NRC's position on how single failure was evaluated during the licensing of plants in the late 1960s and early 1970s was discussed in SECY-77-439, "Single Failure Criterion," dated August 17, 1977, the draft GDC proposed by the AEC on July 11, 1967, and 10 CFR 50, Appendix A. As stated in paragraph 1 of SECY-77-439:

In general only those systems or components which are judged to have a credible chance of failure are assumed to fail when the Single Failure Criterion is applied. Such failures would include, for example, the failure of a valve to open or close on demand, the failure of an emergency diesel generator to start or the failure of an instrument channel to function. A single failure can also be a short circuit in an electrical bus that results in the failure of several electrically operated components to function.

- 27 - Paragraph 2.B, "Definition of Single Failure," of SECY-77-439 states, in part, that: Single failure is defined in 10 CFR 50 Appendix A as follows: A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions.

Multiple failures resulting from a single occurrence are considered to be a single failure. Fluid and electric systems are considered to be designed against an assumed single failure if neither (1) a single failure of any active component (assuming passive components function properly) nor (2) a single failure of a passive component (assuming active components function properly), results in a loss of the capability of the system to perform its safety functions. A footnote to this definition states that "single failures of passive components in electric systems should be assumed in designing against a single failure." This means that for electric systems no distinction is made between failures of active and passive components and all such failures must be considered in applying the Single Failure Criterion. For example, short circuits in electrical cables must be considered even though a short circuit could be regarded as a failure of a passive component.

Section 4.2 of IEEE Std. 279-1971 states, in part, that:

Any single failure within the protection system shall not prevent proper protective action at the system level when required.

NOTE: "Single failure" includes such events as the shorting or open-circuiting of interconnecting signal or power cables. It also includes single credible malfunctions or events that cause a number of consequential component, module, or channel failures-.

TIA Question 2.c Can the timing of electrical failures assumed in analyses be limited to reduce the consequential damage as described in the "internal memo to file"?

  • How is single failure timing applied to the commercial Fant power feeders and the QA-1 power feeders from the KHUs to the PSW different than the Class 1E power feeders to the CT-4 transformer?

Response to TIA Question 2.c No, the timing of electrical failures assumed in the analyses described in the "internal memo to file" may not be limited to reduce the consequential damage. The licensee's "internal memo to file" is not part of ONS licensing basis and not consistent with NRC staff positions, industry standards, or regulatory requirements. The licensee's interpretation of single failure as stated in the "internal memo to file" is contrary to industry practices, has no technical basis, is not a licensing document, and is not reviewed and approved by the NRC.

- 28 - The NRC staff reviewed the licensee's "internal memo to file" dated January 12, 1992 (Note: the memorandum was actually written on January 12, 1993), and the licensee's single failure design basis document (DBD) to assess whether the statements included in these documents accurately reflected the ONS licensing basis on the timing of electrical single failures as well NRC requirements. It should be noted that the staff has neither reviewed nor approved the licensee's positions established in the licensee's "internal memo to file" document. There are no identified license amendments or modification to the licensing basis in accordance with 10 CFR 50.59 that incorporate the internal memo to file into the licensing basis.

The single failure criteria requirements of IEEE Std. 279-1971 is part of the ONS licensing basis. The NRC staff determined that the ONS licensing basis for single failure is consistent with NRC interpretations dating back to the trial use of IEEE Std. 279-1968 which was originally incorporated into the ONS licensing basis. The single failure criterion of IEEE Std. 279-1971 was incorporated into the ONS licensing basis and later presented to the Commission in SECY-77-439, "Single Failure Criterion." SECY-77-439, "Single Failure Criterion," dated August 17, 1977, presented to the Commission, the NRC staff's understanding and application of the single failure criterion and how the criterion was applied up to this time. SECY-77-439 states, in part, that:

[A]pplication of the Single Failure Criterion to systems evaluation depends not only on the initiating event that invokes safety action of these systems, together with consequential failures, but also on active or passive electrical failures, which can occur independent of the event. Thus, evaluation proceeds on the proposition that single failures can occur at any time. A single failure may be the result of events and conditions discussed in Section 3 of IEEE Std. 279-1971. Section 3.7 requires consideration of "the range of transient and steady-state conditions of both the energy supply and the environment (for example, voltage, frequency, temperature, humidity, pressure, vibration, etc. during normal, abnormal and accident circumstances throughout which the system must perform." IEEE Std. 279-1971 describes that the maximum energy supply, resulting from a short circuit may not be available at the start time or demand time of a circuit. Hence, no limitations on short-circuit currents may be established by limiting the start time of a single failure. Since the failure can occur over a 'range of transient and steady-state conditions', it is the licensee's responsibility to consider the worst-case credible single failure without constraints to the timing that yields the maximum available short circuit at the Class 1E circuits. The NRC staff notes that by postulating the single failure immediately on demand of a component to function, the licensee failed to establish the most limiting single failure that could occur at the terminations of transformer CT-4. This method of limiting short-circuit current is unacceptable because it masks the worst-case credible single failures, and there is no regulatory precedence for considering such an analysis in lieu of electrical separation. Based on the information above, the NRC staff has determined that the licensee must consider single failures to occur at whatever time produces the most limiting conditions as described in the single failure criteria of IEEE Std. 279-1971. Additionally, the staff concluded that the licensee must also postulate the most limiting credible fault within the cabling system to envelop any other short-circuit condition. The staff concludes that the licensee is not in conformance with AEC GDC 21, which requires consideration of multiple failures resulting from a single event for designing against a single failure and the NRC's policy on single failure criteria as described in SECY-77-439, as applicable to the recently modified cable configuration.

- 29 - Response TIA Question 2.c (bulleted question) Single failure criterion is applied to only Class 1E or safety related power cables and does not apply to non-safety related Fant and the QA-1 power feeders from the KHUs to the PSW. As described in the Response to Question 2.c, the single failure in the Class 1E or safety related power cables can occur at any time during a postulated event. The single failure criteria requirement of IEEE Std. 279-1971 is part of the ONS licensing bases.

The next two paragraphs describe the configuration of the cables when ONS was originally licensed and how the licensee met the NRC requirements of IEEE Std. 279-1968 and single failure criteria requirements of IEEE Std. 279-1971 prior to a recent plant modification.

Chapter 8 of the ONS UFSAR describes that safety related 125 Vdc power and control cables and safety related 120 Vac engineered safeguards protection system (ESPS) cables for redundant trains were directly buried in ground with 'adequate' separation between the two trains and also adequately separated from the 4.16 kVac and 13.8 kVac power cables such that a fault in one train would not adversely impact redundant trains.

The safety related 4.16 kVac and 13.8 kVac power cables were also directly buried with adequate separation between redundant trains and between medium voltage and low voltage power and control cables such that a single failure would not adversely impact redundant trains.

Since the licensing of ONS, the licensee performed a plant modification that rerouted the previously buried medium voltage safety related and low voltage safety related power and control cables and added new non-safety related power cables in a common concrete trench. The cable rerouting was implemented under the 10 CFR 50.59 program. In addition to the rerouting of the power cables between the KHUs and the three Oconee Units, the licensee introduced a non-safety related 13.8 kVac power feeder to the PSW system in Manhole #6 for normal operation from a 100 kVac power source known as the Fant Line.

As a result of the plant modification, the rerouted cable configuration does not meet the ONS licensing basis for single failure criteria as specified in IEEE Std. 279-1971. The safety related 13.8 kVac and 4.16 kVac power cables and redundant safety related 125 Vdc power and control cables are routed in close proximity to each other in Trench #3. As a consequence, a single failure in a safety related cable in Trench #3 or Manhole #6 may disable redundant circuits for the onsite safety-related emergency power system. As a result, the rerouted cable configuration introduced a new failure mechanism.

UFSAR Section 8.3.1.4.6.2 states that control, instrumentation, and power cables are applied and routed to minimize their vulnerability to damage from any source. The introduction of the non-Class 1E PSW power cables in Manhole #6 and Trench #3 is contrary to the ONS licensing basis since failures in the PSW system cables may degrade safety related systems.

As an example, a failure of a 13.8 kVac safety related emergency power cables from KHU to Transformer CT4 caused by a 3-phase short circuit could induce a large voltage into the redundant safety related 125 Vdc power and control cables in Trench #3 causing failure of ESPS and the reactor protection systems. In addition, cable forces or whiplash resulting from this failure could result in multiple consequential failures to adjacent safety and non-safety related cables in Trench #3 disabling both safety related onsite emergency power systems for all three units.

- 30 - Therefore, based on the information above, the recent plant modification of rerouting cables in Trench #3 and Manhole #6 resulted in ONS not meeting its licensing basis. TIA Question 2.d Can ONS staff make any distinctions between passive and active electrical single failures as described in the "single failure memo to file"?

Response to TIA Question 2.d No. The ONS cannot distinguish between passive and active electrical single failures as described in the ONS "internal memo to file" because that internal memorandum is not part of the ONS UFSAR and is not part of the ONS licensing and design basis documents the NRC staff has relied upon to evaluate compliance with NRC regulations 10 CFR 50.55a(h)(2) and 10 CFR 50.54(jj). The licensee's interpretation of single failure as stated in the "internal memo to file" is contrary to industry practices, has no technical basis, and is not a part of the ONS UFSAR or TSs.

As stated earlier, the NRC's position on the definition of single failure and how single failure was evaluated during the licensing of plants in the late 1960s and early 1970s was discussed in SECY-77-439. As noted in the response to Question 2.b, this means that for electric systems, no distinction is made between failures of active and passive components and all such failures must be considered in applying the single failure criterion.

ONS UFSAR Section 8.3.1.2, "Analysis," the licensee's current licensing basis, states, in part, that: The basic design criterion for the electrical portion of the emergency electric power system of a nuclear unit, including the generating sources, distribution system, and controls is that a single failure of any component, passive or active, will not preclude the system from supplying emergency power when required.

Based on the above information, the NRC staff has determined that the internal ONS memo interpretation contradicts with single failure requirements of IEEE Std. 279-1971 and is not part of the ONS UFSAR, and licensing and design basis documents. In addition, the staff has determined that, as stated in ONS UFSAR Section 8.3.1.2, for electric systems, no distinction is made between failures of active and passive components.

TIA Question 2.e Is the ONS staff required to analyze for combinations of multi-phase short circuits as well as ground faults within trench 3 in order to be compliant with the regulations and/or the current licensing basis for ONS?

Response to TIA Question 2.e Yes. The regulations at 10 CFR 50.54 (jj) require that "[s]tructures, systems, and components subject to the codes and standards in 10 CFR 50.55a must be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety function to be performed."

- 31 - Section 4.2, "Single Failure Criterion," of IEEE Std. 279-1971 states that "'Single failure' includes such events as the shorting or open-circuiting of interconnecting signal or power cables." 'Shorting' between independent interconnecting power cables is an exact parallel condition to multi-phase shorts.

The NRC staff has performed an evaluation of the physical installation of the cable and compared it to the ONS licensing basis. The staff determined that the cables in Trench #3 are intertwined and relatively close together in most of the raceway. The failure mode could be initiated due to arcing from one cable to an adjacent cable rather than the ground. This would be the more limiting fault. Duke Energy has not provided an adequate basis to conclude that multi-phase faults are non-credible in all sections of the cable runs, other than at the terminal connections. Since short circuits may occur between two-phase conductors, between all phases of a polyphase system, or between one or more phase conductors and ground, the short circuit may be solid (or bolted) or welded, in which case the short circuit is permanent and has relatively low impedance. ONS's licensing and design bases includes conformance to the single failure requirements of IEEE Std. 279-1971. The conformance to IEEE 279-1971 includes the requirements to consider the full effects and consequences from electrical single failures in the onsite power system.

Therefore, the NRC staff concludes that ONS is required to analyze for combinations of multi-phase short circuits as well as ground faults within Trench #3 to meet the single failure requirements of IEEE Std. 279-1971.

TIA Question 2.f Is the licensee required to analyze for consequential damage from electrical failures to the adjacent Class 1E safety systems?

  • Is the licensee required to assume that AC circuits could short to DC circuits?
  • If so, are the installed ONS 125Vdc protective devices sufficient to mitigate the effects of AC voltages ranging from 2.5kVac to 13.8kVac to prevent these voltages from propagating throughout the DC systems?

Response to TIA Question 2.f Yes. The licensee is required to analyze for consequential damages from a single electrical failure to the adjacent Class 1E safety systems to ensure that redundant safety trains are not adversely affected and it does not cause a common cause failure of a system in accordance with AEC GDC 21, 10 CFR 50.55a(h)(2), and single failure requirements included in Sections 4.2, 4.7, 4.11 and 4.17 of IEEE Std. 279-1971 in the ONS licensing basis. Duke Energy has stated that the design of the ONS onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE Std. 279-1971. Section 4.2, "Single Failure Criterion," of IEEE Std. 279-1971 states, in part, that:

Any single failure within the protection system shall not prevent proper protective action at the system level when required.

NOTE: "Single failure" includes such events as the shorting or open-circuiting of interconnecting signal or power cables. It also includes single credible

- 32 - malfunctions or events that cause a number of consequential component, module, or channel failures. Response to TIA Question 2.f (first and second bulleted questions) Bullet #1:

Yes. As stated earlier, in accordance with AEC GDC 21 (as stated in the ONS UFSAR) and 10 CFR 50.55a(h)(2) (IEEE Std. 279-1968 and the single failure requirements of IEEE Std. 279-1971), the licensee is required to analyze for consequential damage from electrical failures that can affect adjacent Class 1E safety systems in Trench #3 and Manhole #6 to ensure that redundant safety trains are not adversely affected by any new failure modes, so that the consequential damage does not result in a common cause failure of a system.

Bullet #2:

No, the effects of 13.8 kVac cables to the 125 Vdc protective devices should be analyzed for consequential damage as described in NRC Response to Question 2.f above as part of the ONS licensing basis. The components designed for 125-Vdc systems in Trench #3 and Manhole #6 are not qualified to withstand the 13.8 kVac power levels or terminal voltages that could adversely impact the 125 Vdc protective devices due to certain types of failures of the collocated 13.8 kVac power cables. Operating experience (e.g., GL 2007-01) have shown that these types of failures are credible.

The licensee provided additional information in support of the TIA review by letters dated May 11, 2015, and August 7, 2015. This information reiterated the licensing basis of the plant and provided information related to cable testing performed to evaluate the physical strength of the cables installed in Trench #3 associated with Keowee power system. In addition, the letters provided information such as types of cables installed at ONS, separation criteria related to heat dissipation, overfill of cable trays, types of faults that can be postulated concurrent with design basis events, and the excess margin in design of power cables in Trench #3. The ONS has also provided risk-informed analysis information for external fire events. The Region II staff reviewed the information provided in the letters and determined that the additional information did not contain any new details on the adequacy of the design and installation of the cables in Trench #3.

The NRR staff considered all of the licensee's supplemental information in its technical evaluations and was not able to identify any licensee documentation demonstrating, by analyses and tests, that the present as-built configuration has adequate physical separation and that the Class 1E system protective devices actuate prior to any consequential damage to the redundant engineered safety feature circuits. In the absence of such analysis and test data, the licensee must assume that 13.8 kVac cables could damage adjacent 125 Vdc power and control cables and other engineered safety feature circuits from a worst-case credible short circuit that would result in multiple consequential failures.

- 33 - TIA Question 2.g Are all commercial, non-quality related (i.e. not QA-1 or QA-5) electrical components assumed to fail in the most limiting way possible?

  • Does the failure of one of these commercial components represent a "single failure," in the context of the ONS licensing basis?

Response to TIA Question 2.g Yes, only safety related or Class 1E designated components are credited to mitigate design basis events. The single failure criteria requirements of IEEE Std. 279-1971 apply to Class 1E designated components. The ONS UFSAR Chapter 15 for SSCs describes crediting Class 1E in the accident analysis assumptions. The licensee may not credit any non-safety equipment unless it is specifically evaluated and approved in the plant licensing basis. The non-safety related power cables in Trench #3 and Manhole #6 are not credited in the ONS licensing basis for mitigating design basis events. Therefore, the license must account for the impacts of worst-case credible failures of non-safety equipment on Class 1E circuits as required by IEEE Std. 279-1968, items 3(g) and 3(h)5, regarding environmental impacts and impacts of malfunctions, accidents, or other unusual events.

Response to TIA Question 2.g (bulleted question) No. The single failure criterion requirements of IEEE Std. 279-1971 only applies to safety-related or Class 1E designated SSCs.

As an example, a failure of the non-safety related "Fant" line 13.8 kVac power cables is assumed to occur at any time. This failure is considered as a worse case credible fault condition. The integrity of the Class 1E systems in the common underground raceway in Trench #3 must be demonstrated by the licensee with the above failure and a single failure of the Class 1E equipment. This must not result in loss of safety function of a system or introduce a common cause failure within the electrical power system(s). TIA Question 2.h Can unrestrained cable whip in trench 3 be assumed to cause cable damage leading to secondary short circuits that could cause damage to the DC systems and should these effects of cable whip be analyzed? Response TIA Question 2.h Yes. The detrimental effects of cable whip for a worst case credible cable fault in Trench #3 must be analyzed in accordance with the single failure criteria requirements of IEEE Std. 279-1971, specified in response to TIA Question 1 above.

The electromagnetic forces produced by a short circuit condition can cause whipping of any of the 13.8k Vac power cables in Trench #3 and Manhole #6, which exerts significant forces on cable restraints and any adjacent cables. Hence, the electromagnetic forces generated from a 5 IEEE Std. 279-1971 Sections 3(7) and 3(8) are equivalent to IEEE Std, 279-1968 Sections 3(g) and 3(h).

- 34 - postulated short circuit failure in the 13.8 kVac medium voltage power cables in Trench #3 must be considered in the analysis and demonstrated by tests to validate that there is no collateral damage to adjacent safety related 125 Vdc protection and control system cables. TIA Question 2.i Are overload currents as well as short circuit currents required to be evaluated to determine the most limiting results from electrical faults and component failures?

  • Do the results of such an analysis influence the required component separation to meet regulatory requirements and the ONS licensing basis? Response to TIA Question 2.i No. Only the worst-case credible short circuit currents are required to be evaluated to determine the most limiting results from electrical faults and component failures. Cables are designed to operate under overload conditions without causing consequential damage to other cables. The licensee must follow the requirements for maintaining cable separation, redundancy, and independence to permit the required functioning of the engineered safety feature equipment in accordance with AEC GDCs (principal design criteria). Response to TIA Question 2.i (bulleted question) Yes, the results of short circuit analysis can influence the required component separation to meet regulatory requirements and the ONS licensing basis. The licensee must meet the design basis requirements specified in ONS UFSAR Section 8.3.1.4.6.2, "Cable Separation," and regulatory requirements specified in AEC GDCs 22, 23, 24, and 39 and 10 CFR 50.55a(h)(2) and 10 CFR 50.54(jj) requirements.

TIA Question 2.j Can cable shielding or armor prevent short circuits or limit faulted currents and voltages?

  • Can the two wraps of bronze shielding tape in the licensee's current power cable configuration be considered equivalent to the steel interlocked armored cable as described in the test report MCM-1354.00-0029.001?
  • Are the results of test report MCM-1354.00-0029.001 sufficient to demonstrate that electrical faults cannot propagate from one cable to another as described in the single failure DBD, Section 3.3.6.1?

Response to TIA Question 2.j No. Both cable shielding and armor cannot be credited for preventing short circuits or limiting fault currents and voltages. Cable shielding and cable armor serve different functions. A shield is employed in the subject cable design to preclude excessive voltage stress on voids between the conductor and insulation, and to confine the electric field of the cable to the insulation of the conductor or conductors.

- 35 - Cable Shield and Armor in Power Cables

- 36 - The following definitions were drawn from IEEE Std. 422-1986, "Guide for the Design and Installation of Cable Systems in Power Generating Stations," and the Okonite Company Engineering Information (http://okonite.com/engineering/shielding.html), and in the NRC staff's experience are typical of cable manufacturers' literature. Definition of Shielding Shielding of an electric power cable is the practice of confining the electric field of the cable to the insulation of the conductor or conductors. It is accomplished by means of strand and insulation shields. Functions of Shielding A strand shield is employed to preclude excessive voltage stress on voids between conductor and insulation. To be effective, it must adhere to or remain in intimate contact with the insulation under all conditions.

An insulation shield has a number of functions:

a) To confine the electric field within the cable. b) To obtain symmetrical radial distribution of voltage stress within the dielectric, thereby minimizing the possibility of surface discharges by precluding excessive tangential and longitudinal stresses. c) To protect cable connected to overhead lines or otherwise subject to induced potentials. d) To limit radio interference. e) To reduce the hazard of shock. If not grounded, the hazard of shock may be increased.

- 37 - Definition of Armor A mechanically strong and flexible sheath of corrugated aluminum, copper, bronze or steel which can be applied over a variety of cable cores. Armor is a metal layer wrapped around the exterior of a cable to provide mechanical protection. It is primarily used in hazardous environments that require an extra layer of cable defense, or in situations where Type MC (metal clad) cable is required by the National Electric Code. The metal armor can protect the cable against falling objects, crushing, and other physical damage. Armor vs. Shielding Although both are metal layers used in cable to provide protection, each provides a very different kind of protection. Armor, located on the outside of the cable, is a sturdy layer of metal designed to protect mechanical integrity. It protects the cable against physical hazards and prevents it from being crushed or damaged by outside forces. Shielding is incorporated in the inner layers of the cable, around the conductor. It works to minimize electromagnetic interference and prevents the cable from intercepting outside currents or signals that could damage its productivity. Whether armor and shielding are both used in a cable depends on the application for which it is being designed.

Response to TIA Question 2.j (first and second bulleted questions)

Based on the information above, the cable does not have any armor. The bronze shield is employed to preclude excessive voltage stress on voids between the conductor and insulation, and it confines the electric field of the cable to the insulation of the conductor or conductors.

The NRC staff's review of the McGuire and Catawba medium-voltage cable test report indicated that the ONS cables are not similar (6.9 kVac and 4.16 kVac versus 13.8 kVac, as well as differences in the cable design and the cable physical configuration). The staff finds that the tests performed on the McGuire/Catawba interlocked armor cables were not adequate to envelope the potential faults if high energy power cables (such as the ONS 13.8 kVac) were short circuited within underground electrical raceway systems. The cable testing performed cannot be extrapolated for use to eliminate fault propagation for ONS for the following reasons: 1. Each cable is designed differently. The results of testing on one type of cable do not necessarily determine the results for a different type and make of cable. 2. Testing was only conducted on one 600 V, one 4160 V, and one 6900 V cable. This is not a sufficient sample size to properly determine the behavior of the cables that are being tested.

3. The testing was not conducted with reducing separation criteria in mind. The purpose was to show that fire propagation would not occur. 4. Contrary to ONS's assertions, the 6900 V test resulted in the armor around the fault area being "melted and blown back." Additionally, it was noted that a loading crate 6 feet from the cable was set on fire. These

- 38 - results tend to point toward a high energy arc fault occurring, which is indicative of the type of event that could result in catastrophic failure of other cabling depending upon where in the path of the high energy arc fault that the cabling is routed.

Thus, the testing documented in report MCM-1354.00-0029.001 is not applicable to the cables installed in the ONS underground raceway systems (i.e., connected between the Fant line, PSW, KHS, and ONS systems). Therefore, the licensee has not demonstrated that electrical faults will not propagate from one cable to another. TIA Question 2.k Does the interconnected nature of the Class 1E DC systems in the ONS KHU start panels and the Keowee hydro-station KHU start panels present vulnerabilities where DC to DC interactions could disable the Keowee emergency power systems?

Response to TIA Question 2.k Yes, the Class 1E direct current systems that operate at 125 Vdc have termination clearances and cable insulation capabilities that can withstand marginally higher voltages - typically up to 250 Vdc. At KHU, the safety related DC cable and DC cable terminations in ONS KHU start panels for both trains are in close proximity. In addition, the safety and non-safety related medium-voltage power cables are in close proximity to the safety related 125 Vdc power and control cables in Trench #3 and Manhole #6. Any 13.8 kVac power cable fault could induce voltages up to 13.8 kVac in the 125 Vdc system resulting in a flash over at the terminals in the KHU panels. Hence, the interconnected nature of the ONS/KHS designs could expose the 125 Vdc power and control cables to a single point vulnerability such that a DC-to-DC short circuit at the KHU panel terminal blocks may disable both KHUs. Since the three ONS units consolidated their ESPS emergency power starting system wiring into two ESPS start trains (A and B) within KHU/ONS cabinets, all three units are potentially vulnerable to failure of an ESPS start demand for the KHUs.

Thus, the NRC staff has determined that a single failure vulnerability could exist for DC-to-DC short circuits in the KHU emergency start and switchyard isolation features because of the recent plant modification performed when rerouting the 13.8 kVac medium voltage power cables and 125 Vdc power and control cables in Trench #3. The licensee has not demonstrated that existing routing of power and control cables, including the ESPS protection circuits to the KHU units, from each ONS unit have adequate separation, independence, and redundancy, as specified by the ONS licensing basis. Additionally, the licensee failed to demonstrate that no potential exists to disable functional requirements of redundant Class 1E systems. In accordance with 10 CFR 50.34(b)(2), the licensee must provide a description and analysis of the SSCs in the UFSAR to include the design bases and limits on operation to show that the safety functions will be accomplished.

UFSAR Section 8.3.1.4.6.2, "Cable Separation," and the ONS principal design criteria based upon the AEC GDCs 19, 20, 21, 22, 23, 24, and 39, provide descriptions for the licensee's conformance to applicable requirements.

- 39 - 4.0 CONCLUSION The NRC staff concludes that the 10 CFR 50.59 plant modifications made to the ONS design do not comply with the licensing bases as it pertains to placing safety related cables in close proximity to high energy non-safety related energy sources in Trench #3 and Protected Service Water Modifications discussed in Unresolved Item 05000269/2014007-05, 05000270/2014007-05, 05000287/2014007-05, Potential Unanalyzed Condition Associated with Emergency Power System. Furthermore, the staff is concerned that these modifications potentially introduced new failure modes that were not adequately analyzed.

Attachment:

NRC Staff Response to Duke Energy "Fact Check" Letter Attachment NRC Staff Response to Duke Energy Carolinas, LLC August 15, 2016, "Fact Check" Letter In accordance with the Office of Nuclear Reactor Regulation (NRR) Office Instruction, COM-106, Revision 5, "Control of Task Interface Agreements" (Agencywide Documents Access and Management System (ADAMS) Accession No. ML15219A174), on August 2, 2016, the U.S. Nuclear Regulatory Commission (NRC) provided Duke Energy Carolinas, LLC (Duke Energy, the licensee), with the draft Task Interface Agreement (TIA) 2014-05 response (ADAMS Accession No. ML16214A003) for a fact check related to an unresolved item at the Oconee Nuclear Station (ONS), Units 1, 2, and 3 involving cable configurations in certain underground cable raceways. The licensee's letter dated August 15, 2016, provided its response (ADAMS Accession No. ML16231A451). The NRC staff has reviewed the licensee's response and concluded that it did not identify any factual errors. However, the staff made several clarifications to the TIA Response in response to the licensee's comments and observations. The following NRC staff's response is provided to document the basis for staff's conclusions concerning the licensees views pertaining to TIA response provided for the NRC Region II questions.

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response 1.0, "Introduction" Comment No. 1 Duke Energy did not identify any factual inaccuracies in this section of the draft TIA response. No NRC response required. N/A 2.0, "Background" Comment No. 2 The ONS Updated Final Safety Analysis Report (UFSAR) Section 8.3.1.4.6.2 (Ref. 1) provides the licensing basis cable separation requirements. It should also be pointed out that NRR staff identified the ONS licensing basis for cable separation requirements in Section 3, "Staff's Technical Evaluation," of the draft response. The language identified by this comment was in the background section of the NRC's TIA response, and represents a paraphrase of the Component Design Basis Inspection (CDBI) report. The TIA response did not rely upon the paraphrased language, and instead verified the licensing basis from a review of ONS licensing basis documents as described in the Evaluation section of the TIA. No Comment No. 3 This NRR statement is incorrect because the three (3) ONS units were licensed well before the issuance of the initial revision for Standard Review Plan (SRP), Section 8.2 (Ref. 2) and the SRP has not subsequently been added to the ONS licensing basis. Additionally, [Institute of Electronics and Electrical Engineers (IEEE)] Standard 379 (Ref. 3) is not a part of the ONS licensing basis and therefore statements in this standard, that all failures must be assumed, are outside of the scope of the ONS licensing basis. Specifically, in the absence of regulations and The language identified by this comment was in the background section of the NRC's TIA response, and represents a paraphrase of the CDBI report. The TIA response did not rely upon the paraphrased language, and instead verified the licensing basis from a review of ONS licensing basis documents as discussed in the Evaluation section of the TIA. Although not specifically discussed in the Evaluation section of the TIA, as pointed out in this comment, IEEE Std. 379 and No

- 2 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response standards at the time of initial ONS licensing, Duke Energy, with awareness by the Atomic Energy Commission (AEC), developed its own single failure criterion, using correspondence from the AEC and available mechanical and electrical codes at the time. In addition, ONS has not adopted IEEE Standard 379 or the use of the NRC-referenced version of SRP 8.2 in any subsequent ONS-related licensing basis docketed correspondence.

The NRC has been aware of the ONS approach to satisfying single failure criteria as a result of decades of specific NRC review of related documents and Duke Energy submittals to the NRC. As an example, ONS specification OSS-254.00-00-4013, "Design Basis Specification for the Oconee Single Failure Criterion (Ref. 4)," provides the overall site guidance on the application of the single failure criterion. The ONS licensing basis is stated in Section 3.2.1.4.1, "Credible Failures," which states, "Application of the single failure criterion does not require that all failures be assumed. Only those failures with a credible chance of occurring must be considered in evaluations of system design bases...." As discussed throughout this enclosure, ONS has consistently determined that certain failures, which the NRC relies on, are not credible. The staff's Technical Evaluation focused on standards and did not address the design features that preclude the failure mechanisms raised by the TIA.

Furthermore, NRR undertook a formal review of the ONS Electrical Distribution System (EDS) in August 1995. [A request for additional information (RAI)] response (Ref. 5) stated, in part, that, "In general, only those systems or components with a credible chance of failure are assumed to fail. ONS is not aware of a requirement that all possible failures must be assumed. Also, components are assumed the referenced version of the SRP Section 8.2 is not part of the ONS licensing basis. The TIA relied on the ONS AEC GDC; included in the UFSAR IEEE Std. 279-1968 and single failure criteria requirements in IEEE Std. 279-1971 as discussed in the Evaluation section.

The NRC agrees that only credible failures need to be addressed. In this TIA, as discussed in the Evaluation section, the NRC believes that the failure modes in question are credible and must be considered. The NRC does not believe that the ONS design features (bronze shielding) precludes the failure mechanisms.

- 3 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response to fail only in a credible failure mode." The necessity that the failure mode be credible forms the basis for ONS' decisions regarding separation, which are at issue. In its final report (Ref. 6), NRR acknowledged that, "Because Oconee was not licensed to 10 CFR 50, Appendix A, the plant specific single failure definition for Oconee remains valid and in effect with no additional requirements on the electrical power systems [as a result of 10 CFR 50.46 or 10 CFR 50, Appendix K]." (p. 113) Therefore, the staff erred in its reliance on IEEE-379 in making its conclusion. This error appears in multiple locations within the document. Comment No. 4 The wording in the May 13, 1976 (Ref. 7), letter states that "the Oconee onsite emergency [alternating current (AC)] and [direct current (DC)] power systems conform to the single failure requirements of IEEE 279-1971." The single failure requirements are contained in Section 4.2 of that standard. ONS did not commit to the rest of IEEE 279-1971 (Ref. 8) nor did it imply to do so in any subsequent correspondence. For the TIA to now reference other sections of IEEE 279-1971 (Ref. 8) and portray them as being within the ONS licensing basis (i.e., applicable to ONS) incorrectly portrays the commitment Duke Energy made in its May 13, 1976 letter. Duke is correct in asserting that the 1976 Parker letter stated, "The design of the Oconee onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE 279-1971" (emphasis added). The NRC will correct the error in the TIA response; however, the staff notes that single failure requirements are included in Sections 4.2, 4.7, 4.11, and 4.17 of IEEE Std. 279-1971. As stated in the TIA response, the design basis of the Oconee onsite emergency AC and DC power systems requires conformance to the single failure requirements of IEEE Std. 279-1971. Single failure requirements are specifically addressed in response to questions 2a, 2b, 2c, 2d and 2f. The basic definition and requirement for single failure criterion in Section 4.2 of IEEE Std. 279-1971 is adequate to maintain staff's position for the responses in this TIA. However, Section 4.7 is part of the single failure criteria and helps to understand the intent of 'separation/isolation criterion' and how to ensure that single failure vulnerabilities do not have adverse impact on related or redundant system. Section 4.7.2 elaborates on examples of credible failures and potential failures of isolation devices. Section 4.7.3 elaborates Yes

- 4 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response on the requirements of redundant train after postulated single failure. Section 4.11 elaborates on the requirements of single failure criteria still applies while performing channel bypass or removal from operation. Section 4.17 elaborates on the requirements of single failure criteria still applies during manual initiation of a protection system. Comment No. 5 The terms "close proximity," "adjacent" and "mixing" suggest that cables were not routed in consideration of cable separation requirements. All cables are routed in accordance with ONS cable separation design and licensing requirements per [Updated Final Safety Analysis Report (UFSAR)] Section 8.3.1.4.6.2 (Ref. 1) and other station cable separation requirements (e.g., Ref. 27 and Ref. 29). The language identified by this comment was in the background section of the NRC's TIA response, and represents a paraphrase of the CDBI report. The TIA response did not rely upon the paraphrased language, and instead verified the licensing basis from a review of ONS licensing basis documents. No Comment No. 6 The neutral grounding transformer and resistor installed on the Keowee generators were installed to limit equipment damage for phase-ground faults. This is a standard power system practice and by design, will limit phase-ground fault current resulting in a decrease of energy release magnitude. The language identified by this comment was in the background section of the NRC's TIA response, and represents a paraphrase of the CDBI report. The TIA response did not rely upon the paraphrased language, and instead verified the licensing basis from a review of ONS licensing basis documents. No 3.0, "Staff's Technical Evaluation" Comment No. 7 (History of ONS licensing basis for electric power systems and associated interfacing systems) The NRR reference to UFSAR Section 8.3.1.4.6.2 is incomplete in that the following pertinent information should be included. Specifically, UFSAR Section 8.3.1.4.6.2 continues to state that it is ONS' "intent wherever physically possible to utilize metallically armored and protected cables systems. By this we mean the use of rigid and thin wall metal conduit, metal sheathed cables (aluminum and other metals), bronze armored control cables, steel interlocked armor, or metallic taped power and control cables, and either interlocked armor, served wire or braided armored instrumentation cables." Cable armoring has been an important design feature for satisfying cable separation criteria at ONS. Additionally, UFSAR Section 8.3.1.4.6.2 also states that "five inches of cable tray rail to rail The licensee's reference to the ONS licensing basis with respect to armoring is not relevant to the discussion in UFSAR 8.3.1.4.6.2 on cable separation. Armoring of cable is a separate matter from separation of cable. The UFSAR discussion quoted by the licensee appears to be an explanation of the meaning of cable armoring and protection at ONS, and does not address whether armoring may substitute for separation. Accordingly, the safety evaluation report (SER) statements approving ONS cable separation design and installation, which are quoted by the licensee, cannot reasonably be read as an NRC staff approval of criteria for substituting cable armoring in lieu of meeting applicable separation requirements. No

- 5 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response separation" is provided on installation of a cable tray. In a January 26, 1972 letter (Ref. 10), the AEC endorsed Duke Energy's proposal to revise the [final safety analysis report (FSAR)] to show that "the original cable separation criteria will be met including no cable tray overloading and a minimum of five inches rail-to-rail space between all vertical trays." The AEC stated in the letter that "we conclude that your proposal as noted above is acceptable."

The ONS SER dated Dec. 29, 1970 (Ref. 11), (page 54, Section 8.5, "Cable and Equipment Separation and Fire Prevention"), endorses the staff's acceptance of Oconee's cable separation design through the following statements: "We have reviewed the applicant's design and provisions and installation arrangement plans relating to (1) the preservation of the independence of redundant safety equipment by means of identification and separation, and (2) the prevention of fires spreading through derating of power cables and proper tray loading. We have found these design provision and installation arrangements acceptable." The staff also notes that until 2010, in this FSAR section, the final sentence of this paragraph stated: "With this type construction fire stops as such are not required." This indicates the intent of using metallically armored and protected cable systems was as a fire protection feature to eliminate the use of fire stops, not for physical separation of trains. This sentence was deleted by an FSAR change 09-51.

The licensee referenced the AEC's approval of "five inches rail-to-rail space between all vertical trays." The licensee did not identify any part of the TIA response that is inconsistent with the AEC's approval. The licensee referred to the NRC's approval of ONS SER dated December 29, 1970. The licensee did not identify how the portion of the NRC approval referenced by the licensee relates to the discussion of cable separation in Section 3.0, Staff's Technical Evaluation, on page 14 of the TIA response.

- 6 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response Comment No. 8 (Staff discussion of history of ONS licensing basis for electric power systems and associated interfacing systems) The staff's interpretation of the ONS licensing basis with respect to the applicability of IEEE 603 and IEEE 379 to systems beyond [reactor protection system/engineered safeguards protection system (RPS/ESPS)] is inconsistent with licensing commitments made by ONS to the NRC. The ONS commitment to these standards is limited to the "new digital" portion of the RPS/ESPS upgrade. The January 2008 [license amendment request (LAR)] (Ref. 14) stated that "IEEE Standard 603-1991 applies only to portions of the RPS/ESPS affected by the design change." Furthermore, the ONS [failure modes and effects analysis (FMEA)] calculation (Ref. 15) that was reviewed and referenced in the January 2010 SER (Ref. 16) for LAR 2007-09 (Ref. 14) clearly states that IEEE-Standard 603 is only applied to the digital components. The NRC agrees that amendment Nos. 366, 368, and 367 for ONS Units 1, 2, and 3 for LAR 2007-09 (ADAMS Accession No. ML100220016) incorporated IEEE Std. 603-1998 and 379-1994 as the licensing basis criteria for the single-failure criterion, independence and separation requirements of the portion of the RPS/ESPS affected by the design change. However, the ONS FMEA for the digital RPS/ESPS includes consideration of impacts of cable faults on the digital RPS/ESPS circuits. These standards are part of the ONS licensing basis for the FMEA for the digital components. The TIA has been revised to clarify this position. Yes 3.1, "Response to Requested Actions" Comment No. 9 (Ref: TIA Question 1) As discussed in several Duke Energy Comments in this enclosure, it appears the draft TIA response incorrectly describes the ONS licensing basis in that the draft TIA response does not recognize elements of the licensing basis and/or it incorrectly expands aspects of the licensing basis to systems and components beyond that which was identified in licensee commitments. The staff disagrees with the comment. The staff has performed an extensive examination of all the NRC correspondence with Duke Energy, all relevant safety evaluations for license amendments, the CDBI inspection report, all applicable sections of the ONS UFSAR, and the background information provided by the CDBI inspection team in the TIA, including Duke Energy letters dated May 11, 2015 (ADAMS Accession No. ML15139A049), and August 7, 2015 (ADAMS Accession No. ML15224A370), and the NRC independent review team's feedback. Based on the review of these documents, the staff has correctly assessed what the ONS licensing basis is and has documented that in Section 3.0 of the draft TIA response. No Comment No. 10 (Ref: TIA Question 2.a) Because ONS was issued construction permits on November 6, 1967 (Ref. 17), "protection systems must be consistent with their licensing basis" in order to satisfy the requirements of 10 CFR 50.55a(h)(2). As noted in Duke Energy Comment #4, the only portion of IEEE Standard 279-1971 that is a part of the ONS licensing basis for the onsite AC and DC emergency power systems are The staff agrees that the single failure criteria requirements of IEEE Std. 279-1971 is part of the ONS licensing basis. IEEE Std. 279 1971 Section 4.2, "Single Failure Criterion," states, "'Single failure' includes such events as the shorting or open-circuiting of interconnecting signal or power cables." Yes

- 7 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response the single failure requirements in Section 4.2. The staff is incorrect in stating that Section 3, "Design Basis," of the standard applies to the ONS power cables. Furthermore, as noted in Duke Energy Comment #8, it is also incorrect to apply IEEE Standard 603-1991 requirements to the ONS power cables that are the subject of this TIA. In addition, IEEE Standard 279-1971 does not include the term "multiphase." The Note in IEEE 279-1971 Section 4.2 references "shorting or open-circuiting or interconnecting signal or power cables" and "credible malfunctions." A multiphase fault can occur at either end of the subject cables, since that is the location where all three phases come together at a common connection point.

For faults at other locations, ONS' position on a "shorting" malfunction resulting in "multiphase" faults for the single-conductor medium voltage bronze tape power cables is as follows:

Each phase conductor of the subject three-phase 13.8 [kiloVolt (kV)] and 4.16 kV power systems is a single discrete component. For the specific ONS cable design and installation, a single failure (i.e. shorting malfunction) begins as a cable insulation failure resulting in a single phase-ground fault. Engineering analysis has demonstrated that the cable bronze tape metallic shield is capable of carrying the phase-ground fault current for the required duration to allow the protective relaying and breaker to detect and clear the fault prior to propagation to a multiphase fault in other separate discrete cables.

Cable fault testing of the ONS single conductor bronze tape cable was performed in 2015. The fault testing included purposely induced phase-ground cable faults using power Where "shorting" between independent interconnecting power cables is an exact parallel condition to multi-phase shorts.

The staff disagrees that only the single failure requirements in Section 4.2 of IEEE Std. 279-1971 is part of the ONS licensing basis. The staff notes that single failure requirements are included in Sections 4.2, 4.7, 4.11, and 4.17 of IEEE Std. 279-1971.

The ONS adopted IEEE 279-1968 in its entirety as its licensing basis. Section 3 "Design Basis" items (g) for transient conditions of IEEE 279-1968 are equivalent to Section 3 "Design Basis" item 7 of IEEE 279-1971 for transient and steady-state conditions. The ONS adopted IEEE 279-1968 in its entirety as its licensing basis. Section 3 "Design Basis" items (h) for malfunctions, accidents, or other unusual events of IEEE 279-1968 are equivalent to Section 3 "Design Basis" item 8 of IEEE 279-1971.

As stated above for response to Comment No. 8, the staff has determined that IEEE Std. 603 requirements are also applicable to the ONS Units 1, 2, and 3 based on licensee commitments documented in Amendment Nos. 366, 368, and 367 for ONS, Units 1, 2, and 3, respectively, for LAR 2007-09 (ADAMS Accession No. ML100220016). The ONS FMEA for the digital RPS/ESPS includes consideration of impacts of cable faults on the digital RPS/ESPS circuits. These standards are part of the ONS licensing basis for the FMEA for the digital components. References to IEEE Std. 603-1998 have been clarified or removed.

In addition, the licensee has referenced IEEE Std. 279-1971 stating that it does not include the term "multiphase." This statement challenges the meaning of "multiphase" and it does not challenge factual information of the ONS licensing basis.

- 8 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response sources that emulated the ONS and Fant power systems with respect to power source grounding type (solid and resistance), voltage, available phase-ground and multiphase fault currents and fault durations. The fault durations were based on relay response and breaker opening times. The results of the fault testing demonstrated that a single-phase to ground fault would not propagate to a multiphase fault.

Therefore, based on analysis that has been validated by testing, ONS believes it has adequately addressed multi-phase faults on the single conductor bronze tape design in our analyses. Therefore, the staff's conclusions of Section 3.1, "Response to Requested Actions," remain unchanged.

Regarding cable fault testing, the NRC staff observed the referenced tests and reviewed the results. The staff determined that the testing as conducted by the licensee produced anecdotal results that did not demonstrate the capability of the bronze tape cable to meet separation requirements for the cable design and configurations in question.

The testing failed to simulate the failure modes identified in the TIA, or the actual power levels to which these systems and the ESPS cabling are exposed. The staff noted that the specified test criteria appear contingent on the concepts specified in the ONS "internal memo to file," which then produced the observed anecdotal results: The tests discounted multi-phase faults because the licensee believes that they are not credible. This was the subject of Question 2.e; the licensee must consider failures at any time including credible failure modes for cable short circuits and multi-phase failures are in fact credible. The licensee used the single failure "on-demand" concept to reduce the fault current available to damage components. This was the subject of Question 2.c; the licensee must consider failures at any time including credible worst-case scenarios.

The ONS report did not include the induced voltages observed on the test conductors. The observed induced voltages appeared large enough to be extremely damaging to the DC ESPS cables, which are a subject of the TIA.

Question 2.f asked about induced voltages and impressed

- 9 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response voltages. ONS must consider these voltages along with the consequential damage to adjacent Class 1E components.

The staff considered all testing and arguments presented by ONS and concluded that multi-phase short circuits were a credible failure mode that Duke must consider in the ONS design. Also, per IEEE Std. 279-1971 Section 4.2, "Single Failure Criterion," "the shorting or open-circuiting of interconnecting signal or power cables" was identified as a credible single failure. 'Shorting' between independent interconnecting power cables is considered a single failure by the staff and is an exact parallel condition to multi-phase shorts. (page 25 of the final TIA response; it is a single failure when two cables short together.)

Therefore, the staff concluded that the medium-voltage power cables that are intended to provide emergency power to the ONS Units 1, 2, and 3 are within the scope of IEEE Std. 279-1971 for compliance with the requirements specified in NRC regulations 10 CFR 50.55a(h)(2) and 10 CFR 50.54(jj). In addition, the staff has determined that Section 3, "Design Basis," of IEEE Std. 279-1971 is applicable to the ONS power cables based on the fact that these system descriptions are detailed in the scope of IEEE Std. 279-1971. Section 3 of IEEE Std. 279-1968 is equivalent to Section 3 of IEEE Std. 279-1971.

- 10 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response Comment No. 11 (Ref: TIA Question 2.b) The 3-phase medium voltage power cables are "interconnected" to RPS/ESPS equipment in the context that the Keowee generator is a power source and the interconnections are through a 13.8/4.16 kV transformer, then cabling to another 4.16 kV/600 [Volt (V)] transformer, then cabling to other transformers and/or battery chargers/inverters to reduce the voltage down to the requirements for RPS/ESPS signals. The cables associated with these voltage transformations have protective devices to detect and clear faults.

As discussed in Duke Energy Comment #8, ONS has never committed to conform to the requirements of IEEE Standard 603-1991 for the medium voltage power and control cables that are the subject of this TIA question. The NRR Question 2.b statement also includes on page 24 (2nd paragraph) that "-this occurrence would be a single failure, not two failures as the licensee asserts." It appears this statement is implying that ONS must consider multi-phase faults anywhere in the cable route. As previously stated in Duke Energy Comment #10, other than at the cable ends, a single failure is a phase-ground fault on one of the single conductor cables. Therefore the postulated "interconnection" via the initial phase-ground fault propagating to a three-phase fault that results in cable whip bringing the faulted cables in contact with [instrumentation and control (I&C)] cables is not credible and would require more than a single failure. As stated above in Comment No. 10, the staff has determined that the medium-voltage power cables that are intended to provide emergency power to the ONS, Units 1, 2, and 3 are within the scope of the single failure criteria requirements of IEEE Std. 279-1971 for compliance with the requirements specified in NRC regulations 10 CFR 50.55a(h)(2) and 10 CFR 50.54(jj).

IEEE Std. 279-1971 Section 4.2 states, that single failures included, "single credible malfunctions or events that cause a number of consequential component, module, or channel failures." This statement in the standard is in direct conflict with the ONS comment. Therefore, the staff's conclusions of Section 3.1 "Response to Requested Actions," response to Question 2.b remain unchanged. Duke has stated that the interconnectivity of the three-phase medium voltage cables and the lower voltage RPS/ESPS signal cables exists through various transformers. The comment states further that there are multiple protective devices in the circuit to detect and clear faults implying that the fault consequences are minimal. The staff notes that protective devices function AFTER a fault has occurred.. Duke has not provided an adequate basis to conclude that multi-phase faults are non-credible in all sections of the cable runs, other than at the terminal connections. No

- 11 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response Comment No. 12 (Ref: TIA Question 2.b) As previously discussed in Duke Energy's May 11, 2015 (Ref. 18) letter to the NRC, ONS analysis supports a conclusion that cable shielding provides a level of protection sufficient to preclude inter-cable shorts or faults, thereby removing from credibility, short circuits between the single conductor shielded power cables as a credible single failure. The NRC staff has determined that the licensee's testing and analyses do not demonstrate that the bronze tape shielding for the ONS cable design and configurations in question will prevent short circuits between single conductor cables.

The staff has reviewed Duke Energy's May 11, 2015, letter and other supplemental information to the NRC and determined that it does not provide any new information that requires a change in the conclusions of the TIA response. The staff has determined that the licensee's testing described in this letter is inadequate and does not resolve any of the licensing basis questions posed by the Region II staff in the TIA. This is because the licensee's test did not prove that cable design with bronze shield can withstand a worst-case credible three-phase fault or prevent consequential damages to the nearby cables as discussed in the TIA response. In addition, the licensee's cable crush test did not prove that the cable can withstand or prevent a worst-case credible three-phase fault. It only proved the mechanical capability of the cable. The staff determined that the electromagnetic forces produced during short circuits would likely cause failure of the cable restraint system and could challenge the integrity of the cables along the raceway system to transformer CT4 and the manholes associated with the raceway system to the protected service water (PSW) system. Since the licensee has not fully evaluated the worst-case credible cable faults and single failures to determine the integrity of the emergency power system and other safety-related systems, the staff determined that the cited testing is insufficient to support the licensee's current position described in its response. No

- 12 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response Comment No. 13 (Ref: TIA Question 2.c) The NRR statement is inaccurate because the ONS licensing basis does not limit the timing of failure to minimize damage and all credible failures are assumed (e.g., failures are assumed at initiation or time of demand consistent with the ONS [current licensing basis (CLB)]). ONS does not limit its considerations based on whether or not the outcome would be acceptable.

As communicated in Duke Energy's May 11, 2015 letter to the NRC, the ONS emergency power system switching logic was designed based on failures occurring on initial demand. The switching logic and the associated time delays in the Chapter 15 accident analyses are predicated on failures occurring on initial demand. This design basis has been maintained throughout ONS' history. Therefore, the staff's assessment that ONS' design basis is that single failures may occur at any time is inaccurate. As previously noted herein, the failure on-demand position was also communicated to the NRC in a March 8, 1995 letter (Ref. 19) clarifying meeting minutes issued by the NRC in association with the Keowee Underground Breaker Modification. It is reasonable for ONS to have concluded that the NRC's acceptance (Ref. 20) had indicated that the NRC's single failure concerns had satisfactorily been resolved. The single failure criteria of IEEE Std. 279-1971 is part of the ONS licensing basis. A single failure may be the result of events and conditions discussed in Section 3 of IEEE Standard 279-1971. Section 3.7 requires consideration of "the range of transient and steady-state conditions of both the energy supply and the environment (for example, voltage, frequency, temperature, humidity, pressure, vibration, etc. during normal, abnormal and accident circumstances throughout which the system must perform." The maximum energy supply, resulting from a short circuit may not be available at the start time or demand time of a circuit. Single failures with maximum energy, as described in IEEE Std. 279-1971, may occur at any time and are applicable to the licensee's design basis for the cable configurations in question. The staff position is based on understanding the requirements delineated in all sections of IEEE 279-1971 and further clarified by SECY-77-439 states, in part, that: 'application of the Single Failure Criterion to systems evaluation depends not only on the initiating event that invokes safety action of these systems, together with consequential failures, but also on active or passive electrical failures, which can occur independent of the event. Thus, evaluation proceeds on the proposition that single failures can occur at any time. Yes Comment No. 14 (Ref: TIA Question 2.c) See Duke Energy Comment #3 regarding the application of IEEE Standard 379-2000 requirements. Although not specifically discussed in the Evaluation section of the TIA, as pointed out in Comment 3, IEEE Std. 379 is not part of the ONS licensing basis. The TIA relied on the ONS AEC GDC; included in the UFSAR IEEE Std. 279-1968 and Yes

- 13 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response single failure criteria requirements in IEEE Std. 279-1971 as discussed in the Evaluation section.

Comment No. 15 (Ref: TIA Question 2.c) The worst case credible single failure and its associated maximum fault currents have been considered and evaluated in the design of ONS, which as demonstrated throughout this enclosure, has been accepted by the NRC. In addition, the aforementioned NRC statement references IEEE Standard 379, which is not a part of the ONS licensing basis for single failure criteria. The NRR statement references an NRC requirement for ONS to consider the failures of non-Class 1E cables concurrent with a single failure of Class 1E equipment. Doing so is also contrary to the ONS licensing basis. As mentioned in the May 2015 Duke Energy letter to NRC, and described in the ONS Single Failure Criterion Design Basis Document, the "licensing basis for Oconee contains single failure evaluations that make no distinction between a failure of a "qualified" component and a failure of a "non-qualified" component. (Here "non-qualified" is used to represent equipment variously called control grade, non-safety, non-QA-1, etc. in ONS documents)."

The relevant distinction for application of single failure requirements is limited to whether and how the specific system in question is committed to be designed to handle single failures. The components of such a system may or may not be "qualified", but that is not a factor for single failure design requirements. As presented in an April 12, 1995 letter to the NRC (Ref. 21), several components that are non-QA-1 but required for accident mitigation, were re-designated by ONS as QA-5. This approach was found acceptable in an August 3, 1995 NRC letter (Ref. 22). Reference 21 (April 12, 1995, Duke letter) explains the ONS licensing history regarding the site quality assurance program (QAP) and the quality assurance measures applied to mechanical piping SSCs that perform some safety functions.

This was in response to Generic Letter (GL) 83-28, "Required Actions Based on Generic Implications of Salem ATWS Events," dated July 8, 1983 (ADAMS Accession No. ML031080266). Reference 22 (NRC letter and safety evaluation report dated August 3, 1995; ADAMS Legacy Accession No. 9608090111) approved Duke's approach for a graded QA classification of SSCs. The staff at the time based the approval on the belief, as provided by ONS, that the lower grade SSCs were not safety-related. However, quality assurance measures are not the issue here and the April 12 submittal noted this with the statement on page 5, "it is clear that some seismically designed, single failure proof systems were not classified as QA-1." The issue is how the plant design basis meets the single failure criteria requirements of IEEE Std. 279-1971, and the PDCs applicable to the ONS licensing basis. The April 12 letter did not justify why ONS tried to credit the failure of non-Class 1E SSCs (i.e., the Fant line or the PSW power cables) single failure when IEEE Std. 279-1971 and PDCs do not allow it. The 1995 NRC letter did not approve such a proposal. The implication that the NRC granted ONS the discretion to credit "non-Class 1E" SSCs as a single failure contrary to the ONS licensing basis is unsupportable.

The ONS single failure analyses presented to the CDBI team misconstrued the idea of safety-related and the idea of 10 CFR 50 Appendix B quality assurance measures (which ONS identified as QA-1 in the April 12 1995 letter). The idea No

- 14 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response This point is material because design criteria applied to plants licensed later than ONS may assume all "non-qualified" SSCs (structures, systems, and components) fail, in addition to taking a single failure in a "qualified" system. Such assumptions do not align to Oconee's licensing basis. of safety-related has at least two recognized usages applicable to the ONS licensing basis. The first is comprehensive in nature (Safety-Related), as defined in American Nuclear Society (ANS) Standard 3.2-1972, and the second is specific to the SSCs that form the reactor protection systems (Safety-Related Class 1E), as defined in IEEE Std. 279-1971 and PDCs, which excludes such SSCs as the reactor coolant system pressure boundary piping. The functional performance requirements of the SSCs defined the usages not the quality measures applied to the SSCs. To clarify this, a discussion of the two usages follows below.

First, "Safety-Related" is defined in the original ONS QA plan dated 1973 (ADAMS Accession No. ML16030A215). This included all safety-related SSCs including piping and protection systems SSCs. The QA plan committed to Safety Guide 33, and hence, to ANS 3.2-1972 (American National Standards Institute (ANSI) N18.7-1972). Standard ANS 3.2-1972, Section 2, "Definitions," Subsection 2.2.19, "Safety Related," defined, "[t]hose plant features necessary to assure the integrity of the reactor coolant pressure boundary, the capability to shut down the reactor and maintain it in a safely shut down condition, or the capability to prevent or mitigate the consequences of accidents which could result in off-site exposures comparable to the guideline exposures of AEC Regulations 10 CFR Part 100." No exceptions to the safety guide were noted in the QA plan. Amendment 2 of the QA plan dated July 21, 1975 (ADAMS Legacy Accession No. 7911250016), stated that the ONS QA plan conformed to ANSI N18.7-1972 with no exceptions.

Second, "Class 1E," is specified by the IEEE Std. 100 definitions in the ONS licensing basis.

- 15 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response The IEEE standards specified that Class 1E included the electrical and mechanical SSCs pertinent to the functional performance of the reactor protection systems. Although, both IEEE standards required appropriate levels of quality assurance measures comparable to 10 CFR 50 Appendix B or ANSI NQA-1, they both separated the functional performance criteria from quality. Comment No. 16 (Ref: TIA Question 2.d) ONS does not distinguish between active and passive electrical single failures for the emergency power system. The ONS licensing basis requires that a single failure, either passive or active, is addressed for the emergency electric power system as noted in Oconee UFSAR Section 8.3.1.2. The staff agrees that the ONS licensing basis is as described in UFSAR Section 8.3.1.2 and not the ONS "internal memo to file" document. Specifically, the UFSAR Section 8.3.1.2 states "The basic design criterion for the electrical portion of the emergency electric power system of a nuclear unit, including the generating sources, distribution system, and controls is that a single failure of any component, passive or active, will not preclude the system from supplying emergency power when required."

The staff also notes that the above criteria is consistent with UFSAR Section 3.1.21, "Criterion 21 - Single Failure Definition (Category B)," which states that "[m]ultiple failures resulting from a single event shall be treated as a single failure." No Comment No. 17 (Ref: TIA Question 2.e) All faults and their effects were considered in the design of the subject cables. As stated in the Duke Energy Comment #10, other than at the cable ends, a credible single cable failure is a phase-ground fault on one of the single conductor cables. The draft TIA response references to IEEE Standards 141 and 242 (Refs. 24 and 25) on phase-ground fault current are not applicable to the 13.8 kV Keowee fed power system since it is resistance grounded and the phase-ground fault current will be limited to about 18 Amps. Since the licensee's evaluations and cable tests only assessed a phase-ground fault on the end of a cable, the NRC staff disagrees with the licensee's statement. The licensee has not provided any documented evidence of how it has considered the following electrical single failures in the onsite power system: (1) phase-to-phase faults, (2) single phase-to-ground fault conditions (including high impedance faults), (3) double phase-to-ground (including high impedance faults), and (4) three phase-to-ground or three phase bolted faults (including high impedance faults). The staff position is provided in response to Question 2.e and the response to Comment No. 10. Yes

- 16 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response The references to IEEE Standards 141 and 242 were removed. Comment No. 18 (Ref: TIA Question 2.f) As stated in Duke Energy Comment #4, ONS has not stated that it conforms to IEEE 279-1971 and therefore, this TIA statement (as Duke Energy has previously noted in this enclosure) is inaccurate. Furthermore, more discussion from IEEE 603-1991 also appears in this portion of NRR's draft response, which also has no applicability to the ONS design and licensing basis for the emergency power systems as stated in Duke Energy Comment #8. See discussion of history of ONS licensing basis for electric power systems and associated interfacing systems provided in Section 3.0 of the TIA response. The ONS licensing basis includes conformance with single failure requirements of IEEE Std. 279-1971. References to IEEE Std. 603 have been clarified. Also, refer to NRC responses to Comment Nos. 4, 8, and 10.

Duke is correct in asserting that the 1976 Parker letter stated, "The design of the Oconee onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE 279-1971" (emphasis added). The NRC will correct the error in the TIA response; however, the staff notes that Sections 4.2, 4.7, 4.11, and 4.17 of IEEE Std. 279-1971 all address single failure, not only Section 4.2. Yes Comment No. 19 (Ref: TIA Question 2.f) This statement disregards the cable crush and fault testing which were performed in 2015 for the ONS and therefore is inaccurate by omission. The results of the cable crush testing were provided to the NRC in the May 11, 2015 letter. The results of cable fault testing on the 4.16 kVac and 13.8 kVac cables were also presented in a meeting at NRR headquarters in December 2015. Specific answers to the staff's questions regarding the cable testing were provided in Attachment 2 to Duke Energy's February 15, 2016 request for alternative submittal (Ref. 26). ONS concludes that the cable testing validated that the ONS emergency power cable design provides an acceptable level of quality and safety. See the staff's responses to Comment Nos. 10 and 12, and the staff's discussion provided in response to TIA Question 2.j. This statement was revised to reflect that the NRC did consider the testing and analyses described by Duke in its letters dated May 11 and August 7, 2015, as stated in Section 2.0 of the draft TIA response. The fault testing conducted by Duke in late 2015, as described in the letter dated February 15, 2016, was considered by the staff, as discussed in the response to Comment No. 10. Yes Comment No. 20 The NRR draft response to this question is inconsistent with the ONS licensing basis. The current day version of the Refer to the NRC response to Comment No. 15. No

- 17 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response (Ref: TIA Question 2.g) definition of safety-related or Class 1E, as presented on Page 1 of the draft TIA response aligns with the definition of a basic component in 10 CFR 21.3. 10 CFR Part 21 was issued after ONS was licensed to operate. For ONS, the term safety-related refers to those structures, systems, and components (SSCs) which have been designated QA-1, as defined in the Duke Energy QA Topical. The general criteria for identifying an SSC as QA-1 is divided into two categories: 1) SSCs that were designated QA-1 as part of the original licensing basis and 2) SSCs that Duke Energy committed to treat as QA-1 in correspondence subsequent to initial licensing. The first category is comprised of those SSCs which were deemed essential to prevent and mitigate the effects of a Large Break LOCA (LBLOCA) coincident with a Loss of Offsite Power (LOOP). As such, there exists SSCs that are deemed non-safety (i.e., not QA-1) but that are credited to prevent and/or mitigate the effects of other UFSAR Chapter 15 design basis accident, non-LBLOCA/LOOP events. Further discussion on QA-1 designation at Oconee can be found in UFSAR Section 3.1.1.1 'Oconee QA-1 Program.'

This licensing history has been previously reviewed and agreed upon within an August 3, 1995 safety evaluation titled "Safety Evaluation by the Office of Nuclear Reactor Regulation Supplemental Response to Subpart 1 of Section 2.2.1 of Generic Letter 83-28 General Criteria for Classifying QA-1 for Structures, Systems, and Components." The staff stated that "all commercial, non-safety related (i.e., non-Class 1E) electrical components are assumed to fail in the most limiting way. Only safety-related (Class 1E) components are credited to mitigate design basis events with a single failure (see IEEE 279-1971, ONS UFSAR,

- 18 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response Chapter 15 for SSCs credited in the accident analysis assumptions)." The previous statements contradict the original ONS licensing basis for both QA-1 (safety-related) components and mitigation of UFSAR Chapter 15 design basis accidents and, if they were true, then ONS would not be able to credit certain functions necessary to prevent or mitigate the effects of some design basis accidents beyond the LBLOCA/LOOP. In addition, UFSAR Section 15.1.9,

'Credit for Control Systems and Non-Safety Components and Systems,' contains a listing of non-safety components credited in the accident analyses for mitigating design basis events. Therefore, the staff's application of current standards to the existing licensing basis constitutes a change in regulatory position.

As for application of the single failure criterion, ONS performs single failure analysis for an SSC consistent with the licensing basis of the SSC in question. For the Emergency Power System, UFSAR Section 8.3.1.2,

'Analysis,' states, "the basic design criterion for the electrical portion of the emergency electric power system of a nuclear unit, including the generating sources, distribution system, and controls is that a single failure of any component, passive or active, will not preclude the system from supplying emergency power when required." This same statement was present in FSAR Section 8.2.3.3 as part of Oconee's initial licensing. The present day UFSAR and historic FSAR Chapter 8 discussion on this basic design criterion are included as part of the overall response in UFSAR Section 3.1.39 and FSAR Section 1A.39, 'Criterion 39 - Emergency Power for Engineered Safety Features (Category A),' for Oconee's accepted (by initial licensing) alternate approach to meeting the intent of the proposed [General Design Criteria (GDC)] 39. Using this criterion, ONS performs single failure analysis based upon

- 19 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response the design of the system and does not distinguish between safety-related and non-safety-related equipment. Comment No. 21 (Ref: TIA Question 2.h) Duke Energy did not identify any factual corrections for this section of the draft response. However, as summarized below, Duke Energy maintains that the analysis provided in the May 11, 2015 letter to the NRC remains valid and no collateral damage to DC systems would occur.

For three-phase faults at the cable ends with postulated electromagnetically induced cable movement in Trench 3, the robust cable construction (as validated by crush and impact testing) and cable installation design will not result in failure of adjacent DC and protection system cables.

For faults at other locations within Trench 3, as previously stated in the Duke Energy Comment #10, a credible single cable failure is a phase-ground fault on one of the single conductor cables. Under these fault conditions, only one conductor has the potential to carry fault current. Since at least two current carrying conductors are required to develop attractive and repulsive electromagnetic forces, this scenario will not result in unrestrained cable movement. Refer to the NRC response to Comment Nos. 10, 12, and 19.

Duke did not identify any factual corrections to the staff's statements in Response 2.h, but believes the May 11, 2015, letter provided analyses that demonstrated that cable whip in trench 3 would not result in failure of the DC control circuits. The staff evaluated all testing and arguments presented by ONS and concluded that multi-phase short circuits were a credible failure mode that Duke must consider in the ONS cable configurations in question. Also, Per IEEE Std. 279-1971 Section 4.2, "Single Failure Criterion," "the shorting or open-circuiting of interconnecting signal or power cables" was identified as a credible single failure. "Shorting" between independent interconnecting power cables is considered a single failure by the staff and is an exact parallel condition to multi-phase shorts. No Comment No. 22 (Ref: TIA Question 2.i) It is Duke Energy's belief that there is no regulatory link between the results of a short circuit analysis and the required cable separation to meet regulatory requirements and the ONS licensing basis. As described in the staff's response to Comment No. 21, there is a regulatory link between short circuit power and results pertaining to the required separation. No Comment No. 23 (Ref: TIA Question 2.j) The draft TIA response incorrectly describes the function of cable insulation shielding with respect to the single conductor bronze tape cables and does not acknowledge the dual use of bronze tape as both a metallic insulation shield and armor for cable mechanical protection. Analysis previously provided in letters to the NRC as well as the results of extensive cable testing supports that the bronze tape shield/armor in our design provides a level of See responses to Comment Nos. 10 and 12 above.

The part of the staff's TIA response referred to in Comment No. 23 is a generic discussion on the functions of cable shielding and armor, and is factually correct. However, the licensee contends that the response fails to address the specific design and performance of the bronze tape shielded Yes

- 20 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response protection sufficient to preclude inter-cable shorts or faults. Also, it should be noted that the picture shown on Page 32 of the draft TIA response is incorrect since it illustrates a cable design consisting of three conductors, while the subject cables at ONS are single conductor cables. cable used at ONS, which it contends will not experience, or can withstand, the types of failures assumed by the staff.

The licensee has cited three sets of tests to support its position: the McGuire and Catawba medium-voltage cable test report (addressed in the TIA response to Question 2.j); the Oconee medium-voltage cable crush tests (conducted in early 2015, as discussed in the May 11, 2015 letter); and the Oconee fault testing (conducted in late 2015, as discussed in February 15, 2016 letter). The latter two sets of tests were not addressed in the draft TIA response.

The fault testing conducted by Duke in late 2015, as described in the letter dated February 15, 2016, was considered by the staff, as discussed in the responses to Comment Nos. 10 and 19. Regarding cable fault testing, the NRC staff observed the referenced tests and reviewed the results. The staff determined that the testing as conducted by the licensee produced anecdotal results that did not demonstrate the capability of the bronze tape cable to meet separation requirements for the cable design and configurations in question, and did not address the other staff concerns.

The testing failed to simulate the failure modes identified in the TIA, or the actual power levels to which the licensee exposes these systems and the ESPS cabling. The staff noted that the specified test criteria appear contingent on the concepts specified in the ONS "internal memo to file," which then produced the observed anecdotal results: The tests discounted multi-phase faults because the licensee believes that they are not credible. This was the subject of Question 2.e; the licensee must consider failures at any time

- 21 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response including credible failure modes for cable short circuits and multi-phase failures are in fact credible.

The licensee used the single failure "on-demand" concept to reduce the fault current available to damage components. This was the subject of Question 2.c; the licensee must consider failures at any time including credible worst-case scenarios.

The ONS report did not include the induced voltages observed on the test conductors. The observed induced voltages appeared large enough to be extremely damaging to the DC ESPS cables, which are a subject of the TIA. Question 2.f asked about Induced voltages and impressed voltages. ONS must consider these voltages along with the consequential damage to adjacent Class 1E components. For additional information, refer to the NRC response to Comment Nos. 12, 19, and 21. The staff will add a figure of the ONS cable design in its response to Question 2.j. Comment No. 24 (Ref: TIA Question 2.j) The staff's draft TIA response incorrectly equates/combines the insulation shield with the bronze tape metallic shield which is not representative of the ONS cable configuration. The ONS single conductor bronze tape cables have three different shields - the strand (conductor) shield, insulation shield and metallic shield. The strand shield (or conductor screen) is a semi-conducting layer extruded over the conductor and its purpose is to present a smooth cylinder at the interface between the conductors and the insulation thereby reducing and equalizing the voltage stress in an outward radial direction. The staff disagrees with the licensee's comment. See responses above. The staff response is supported by industry accepted quality standards as stated in the TIA response. The ONS specific definitions are not consistent with any industry standards, vendor published catalog, or vendor design data. The licensee did not identify nor provide any new information.No

- 22 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response The section "Functions of Shielding," Items a-b, do not fully describe the insulation shield components as it applies to the ONS cable design. For the ONS cable design, the insulation shield is made of two separate components with different electrical functions; a nonmetallic semiconducting (or stress relief) shield and a metallic shield. The semiconducting shield is extruded over the insulation and its purpose is similar to the strand shield. Whenever the cable is energized, voltage is present on the insulation semiconducting shield.

The metallic insulation shield is applied over the semiconducting insulation shield and is grounded. The electrical functions of the metallic shield are to protect personnel from voltage present on the semiconducting insulation shield, to provide a low resistance path to ground for cable charging current and to provide a path to ground for detection and clearing of phase-ground faults. For the ONS single-conductor power cables, the greater than standard bronze tape thickness serves an additional mechanical function as cable armor.

In the section on Armor vs. Shielding, the statement that "Whether armor or shielding are both used in a cable depends on the application for which it is being designed" appears to imply that using bronze tape for both shielding and armor are mutually exclusive. As discussed above, the bronze tape performs the electrical requirements for metallic shielding and based on UL 1569 testing performed in 2015, passes the crush and impact performance requirements for Metal Clad cable. As stated in the Definition of Armor section of the draft TIA response, Metal Clad cable is armored cable. Therefore, the Duke Energy cable design with bronze tape is considered armored cable.

- 23 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response Comment No. 25 (Ref: TIA Question 2.j) As discussed in Duke Energy Comment #s 10 & 19, ONS has validated the current configuration using crush and fault testing, and that the robust design of the single-conductor bronze tape cables will preclude an initial phase-ground fault from "propagating from one cable to another." The staff has been made aware of the test results as provided in letters to the NRC (May 2015 and February 2016). At the 2015 fault testing at KEMA labs, Region II and NRR staff witnessed that cable faults did not propagate from one cable to another. During that testing, ONS demonstrated that electrical faults will not propagate from one cable to another. Refer to the NRC response to Comment Nos. 10, 12, 19, and 23.

No Comment No. 26 (Ref: TIA Question 2.j) The overall MCM-1354.00-0029.001 document contains a series of test reports evaluating both overload and short circuit conditions in power and control cables. Duke Energy infers from the TIA statements quoted above that NRR is referencing, in particular, the August 1976 Westinghouse High Power Laboratory fault test report as it makes reference to fire propagation and utilized test voltages of 600 V, 4160 V, and 6900 V). Although reference to testing for fire propagation is made within that particular Westinghouse High Power Laboratory fault test report, the overall purpose of the testing program was to evaluate the ability of armored cable to act as a barrier and therefore, is relevant to Duke's positions on this matter. As stated in the "Introduction" section of MCM 1354.00-0029.001: "Section 8.3.1.2.7.5, Cable Application and Installation of the McGuire Nuclear Station Final Safety Analysis Report states that all wire and cables are of fire retardant construction and selected for the application. Armored cable which has been demonstrated to be an excellent barrier to Duke's comments fail to justify why the different cable types tested are applicable to ONS, or how armored cable that may provide protection against fire propagation also protects against electrical faults (and more specifically, how is the 13.8-kV bronze tape cable at ONS equivalent to the lower voltage, steel-interlocked armored cable at Catawba Nuclear Station and McGuire Nuclear Station.) In addition, refer to the NRC response to Comment Nos. 10, 12, 19, and 23. No

- 24 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response externally and internally generated fires is used throughout the plant. Short circuit tests have been conducted on the interlocked armor cable by Duke Power Company (Duke Energy). These tests have demonstrated its acceptability as an adequate barrier by preventing damage to adjacent cables. This report provides the methods of approach, test data, and test results for those tests performed to demonstrate the acceptability of interlocked armor cable as an adequate barrier to internally generated faults." Further discussion on the use and application of the testing within McGuire Nuclear Station's licensing basis was included in the Duke Energy August 7, 2015 supplemental information submittal. As for the number and variance of tests performed, MCM 1354.00-0029.001 documents an approach of first performing exploratory tests followed by more rigorous testing. The July 24, 1975 Federal Pacific Test Lab report documents the eleven exploratory tests, all performed at a test voltage of 610 V and fault currents ranging from 23.4 [kiloamperes (kA)] to 100 kA.

The rigorous testing regimen is documented in the previously discussed August 1976 Westinghouse High Power Laboratory fault test report. The rigorous testing consisted of three tests at 6900 V and 50 kA, four tests at 4160 V and 50 kA, and three tests at 600 V and 50 kA. Comment No. 27 (Ref: TIA Question 2.j) Although the NRR statements on the armor of the faulted cable being blown back and the loading crate being set on fire are factual, it omits other "key" test results. The NRR referenced statements are found within the 1976 Duke's comments fail to justify why the different cable types tested are applicable to ONS, or how armored cable that may provide protection against fire propagation also protects against electrical faults (and more specifically, how is the No

- 25 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response Westinghouse High Power Laboratory fault test report for test number 2-51304-B. For the sake of completeness, it should be noted that the results of the test also concluded the following:

  • For the control cable tray directly above the faulted cable, "damage to control cables in this tray were limited to superficial PVC jacket damage."
  • For the other cables directly adjacent to the faulted cable in the specimen middle tray, "there was only superficial damage to the other cables in the specimen tray."
  • For the control cable tray directly below the faulted cable, "damage to control cables in this tray was limited to superficial [polyvinyl chloride (PVC)] jacket damage." 13.8-kV bronze tape cable at ONS equivalent to the lower voltage, steel-interlocked armored cable at Catawba Nuclear Station and McGuire Nuclear Station.) In addition, refer to the NRC response to Comment Nos. 10, 12, 19, and 23. Comment No. 28 (Ref: TIA Question 2.k) NRR conclusions based on the use of "GDC" (General Design Criteria) terminology are inaccurate since the three (3) Oconee Units were licensed before the GDCs were in-effect. ONS complies with the 70 Principal Design Criteria (PDC) that were developed for Nuclear Power Plant Construction Permits proposed by the AEC in a proposed rule-making published for 10 CFR Part 50 in the Federal Register of July 11, 1967. There are no designed interconnections between the

[Keowee Hydro Station (KHS)] and the ONS units such that a single failure due to "DC-to-DC short circuits" would credibly result in loss of both KHS units. Therefore, the NRR Statement and the basis on which it is made are inaccurate.

At ONS, separation, independence and redundancy are ensured by system design and cable routing. Pertinent UFSAR sections and station implementation and guidance documents with respect to the Keowee and plant DC systems and cable separation are summarized below. The NRC draft TIA response refers to the AEC GDCs, which formed the basis for the ONS PDCs described in the UFSAR, as discussed earlier in the TIA response (pages 9-13). Although the staff may have been imprecise in its reference here, there do not appear to be any substantive differences in the cited proposed AEC GDCs and the PDCs; thus, it is not clear what the licensee is disputing in its comment. The staff has clarified the TIA response. In the TIA response, the staff specified the areas where both trains of DC control power could be vulnerable to short circuits that could disable both trains (i.e., in the Keowee Hydro Unit (KHU) start panels at Keowee and ONS; at the terminal blocks) Duke's response states, in part, that:

Cables of different safety channels or trains may be within less than five inches of each other when entering or accessing a common enclosure. However, mutually redundant safety cables, in any Yes

- 26 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response Keowee has two separate and redundant 125 Volt DC systems that are arranged such that a single fault within either unit's system does not preclude the other unit from performing its intended function of supplying emergency power (Ref. UFSAR Sections 8.3.2.1.3 (Ref. 1) and 8.3.2.2 (Ref. 1)). Each unit has two independent and physically separated 125 Volt DC systems. The 125 Volt DC Instrumentation and Control Power System is arranged such that a single fault within either system does not preclude the engineered safeguards equipment from performing their safety functions (Ref. UFSAR Sections 8.3.2.1.1 (Ref. 1) and 8.3.2.2.1 (Ref. 1)).

Control, instrumentation, and power cables are applied and routed to minimize their vulnerability to damage from any source (Ref. UFSAR Sections 8.3.1.4.6.2). Cables of different safety channels or trains may be within less than five inches of each other when entering or accessing a common enclosure. However, mutually redundant safety cables, in any transition area, shall be precluded from making contact with each other. Barriers shall be installed any time the free air separation requirement cannot be met (Ref. OSS-0218.00-00-0019, Cable and Wiring Separation Criteria (Ref. 27)). Therefore, there are no designed interconnections between the KHS and ONS units such that a single failure due to "DC-to-DC short circuits" would result in loss of both KHS units. A single failure vulnerability does not exist for DC-to-DC short circuits in the KHU start panels. transition area, shall be precluded from making contact with each other. Barriers shall be installed any time the free air separation requirement cannot be met (Ref. OSS-0218.00-00-0019, Cable and Wiring Separation Criteria (Ref. 27)). Section 8.3.1 of this internal Duke specification document (OSS-0218.00-00-0019, dated July 15, 1987) states, in part, that: Wiring and control devices are to be installed so as to maximize the physical separation distance between mutually redundant safety related wiring. In no case, shall mutually redundant safety related wiring or devices be in physical contact. When separation cannot be maintained a barrier must be installed. Duke did not provide sufficient detailed information describing the barriers in place in the specified areas where both trains of DC control power are in close proximity. 4.0, "Conclusion" Comment No. 29 As discussed throughout this enclosure, this NRR statement is inaccurate by omission since it does not The staff disagrees with the licensee's assertions. In response to various comments provided above, the staff has indicated that it reviewed all of the information provided by the No

- 27 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response (Draft Response to TIA 2014-05: "Conclusion") appear that NRR has considered information provided by Duke Energy. licensee in developing its TIA responses. Since the licensee did not provide any new information, nor identify any factual errors, the staff determined that the TIA responses and conclusions remain the same.

See the staff's responses to Comment Nos. 10 and 12, and the staff's discussion provided in response to TIA Question 2.j for additional information.

As discussed in response to comment No. 19, the NRC staff did consider the testing and analyses described by Duke in its letters dated May 11 and August 7, 2015, as stated in Section 2.0 of the draft TIA response. The fault testing conducted by Duke in late 2015, as described in the letter dated February 15, 2016, was considered by the staff, as discussed in the response to Comment No. 10. Comment No. 30 (Draft Response to TIA 2014-05: "Conclusion") The licensing basis single failure criterion that ONS conforms to for the onsite AC and DC power systems is delineated in IEEE Standard 279-1971, Section 4.2 as well as in UFSAR Section 8.3.1.2 (Ref. 1). ONS adheres to IEEE Standard 279-1971, Section 4.2, and UFSAR Section 8.3.1.2 and therefore is in conformance with its licensing basis with respect to the single failure criterion. It is inaccurate for the NRC to use standards that are not part of the ONS licensing basis (e.g., IEEE Standards 379 and 603) as the single failure criteria for the ONS onsite AC and DC power systems. The licensing and design bases history of the ONS single failure criterion for analyzing electrical failure vulnerabilities between medium voltage AC power systems and low voltage DC circuits is discussed in Section 3.0. The TIA response has been revised as discussed in the individual comments above. Refer to the NRC responses to Comment Nos. 8 and 14. Yes

- 28 - Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Draft TIA Response Section/Comment No. Duke Energy Comment NRC Response Change to TIA Response Comment No. 31 This statement and conclusion are inaccurate because NRR has omitted consideration of relevant ONS information. Cable fault testing performed by ONS in 2015 and provided to the NRC (but not evaluated in the TIA) involved inducing a fault on a single conductor medium voltage bronze armor power cable while monitoring for any effects on adjacent power and control cables. The fault testing validates the engineering analyses which have concluded that the single conductor power cables subject to a single phase-to-ground fault will not propagate to a multi-phase fault and will not adversely interact with the low voltage control cables leading to consequential functional failures of redundant trains. The cable crush testing demonstrated that the bronze armor power cables meet the UL 1569 impact and crush test performance requirements for metal clad cable (Ref. 18). Refer to the NRC responses to Comment Nos. 10 and 12, and the staff's discussion in response to TIA Question 2.j. No Comment No. 32 As stated in Duke Energy Comment #s 3, 15, and 20, it does not appear that NRR reviewed all of the separation criteria in the ONS licensing basis. Refer to the NRC responses to Comment Nos. 10 and 12, and the staff's discussion in response to TIA Question 2.j. No

Retrieved from "https://kanterella.com/w/index.php?title=ML17264A031&oldid=524131"