ML021710770

Proposed License Amendment Request to Fully Credit the Standby Shutdown Facility and to Eliminate Crediting the Spent Fuel Pool to High Pressure Injection System Flow Path for Tornado Mitigation

ML021710770
Person / Time
Site:	Oconee
Issue date:	06/07/2002
From:	Mccollum W Duke Energy Corp
To:	Document Control Desk, Office of Nuclear Security and Incident Response
References
-nr, 2001-005
Download: ML021710770 (44)

Text

Duke OkEnergy Duke Energy Oconee Nuclear Station 7800 Rochester Highway Seneca, SC 29672 W R. McCollum, Jr. (864) 885-3107 OFFICE Vice President (864) 885-3564 FAX June 7, 2002 U. S. Nuclear Regulatory Commission Document Control Desk Washington, D. C. 20555

Subject:

Oconee Nuclear Station, Units 1, 2, and 3 Docket Numbers 50-269, 50-270, and 50-287 Proposed License Amendment Request to Fully Credit the Standby Shutdown Facility and to Eliminate Crediting the Spent Fuel Pool to High Pressure Injection System Flow Path for Tornado Mitigation, License Amendment Request No. 2001-005 Pursuant to 10 CFR 50.90, Duke Energy Corporation (Duke) submits a proposed license amendment for Facility Operating License Nos. DPR-38, DPR-47, and DPR-55 for Oconee Nuclear Station (ONS) Units 1, 2, and 3, respectively.

The proposed license amendment request (LAR) revises the Updated Final Safety Analysis Report (UFSAR) to eliminate credit in the Licensing Basis (LB) for the Spent Fuel Pool (SFP) to High Pressure Injection (HPI) pump flow path as one of the sources of primary system makeup following a tornado event. In addition, this submittal credits the Standby Shutdown Facility (SSF) as the assured means of achieving safe shutdown for all Oconee Units following a tornado.

This revision is justified, when coupled with two recent plant modifications, by the reduction of tornado risk at Oconee.

The purpose of this request originates from a Duke initiative to improve the station's tornado licensing and design basis. The current tornado LB is structured on PRA insights which depend on diverse options for achieving safe shutdown. However, without an assured, deterministic success path for tornado mitigation, the various system functions, testing requirements, and operator actions are difficult to define and implement. It is for this reason that Duke requests to eliminate any credit for the SFP to HPI flow path.

To this end, Duke intends to establish the SSF as the primary, assured success path for tornado mitigation. This will be accomplished by implementing a modification to harden the area of the system that previously had been vulnerable to tornado damage. The modification to fully qualify the SSF for this purpose will be necessary to implement this proposed revision to the Oconee LB.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 June 7, 2002 Page 2 Pursuant to Regulatory Guide 1.174, this risk informed LAR submittal provides a method for obtaining a NRC review and approval of the proposed revisions to the current tornado licensing basis. In an effort to more accurately characterize plant risk, Duke performed a comprehensive upgrade of its probabilistic risk assessment model for tornadoes. This effort resulted in a number of changes to the risk model and reflects recently completed and proposed modifications to the facility. Overall, results of this evaluation showed that the proposed changes to the plant result in a risk reduction on the order of 3.9E-6 , 1. iF 6, and 8.0E-7 for Oconee Units 1, 2, and 3 respectively.

The submittal contains the following attachments: provides the retyped UFSAR pages. provides a mark-up of applicable UFSAR sections. provides a risk based technical discussion of changes to the UFSAR. documents the determination that the amendment contains No Significant Hazards Consideration pursuant to 10 CFR 50.92. provides the basis for the categorical exclusion form performing an Environmental assessment/Impact Statement pursuant to 10 CFR 51.22 (c) (9).

In accordance with Duke administrative procedures and the Quality Assurance Program Topical Report, this proposed change to the UFSAR has been reviewed and approved by the Plant Operations Review Committee and Nuclear Safety Review Board. Additionally, a copy of this proposed amendment is being sent to the State of South Carolina in accordance with 10 CFR 50.91 requirements.

Other sections of the UFSAR affected by the submittal will be revised, as necessary, to reflect approval of this submittal in a time frame consistent with normal UFSAR update practices.

Duke requests that the review of this submittal be completed by April 2, 2003.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 June 7, 2002 Page 3 Inquiries on this proposed amendment request should be directed to Stephen C. Newman of the Oconee Regulatory Compliance Group at (864) 885-4388.

Very truly yours, W. R. McCollum, Jr., Site Vice Pr i ent Oconee Nuclear Site Attachments

Nuclear Regulatory Commission License Amendment Request No. 2001-005 June 7, 2002 Page 4 xc w/attachments:

Mr. L. N. Olshan, Project Manager Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Washington, D. C. 20555 Mr. L. A. Reyes, Regional Administrator U. S. Nuclear Regulatory Commission - Region II Atlanta Federal Center 61 Forsyth St., S.W., Suite 23T85 Atlanta, Georgia 30303 Mr. M. C. Shannon Senior Resident Inspector Oconee Nuclear Station Mr. Virgil R. Autry, Director Division of Radioactive Waste Management Bureau of Land and Waste Management Department of Health & Environmental Control 2600 Bull Street Columbia, SC 29201

Nuclear Regulatory Commission License Amendment Request No. 2001-005 June 7, 2002 Page 5 AFFIDAVIT W. R. McCollum, Jr., being duly sworn, states that he is Site Vice President, Oconee Nuclear Site, Duke Energy Corporation, that he is authorized on the part of said Company to sign and file with the U. S. Nuclear Regulatory Commission this revision to the Facility Operating License Nos. DPR-38, DPR-47, and DPR-55; and that all statements and matters set forth herein are true and correct to the best of his knowledge.

W. R. McCollum, Jr., Site Vice Pre nt Oconee Nuclear Site Subscribed and sworn to before me this day of ,2002 Notary Public My Commission Expires:

Date SEAL

ATTACHMENT 1 RETYPED PAGES OF THE UPDATED FINAL SAFETY ANALYSIS REPORT (UFSAR)

AND UFSAR UPDATE INSTRUCTIONS

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Retyped UFSAR Pages and Update Instructions June 7, 2002 Page 2 UFSAR UPDATE INSTRUCTIONS Remove Pages Replace Pages 3.2-3 3.2-3 3.2-4 3.2-4 3.2-5 3.2-5 3.2-6 3.2-6

Oconee Nuclear Station UFSAR Chapter 3 The Reactor Coolant System will not be damaged by a turbine missile. Capability is provided to safely shutdown the affected units.

3. Earthquake Major equipment and portions of systems that can withstand the maximum hypothetical earthquake include the following:

a. Reactor Coolant System.

b. Borated water storage tank and piping to high pressure and low pressure injection pumps and Reactor Building spray pumps.

c. HP injection pumps and piping to Reactor Coolant System.

d. LP injection pumps, LP injection coolers and piping to both Reactor Coolant System and Reactor Building spray pumps.

e. Core flood tanks and piping to Reactor Coolant System.

f. Reactor Building spray pumps, piping to spray headers, and the spray headers.

g. Reactor Building coolers.

h. Low pressure service water (LPSW) pumps, LPSW piping to LP injection coolers and Reactor Building coolers and LPSW piping from these coolers to the condenser circulating water (CCW) discharge.

i. CCW intake structure, CCW pumps, pump motors, CCW intake piping to the LPSW pumps, also through the condenser and emergency CCW discharge piping and CCW discharge piping.

j. Upper surge tanks, and piping to the emergency feedwater pump.

k. Emergency feedwater pump and turbine and auxiliary feedwater piping to the steam generators.

1. Main steam lines to and including turbine stop valves. Turbine bypass system up thru Main Steam System isolation valves, and steam supply lines to the emergency feedwater pump turbine.

m. Penetration Room Ventilation System.

n. Reactor Building penetrations and piping through isolation valves.

o. Siphon Seal Water System.

p. Essential Siphon Vacuum System.

q. Electric power for above.

4. Tornado The Reactor Coolant System will not be damaged by a tornado. A loss of Reactor Coolant Pump (RCP) seal integrity was not postulated as part of the tornado design basis. The SSF provides an assured means to safely shut down all three units in the event of a design basis tornado.

The Reactor Coolant System, by virtue of its location within the Reactor Building, is protected from tornado damage. A sufficient supply of secondary cooling water for safe shutdown is assured by the SSF auxiliary service water (ASW) pump located in the SSF building structure and taking suction from the CCW intake piping. Primary system makeup is assured by the SSF Reactor Coolant Make Up (RCMU) pump. The SSF is protected from the wind, differential pressure, and missile loads from the 300 mph design basis tornado. Specific SSF capabilities and design criteria are described in Section 9.6.

(31 DEC 2000) 3.2- 3

Oconee Nuclear Station UFSAR Chapter 3 The Oconee design basis does not require postulation of a single failure with a tornado event. Aside from the SSF, other means of secondary side heat removal and primary system injection are not fully protected from tornado damage. However, these diverse means of safe shutdown further reduce plant risk from tornadoes and are appropriately modeled in the Oconee Probabilistic Risk Assessment (PRA). The alternate safe shutdown functions modeled in the PRA include the following:

a. A High Pressure Injection Pump can take suction from the Borated Water Storage Tank (BWST).

The BWST is not designed for tornado missiles. Either the "A" or "B" High Pressure Injection Pump can be powered from Keowee via the Auxiliary Service Water Pump Switchgear.

b. The station ASW system can establish secondary side heat removal for a single unit. The assumed reliability of this function reflects the fact that certain features, such as the Keowee emergency power source, atmospheric dump valves, and some piping above grade elevation, are not fully protected from tornado damage. In the event secondary side heat removal is established with EFW and its inventory is depleted, secondary side heat removal can be transitioned to station ASW on any or all of the Oconee units.

c. A given unit's turbine driven EFW pump can provide secondary side heat removal for that unit.

The assumed reliability of this function reflects the fact that certain features, such as the turbine driven EFW pump suction piping, pump cooling water support systems, and inventory are not fully protected from tornado damage.

3.2.2.1 System Classifications Plant piping systems, or portions of systems, are classified according to their function in meeting design objectives. The systems are further segregated depending on the nature of the contained fluid. For those systems which normally contain radioactive fluids or gases, the Nuclear Power Piping Code, USAS B 31.7 and Power Piping Code USAS, B31.1.0 are used to define material, fabrication, and inspection requirements.

Diagrams for each system are included in the FSAR sections where each system is described.

Fabrication and erection of piping, fittings, and valves are in accordance with the rules for their respective classes. Welds between classes of systems (Class I to II, I to Ill, or II to III) are performed and inspected in accordance with the rules for the higher class. This preceding sentence does not apply to valves where the class break has been determined to occur at the valve seat, and to pipe with 1" nominal diameter and less.

In-line instrument components such as turbine meters, flow nozzle assemblies, and control valves, etc. are classified with their associated piping unless their penetration area is equal to or less than that of a 1 inch i.d. pipe of appropriate schedule for the system design temperature and pressure, in which case they are placed in Class III. Definitions of the three classes are listed below:

Class I This class is limited to the Reactor Coolant System and Reactor Coolant Branch lines, as described herein. The Reactor Coolant Branch lines include connecting piping out to and including the first isolation valve. This section of piping is Class I in material, fabrication, erection, and supports and restraints. A Class I analysis of the piping to the first isolation valve has been completed for the following systems:

1. High Pressure Injection (Emergency Injection)

2. High Pressure Injection (Normal Injection)

3. High Pressure Injection (Letdown)

4. Low Pressure Injection (Decay Heat Removal Drop-line)

5. Low Pressure Injection (Core Flood)

6. Reactor Coolant Drain Lines (31 DEC 2000) 3.2 - 4

Oconee Nuclear Station UFSAR Chapter 3

7. Pressurizer Spray

8. Pressurizer Relief Valve Nozzles Modifications that affect the Reactor Coolant System and the Class I portion of the branch lines must demonstrate that the impact on the Class I piping is acceptable. The impact may be assessed by performing a Class I analysis or by other conservative techniques to assure Class I allowable limits are not exceeded. Isolation valves can be either stop, relief, or check valves. Piping 1 inch and less is excluded from Class I.

Class II Class 11 systems, or portions of systems, are those whose loss or failure could cause a hazard to plant personnel but would represent no hazard to the public. Class II systems normally contain radioactive fluid whose temperature is above 212'F, and in addition, those portions of Engineered Safeguards Systems outside the Reactor Building which may see recirculated reactor building sump water following a LOCA. Piping 1 inch and less is excluded.

Class III Class III systems, or portions of systems, are those which would normally be Class II except that the contained fluid is less than 212'F. Valves, piping, instrument fittings and thermowells with a penetration area equal to or less than a 1 inch i.d. pipe or less (all schedules) are placed in Class mII regardless of system temperature or pressure, when such equipment is connected to Class I, II, or III systems.

3.2.2.2 System Piping Classifications System piping is divided into eight classes, depending on the required function of the system or portion of a system. These eight piping classes result from the combination of the preceding system classifications with and without design for seismic loading, as indicated in Table 3-1. Piping classes A through C meet the intent of USAS B31.7 Nuclear Power Piping Code (February 1968) and Addenda (June 1968) with the exception of those portions of the code which lack adequate definition for complete application.

Code Applicability: Due to the numerous code references located throughout this UFSAR, no attempt is made to revise these references as Codes are amended, superseded or substituted. Consequently, the station piping specifications should be relied upon to determine applicable codes. The existing Code references are the basis for design and materials; however, it is Duke Power Company's intent to comply with portions of, or all of, the latest versions of existing Codes unless material and/or design commitments have progressed to a stage of completion such that it is not practical to make a change.

When only portions of Code Addenda are utilized, the appropriate engineering review of the entire addenda will be made to assure that the overall intent of the Code is still maintained. Detailed information for each station unit and code applicability with respect to design, material procurement, fabrication techniques, Nondestructive Testing (NDT) requirements and material traceability for each piping system class is described in the station piping specifications.

Table 3-1 applies uniformly to all piping except auxiliary systems in the Reactor Building. Due to schedule commitments, and concern over lack of definitive design guidance in B31.7, it was decided to use B31.1 and applicable nuclear cases in the Reactor Building, but the materials were bought, erected, and inspected to the standards set down in B31.7. The Reactor Coolant System was designed to B31.7, Class I. The Class I portion of the connecting piping to the RCS will have Class I analyses completed by August 31, 1999 (See Section 3.2.2.1).

Oconee has a number of systems that were designed to USAS B31.7 Class II and Class III and to USAS B31.1.0 requirements [Reference Table 3-11. Piping analyses for these systems include stress range reduction factors to provide conservatism in the design to account for thermal cyclic operations. Thermal fatigue of mechanical systems designed to USAS B31.7 Class II and Class mI and to USAS B31.1 is (31 DEC 2000) 3.2- 5

Oconee Nuclear Station UFSAR Chapter 3 considered to be a time-limited aging analysis because all six of the criteria contained in Section 54.3 are satisfied.

From the license renewal review, it was determined that the existing analyses of thermal fatigue of these mechanical systems are valid for the period of extended operation.

3.2.2.3 System Valve Classifications In the absence of definitive codes, the non-destructive testing criteria applied to system valves are consistent with the intent of Par. 1-724 of USAS B31.7 Nuclear Power Piping Code (Feb. 1968) and the piping classification applicable to that portion of the system which includes the valve. On this basis, valves are grouped into the same eight classes as shown for piping in Table 3-1, and a valve is in the same class as the portion of system piping which includes the valve.

3.2.2.4 System Component Classification In the absence of definitive codes, the design criteria applied to pressure retaining system components are generally consistent with the intent of Sections III and VIII of the ASME Boiler and Pressure Vessel Code, the piping system classification applicable to that portion of the system which includes the component, and the required function of the component. Atmospheric water storage tanks important to safety conform to American Waterworks Association Standard for Steel Tanks, Standpipes, Reservoirs and Elevated Tanks for Water Storage, D100, or equivalent.

Components are listed by system in Table 3-2. This tabulation shows the code to which the component was designed, whether the component was designed to withstand the seismic load imposed by the maximum hypothetical earthquake, and the analytical technique employed in seismic analysis.

3.2.3 Reference

1. Applicationfor Renewed OperatingLicensesfor Oconee Nuclear Station, Units 1, 2, and 3, submitted by M. S. Tuckman (Duke) letter dated July 6, 1998 to Document Control Desk (NRC), Docket Nos.

50-269, -270, and -287.

2. NUREG-1723, Safety EvaluationReport Related to the License Renewal of Oconee Nuclear Station, Units 1, 2, and 3, Docket Nos. 50-269, 50-270, and 50-287.

3. NRC Safety Evaluation Report, dated xx-xx-2003.

THIS IS THE LAST PAGE OF THE TEXT SECTION 3.2.

(31 DEC 2000) 3.2- 6

ATTACHMENT 2 MARKUP OF UFSAR PAGES

Oconee Nuclear Station UFSAR Chapter 3 The Reactor Coolant System will not be damaged by a turbine missile. Capability is provided to safely shutdown the affected units.

3. Earthquake Major equipment and portions of systems that can withstand the maximum hypothetical earthquake include the following:

a. Reactor Coolant System.

b. Borated water storage tank and piping to high pressure and low pressure injection pumps and Reactor Building spray pumps.

c. HP injection pumps and piping to Reactor Coolant System.

d. LP injection pumps, LP injection coolers and piping to both Reactor Coolant System and Reactor Building spray pumps.

e. Core flood tanks and piping to Reactor Coolant System.

f. Reactor Building spray pumps, piping to spray headers, and the spray headers.

g. Reactor Building coolers.

h. Low pressure service water (LPSW) pumps, LPSW piping to LP injection coolers and Reactor Building coolers and LPSW piping from these coolers to the condenser circulating water (CCW) discharge.

i. CCW intake structure, CCW pumps, pump motors, CCW intake piping to the LPSW pumps, also through the condenser and emergency CCW discharge piping and CCW discharge piping.

j. Upper surge tanks, and piping to the emergency feedwater pump.

k. Emergency feedwater pump and turbine and auxiliary feedwater piping to the steam generators.

I. Main steam lines to and including turbine stop valves. Turbine bypass system up thru Main Steam System isolation valves, and steam supply lines to the emergency feedwater pump turbine.

m. Penetration Room Ventilation System.

n. Reactor Building penetrations and piping through isolation valve

o. Siphon Seal Water System.

p. Essential Siphon Vacuum System.

q. Electric power for above.

4. Tornado The Reac Coolant System ill not be damaa d'by a tornado. oss of Reactor Co n*t Pump (RCPeal integrity was postulated as c of the tornado d gn basis. Capabilit s provided to s down safely all t e units.

The Reactor C ant System, b ue of its locatio ithin the Reactor I ding, is protected tornado da ge. A sufficien upply of second siecoln water -- safe shutdown is as ed by tornadiytm,2thrtg"ond"p an au jary service wat ump located in t Auxiliary Buildin nd taking suction fro Oconee 2 C intake pipin edundant and d* rse sources of se zdary makeup water e credited for onDo miati r These include: the other units' Sses )teA "ond"pm and 3) the S AS pump.

P e d or physically s rated lines are us to supply cooling wat o each steam gen or. One o esix sources of ctric power for t ump is supplied from owee Hydro Stati (31 DEC 2000) 3.2- 3

The Reactor Coolant System will not be damaged by a tornado. A loss of Reactor Coolant Pump (RCP) seal integrity was not postulated as part of the tornado design basis. The SSF provides an assured means to safely shut down all three units in the event of a design basis tornado.

The Reactor Coolant System, by virtue of its location within the Reactor Building, is protected from tornado damage. A sufficient supply of secondary cooling water for safe shutdown is assured by the SSF auxiliary service water (ASW) pump located in the SSF building structure and taking suction from the CCW intake piping. Primary system makeup is assured by the SSF Reactor Coolant Make-Up (RCMU) pump. The SSF is protected from the wind, differential pressure, and missile loads from the 300 mph design basis tornado. Specific SSF capabilities and design criteria are described in Section 9.6.

The Oconee design basis does not require postulation of a single failure with a tornado event.

Aside from the SSF, other means of secondary side heat removal and primary system injection are not fully protected from tornado damage. However, these diverse means of safe shutdown further reduce plant risk from tornadoes and are appropriately modeled in the Oconee Probabilistic Risk Assessment (PRA). The alternate safe shutdown functions modeled in the PRA include the following:

a. A High Pressure Injection Pump can take suction from the Borated Water Storage Tank (BWST). The BWST is not designed for tornado missiles. Either the "A" or "B" High Pressure Injection Pump can be powered from Keowee via the Auxiliary Service Water Pump Switchgear.

b. The station ASW system can establish secondary side heat removal for a single unit. The assumed reliability of this function reflects the fact that certain features, such as the Keowee emergency power source, atmospheric dump valves, and some piping above grade elevation, are not fully protected from tornado damage. In the event secondary side heat removal is established with EFW and its inventory is depleted, secondary side heat removal can be transitioned to station ASW on any or all of the Oconee units.

c. A given unit's turbine driven EFW pump can provide secondary side heat removal for that unit. The assumed reliability of this function reflects the fact that certain features, such as the turbine driven EFW pump suction piping, pump cooling water support systems, and inventory are not fully protected from tornado damage.

UFSAR Chapter 3 Oconee Nuclear Station An exte source of cooling w is not immediately requi due to the large qu ities of water stor underground in thhe i e and discharge CCW ing. The stored vo e of water in the nddrge stake ad i below elevation 79 w d provide sufficient oling water for all t e Although fully protected from to oes, the following so es provide reasonab assurance that a suf lent supply of primary sid akeup water is avai e during a tornado i ated loss of offsite

a. The SSF Reacto oolant Makeup Pu an take suction fro e Spent Fuel Pool. e pump can be sup ower from the SS iesel.

b. A Pressure Injection p can take suction either the Borated ter Storage Tank or e Spent Fuel P aols.erthe "A" or "B" Pressure Injection can be powered er.oof Keowee viaptohe iliary Service Water mp Switchgear. 0 Aspr f orgnlF Protection again toeado is an Oco design criteria, si to the critera to otect against earthquakes ind, snow, or other tural phenomena de ed in UEFSAR sectiW3.1.2. A specific occurr e of these phenome s not postulated, nor all equipment that w be used to bring the to safe shutdown rehensively listed. e statement, "Capab y is provided to shut n safely all three unit " s intended to be a itative assessment that tera tornado, normal tdown systems will re in available or alterna ystems will be availab o allow shutdown of t ant. It was not itend to imply that specif systems should be to -rof spato eoiinlFA deve ment, specific accid analyses were not tpermed to prove this ju ment, nor were the uested by the NRC. ubsequent probabilist' tudies have confirme at the original uali ye assessments were ect. The ris of n eing able to achieve e shutdown after a ado is sufficiently s that additional protect' is not required.

In ad *n, there was conside e correspondence bet Duke and NRC e years post-TMI di ssing Oconee's abilit survive tornado genera missiles. Based pri y on PRA justifications, the NRC concluded the secondary side t removal function lied with the criterion for protection agains madoes.

3.2.2.1 System Classifications Plant piping systems, or portions of systems, are classified according to their function in meeting design objectives. The systems are further segregated depending on the nature of the contained fluid. For those systems which normally contain radioactive fluids or gases, the Nuclear Power Piping Code, USAS B31.7 and Power Piping Code USAS, B31.1.0 are used to define material, fabrication, and inspection requirements.

Diagrams for each system are included in the FSAR sections where each system is described.

Fabrication and erection of piping, fittings, and valves are in accordance with the rules for their respective classes. Welds between classes of systems (Class I to II, I to III, or II to III) are performed and inspected in accordance with the rules for the higher class. This preceding sentence does not apply to valves where the class break has been determined to occur at the valve seat, and to pipe with 1" nominal diameter and less.

In-line instrument components such as turbine meters, flow nozzle assemblies, and control valves, etc. are classified with their associated piping unless their penetration area is equal to or less than that of a 1 inch i.d. pipe of appropriate schedule for the system design temperature and pressure, in which case they are placed in Class III. Definitions of the three classes are listed below:

3.2- 4 (31 DEC 2000)

Oconee Nuclear Station UFSAR Chapter 3 Class I This class is limited to the Reactor Coolant System and Reactor Coolant Branch lines, as described herein. The Reactor Coolant Branch lines include connecting piping out to and including the first isolation valve. This section of piping is Class I in material, fabrication, erection, and supports and restraints. A Class I analysis of the piping to the first isolation valve has been completed for the following systems:

1. High Pressure Injection (Emergency Injection)

2. High Pressure Injection (Normal Injection)

3. High Pressure Injection (Letdown)

4. Low Pressure Injection (Decay Heat Removal Drop-line)

5. Low Pressure Injection (Core Flood)

6. Reactor Coolant Drain Lines

7. Pressurizer Spray

8. Pressurizer Relief Valve Nozzles Modifications that affect the Reactor Coolant System and the Class I portion of the branch lines must demonstrate that the impact on the Class I piping is acceptable. The impact may be assessed by performing a Class I analysis or by other conservative techniques to assure Class I allowable limits are not exceeded. Isolation valves can be either stop, relief, or check valves. Piping 1 inch and less is excluded from Class I.

Class II Class II systems, or portions of systems, are those whose loss or failure could cause a hazard to plant personnel but would represent no hazard to the public. Class II systems normally contain radioactive fluid whose temperature is above 212'F, and in addition, those portions of Engineered Safeguards Systems outside the Reactor Building which may see recirculated reactor building sump water following a LOCA. Piping 1 inch and less is excluded.

Class III Class III systems, or portions of systems, are those which would normally be Class II except that the contained fluid is less than 212'F. Valves, piping, instrument fittings and thermowells with a penetration area equal to or less than a 1 inch i.d. pipe or less (all schedules) are placed in Class III regardless of system temperature or pressure, when such equipment is connected to Class I, II, or III systems.

3.2.2.2 System Piping Classifications System piping is divided into eight classes, depending on the required function of the system or portion of a system. These eight piping classes result from the combination of the preceding system classifications with and without design for seismic loading, as indicated in Table 3-1. Piping classes A through C meet the intent of USAS B31.7 Nuclear Power Piping Code (February 1968) and Addenda (June 1968) with the exception of those portions of the code which lack adequate definition for complete application.

Code Applicability: Due to the numerous code references located throughout this UFSAR, no attempt is made to revise these references as Codes are amended, superseded or substituted. Consequently, the station piping specifications should be relied upon to determine applicable codes. The existing Code references are the basis for design and materials; however, it is Duke Power Company's intent to comply with portions of, or all of, the latest versions of existing Codes unless material and/or design commitments have progressed to a stage of completion such that it is not practical to make a change.

When only portions of Code Addenda are utilized, the appropriate engineering review of the entire addenda will be made to assure that the overall intent of the Code is still maintained. Detailed information for each station unit and code applicability with respect to design, material procurement, (31 DEC 2000) 3.2- 5

UFSAR Chapter 3 Oconee Nuclear Station fabrication techniques, Nondestructive Testing (NDT) requirements and material traceability for each piping system class is described in the station piping specifications.

Table 3-1 applies uniformly to all piping except auxiliary systems in the Reactor Building. Due to schedule commitments, and concern over lack of definitive design guidance in B31.7, it was decided to use B31.1 and applicable nuclear cases in the Reactor Building, but the materials were bought, erected, and inspected to the standards set down in B31.7. The Reactor Coolant System was designed to B31.7, Class I. The Class I portion of the connecting piping to the RCS will have Class I analyses completed by August 31, 1999 (See Section 3.2.2.1).

Oconee has a number of systems that were designed to USAS B31.7 Class II and Class III and to USAS B31.1.0 requirements [Reference Table 3-11. Piping analyses for these systems include stress range reduction factors to provide conservatism in the design to account for thermal cyclic operations. Thermal fatigue of mechanical systems designed to USAS B31.7 Class II and Class III and to USAS B31.1 is considered to be a time-limited aging analysis because all six of the criteria contained in Section 54.3 are satisfied.

From the license renewal review, it was determined that the existing analyses of thermal fatigue of these mechanical systems are valid for the period of extended operation.

3.2.2.3 System Valve Classifications In the absence of definitive codes, the non-destructive testing criteria applied to system valves are consistent with the intent of Par. 1-724 of USAS B31.7 Nuclear Power Piping Code (Feb. 1968) and the piping classification applicable to that portion of the system which includes the valve. On this basis, valves are grouped into the same eight classes as shown for piping in Table 3-1, and a valve is in the same class as the portion of system piping which includes the valve.

3.2.2.4 System Component Classification In the absence of definitive codes, the design criteria applied to pressure retaining system components are generally consistent with the intent of Sections III and VIII of the ASME Boiler and Pressure Vessel Code, the piping system classification applicable to that portion of the system which includes the component, and the required function of the component. Atmospheric water storage tanks important to safety conform to American Waterworks Association Standard for Steel Tanks, Standpipes, Reservoirs and Elevated Tanks for Water Storage, D100, or equivalent.

Components are listed by system in Table 3-2. This tabulation shows the code to which the component was designed, whether the component was designed to withstand the seismic load imposed by the maximum hypothetical earthquake, and the analytical technique employed in seismic analysis.

3.2.3 Reference

1. Applicationfor Renewed OperatingLicensesfor Oconee Nuclear Station, Units 1, 2, and 3, submitted by M. S. Tuckman (Duke) letter dated July 6, 1998 to Document Control Desk (NRC), Docket Nos.

50-269, -270, and -287.

2. NUREG-1723, Safety Evaluation Report Related to the License Renewal of Oconee Nuclear Station, Units 1, 2, and 3, Docket Nos. 50-269, 50-270, and 50-287.

SECTION 3.2.

PAGE OF THE TEXT LAST THS IS TRE T

3.2- 6 (31 DEC 2000)

ATTACHMENT 3 TECHNICAL JUSTIFICATION

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 2 OVERVIEW As background information, Oconee initiated a focused review of its design basis in 1998. An objective of this effort was to identify potential plant improvements that will reduce plant risk.

As an example, the Reactor Coolant Pump (RCP) seals on Oconee Nuclear Station Unit 1 (ONS

1) were replaced in the fall of 2000. The RCP seal modification significantly reduces plant risk by reducing the probability of an RCP seal loss-of-coolant accident (LOCA). Given that external events are the largest contributors to plant risk at Oconee, a focused initiative on tornado design basis improvements was initiated. This initiative has identified plant modifications, procedure changes, and resulted in a significantly improved ability to effectively mitigate tornado initiated transients. One key element of this initiative is to update the Oconee tornado Licensing Basis (LB).

Pursuant to Regulatory Guide (RG) 1.1741, this risk informed License Amendment Request (LAR) submittal provides a method for obtaining NRC review and approval of a proposed revision to the current tornado LB. Presently, the ONS tornado LB is structured on diverse means of achieving safe shutdown, i.e., a defense-in-depth concept and, to a larger extent, the insights from Probabilistic Risk Assessment (PRA) results. The current Revision 2 to the PRA includes an assessment of Oconee's overall capabilities with respect to tornado initiated transients and supports a conclusion that there is reasonable assurance that safe shutdown can be achieved following a tornado. This model was based on a scenario that included tornado damage to ONS 3 with a loss-of-offsite power (LOOP) on ONS-1 and -2.

In an effort to more accurately characterize plant risk, Duke initiated a study in 2001 to evaluate tornadoes on a plant wide basis. This more accurate modeling of tornadoes identified interactions between the Oconee units that were not apparent from the single unit PRA model. In accordance with RG 1.174, the revised (Revision 3) tornado PRA model provides the risk insights necessary to support the LB changes requested in this LAR.

Insights from the tornado risk study have highlighted a risk benefit from hardening the West Penetration and Cask Decontamination room walls to establish a straightforward, deterministically assured approach to address tornado mitigation for all three units. Duke will modify the West Penetration Room and Cask Decontamination room walls to withstand the wind, differential pressure, and missile loads associated with a design basis tornado. This modification will resolve an existing tornado vulnerability with the Standby Shutdown Facility (SSF) and will therefore, establish the SSF as the assured means of achieving safe shutdown following a tornado. In addition, the December 2000 replacement of the ONS-1 reactor coolant pump seal packages I NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant Specific Changes to the Current Licensing Basis," July 1998.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 3 reduced the risk significance of the Spent Fuel Pool to High Pressure Injection (SFP-HPI) flow path and justifies its elimination from the LB.

Results of the plant wide tornado risk analysis demonstrate that the changes requested by this LAR reduce the core damage frequency by approximately 3.9E -6, 1.1E-6,and 8.OE"7 for ONS-1, -2, and 3 respectively. The specific details relating to how these results were obtained are discussed later in this section. This provides the necessary justification to continue forward with the implementation of these changes and to revise the license basis as appropriate. Consequently, Duke requests the following LB changes:

"* To eliminate crediting the SFP-HPI pump flow path as one of the sources of primary system make-up following a tornado, and

"* To fully credit the SSF as the primary, assured means of achieving safe shutdown of all three units following a tornado.

The LAR also includes discussion of key insights from the tornado risk study that are not considered as changes to the existing LB.

DESCRIPTION OF THE CURRENT LICENSING BASIS The ONS LB at the time of the issuance of operating licenses is documented in the original Final Safety Analysis Report (FSAR) and NRC Safety Evaluation Report (SER) for the facility. The FSAR demonstrated safe shutdown following a tornado via the establishment of secondary side cooling from the Station Auxiliary Service Water (ASW) system. No single failure was postulated as part of the tornado LB. The fact that a single failure was not postulated is very clear in that the original LB relied upon one Station ASW pump, powered from the single ASW switchgear located in the basement of the Auxiliary Building. As with the original LB, the current LB does not postulate a single failure with a tornado.

The only tornado licensing action that has occurred since the original licensing of the facility was the post-Three Mile Island (TMI) review of the ONS Emergency Feedwater (EFW) system. In the early 1980's, the primary tornado licensing interactions between Duke and the NRC focused on addressing EFW system vulnerabilities and the ability to establish secondary side cooling on a loss of EFW. Duke responded in October 1981, that the primary source of secondary cooling following a loss of EFW would be Station ASW. Additionally, the SSF ASW system would likely be capable of providing an additional cooling water source following a tornado.

Due to limitations associated with each of the cooling alternatives credited, the NRC requested that Duke provide an evaluation to assure that the probability of tornado damage to both EFW and SSF is acceptably low. This information was provided in late 1982 and focused on systems'

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 4 vulnerabilities to wind. Following this Duke submittal, there was no tornado licensing related correspondence until mid-1986 when the NRC requested additional information to complete its review of tornado generated missiles. From this point on, Duke's submittals and the NRC's review focused on tornado missiles. Duke submitted secondary side heat removal risk analyses by letters dated September 15, 1986, July 17, 1987, and December 19, 1988. These risk analyses considered the effect of tornado damage to a single unit. The NRC's July 28, 1989, SER acknowledges this fact. The cover letter of this safety evaluation states:

"Finally, the undamaged EFW system in one unit can supply feedwater to the steam generators in a unit with a damaged EFW system by means of system cross-connections in the pump discharge piping."

The cover letter of the NRC's SER concludes the following:

"Based on review of your probabilistic analysis, the staff concludes that the Oconee secondary side heat removal capability complies with the criterion for protection against tornadoes, and is therefore acceptable. This conclusion is based primarily on the availability of the SSF ASW system."

The post-TMI review of the EFW system for tornado missiles acknowledges that EFW, Station ASW, and SSF ASW are not fully protected from tornado damage. However, collectively, these systems afford sufficient protection against tornado damage and provide reasonable assurance that safe shutdown conditions can be achieved following a tornado. The current LB, documented in Section 3.2.2 of the Oconee Updated Final Safety Analysis Report (UFSAR) 2, includes the secondary side heat removal functions credited in the NRC's post-TMI review of the EFW system for tornado missiles. Historically, a tornado that damages all three units has not been postulated in risk studies. Studies previously submitted to the NRC assume a tornado damages one unit with an associated LOOP on the other two units.

As described in Item 4, Section 3.2.2 of the UFSAR, "System Quality Group Classification Tornado," the Reactor Coolant System will not be damaged by a tornado and a loss of Reactor Coolant Pump (RCP) seal integrity was not postulated as part of the tornado design basis.

Capability is provided to shutdown safely all three units. Section 3.2.2 of the UFSAR provides the following information with respect to secondary side heat removal:

"The Reactor Coolant System, by virtue of its location within the Reactor Building, is protected from tornado damage. A sufficient supply of secondary side cooling water for safe shutdown is assured by a station Auxiliary Service Water (ASW) pump, located in the Auxiliary Building, 2 Duke Power Company, Oconee Nuclear Station, "Updated Final Safety Analysis Report (UFSAR)," through Revision 10, (December 2000).

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 5 taking suction from the ONS-2 Circulating Cooling Water system intake piping. Redundant and diverse sources of secondary makeup water are credited for tornado mitigation. These include: 1) the other units' EFW Systems, 2) the ASW "tornado" pump, and 3) the SSF ASW pump.

Protected or physically separated lines are used to supply cooling water to each steam generator.

One of the six sources of electric power for the pump is supplied from Keowee hydroelectric Station."

With respect to primary system injection, the original FSAR and SER do not describe any review or discussion of a tornado protected means of primary system injection. In fact, no NRC safety evaluation since the original licensing of the facility, except the Individual Plant Examination (IPE) and IPE of External Events (IPEEE) submittals, acknowledges any review of primary system makeup capabilities following a tornado. The only information submitted by Duke which mentions primary system makeup following a tornado, aside from the IPE and IPEEE submittals, is Duke's September 15, 19863, response to an NRC Request for Additional Information 4 . This letter, associated with the post-TMI licensing action on EFW, provided an analysis that demonstrated Station ASW could adequately remove decay heat. The analysis included the mass loss through the reactor coolant system safety valves prior to establishing secondary side heat removal that was consistent with the original LB of the facility. Duke's response also stated that injection flow from one HPI pump, powered by the tornado-protected ASW switchgear, is initiated. This discussion was included as an ancillary boundary condition for the analysis and did not affect the primary system losses prior to the restoration of secondary side cooling or the conclusions with respect to maintaining adequate core cooling.

In the early 1990s, due to concerns that an RCP seal LOCA might occur if seal cooling is lost following a tornado event, Duke chose to add primary system makeup to the tornado description in the UFSAR. At the time it was determined that this action should be undertaken to address insights from the IPE and IPEEE risk assessments. Consequently, this SFP-HPI flow path information was added to the UFSAR, calculations, and other design basis documents. Section 3.2.2 of the UFSAR provides the following information with respect to primary system makeup:

"Although not fully protected from tornadoes, the following sources provide reasonable assurance that a sufficient supply of primary side makeup water is available during a tornado initiated loss-of-offsite-power.

a. The SSF Reactor Coolant Makeup Pump can take suction from the Spent Fuel Pool. The pump can be supplied power from the SSF Diesel

b. A High Pressure Injection Pump that can take suction from either the Borated Water 3 DPC letter to H. R. Denton, Director NRR, U. S. Nuclear Regulatory Commission, Re: Response to NRC RAI Dated May 30, 1986, EFW Tornado Protection - Oconee Nuclear Station Units 1, 2, and 3, dated September 15, 1986.

4 NRC letter to H. B. Tucker, "EFW TORNADO PROTECTION - REQUEST FOR ADDITIONAL INFORMATION (Re:

Oconee Nuclear Station, Units 1, 2, and 3)," dated May 30, 1986.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 6 Storage Tank or the Spent Fuel Pool. Either the "A" or "B" High Pressure Injection Pump can be powered from Keowee via the Auxiliary Service Water Pump Switchgear."

DESCRIPTION OF THE CHANGE UFSAR Section 3.2.2, Item 4, "Tornado" will be revised in its entirety. NRC approval is requested for the following changes:

1. The description of the SFP-HPI flow path is removed from the UFSAR.

2. The SSF is described as being designed to withstand the design basis tornado. This design capability provides an assured means of secondary side heat removal and primary system makeup for all three units following a design basis tornado.

BASES FOR THE PROPOSED CHANGES The reasons for pursuing elimination of the SFP-HPI flow path from the LB are that this function has low risk significance, it is not reliable, and it involves significant operator actions outside the control room. In addition, although both the HPI and Reactor Coolant Makeup (RCMU) pumps take suction from the SFP, the RCMU pump injection is at a much lower and controlled rate than the HPI pump. Analysis demonstrates that makeup to the SFP is not necessary until 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> if the RCMU pump is in operation. Since an HPI pump has a much larger capacity than a RCMU pump, the more rapid depletion of SFP inventory is prevented if the SFP-HPI flow path is eliminated.

The SFP-HPI flow path was not credited in the original ONS FSAR. The flow path was voluntarily added in the UFSAR, calculations, and design basis documents by Duke in the early 1990s, to address primary side losses due to potential RCP seal LOCAs identified from IPE analyses. These analyses showed that primary side makeup could be necessary following a tornado event due to coolant losses from a beyond design basis RCP seal LOCA. However, in December 2000, this beyond design basis risk concern was successfully addressed by replacing the ONS-1 RCPs seal packages 5 with more reliable substitutes.

All three units now have Sulzer RCP seal packages that have a much lower probability of failure during a loss of seal cooling. This design change significantly reduces the risk of a seal LOCA.

Thus the need for describing primary makeup via the SFP-HPI flow path in the UFSAR is also diminished.

5 The RCP seal packages had previously been replaced on ONS-2 and -3.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 7 The LB for Oconee does not postulate a single failure during tornado events. Thus, although primary system makeup has not been explicitly reviewed in the past by the NRC, reliance on the SSF RCMU system assures that this function is available. Defense-in-depth is improved by assuring that this means of primary system makeup is fully protected from tornado damage. In addition, the proposed UFSAR retains the option of the HPI pump taking suction from the BWST if available. The BWST is designed to withstand the design basis tornado wind and differential pressure loadings. However, it is not designed to withstand tornado missiles.

The SSF structure, located on the west side of the station, is constructed of reinforced concrete and will withstand the wind, differential pressure, and missile loads of the SSF design basis tornado. The design tornado used in calculating tornado loadings for the SSF differs slightly from the description given in UFSAR Section 3.3, "Wind and Tornado Loadings." Specifically, the SSF design tornado as described in UFSAR Section 9.6.3.1, "System Descriptions Structure - Wind and Tornado Loads," conforms to RG 1.76 with the following exceptions:

"* Rotational wind speed is 300 mph.

"* Translational speed of tornado is 60 mph.

"* Radius of maximum rotational speed is 240 feet.

"* Tornado induced negative pressure differential is 3 pounds per square inch (psi),

occurring in three seconds.

Although the main SSF building structure is adequately protected from a design basis tornado, portions of the SSF piping and cabling passing through the West Penetration and Cask Decontamination Rooms of each unit are not (the cask decontamination room is located directly below the penetration room). These rooms are part of the Auxiliary Building and their exterior walls are currently not designed to withstand the forces of the SSF design basis tornado. Duke will implement a modification to protect the West Penetration and Cask Decontamination rooms from the wind, differential pressure, and missile loads associated with the SSF design basis tornado. Following the completion of this modification, the SSF will be capable of safely shutting down all three Oconee units in the event of the design basis tornado.

The SSF is capable of providing RCP seal injection and reactor coolant makeup as well as feedwater to maintain the reactor in Mode 3 for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> while normal plant systems are repaired or restored. The SSF ASW pump is a high-capacity, high-head pump (2250 gpm at approximately 1050 psig) and was designed to supply feedwater to all six Steam Generators (SGs) for emergencies when no other source of feedwater is available. Reliance on the high-head SSF ASW pump eliminates the need to depressurize the SGs via the Atmospheric Dump Valves (ADVs).

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 8 The SSF RCMU pump is designed to provide seal injection quickly following a loss of seal cooling and therefore, maintain seal temperatures and prevent excessive leakage through the seals. This is the preferred strategy for dealing with the tornado-induced transient. As a consequence of the longer time required to establish injection with an HPI pump, a RCP seal LOCA may have already occurred and the strategy then requires mitigation versus prevention of primary inventory loss.

The SSF is included in the Technical Specifications (TS), the Selected Licensee Commitment (SLC) Manual, and the Maintenance Rule program. As such, availability and reliability performance criteria have been established to assure that system reliability and performance is fully monitored. The following documents are associated with SSF performance monitoring:

• TS 3.10 provides controls and testing requirements for the SSF;

• SLC 16.7.12 provides controls for the SSF diesel generator air start pressure instrumentation;

• SLC 16.7.13 provides controls for SSF instrumentation; and

• SLC 16.9.14 provides criteria for inspection of the SSF diesel generator.

The ONS In-Service Testing program and Generic Letter 89-10 program also provide controls on SSF components. SSF components found to not be in compliance with any of these controls would be addressed via Duke's corrective action program.

In summary, adequate controls are established to ensure availability and monitoring of the performance and reliability of the SSF. As described earlier, Duke is pursuing modifications to assure that the SSF is fully protected from tornado damage. This design improvement results in an assured means of achieving safe shutdown following a tornado. As described later in this submittal, the risk importance of the SFP-HPI flow path fully meets the acceptance threshold in RG 1.174. Therefore, the proposed changes to the LB are justified.

EFFECTS ON SAFETY Deterministic Evaluation The deterministic evaluation consisted of a review of plant systems and safety functions impacted by the elimination of the SFP-HPI flow path as an alternate source of primary make-up water following a tornado. The tornado mitigating effects from this change are quantitatively and qualitatively assessed. For primary system makeup, the SSF RCMU pump flow path replaces the existing SFP-HPI flow path for RCP seal injection and primary side makeup.

Since the replacement of the ONS-1 RCP seals, the risk associated with a RCP seal LOCA

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 9 following a tornado has been significantly reduced. Additionally, since the SSF RCMU flow path is fully protected from tornadoes, there is reasonable assurance that this primary makeup delivery method will be available if necessary. Consequently, there are no reductions in safety associated with eliminating the SFP-HPI flow path from the current LB.

For secondary side decay heat removal, defense-in-depth is improved through the modifications to fully protect the SSF ASW System from tornado damage. This assures that the SSF can mitigate tornadoes in a deterministic manner via TS required systems. Following the modifications to harden the West Penetration and Cask Decontamination Room Walls from severe tornadoes, the SSF ASW system becomes the protected and assured success path for establishing decay heat removal for the station.

Although not tornado protected, EFW and Station ASW are also maintained in the UFSAR as alternate means of secondary side heat removal. This is consistent with the diverse means of secondary side heat removal reviewed and approved by the NRC in its 1989 SER on EFW tornado missiles.

It is concluded that no new accidents or transients would be introduced by the proposed changes and that the SFP-HPI flow path elimination does not adversely impact any assumptions or inputs currently in the UFSAR. This is predicated on the fact that the SSF RCMU flow path will now be fully protected from tornado damage and as such provides an assured source of primary makeup if necessary. In addition, although not fully protected from tornado damage, primary system makeup from the HPI-BWST flow path is maintained in the UFSAR.

Probabilistic Risk Assessment The probabilistic risk assessment used to assess the impact of the proposed change is based upon similar measures defined in RG 1.1746. The risk impacts of the proposed changes to eliminate the SFP-HPI flow path and fully credit the SSF are calculated and compared against the acceptance guidelines as stated in the RG.

For the proposed changes, a delta core damage frequency (ACDF) is calculated based on the difference between the risk results of current versus the proposed plant configuration. During the process of evaluating the current tornado risk, Duke implemented numerous improvements to the previous tornado risk analysis in order to develop a more complete and accurate estimate of the tornado induced CDF. Modifications to the previous tornado analysis are grouped into the following general categories for the purpose of discussion:

6 NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant Specific Changes to the Current Licensing Basis," July 1998.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 10

1. Consideration of multi-unit interactions,

2. Modifications to reflect new insights and information on wind fragilities,

3. Increasing the level of detail in the modeling of the most important systems,

4. Updating the model to include modifications to the plant.

Multi-Unit Interactions The consideration of multi-unit interactions takes into account the impact of various combinations of spatial and functional dependencies between units that impact core damage sequences. A review of the Oconee system design features and layout identified several important multi-unit interactions. The following system functional dependencies were identified between units:

1. Keowee Auxiliary Power from ONS-1 Switchgear ITC,

2. Cooling Water for the Turbine-Driven (TD) EFW pump,

3. Vital Instrumentation and Control (I&C) power, and

4. Operator staffing and time limits for Station ASW activation.

Some of the tornadoes that strike ONS-3 are also postulated to strike the other units, with ONS-1 being the most critical. The Keowee hydro unit aligned to the underground path is designed to receive power for the unit's auxiliary systems from ONS-1 via an underground feed from switchgear 1TC. Under the assumption that a tornado strike causes extensive damage in the ONS switchyard, the expectation is that the Keowee overhead path is damaged and the Keowee main step-up transformer will be "locked-out".

This condition prevents the closure of the overhead generator breakers creating a loss of power to Keowee auxiliary power transformers 1X and 2X and leaving Keowee transformer CX as the only available auxiliary power source.

Since power to CX is supplied from Oconee switchgear 1TC, tornadoes that cause damage to the ONS-1 main feeder buses or switchgear 1TC result in a loss of the remaining auxiliary power source. Keowee is expected to run for approximately 1-hour without power to the unit auxiliaries before failing.

Upon recognition that this was an important PRA dependency, Oconee promptly initiated a modification at Keowee to add a control switch in the Keowee control room to simplify the operator actions necessary to recover auxiliary power. This is accomplished by allowing the unit aligned to the underground to connect to the Keowee main step-up transformer and power the auxiliaries through this alternate path. Keowee operator action is required within 1-hour in order to realign the breakers at Keowee to provide power to the auxiliaries. The modification, a new abnormal procedure to direct this recovery

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 11 action, and training of the operators, were completed in April 2002.

Tornadoes that strike ONS-1 only are also important because of the Keowee interaction.

A tornado strike on any Oconee unit is assumed to result in a LOOP to all three units.

Therefore, the potential for loss of Keowee as a source of power is an important interaction.

The second interaction is cooling water for TDEFW pumps. Normally the pumps are cooled by each unit's respective Low Pressure Service Water (LPSW) system. However, in the event of a loss of the 4kV power system, LPSW is lost and each pump must rely on its automatic backup cooling water source from the High Pressure Service Water (HPSW) system. However, the HPSW pumps may not be available since they rely on 4kV power from the ONS-1 main feeder buses and because the Elevated Water Storage Tank (EWST) may have failed. Even if the EWST survives the tornado strike, there is uncertainty whether the tank site will be accessible enough for operators to refill the EWST in a timely and reliable manner.

The third interaction is the design of the Vital I&C power system which is designed to cope with a loss of all power on a given unit by using a backup source from an adjacent unit. The concern is that there is a high conditional probability of all three units losing 4kV power at the same time. In this event, all normal instrumentation and controls are expected to be lost when the station Vital Batteries are depleted. Without instrumentation, it would be extremely difficult to control secondary side heat removal with EFW or Station ASW. The PRA models the loss of instrumentation as a run failure of EFW and Station ASW.

The fourth interaction is related to the operator staffing available to implement an alignment of the Station ASW pump following a tornado strike. Current staffing levels have enough resources to align Station ASW to one unit's SGs within 40 minutes.

However, because of staffing and time constraints, it is not expected that the Station ASW pump could be placed in service on more than one unit in the short period of time required when both the EFW and SSF ASW systems fail to start. As a result, although capable, Station ASW is not credited for providing secondary side heat removal if more than one unit requires secondary side heat removal in a short period of time.

Wind Damage Analysis Past risk studies assumed that the Upper Surge Tanks (USTs), located in the upper elevation of the turbine building, would fail if impacted by F2 or greater tornado winds.

Duke recently completed wind-loading calculations that demonstrated that the USTs

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 12 would withstand the wind and differential pressure loadings associated with a 300 mph tornado. Thus the likelihood of UST failure is significantly less than previously assumed.

The suction line to the TDEFW pump and the EFW recirculation line were analyzed to assess their potential for failure as a result of tornado winds. The wind load analysis demonstrated that the TDEFW pump suction lines are capable of withstanding the effects of wind speeds approaching the F3 wind threshold of 158 mph. Therefore, in the revised model, these suction lines are assumed to fail when impacted by F3 or higher tornado level winds. Conversely, the wind load analysis concluded that the TDEFW pump recirculation lines would fail at wind speed in the middle of the FL wind speed range.

The recirculation line is assumed to fail when impacted by F2 or higher tornadoes producing winds at the mid-Fl damage impact level. The potential failure of the suction lines is included in the updated analysis as an EFW start failure, and failure of the recirculation line is included as an EFW run failure.

The BWST has been determined to be rugged with respect to wind loadings. The potential for damage as a result of tornado-generated missiles is now expected to be the dominant failure mode for the BWST. The fault tree modeling has been modified to reflect the new understanding.

The ONS-3 main feeder buses are also subject to damage from wind loadings. The main feeder buses are assumed to fail at the F2 and higher wind velocities and this consideration has been included in the fault tree.

The reliability of Station ASW was adjusted to reflect the need to access components not protected from tornado damage, such as the ADVs and the injection valve in the East Penetration Room.

Another significant change in the assessment of wind damage is the recognition of the importance of the area around the outside of the ONS-1 / ONS-2 blockhouse from which the main feeder buses for all three units originate. A tornado strike in this specific area has a very high potential to cause a loss of all 4kV power on all three units. Thus, the model now includes damage events and logic that represent a tornado strike in this area.

A small portion of the Unit 3 Control Room (CR) north wall is not designed for tornado loads. Although analysis has shown that the wall is expected to survive direct wind loads up to 300 mph, it will not withstand the maximum negative pressure loads expected from a design basis tornado. This dependency was not included in the updated model since the wall failure mechanism would be outward from the room since the inside pressure is higher than the outside atmosphere. Specifically, a portion of the block wall, of sufficient

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 13 cross-sectional area to vent the room, would likely fall outward from the Control Room.

This condition is not likely to produce damage to critical CR equipment which is located a distance away from the walls. In addition most of the walls are outside walls in rooms that separate the operational areas of the CR from the block walls themselves. It was also concluded that wind or missile damage to the CR north wall station would be very unlikely since the majority of the wall is shielded from tornadoes from the dominant tornado direction by the reinforced concrete walls of the Spent Fuel Pool area and the ONS-2 and -3 Reactor Buildings.

Increased Level of Detail The likelihood of failure of plant systems during a tornado-initiated transient is dominated by damage inflicted by the tornado. In order to more accurately gauge the potential benefit of proposed plant modifications to improve system ruggedness and to provide more useful insights on the importance of specific components, additional detail has been included on the most important systems.

One important enhancement of the model was made by modifying the EFW and SSF ASW logic to differentiate start and run failures. This enhancement allows the model to give full credit for HPI feed and bleed cooling on loss of 4kV power sequences since run failures provide the additional time to allow HPI to be re-powered from the Station ASW switchgear.

The other primary area of detail enhancement is the inclusion of "independent" and common cause failures of plant systems and components. For Keowee, maintenance events, common cause failure events, and random start and run failure events are now included in the model. Start and run failures of the HPI pumps are now included in the model along with the human error for failure to align power for the pump from the Station ASW switchgear. The most important random failures of the turbine driven EFW pump have also been added to the model. These include the start and run failures, maintenance unavailability, and latent human error.

The SSF modeling has also been modified to integrate the tornado logic with SSF system model analysis instead of a simplified approach. These include diesel generator start and run failures, SSF ASW pump failures, and SSF RCMU pump failures. The SSF maintenance unavailability is also included. As described earlier, the SSF ASW related events and common support system events have been segregated in the logic into start and run failures.

The Station ASW model was upgraded to include independent Station ASW component

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 14 failure events including start and run failures, human errors, and maintenance unavailability.

Additional modeling details were also incorporated in the model for the operation of the Pressurizer Power Operated Relief Valve (PORV) and PORV block valve. The PORV has the capability of delaying a challenge to Pressurizer safety valves allowing additional time for operators to align SSF ASW. If the PORV sticks open, the PORV block valve can be closed from the SSF control room. The Pressurizer PORV relies on battery backed power for instrumentation and controls. The model also contains failure modes where the PORV remains closed.

Plant Modifications The Westinghouse RCP seal packages on the ONS-1 RCPs have been replaced with Sulzer seals, similar to those packages installed on the ONS-2 and -3 RCPs.

Consequently, the seal LOCA model has been revised to use the Rhodes model for all three units. The Rhodes model provides more conservative results for the Sulzer seals than the Combustion Engineering Owners Group seal LOCA model for Sulzer seals currently under review by the NRC. This change in seal LOCA modeling affects the entire PRA analysis, not just the tornado model.

As described earlier, Keowee has been modified to allow recovery of power to the auxiliaries of the unit aligned to the underground path when power from 1TC has been lost.

The revised tornado risk model also estimates the risk reduction associated with the modification that fully protects the SSF function from tornado damage.

PRA Results and Conclusions For tornado events, Revision 2 of the ONS PRA focused on conditional probabilities of failure of applicable plant structures, systems, or components. All of the tornadoes considered in that current model are assumed to damage a single unit with a loss of offsite power for the station.

The tornado analyses also focused on various aspects of the following:

"* The turbine building, which houses the major components of the EFW system, the 4kV switchgear, and the service water systems for all three units;

"* The BWST, which is located on the west side of each unit's Auxiliary Building; and

"* The West Penetration Room in the Auxiliary Building, through which pass cables and

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 15 piping needed for the SSF to deliver reactor coolant makeup and SG feedwater.

Using the ONS PRA Revision 2 model, the overall tornado CDF to the station is estimated to be approximately 1.4E 5 . This number however, does not include the contribution from recent wind fragility assessments and insights, implemented modifications to the plant, and multi-unit interactions. An extensive effort has been made to identify dependencies that could be important for tornado events and improve the level of detail in the model. This included both the conditional probabilities of tornadoes that could affect different areas within the plant, and functional dependencies. For example, the potential for tornado-induced loss of power on switchgear 1TC, which may be needed to supply power to auxiliaries for the Keowee Hydro Station, is now modeled. This same event also affects the availability of cooling water to the TDEFW pump and the availability of Vital I&C Power for long-term operation of EFW and/or Station ASW.

Also, it is realized that multi-unit interactions play a more significant risk role than what was envisioned previously. Specifically, modeling damage to a single unit is no longer appropriate since it is now known that for certain tornadoes, damage to one unit may have detrimental effects on the other two that should be addressed.

The updated tornado model is being added to Revision 3 of the ONS PRA. The updated estimate for the tornado CDF increases to approximately 2.41E-5 , 2.13E-5 , and 2.07E-5 , for ONS-1, -2, and

-3 respectively. These values become the CDF base case and are shown in Table 1 under the "CDF from Updated PRA Model" heading.

The impact of modifying the plant's LB is evaluated by including the risk impact of the following changes in the Current Design Basis Tornado CDF model:

"* The SFP-LHPI flow path is removed,

"* The West Penetration and Cask Decontamination Rooms are considered hardened,

"* The ONS-1 RCP seal LOCA model is revised, and

"* The recovery of Keowee auxiliary power per the new procedure and modification is included. This is a new insight from the revised tornado risk analysis.

Taking into account the above changes, the new CDF is estimated to be 2.02E 5 , 2.02E 5 , and 1.99E-5 , for ONS-1, -2, and -3 respectively. This clearly shows reductions in the tornado CDF of 3.9E-6 , 1.1E-6 , and 8.0E 7 for ONS-1 through 3 respectively. These values are also shown in Table 1 as "CDF with Proposed Changes," and "Total Tornado CDF Change."

The individual CDF contribution for each change is shown in Table 1. There was a modest risk

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 16 7 7 and 6.0E 7 increase due to the removal of the SFP-HPI flow path on the order of 3.0E , 3.0E- ,

(for ONS-1, -2, and -3). However, the ONS-1 RCP seal replacement and the hardening of the West Penetration and Cask Decontamination room walls result in a greater risk reduction.

In conclusion, these CDF results show that the changes proposed in the LAR result in an overall risk reduction to the ONS Tornado CDF and are therefore justifiable. The proposed changes to the UFSAR and LB, as a result of these proposed changes, are also consistent with and fully comply with the key principles set forth in RG 1.174.

Table 1 Tornado CDF UNIT 1 UNIT 2 UNIT 3 CDF from Updated PRA Model 2.41E-5 2.13E-5 2.07E-5 2.02E 5 2.02E-5 1.99 5 CDF with Proposed Changes 6 7 Tntnl Tnrnndn CDF Change -3.9E 6 -1.1E" -8.0E Removal of SFP-HPI Flow path 3.0E 7 3.0E-7 6.0E-7 Hardening WP/CD Room Walls -1.4E-6 -1.4E 6 -1.4E-6 Reactor Coolant Pump Seal Replacement -2.8EK n/a n/a A more detailed description of the risk analyses that support this submittal is provided in Severe Accident Analysis Group (SAAG) Reports #6737 and #7128.

Large Early Release Freauency (LERF)

None of the changes in the proposed LAR directly affect the performance of the containment isolation function, or the potential for a containment bypass. The changes proposed in this LAR have been shown to result in a net reduction in CDF. Additionally, hardening of the West Penetration Room reduces the likelihood of damage to piping in that room that might potentially result in an isolation failure. Consequently, no increase in LERF is expected to result from the changes requested in this LAR.

7 Oconee Nuclear Station, Severe Accident Analysis Group PRA System Documentation - SAAG #673, "Oconee PRA Revision 3 Tornado Analysis Update," dated June 5, 2002.

8Oconee Nuclear Station, Severe Accident Analysis Group PRA System Documentation - SAAG #712, "PRA Risk Evaluation for Oconee Tornado Licensing Submittal," dated June 5, 2002.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 17 PRA QUALITY PRA Updates Duke's Severe Accident Analysis Group (SAAG) periodically evaluates changes to the plant with respect to the assumptions and modeling in the Oconee PRA. The original 1984 Oconee NSAC-60 PRA9 was a Level 3 PRA with internal and external events sponsored by the Electric Power Research Institute (EPRI) and Duke. The NRC contractor, Brookhaven National Laboratory (BNL), reviewed NSAC-60 and published its findings in NUREG/CR-4374 Vol. 1 310. In 1990, a large-scale review and update of the PRA resulted in the Individual Plant Examination Report (IPE) submitted to the NRC as part of Generic Letter 88-20 response". The 12 NRC reviewed the IPE submittal and documented its review in a NRC Evaluation In 1995, Oconee initiated Revision 2 of the 1990 IPE and provided the results to the NRC in 1997'3. Currently, Revision 3 of the Oconee PRA is underway. This update, which is a comprehensive revision to the PRA models and associated documentation, is expected to be completed in 2002. The objectives of this update are as follows:

"* To ensure the models comprising the PRA accurately reflect the current plant, including its physical configurations, operating procedures, maintenance practices, etc.

"* To review recent operating experience with respect to updating the frequency of plant transients, failure rates, and maintenance unavailability data.

• To correct items identified as errors and implement PRA enhancements as needed.

"* To address weaknesses identified in the recent Oconee PRA Peer Review.

"* To utilize updated Common Cause Analysis data and Human Reliability Analysis data.

PRA maintenance encompasses the identification and evaluation of new information into the PRA and typically involves minor modifications to the plant model. PRA maintenance and updates as well as guidance for developing PRA data and evaluation of plant modifications, are governed by Workplace Procedures. In January 2001, an enhanced configuration control process 9 'A Probabilistic Risk Assessment of Oconee Unit 3," NSAC-60, June 1984.

10NUREG/CR-4374, Vol. 1-3, "A Review of the Oconee-3 Probabilistic Risk Assessment," Brookhaven National Laboratory, March 1986.

I1 NEI-00-02, "Industry PRA Peer Review Process," Nuclear Energy Institute, January 2000.

12 NRC Letter to Duke Power Company, "Examination of the Oconee, Units 1,2 and 3 Individual Plant examination for examination (IPE) - Internal Events Submittal," April 1, 1993.

13 "Probabilistic Risk Assessment Individual Plant Examination," Oconee Nuclear Site letter to NRC, February 13, 1997.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 18 was implemented to more effectively track, evaluate, and implement PRA changes to better ensure the PRA reflects the as-built, as-operated plant.

Peer Review Process Between May 7-11, 2001, Oconee participated in the B&W Owners Group (B&WOG) PRA Certification Program. This review followed a process that was originally developed and used by the Boiling Water Reactor Owners Group (BWROG) and subsequently broadened to be an industry-applicable process through the Nuclear 14 Energy Institute Risk Applications Task Force.

The resulting industry document, NEI-00-02 , describes the overall PRA peer review process.

The Certification/Peer Review process is also linked to a draft version (Revision 13) of the upcoming ASME PRA Standard15.

The objective of the PRA Peer Review process is to provide a method for establishing the technical quality and adequacy of a PRA for a range of potential risk-informed plant applications for which the PRA may be used. The PRA Peer Review process employs a team of PRA and system analysts, who possess significant expertise in PRA development and PRA applications.

The team uses checklists to evaluate the scope, comprehensiveness, completeness, and fidelity of the PRA being reviewed. One of the key parts of the review is an assessment of the maintenance and update process to ensure the PRA reflects the as-built plant.

The review team for the Oconee PRA Peer Review consisted of six members. Three of the members were PRA personnel from other utilities. The remaining three were industry consultants. Reviewer independence was maintained by assuring that none of the six individuals had any involvement in the development of the Oconee PRA or IPE.

The Peer Review team noted that the Oconee PRA had a strong foundation laid in NSAC-60 and the IPE and that the full scope Level 3 PRA with external events should support a wide range of applications. A summary of some of the Oconee PRA strengths and areas for enhancement from the peer review are as follows:

Strengths

"* Results summary and insights

"* Uncertainty/sensitivity analysis

"* Time dependent RCP seal LOCA/SBO treatment

"* Delineation of small LOCA contributors

"* Bayes' update of failure data validated 14 NEI-00-02, "Industry PRA Peer Review Process," Nuclear Energy Institute, January 2000.

15 "Standard For Probabilistic Risk Assessment for Nuclear Power Plant Applications," ASME Draft Revision 13, July 2001.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 19

"* Detailed analysis of hydroelectric plant

"* Strong maintenance and update process

"* Thorough system notebooks with good detail, separate quantification, clear boundaries, and tie to service experience Areas for Enhancement

"* Improved basis for identifying and screening support system initiators

"* Enhanced documentation of dependencies

"* Enhanced guidance and documentation for event sequence quantification

"* Enhanced completeness and accountability of common cause failures

"* Enhanced treatment of dependencies and time basis for human reliability

"* Improved justification for assumptions and calculations impacting LERF

"* Enhanced documentation of screening of containment isolation and bypass pathways

"* Enhanced documentation of standby test intervals The significance levels of the B&WOG Peer Review Certification process have the following definitions:

A. Extremely important and necessary to address to ensure the technical adequacy of the PRA, the quality of the PRA, or the quality of the PRA update process.

B. Important and necessary to address but may be deferred until the next PRA update.

The Oconee PRA received 4 "A" and 35 "B" fact and observation findings during its peer review. All four of the "A" findings have been addressed and are being incorporated into Oconee PRA Rev. 3 update that is nearing completion. Many of the "B" findings have been incorporated as well.

Results of Reviews with Respect to this License Amendment Request Oconee Nuclear SAAG Reports #673 and #712 contain the quantification and documentation of the analysis performed for this LAR. Consistent with the work place procedures governing PRA analysis, this calculation has undergone independent checking by a qualified reviewer. The review verified that the analysis adequately modeled the risk impacts of the elimination of the SFP-HPI flow path and hardening of the West Penetration room.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 20 In April 2002, an outside consultant conducted an independent review of the aforementioned report. Results of the review focused on several key aspects including:

" The choice of methods being used. Were they representative of the state of the art and appropriate for this application?

" The implementation of the methods. Were they being employed in a proper manner?

" The level of completeness of the analysis. Was a comprehensive evaluation made of potential tornado-induced failures and the accidents to which they could contribute?

" The available documentation. Did the documentation provide a clear and thorough explanation of the work being performed and justify the results obtained?

The review process consisted of the following activities:

An examination of a variety of documents. The current ongoing analysis was summarized in a report that is an adjunct to the Oconee PRA and being supplemented by additional, more detailed reports.

"* A briefing and discussion with the Duke staff performing the analysis.

"* A walkdown of the plant to perform an additional search for possible vulnerabilities that might have been overlooked and to gain further insight into the geometry and shielding of targets that might be of interest.

As concluded in the peer review report16 , the methods utilized in the revised tornado model were appropriate to the nature of the plant hazard and the objective of the updated analysis and were noted as "being implemented carefully and conscientiously." Also stated was that the analysis

[although not fully completed at the time of the peer review] appeared to be following a very comprehensive course and that there were no omissions or areas in which significant improvement was needed.

The important features and assumptions of the updated tornado model were also presented to a site expert panel for review and comments. This review covered the accident sequence assumptions for the event tree, system functional dependencies, and human reliability analysis.

From this review, additional enhancements for the accident sequence logic were recommended by the panel to increase credit for preventing a stuck-open Pressurizer safety valve using SSF ASW. Additional documentation enhancements and clarifications were also suggested. These 16 Review of the Draft Tornado Analysis for the Oconee Nuclear Station, Lewis, Stuart R., April 2002

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 21 recommendations were subsequently incorporated into the analysis.

PRA Quality Assurance Methods Approved workplace procedures address the quality assurance of the PRA. One way the quality assurance of the Oconee PRA is ensured is by maintaining a set of system notebooks on each of the PRA systems. Each system PRA analyst is responsible for updating a specific system model.

This update consists of a comprehensive review of the system including drawings and plant modifications made since the last update as well as implementation of any PRA change notices that may exist on the system. The analyst's primary focal point is with the system engineer at the site. The system engineer provides information for the update as needed. The analyst will review the PRA model with the system engineer and as necessary, conduct a system walkdown with the system engineer. This interaction is documented in a memorandum.

The system notebooks contain, but are not limited to, documentation on system design, testing and maintenance practices, success criteria, assumptions, descriptions of the reliability data, as well as the results of the quantification. The system notebooks are reviewed and signed off by a second independent person and are approved by the manager of the group.

When any change to the PRA is identified, the same three-signature process of identification, review, and approval is utilized to ensure that the change is valid and that it receives the proper priority.

Maintenance Rule Confliuration Control 10 CFR 50.65 (a)(4), RG 1.182 17, and NUMARC 93-0118 require that prior to performing maintenance activities, risk assessments shall be performed to assess and manage the increase in risk that may result from proposed maintenance activities. These requirements are applicable for all plant modes. NUMARC 91-0619 requires utilities to assess and manage the risks that occur during the performance of outages.

Duke has several Work Process Manual procedures and Nuclear System Directives that are in place at the Oconee Nuclear Station to ensure the requirements of the Maintenance Rule are implemented. The key documents are as follows:

• Nuclear System Directive 415, "Operational Risk Management (Modes 1-3) per 10 CFR 17 NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants," May 2000.

18 NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," March 2000.

19 NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," December 1991.

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Technical Justification June 7, 2002 Page 22 50.65 (a.4)," Revision 1, April 2002.

"* Nuclear System Directive 403, "Shutdown Risk Management (Modes 4, 5, 6, and No Mode) per 10 CFR 50.65 (a.4)," Revision 9, February 2002.

"* Work Process Manual, WPM-609, "Innage Risk Assessment Utilizing GRAM SENTINEL," Revision 5, April 2002.

"* Work Process Manual, WPM-608, "Outage Risk Assessment Utilizing ORAM SENTINEL," Revision 5, April 2002.

The documents listed above are used to address the Maintenance Rule requirement and the on line (and off-line) Maintenance Policy requirement to control the safety impact of combinations of equipment removed from service. More specifically, the Nuclear System Directives address the process, define the program, and state individual group responsibilities to ensure compliance with the Maintenance Rule.

The Work Process Manual procedures provide a consistent process for utilizing the computerized software assessment tool, GRAM-SENTINEL, which manages the risk associated with equipment inoperability. ORAM-SENTINEL is a Windows-based computer program designed by the Electric Power Research Institute as a tool for plant personnel to use to analyze and manage the risk associated with all risk significant work activities including assessment of combinations of equipment removed from service. It is independent of the requirements of Technical Specifications and Selected Licensee Commitments.

The tRAM-SENTINEL models for Oconee are based on a "blended" approach of probabilistic (the full Oconee Revision 2 PRA model is utilized) and traditional deterministic approaches.

The results of the risk assessment include a prioritized listing of equipment to return to service, a prioritized listing of equipment to remain in service, and potential contingency considerations.

Additionally, prior to the release of work for execution, Operations personnel must consider the effects of severe weather and grid instabilities on plant operations. This qualitative evaluation is inherent of the duties of the Work Control Center Senior Reactor Operator (SRO). Responses to actual plant risk due to severe weather or grid instabilities are programmatically incorporated into applicable plant emergency or response procedures.

ATTACHMENT 4 NO SIGNIFICANT HAZARDS CONSIDERATION

Nuclear Regulatory Commission License Amendment Request No. 2001-005 No Significant Hazards Consideration June 7, 2002 Page 2 Pursuant to 10 CFR 50.91, Duke Energy Corporation (Duke) has made the determination that this amendment request involves a No Significant Hazards Consideration by applying the standards established by the NRC regulations in 10 CFR 50.92. This ensures that operation of the facility in accordance with the proposed amendment would not:

1. Involve a significant increase in the probability or consequences of an accident previously evaluated.

The changes being requested in this amendment request involve (1) the elimination of the Spent Fuel Pool as a suction source to a High Pressure Injection pump for primary system make-up, and (2) to fully credit the Standby Shutdown Facility (SSF) as the primary assured means of achieving safe shutdown of all three units following a tornado. Following the modification to fully tornado protect the SSF, this facility becomes the station's assured flow path for both primary make-up and secondary decay heat removal for all three units.

Although the probability of a severe tornado strike at the station does not change, new tornado insights gained from a review of the current external event risk analysis have resulted in an enhanced risk model that more accurately characterizes station tornado damage risk.

The proposed changes are part of the revised tornado mitigation strategy that provides for an assured, deterministic success path rather than the current strategy that is based on risk insights and diversity for achieving safe shutdown. This effort has resulted in an overall reduction in tornado risk at the station and consequently, would not result in a significant increase in the consequences of an accident previously evaluated.

Other than the fortification of walls of existing structures to harden them against tornado damage, there are no physical changes to the plant structures, systems, or components (SSCs) or operating procedures, nor are there any changes to safety limits or set points. Also, no new radiological release pathways are created.

2. Create the possibility of a new or different kind of accident from any accident previously evaluated.

The changes being proposed in this amendment request do not create the possibility of a new or different kind of accident from any accident previously evaluated. The initial placement of the SFP-HPI flow path into the LB was based on 1989 risk analyses that showed a potential need for primary make-up due to inventory losses from a reactor coolant pump (RCP) seal loss-of-cooling accident (LOCA). The upgrade of the RCP seals has significantly reduced the probability of a seal LOCA and subsequently, alleviated the initial reliance on the SFP HPI flow path for primary make-up. If multi-unit primary make-up and decay heat removal

Nuclear Regulatory Commission License Amendment Request No. 2001-005 No Significant Hazards Consideration June 7, 2002 Page 3 are required following an event, the tornado protected SSF RBMU or SSF ASW pumps have the capabilities to perform these functions for all three units.

Other than the fortification of walls of existing structures to harden them against tornado damage, there are no physical changes to the plant SSCs or operating procedures. There are no new hazardous materials or potential missiles. It does not introduce the possibility of any new or different malfunctions. No safety limits or set points are changed.

3. Involve a significant reduction in a margin of safety.

As mentioned previously, new tornado insights gained from a review of the current external event risk analysis have resulted in an enhanced risk model that more accurately characterizes station tornado damage risk. The proposed changes are part of the revised tornado mitigation strategy that provides for an assured, deterministic success path rather than a strategy that is based on risk insights and diversity for achieving safe shutdown.

There are no safety limit, set point, design parameters, or operating procedure changes required. The integrity of the fuel cladding, reactor coolant system, and containment are preserved. Thus, the proposed changes do not involve a significant reduction in a margin of safety.

ATTACHMENT 5 ENVIRONMENTAL IMPACT ANALYSIS

Nuclear Regulatory Commission License Amendment Request No. 2001-005 Environmental Impact Analysis June 7, 2002 Page 2 Pursuant to 10 CFR 51.22(b), an evaluation of the license amendment request (LAR) has been performed to determine whether or not it meets the criteria for categorical exclusion set forth in 10 CFR 51.22(c)9 of the regulations. The LAR does not involve:

1. A significant hazards consideration.

This conclusion is supported by the determination of no significant hazards contained in Attachment 4.

2. A significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

This LAR will not change the types or amounts of any effluents that may be released offsite.

3. A significant increase in the individual or cumulative occupational radiation exposure.

This LAR will not increase the individual or cumulative occupational radiation exposure.

In summary, this LAR meets the criteria set forth in 10 CFR 51.22 (c) 9 of the regulations for categorical exclusion from an environmental impact statement.