ML21047A241

DPO-2019-001, Redacted Differing Professional Opinion (DPO) Case File (Public)

ML21047A241
Person / Time
Site:	Oconee
Issue date:	02/16/2021
From:	Ian Gifford NRC/OE
To:
Gifford I
References
DPO-2019-001
Download: ML21047A241 (182)

Text

DPO Case File for DPO-2019-001 The following pdf represents a collection of documents associated with the submittal and disposition of a differing professional opinion (DPO) from an NRC employee involving the Oconee Task Interface Agreement 2014-04, NRC Staff's Response Concerning Degraded Voltage Protection.

Management Directive (MD) 10.159, NRC Differing Professional Opinions Program, describes the DPO Program. https://www.nrc.gov/docs/ML1513/ML15132A664.pdf The DPO Program is a formal process that allows NRC employees and contractors to have their differing views on established, mission-related issues considered by the highest-level managers in their organizations (i.e., Office Directors and Regional Administrators). The process also provides managers with an impartial, multi-person review of the issue (one person chosen by the employee). After a decision is issued to an employee, they may appeal the decision to the Executive Director for Operations (or the Commission, for those offices that report to the Commission).

Because the disposition of a DPO represents a multi-step process, readers should view the records as a collection. In other words, reading a document in isolation will not provide the correct context for how this issue was reviewed and considered by the NRC.

It is important to note that the DPO submittal includes the personal opinions, views, and concerns by NRC employees. The NRCs evaluation of the concerns and the NRCs final position are included in the DPO Decision or in the DPO Appeal Decision (for appealed cases).

The records in this collection have been reviewed and approved for public dissemination.

Document 1: DPO Submittal Document 2: Memo Establishing DPO Panel Document 3: DPO Panel Report Document 4: DPO Decision Document 5: DPO Appeal Document 6: Statement of Views Document 7: DPO Appeal Decision

Document 1: DPO Submittal

Document 2: Memo Establishing DPO Panel

Document 3: DPO Panel Report UNITED STATES NUCLEAR REGULATORY COMMISSION REGION I 2100 RENAISSANCE BLVD.

KING OF PRUSSIA, PA 19406-2713 December 12, 2019 MEMORANDUM TO: Ho Nieh, Director Office of Nuclear Reactor Regulation FROM: Paul G. Krohn, DPO Panel Chair /RA/

Region I Samuel T. Graves, DPO Panel Member /RA/

Region IV John Hanna, DPO Panel Member /RA/

Region III Kenneth A. Miller, DPO Panel Member /RA/

Office of Nuclear Regulatory Research

SUBJECT:

DIFFERING PROFESSIONAL OPINION PANEL REPORT ON THE OCONEE TASK INTERFACE AGREEMENT 2014-04, NRC STAFFS RESPONSE CONCERNING DEGRADED VOLTAGE PROTECTION (DPO-2019-001)

In a memorandum dated May 21, 2019, we were appointed as members of a Differing Professional Opinion (DPO) Ad Hoc Review Panel (DPO Panel) to review a differing opinion regarding the NRC staffs response to Oconee Task Interface Agreement (TIA) 2014-04 associated with degraded voltage protection. The DPO Panel has reviewed the DPO in accordance with the guidance in Management Directive 10.159, The NRC Differing Professional Opinion Program. The scope was limited to a review of the issues identified in the DPO as clarified through a Summary of Issues developed by the Panel and confirmed by the DPO submitter. The Panel evaluated the issues through interviews of knowledgeable NRC staff and a review of various documents, including official agency records.

The results of the Panels evaluation of the concerns raised in the DPO are detailed in the enclosed DPO Panel Report. The Panel was able to reach alignment on all of the issues provided by the DPO submitter. The DPO Panel made the following conclusions:

Oconee meets the regulatory requirements under which they were licensed (i.e., their license basis).

The DPO Panel did not find a non-compliance associated with the licensing basis or the degraded voltage protection scheme at Oconee.

CONTACT: Paul G. Krohn, RI/DRS (610) 337-5081

3 H. Nieh were licensed; and there is no adequate protection or safety basis for additional modifications in accordance with 10CFR 50.109. We also offer the following recommendations for your consideration:

while a verbal meeting was held with the DPO submitter in October 2018 to disposition the NRR Electrical Branchs comments to the draft TIA response, a more formal disposition and addressing of the comments in written form in the final TIA response would have been beneficial from the standpoint of the Principles of Good Regulation (i.e., Openness and Transparency) for internal staff and in this case, the DPO submitter. Including a written disposition of the comments in the TIA response could have, in fact, eliminated the need for this DPO Panel resulting in an overall saving of agency resources.

a review of the process, as applied to the response to TIA 2014-04, should be considered to ascertain whether there were any missed opportunities to have researched Oconees DVR configuration to the same depth as that performed by the DPO Panel. Specifically, the Panel reviewed and evaluated specific licensee procedures and drawings to verify that Oconees DVR configuration (i.e., the ABB CV-7, 27N and 27E, undervoltage relays on the 4.16 kV MFBs) meets regulatory requirements. Having evaluated the electrical distribution system design configuration to the same depth during development of the TIA response may have eliminated the need for this DPO Panel resulting in an overall saving of agency resources.

more dialogue in Regulatory Information Summary (RIS) 2011-12, Adequacy of Station Electric Distribution System Voltages on pre-GDC plants, such as a discussion of the 10 CFR 50.36(c)(2)(iii) exemption and 50.55a(h)(2), would have led to an increased understanding of the licensing basis associated with plants that were issued construction and operating licenses before GDC 17 came into effect. Such additional research and documentation in 2011 could have addressed at least some of the DPO submitters concerns. Supplementing RIS 2011-012 regarding pre-GDC plants should be considered as a knowledge transfer tool to future regulators.

Please do not hesitate to contact us if you have any questions regarding the enclosed report.

Enclosure:

DPO Panel Report cc: Submitter Director, OE DPO PM

Differing Professional Opinion (DPO)

Panel Report on the Oconee Task Interface Agreement 2014-04, NRC Staffs Response Concerning Oconee Degraded Voltage Protection (DPO-2019-001)

/RA/

Paul G. Krohn, Panel Chair

/RA/

Sam Graves, Panel Member

/RA/

John Hanna, Panel Member

/RA/

Kenn A. Miller, Panel Member Date: December 12, 2019

Table of Contents INTRODUCTION .....................................................................................................................

SUMMARY

OF ISSUES (SOI) ................................................................................................. EXECUTIVE

SUMMARY

- DPO Panel Outcome .................................................................... EVALUATION .......................................................................................................................... Issue 1 .................................................................................................................................. Issue 2 ................................................................................................................................ Issue 3 ................................................................................................................................ Issue 4 ................................................................................................................................ Issue 5 ................................................................................................................................ Issue 6 ................................................................................................................................ RECOMMENDATIONS .......................................................................................................... Appendix A - Documents Reviewed ......................................................................................... A-1 Appendix B - NRC Staff Interviewed ......................................................................................... B-1 Appendix C - Figure 1: Electrical Distribution System Diagram ................................................ C-1 Appendix D - Risk Insights ........................................................................................................ D-1 Appendix E - Comparison with Other Risk-Informed Processes .............................................. E-1 Appendix F - Additional Information .......................................................................................... F-1

INTRODUCTION On May 9, 2014, the U.S. Nuclear Regulatory Commission (NRC) Region II Office (Region II) staff completed a Component Design Bases Inspection (CDBI) at Oconee Nuclear Station (Oconee). Duke Energy Carolinas, LLC is the licensee for Oconee. During the inspection, the inspectors identified several concerns regarding the adequacy of the licensees DVR protection design and licensing bases. These concerns were documented in Unresolved Item 2014007-04, Degraded Voltage Relay Scheme, from the CDBI Report No. 05000269/2014007, 05000270/20140007, and 05000287/2014007, dated June 27, 2014 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML14178A535). To resolve these concerns, Region II developed Task Interface Agreement (TIA) 2014-04, dated November 7, 2014 (ADAMS Accession No. ML14311A862), to request assistance from the Office of Nuclear Reactor Regulation (NRR).

In its TIA, Region II staff described concerns about aspects of the licensees protection from degraded and loss of voltage conditions - that DVRs were not installed on the 4.16 kV safety buses during normal operation when those buses are fed from the unit auxiliary transformers (UATs), that the licensee used manual actions during mitigation of degraded voltage conditions, and that loss-of-power (LOP) relays are used for monitoring safety-related bus voltages, but relay setpoints and time delays were not in the Technical Specifications (TSs).

By electronic mail (email) dated July 27, 2018 (ADAMS Accession No. ML18211A217),

Region II staff revised its request by modifying the scope of the TIA and requesting NRR staff clarify whether the issues discussed in the TIA are consistent with the Oconee licensing basis and staff positions applicable to Oconee. The TIA response was subsequently issued on January 22, 2019 (ML18226A215).

On May 8, 2019, a NRC staff member filled a Differing Professional Opinion (DPO) in accordance with Management Directive 10.159, The NRC Differing Professional Opinions Program. (ADAMS Accession No. ML18073A298). The DPO involved the staffs response to Oconee Nuclear Station TIA 2014-04 associated with that sites DVR protection configuration and compliance with their licensing basis (ML18226A215). The submitters concerns involved:

the licensing and design basis requirements for DVR protection; the lack of safety-related degraded voltage relays at the 4.16 kV ES busses; allowance of manual actions in place of automatic actions for degraded voltage protection; the lack of Technical Specification requirements for DVR protection monitors; incorrect safety evaluation conclusions; and the granting of an informal exemption from the design and licensing bases requirements for DVRs.

The NRCs Office of Enforcement accepted the DPO on May 16, 2019, and assigned the case number DPO-2019-001. By memorandum dated May 21, 2019, (ML19140A434), the Office of Enforcement established an Ad Hoc Review Panel (the Panel) to perform a review of the DPO.

The Panel developed a draft Summary of Issues (SOI) and shared it with the submitter on July 31, 2019. Based on subsequent discussions and feedback from the submitter, a final SOI was agreed to by the DPO Panel and the submitter on August 14, 2019. The final SOI is documented in the next section.

In the DPO filing, the submitter asserted that the issues raised an immediate public health and safety concern. Specifically, the DPO submitter disagreed with the NRC staffs position in the January 22, 2019 response to the TIA and asserted that the lack of DVR protection on the

engineered safeguards (ES) busses was a safety concern because safe shutdown capability is not assured in the event of a degraded voltage condition until manual actions are taken. In addition, the DPO submitter asserted that safety-related equipment at all Oconee units is susceptible to degradation from a single-failure and common-cause-failures due to degraded voltage. As a result, NRR performed a prompt evaluation to gain risk insights into DPO-2019-001. The evaluation was completed by May 22, 2019. The prompt evaluation determined that:

There are a limited number of initiating events for which the time-delay (~12 minutes) to take manual actions to restore power will impact plant safety.

The initiating event frequency of greatest concern is a large loss-of-coolant-accident (LOCA), which is a low frequency event (on the order of 1E-6 per year).

The likelihood of a degraded voltage condition on both the safety-related busses resulting from a single failure without causing degraded voltage in the switchyard is also very low.

If damage were to occur, it is likely to impact only one of the busses and occur during normal operations, which would allow the site and operators to identify the issue, isolate the busses, and perform corrective maintenance to restore the equipment.

The Oconee standby shutdown facility (SSF) and FLEX equipment provide additional defense-in-depth should a degraded voltage condition occur simultaneously with an initiating event.

Within the context of the prompt evaluation, NRR concluded that based on the low likelihood of an initiating event occurring simultaneously with a degraded voltage condition and the additional mitigation and defense-in-depth capability present, the issue did not rise to the level of an immediate safety concern. The DPO Panel considered this a reasonable result given the high level nature of the analysis.2 The DPO Panel was tasked with reviewing the individual DPO issues and providing conclusions, and recommendations, if necessary. Following several discussions with the submitter and development of the SOI, the DPO Panel conducted its review by collecting and reviewing documents; performing interviews with knowledgeable NRC staff including the Oconee resident inspectors as well as OGC, TIA, Backfit, and TS subject matter experts; performing a probabilistic risk assessment (PRA) analysis; and conducting biweekly conference calls over a five-month period. A list of documents reviewed, NRC staff interviewed, a one-line electrical distribution diagram, and a PRA analysis are provided in Appendices A, B, C, and D respectively. Appendix E includes a comparison of the Oconee risk analysis results with other agency risk-informed processes. Appendix F provides additional information requested by the Director, NRR as the Panel commenced its work.

2 - Notwithstanding the results of NRRs prompt evaluation, in performing a more detailed risk evaluation (DRE), the DPO Panel determined that:

a loss-of-offsite-power (LOOP) leading to a station blackout (SBO) was the dominant accident sequence, not a large LOCA; and credit for FLEX equipment in post-accident situations must be carefully evaluated relative to timing and core injection. For example, core damage may occur prior to FLEX equipment being retrieved from the storage location, connected to the plants systems, and starting to inject into the core. However, in order to create a conservative and bounding analysis, the DPO Panels DRE did not consider FLEX equipment. Rather, the Panels DRE assumed that only the SSF was functional as it is designed for an SBO at all three Oconee Units.

SUMMARY

OF ISSUES (SOI)

Based on a review of the DPO submittal, the Panel identified that the individual concerns could be grouped into six distinct areas. Based on a review of the DPO submittal and associated references as well as interviews and agreement with the submitter, the following issues were assessed by the Panel:

Issue 1 The issued TIA response dated January 22, 2019, (ML18226A215), did not reflect the NRC requirements, nor the Oconee licensing and design bases requirements for DVR protection of safety-related equipment (i.e., the Oconee licensing basis is incorrectly characterized and interpreted and is not in accordance with existing NRC guidance, staff positions, and staff precedence). For example, several staff safety evaluations and Technical Specifications Bases statements and references are discussed and quoted in the TIA-2014-04 response to conclude that the staff approved the Oconee DVR and loss of voltage (LOV) design. The TIA response is in error because the staffs statements in the safety evaluation (SE) and contents of Technical Specification (TS) Bases are not considered part of Oconees licensing basis and are inconsistent with the licensing basis definition and guidance. The issued TIA response also did not capture the Electrical Branchs technical positions, submitted in a previous revision to the TIA response (ML15231A376) for DVR protection of safety-related equipment at Oconee.

Also, the submitter noted incorrect characterization of certain facts. For example, the response to Question 2 states that generic communications, such as Regulatory Issue Summaries (RIS),

do not constitute requirements. My review (i.e., the submitter) notes that the above statement is an incorrect characterization of what is a RIS. It should be noted that RIS 2011-12 was issued to clarify the NRC staffs technical positions on existing regulatory requirements which apply to DVR and LOV requirements.

Issue 2 The three Oconee units have non-safety-related DVRs installed at the 230 kV switchyard Yellow bus and this power source is in standby mode and isolated from the safety-related busses.

The three units are therefore operating without safety-related degraded voltage protection relays at the 4.16 kV ES buses which have safety-related equipment operating (e.g. cooling water and HVAC systems) to support power generation. A degraded voltage condition in the power supply system could adversely impact redundant trains of equipment (Oconee design and operating configuration allows a single power source to both ES buses) and potentially damage redundant safety-related equipment during normal plant operation and complicate safe shutdown of the units following a plant trip or during a design basis event/accident condition. Currently, the licensee is operating the three Oconee units in an unanalyzed condition (i.e., no analysis exists). The present DVR design does not meet an NRC regulation (10 CFR Part 50.55a(h)(2))

as it pertains to single failure criteria). This is a safety concern.

Issue 3 The use of manual actions in lieu of automatic features, as required by NRC staff position established in Enclosure 1, SAFETY EVALUATION AND STATEMENT OF STAFF POSITIONS RELATIVE TO THE EMERGENCY POWER SYSTEMS FOR OPERATING REACTORS, in a June 3, 1977 compliance letter from NRC to Duke Power Company, Section B.1.d required, in part, that The voltage monitors shall automatically initiate the disconnection of offsite power sources whenever the voltage setpoint and time delay limits have been exceeded. Manual actions are being credited for required automatic protective actions for degraded voltage protection at Oconee three units. This is inconsistent with actions required to be met by all licensees as part of the NRC generic Multi-plant Action B-23 resolution. This is a safety concern because before any manual actions can be taken, degraded voltage would potentially damage redundant safety related equipment during normal plant operation and complicate safe shutdown of the units following a plant trip or during a design basis event/accident condition. The present DVR design does not meet NRC regulation (10 CFR Part 50.55a(h)(2)) as it pertains to single failure criteria. This is a safety concern.

Issue 4 The licensee failed to provide Technical Specification requirements, as required by Enclosure 1, SAFETY EVALUATION AND STATEMENT OF STAFF POSITIONS RELATIVE TO THE EMERGENCY POWER SYSTEMS FOR OPERATING REACTORS, in a June 3, 1977 compliance letter from NRC to Duke Power Company. Section B.1.f which required, in part, that The Technical Specifications shall include limiting conditions for operation, surveillance requirements, trip setpoints with minimum and maximum limits, and allowable values for the second-level voltage protection monitors. No second-level voltage protection monitors exist, and the existing protection monitors do not have the required technical specification requirements. This condition does not meet the NRC regulation 10 CFR 50.36 (c)(3) (i.e.

setpoints and time delays to be added in the TS) and the staff positions provided in NRC compliance letter dated June 3, 1977 and BTP PSB-1.

Issue 5 The conclusions reached in the NRC staff Safety Evaluation, written in a letter to Duke Power Company dated November 14, 1990, were not in accordance with the Oconee licensing basis and are inconsistent with NRC guidance.

Specifically, the staff reviewers speculation in the SE that the quality of the local grid servicing the Oconee site may have had similar weaknesses to what existed in the Northeast (prior to 1990) led to a conclusion that it was not prudent to impose the complete requirements of the Branch Technical Position and the licensees degraded grid protection was acceptable. The above staff approval is in error (staff cannot establish regulatory positions through an SE) and does not make any technical sense (contrary to the NRC actions) because the degraded voltage conditions become more problematic when the grid is weak. Therefore, the NRC required automatic Class 1E degraded voltage protection at the safety buses to prevent common cause failure of redundant safety-related equipment in accordance with compliance letter dated June 3, 1977 and BTP PSB-1. This is inconsistent with actions required to be met by all licensees as part of the NRC generic Multi-plant Action B-23 resolution. This is a safety concern.

Issue 6 It appears that the staff approving the license amendments granted an informal exemption from the design and licensing bases requirements for DVRs and loss of voltage requirements via the 10 CFR 50.90 license amendment process. Since the licensee did not request exemptions from applicable regulations in accordance with 10 CFR 50.12, the licensees current design bases configuration of the degraded voltage and loss of power protection schemes at Oconee are not in compliance with 10 CFR 50.36, 10 CFR 50.55a(h)(2), and NRC requirements imposed as part of the NRC generic Multi-plant Action B-23 resolution.

EXECUTIVE

SUMMARY

- DPO Panel Outcome The DPO Panel carefully considered each of the six statements of concern provided by the submitter. The Panel conducted a detailed evaluation of the undervoltage and degraded voltage protection schemes at Oconee on both the 230 kV and 4.16 kV busses. This included an in-depth review of plant drawings and procedures associated with those DVRs connected to the MFBs as well as other independent sources of emergency and offsite power. The Panel found that:

Oconee meets the requirements under which they were designed and licensed.

Specifically, Oconees electrical power systems were licensed to AEC Criterion 39 (equivalent to GDC 17) and the licensee committed to IEEE 279-1968 as part of their design basis. The DPO Panel was not able to find a non-compliance associated with AEC Criterion 39 or the IEEE Standard.

The current DVR design is consistent with the plants licensing basis as defined in TSs and meets the intent of the June 3, 1977 Multi-plant Action Letter and Branch Technical Position PSB-1 regarding station electric distribution system requirements and voltages. Specifically, Oconee has inverse time characteristic, safety-related undervoltage relays physically attached to the 4.16 kV MFBs under all modes of operation. The MFBs are electrically connected to the ES busses by normally-closed, safety-related breakers. These relays are part of the Emergency Power Switching Logic (EPSL) system and will automatically actuate to seek a source of power that supplies safety-related equipment that meets all design requirements in the event of a design basis accident coincident with a degraded voltage event. No manual actions are required. Furthermore, the DVR inverse-time setpoints are such that safety-related equipment will not be damaged during a design basis accident coincident with a degraded voltage event. Any manual actions by Oconee are conservative and prudent measures taken prior to reaching those limits.

Oconees electrical system is unique in its use of hydroelectric and gas turbine units to provide redundant, independent sources of emergency and offsite power. Coupled with the undervoltage protection schemes on the 230 kV and MFBs, the ES buses have adequate sources of emergency power under all modes of plant operation and analyzed conditions.

From a safety function perspective, the DPO Panel carefully reviewed and considered a number of scenarios and was unable to identify a design basis event where the ES busses would not be powered so as to mitigate the consequences of an accident.

Normally, nuclear plants are required to have DVR setpoints defined in the plants TSs in accordance with 10 CFR 50.36(c)(1)(ii)(A) since these setpoints represent a limiting safety system setting (LSSS) and are necessary to prevent core damage during a design basis event. However, 10 CFR 50.36(c)(2)(iii) provides an exemption and states that, A licensee is not required to propose to modify TSs that are included in any license issued before August 18, 1995 to satisfy the criteria in paragraph (c)(2)(ii) of this section. Title 10 of CFR Part 50.36(c)(2)(ii) provides the criterion for which LCOs are required.

Oconee TS 3.3.17, Emergency Power Switching Logic (EPSL) Automatic Transfer Function and TS 3.3.18, Emergency Power Switching Logic (EPSL) Voltage Sensing Circuits provide the LCOs required by 50.36(c)(2)(ii). However, since Oconees operating license and TSs were issued in the early 1970s (i.e., prior to August 18, 1995), the licensee is not required to propose to modify TSs to include the DVR setpoints and can invoke the exemption allowed under 10 CFR 50.36(c)(2)(iii). Therefore, the surveillance requirements of TS 3.3.17 and 3.3.18 are not required to include specific DVR setpoint values and the surveillance requirement to a Perform CHANNEL FUNCTIONAL TEST in accordance with the surveillance frequency control program is acceptable.

From a risk perspective the Panel assessed the impact of the submitters concerns by evaluating the CDF (above the nominal baseline risk) associated with three postulated scenarios. These three sensitivity studies were performed to understand, given the existing plant configuration, the impacts of progressively more severe degraded voltage failures (Appendix D). Mean delta-CDF values ranged from 5E-10/year to 9E-7/year. The relatively low risk results reflect: 1) the robustness of the overall system design at the Oconee site, and 2) the low likelihood of a sustained degraded grid voltage condition coincident with another event demanding the ECCS. Furthermore, given that there are inverse-time characteristic, safety-related undervoltage relays physically attached to the 4.16 kV MFBs, there was limited safety benefit of either relocating the DVR relays from the 230 KV Switchyard Degraded Grid Voltage Protection system to the 4.16 KV busses, or adding additional DVRs to the ES busses. The DPO team also reviewed the last three years of operating experience for degraded voltage conditions at Oconee and, based on control room alarms, noted nine momentary entries, all less than 1 minute. The Panel also compared the CDF results to a number of risk-informed Agency processes (Appendix E). None of these measures indicated the need for immediate action, a loss of adequate protection, or a basis to modify the existing Oconee DVR electrical configuration.

EVALUATION Issue 1 Summary of Issue The Response to TIA 2014-04 Does Not Reflect the Oconee Licensing Basis and Design Requirements for DVR Protection

DPO Panels Outcome The TIA response was correct in that Oconee meets the licensing and design basis requirements for DVR protection, albeit it for different reasons. Specifically, the DPO Panel performed additional research and was able to verify that Oconee has inverse-time characteristic, safety-related undervoltage relays physically attached to the MFBs that meet the requirements of AEC 39, 10 CFR 50.36, and Technical Specifications in that they will automatically actuate to seek a source of power that meets the design requirements for the SR-1E power system in the event of a design basis accident coincident with a degraded voltage event.

Detailed Problem Statement The issued TIA response dated January 22, 2019, (ML18226A215), did not reflect the NRC requirements, nor the Oconee licensing and design bases requirements for DVR protection of safety-related equipment (i.e., the Oconee licensing basis is incorrectly characterized and interpreted and is not in accordance with existing NRC guidance, staff positions, and staff precedence). For example, several staffs safety evaluations and Technical Specifications Bases statements and references are discussed and quoted in TIA-2014-04 response to conclude that the staff approved the Oconee DVR and LOV design. The TIA response is in error because the staffs statements in the SE and contents of TS Bases are not considered part of Oconees licensing basis and are inconsistent with the licensing basis definition and guidance. The issued TIA response also did not capture the Electrical Branchs technical positions, submitted in a previous revision to the TIA response (ML15231A376) for DVR protection of safety related equipment at Oconee.

Also, the submitter noted incorrect characterization of certain facts. For example, the response to Question 2 states that generic communications, such as Regulatory Issue Summaries (RIS),

do not constitute requirements. My review (i.e., the submitter) notes that the above statement is an incorrect characterization of what is a RIS. It should be noted that RIS 2011-12 was issued to clarify the NRC staffs technical positions on existing regulatory requirements which apply to DVR and LOV requirements.

Background Information The DPO Panel found that no legal definition for Licensing Basis exists for operating reactors.

That said, NRR LIC 100, Control of Licensing Basis for Operating Reactors, Revision 1, provides guidance that includes:

The licensing bases for a commercial nuclear power plant is comprised of selected information exchanged between a licensee and the NRC. The information is related to design features, equipment descriptions, operating practices, site characteristics, programs and procedures, and other factors that describe a plants design, construction, maintenance, and operation. The information is contained in a variety of document types. Each document has certain characteristics in terms of change control mechanisms, reporting of changes to the NRC, the mechanisms for dealing with discrepancies, and the possible involvement of the public.

Although the terms current licensing bases and licensing bases are widely used in matters related to power reactors operating in accordance with the regulations in 10 CFR Part 50, the terms are not defined in Part 50 or major regulatory guidance related to Part 50. The following definition is provided by 10 CFR 54.3 pertaining to license renewal for power reactor facilities.

Current licensing basis (CLB) is the set of NRC requirements applicable to a specific plant and a licensee's written commitments for ensuring compliance with and operation within applicable NRC requirements and the plant-specific design basis (including all modifications and additions to such commitments over the life of the license) that are docketed and in effect. The CLB includes the NRC regulations contained in 10 CFR Parts 2, 19, 20, 21, 26, 30, 40, 50, 51, 54, 55, 70, 72, 73, 100 and appendices thereto; orders; license conditions; exemptions; and technical specifications. It also includes the plant-specific design-basis information defined in 10 CFR 50.2 as documented in the most recent final safety analysis report (FSAR) as required by 10 CFR 50.71 and the licensee's commitments remaining in effect that were made in docketed licensing correspondence such as licensee responses to NRC bulletins, generic letters, and enforcement actions, as well as licensee commitments documented in NRC safety evaluations or licensee event reports.

In a similar manner, Inspection Manual Chapter (IMC) 0326, Operability Determinations describes a plants CLB as the same set of requirements discussed in 10 CFR 54.3 above. The submitter is correct in that safety evaluation statements and TS Bases would not normally be considered to be in a plants CLB. Given that there is not a precise definition for CLB in 10 CFR Part 50, the Panel sought to go back to source regulations to define those legally binding requirements for Oconee regarding DVR. In that context, the Panel found the relevant regulations to be 10 CFR 50.36; Technical Specifications; Oconees Technical Specifications, Sections 3.3.17 and 3.3.18; AEC 39; and Title 10 of CFR 50.55a(h)(2).

Discussion and Evaluation Regarding 10 CFR 50.36, the Panel found that the DVR relays are within the safety-related Class 1E boundary (see Oconee drawing O-702-A, Oconee Nuclear Station Units 1-3, One-Line Diagram, 6900 & 4160 Auxiliary System, Revision 38. Drawing O-702-A is a QA Condition 1 drawing and is safety-related (see grid G-3). This drawing shows the safety-related, CV-7, 4160 undervoltage relays physically connected to the MFBs. In turn, the MFBs are electrically connected to the ES busses through normally closed breakers. Each of the two MFBs can be connected to each of the three ES buses through redundant circuit breakers, ensuring the ES buses have a continuous source of reliable power. (See drawings O-0702 for unit 1; O-1702 for unit 2, and O-2702 for unit 3). These ABB CV-7 type, (identified by the licensee as 27N and 27E), undervoltage relays have an inverse-time characteristic, are part of the safety-related EPSL system and will automatically actuate to seek a reliable source of power in the event of a design basis accident or degraded voltage event. The inverse-time characteristic of these relays means that the lower the voltage level, the faster they will trip. No manual actions are required. Oconee procedure IP/1,2,3/A/0610/001A,B EPSL [Emergency Power Switching Logic] Startup Source Voltage Sensing Circuit, Revision 39 tests the 27N and 27E undervoltage relays on a 2-year frequency. Oconee procedure IP/1,2,3/A/0610/001A,B

hydroelectric and gas turbine units to provide redundant, independent sources of emergency and offsite power. Coupled with the undervoltage protection schemes on the 230 kV and MFBs, the ES buses have adequate sources of emergency power under all modes of plant operation and analyzed conditions, including a single active failure.

Title 10 of CFR 50.55a(h)(2) states, For nuclear power plants with construction permits issued before January 1, 1971, protection systems must be consistent with their licensing basis or may meet the requirements of IEEE Std. 603-1991 The Panel found that the DVR protection system at Oconee is in compliance with their licensing basis so 10 CFR 50.55a(h)(2) is satisfied. Notwithstanding, IEEE Std. 603-1991 imposes single failure requirements on safety systems. Since Oconees DVR relays are designated as safety-related, Class 1E and operate on a two-out-of-three coincidence logic, they also meet the single failure requirements of IEEE Std. 603-1991.

Finally, while not legally binding, other NRC letters and correspondence over the years interpreted the regulations associated with degraded voltage events. For instance, the Generic Letter (GL) to Oconee dated June 3, 1977 stated that, The voltage monitors shall automatically initiate the disconnection of offsite power sources whenever the voltage setpoint and time delay limits have been exceeded. The GL further states that the voltage monitors shall be designed to satisfy the requirements of IEEE Std. 279-1971. This automatic feature was meant to ensure the adequacy of the offsite power system and the onsite distribution system and ensures that the electrical system has sufficient capacity and capability to automatically start and operate under all required safety loads. Similarly, the NRC staff reiterated this position in GL 79-36, Adequacy of Station Electric Distribution System Voltages, dated August 8, 1979 following the event at Arkansas Nuclear One (ANO). The NRC staff position became known as Multi-plant Action (MPA) B-23 and was subsequently included in Branch Technical Position (BTP) Power Systems Branch (PSB)-1, Adequacy of Station Electric System Distribution Voltage, in Appendix 8-A to Chapter 8 of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants. The DPO Panel found that Oconee meets the interpretation of the regulations discussed in the June 3, 1977 Generic Letter to Oconee and the BTP PSB-1.

In summary, the Oconee DVR configuration is in compliance with 10 CFR 50.36, AEC Criterion 39, and Technical Specifications and is capable of responding to design basis events.

Dispositioning of Electrical Branchs Technical Positions during Formulation of TIA 2014-004 Response and Opportunities to Have Performed Additional Research The DPO Panel reviewed the history associated with revisions to TIA 2014-04 and noted that the DPO submitter provided comments to a draft version (Revision 8) of the TIA response on October 18, 2018. The comments included several alternate views and concluded with, the staff finds that the licensee would not meet NRC requirements for ONS Units 1, 2, and 3 if evaluated in accordance with todays guidance. Since the NRC found the undervoltage protection scheme acceptable previously, a change in staffs position with respect to the existing NRC requirements and licensing basis would constitute backfitting as defined in 10 CFR 50.109(a)(1).

More specifically, key points of the DPO submitters disagreement with Revision 8 to the draft TIA response included:

1. Oconees pre-GDC, IEEE-279-1971 via 50.55a(h), and 50.36(c)(2)(ii) require the licensee to have DV protection on safety-related buses to protect from single-failure.

o Staff disposition - The pre-GDC and IEEE standard were issued prior to the degraded voltage (DV) issue being known; therefore, original licensing basis would not have accounted for DV.

o Furthermore, 10 CFR 50.36(c)(2)(iii) states that plants with licenses issued prior to 1995 do not have to modify TSs to meet (c)(2)(ii).

2. Generic Letters (GLs), Multiple Plant Actions (MPAs), and Branch Technical Positions (BTPs) - not NRC Oconee-specific letters and safety evaluations - constitute applicable staff positions.

o Staff disposition - The DV GLs had licensees resolve the issue through amendments, which Oconee did. Amendments and staff positions in plant-specific correspondence constituted staff positions that interpreted how the licensee was meeting the GL, MPA, and BTP. SEs contain staff positions; the draft NUREG-1409 proposes this definition.

3. The 10 CFR 54.3(a) definition of current licensing bases is applicable: regulations; written commitments to bulletins, GLs, enforcement actions, SEs, and licensee event reports; license conditions, exemptions, TSs, 50.2 design basis information documented in the FSAR.

o Staff disposition - This definition was rejected in other TIAs because the license renewal definition of CLB is only applicable for license renewal process purposes.

4. Oconee is not meeting requirements because the NRC approved Oconees licensing basis in error regarding the use of manual actions, similar to the basis for the Hatch and Farley backfits.

o Staff disposition - TIA response does not address adequacy of the licensing basis; only whether the issues raised in the TIA are consistent with the licensing basis. The TIA response does not preclude the staff from pursuing a backfit if it determines the backfit criteria are met.

5. The TS Bases that were issued as part of the TSs during relevant licensing actions were not part of the licensing basis.

o Staff disposition - TS Bases were part of the operating licenses via the TSs prior to being removed in the 1998 ITS conversion.

A face-to-face meeting was held with the DPO submitter on October 30, 2018. The meeting included Division of Operating Reactor Licensing (DORL) Project Managers (PMs) and subject matter experts (SMEs), the EEOB acting Branch Chief, and the backfit SME. These individuals explained the intended dispositioning of the comments, however, the meeting ended with the DPO submitter in disagreement with the intended outcome. On November 7, 2018, the NRR Office Director was briefed on the intended TIA response and the draft response was submitted to OGC for NLO later the same day. After one round of comments, an OGC no-legal-objection (NLO) was received on January 7, 2019. The final TIA response was subsequently signed out on January 22, 2019.

Recommendation While a verbal meeting was held with the DPO submitter in October 2018 to disposition the NRR Electrical Branchs comments to the draft TIA response, a more formal disposition and addressing of the comments in written form in the final TIA response would have been beneficial from the standpoint of the Principles of Good Regulation, (i.e., Openness and Transparency) for internal staff and in this case, the DPO submitter.

Including a written disposition of the comments in the TIA response could have, in fact, eliminated the need for this DPO Panel resulting in an overall saving of agency resources.

The DPO Panel also appears to have gone deeper into the actual configuration and procedures associated with Oconees DVRs on the MFBs then the previous response to TIA 2014-04. This additional research allowed the Panel to verify that there are safety-related, 4.16 kV undervoltage relays physically connected to the MFBs which are electrically connected to the ES busses through normally closed breakers. These undervoltage relays have an inverse-time characteristic and will automatically actuate to seek a reliable source of power in the event of a design basis accident or degraded voltage event and are associated with the Emergency Power Switching Logic circuit described in Technical Specification 3.3.18. No manual actions are required.

Recommendation A review of the process, as applied to the response to TIA 2014-04, should be considered to ascertain whether there were any missed opportunities to have researched Oconees DVR configuration to the same depth as that performed by the DPO Panel. Specifically, the Panel reviewed and evaluated specific licensee procedures and drawings to verify that Oconees DVR configuration (i.e., the ABB CV-7, 27N and 27E, undervoltage relays on the 4.16 kV MFBs) meets regulatory requirements.

Having evaluated the electrical distribution system design configuration to the same depth during development of the TIA response may have eliminated the need for this DPO Panel resulting in an overall saving of agency resources.

Regulatory Information Summary (RIS) 2011-012 Regulatory Issue Summaries are used, in part, to communicate and clarify NRC technical or policy positions on regulatory matters that have not been communicated to or are not broadly understood by the nuclear industry. The DPO submitter is correct in stating that RIS 2011-12, Revision 1, Adequacy of Station Electric Distribution System Voltages, was issued to clarify voltage studies necessary for DVR settings and Transmission Network/Offsite/Station electric power system design in order to meet the regulatory requirements specified in General Design Criteria (GDC) 17 to 10 CFR Part 50, Appendix A. The RIS, however, went on to state that for nuclear power plants that were licensed before GDC 17 applied (i.e., Oconee), the updated final safety analysis report provides the applicable design criteria.

Recommendation In retrospect, more dialogue in RIS 2011-12, Adequacy of Station Electric Distribution System Voltages on pre-GDC plants, such as a discussion of the 10 CFR 50.36(c)(2)(iii) exemption and 50.55a(h)(2), would have led to an increased understanding of the licensing basis associated with plants that were issued construction and operating licenses before GDC 17 came into effect. Such additional research and documentation in 2011 could have addressed at least some of the DPO submitters concerns.

Supplementing RIS 2011-12 regarding pre-GDC plants should be considered as a knowledge transfer tool to future regulators.

Conclusion - Issue 1 Regarding the response to TIA 2014-04, the DPO Panel found that the response was correct in that Oconee does meet the licensing and design basis requirements for DVR protection, albeit for different reasons. Specifically, the DPO Panel performed additional research and was able to verify that Oconee has inverse-time characteristic, safety-related undervoltage relays physically attached to the 4.16 kV main feeder busses (which are electrically connected to the engineered safeguard feature (ES) busses). These safety-related, undervoltage relays meet the requirements of AEC Criterion 39; 10 CFR 50.36, Technical Specifications; and 10 CFR 50.55a(h)(2) in that they will automatically actuate to seek a reliable source of power in the event of a design basis accident with a coincident degraded voltage event. No manual actions are required. Furthermore, the DPO Panel found that the ES buses have adequate sources of emergency power under all modes of plant operation and analyzed conditions.

Regarding the TIA response not capturing the NRR Electrical Branchs technical positions, the DPO Panel found that the staff involved in the response did consider the comments and actively met with the DPO submitter during October 2018 to provide a verbal response to the submitters comments to the draft TIA. However, the DPO Panel found that a more formal disposition and addressing of the Electrical Branchs comments in written form in the final TIA response would have been beneficial from the standpoint of the Principles of Good Regulation (i.e., Openness and Transparency) for internal staff and in this case, the DPO submitter.

Regarding the statement in RIS 2011-12, the DPO submitter is correct in that the communication was issued to clarify voltage studies necessary for DVR settings and power system design to meet the regulatory requirements of GDC 17. Pre-GDC plants like Oconee, however, are an exception to the pre-GDC statements in RIS 2011-12. Consideration should be given to supplementing RIS 2011-12 for pre-GDC plants to include a discussion of the 10 CFR 50.36(c)(2)(iii) exemption and 50.55a(h)(2) as a knowledge transfer tool to future regulators.

Issue 2 Summary of Issue The Three Oconee Units Are Operating Without a Safety-Related Degraded Voltage Protection Relays at the 4.16 kV ES Buses.

DPO Panels Outcome While it is true that the Oconee degraded voltage relays are not physically located on the 4.16 kV ES busses, the system design (when viewed in its entirety) provides reasonable assurance that the safety-related loads connected to the ES busses will fulfill their design basis functions. Specifically, the safety-related relaying associated with the EPSL power seeking circuit (TS 3.3.17 & 18) is part of the MFBs (which supply the ES busses) and satisfies the requirement of safety-related DVRs on the ES busses. In addition, these circuits function automatically at all times to ensure adequate power is supplied to the ES busses in accordance with the requirements specified in the 1977 GL.

Detailed Problem Statement The three Oconee units have non-safety related DVRs installed at the 230 kV switchyard Yellow bus and this power source is in standby mode and isolated from the safety-related busses.

The three units are therefore operating without a safety-related degraded voltage protection relays at the 4.16 kV ES buses which have safety-related equipment operating (e.g. cooling water and HVAC systems) to support power generation. A degraded voltage condition in the power supply system could adversely impact redundant trains of equipment (Oconee design and operating configuration allows a single power source to both ES buses) and potentially damage redundant safety-related equipment during normal plant operation and complicate safe shutdown of the units following a plant trip or during a design basis event/accident condition.

Currently, the licensee is operating the three Oconee units in an unanalyzed condition (no analyses exist). The present DVR design does not meet NRC regulation (10 CFR Part 50.55a(h)(2)) as it pertains to single failure criteria. This is a safety concern.

Background Information The requirement for redundant, safety-related protective relaying on vital electrical distribution systems is not new. Two significant events led the NRC to determine that existing electrical distribution system designs may not provide adequate protection against degraded voltage impacts on engineered safety features (ES) equipment and require a second level of undervoltage protection be added to safety-related electrical buses. The first event occurred at Millstone Unit 2 in July 1976, and the second event occurred at ANO in September 1978.

After the Millstone event the NRC staff identified a significant technical issue related to potential common mode failure of redundant safety-related electrical equipment, which could result from a degraded grid voltage condition. The NRC staffs review identified several significant factors from the event which was caused by improper transformer tap settings resulting in degraded voltages throughout the onsite electrical distribution system when connected to degraded grid voltage. The staff identified that during the degraded voltage event, if the plant had tripped due

to a design basis accident a common mode failure of the 480V safety-related equipment could have resulted, along with ensuing potentially serious safety consequences; and, the potential common mode failure could occur, even without the existence of the design defect, as a result of grid voltage degradation. After early investigation of the incident, the licensee raised the undervoltage (UV) trip setpoint on their 4 kV bus protective relays. This was done to prevent the potential common mode failure. However, the change was made without adequate licensee consideration of the possible actuation of the UV sensors due to transients in voltage level that normally result from large alternating current motor starts. On July 21 the licensee started a 1500 horsepower motor which, because of the lowered UV relay setpoint resulted in a reactor trip, de-energized the emergency buses starting the emergency diesels and load shed the ES loads. When the first large motor load was sequenced onto the emergency generator, the resulting voltage transient again actuated the UV trip and the resulting load shedding signal disconnected this load from the bus. This occurred in sequence with each subsequent load.

Thus, on completion of the load sequencing, although the emergency buses were properly energized, none of the sequentially applied ES loads were being powered (NUREG-0138, Issue 10, ML13267A423).

Because of the potentially serious consequences of such a failure, all operating nuclear power plants were reviewed to establish the adequacy of the design and plant operating procedures.

Oconee was sent a letter on June 3, 1977 (ADAMS Accession No. ML14231B281), in which the NRC staff requested the licensee compare the design of their emergency power systems to the staff positions stated in the Enclosure 1 to the letter, and either (1) propose plant modifications to meet the staff positions, or (2) provide a detailed analysis that showed that the facility design had equivalent capabilities and protective features. Position 1 of the letter stated, in part, that the NRC required that a second level of undervoltage protection for the onsite power system be provided and that the time delay of this second level of undervoltage protection shall ensure that the allowable time duration for a degraded voltage condition at all distribution system levels shall not result in failure of safety systems or components. The staff also requested that certain technical specifications be incorporated into the operating licenses to require integrated testing to assure that power transients in the offsite or onsite power systems do not cause loss of function of ES systems. In response, Oconee provided an equivalency analysis in a letter dated July 21, 1977 (ADAMS Accession No. ML14231B282). The licensee concluded that the design of the Oconee emergency power system had equivalent capabilities and protective features to those described in the staff's position. In addition, the licensee submitted a letter dated October 7, 1977 (ADAMS Accession No. ML14231B295) requesting a license amendment to revise sections of the Auxiliary Electrical Systems and Emergency Power Periodic Testing Technical Specifications, as requested in the June 3rd NRC letter adding requirements for each unit to have three, start-up source voltage monitoring channels operable, and adding periodic testing requirements to include a monthly check of the startup source voltage monitoring channels and an annual check that the startup source voltage monitors be calibrated to ensure they initiated a trip of the startup source breakers upon both a complete loss of voltage and a degraded voltage condition. Note: There is no documented evidence that this license amendment request was approved by the NRC.

The NRC responded to both the July 21, 1977, letter and the October 7, 1977, letter in a December 20, 1978 letter (ADAMS Accession No. ML14231B293). The NRC staff noted that Oconee was originally licensed with undervoltage protection designed to protect the Class 1E equipment from a loss of voltage or a sustained degradation of grid voltage on the emergency buses, and further, that the licensee had performed an acceptable voltage drop analysis which

concluded that voltage levels were adequate for starting all the engineered safety feature loads when being started from either the start-up transformer or the Keowee Hydro units. The NRC staff concluded that based upon review of the existing system design that the design afforded adequate protection against degraded grid undervoltage conditions in accordance with the NRC letter of June 3, 1977 and was therefore acceptable.

The 1978 ANO event demonstrated that degraded voltage conditions could exist on the ES buses even with normal grid voltages, due to latent deficiencies in equipment between the grid and the safety-related buses or by the starting transients experienced during certain accident events not originally considered in the sizing of these circuits.

Generic Letter 79-36, Adequacy of Station Electric Distribution Systems Voltages, was issued to address the issues in the 1977 generic letters from the Millstone event and the issues associated with the ANO event.

Additional historical information related to Oconee licensing basis and NRC correspondence can be found in the response to Task Interface Agreement 2014-04, Adequacy of the Oconee Nuclear Station Design and Licensing Bases for Degraded Voltage Protection (ML18226A215).

Recent inspection findings have identified that licensees are inconsistently interpreting and applying the NRC requirements and guidance. The list below highlights several plants that have had enforcement actions taken to ensure compliance:

DC Cook - Compliance Backfit Fermi - Compliance Backfit Hatch - Compliance Backfit Farley - Compliance Backfit Peach Bottom Palo Verde Watts Bar Sequoyah Ginna Discussion and Evaluation:

A. Offsite Power The Oconee offsite electrical system configuration includes separate 230 kV and 525 kV bus switching systems interconnected by an autotransformer. Unit 1 and 2 are normally connected to the 230 kV system; Unit 3 is connected to the 525 kV system. Both switching systems have a separable two-bus structure, identified as Red and Yellow bus. Each switching system is configured in a breaker-and-a-half scheme. The 230 kV buses can also be fed from the Keowee hydro units, with the Yellow bus being connected via a Technical Specification-required overhead transmission line. See Appendix C for a copy of the electrical distribution system diagram.

Additional regulatory information about the Degraded Grid Protection System is also in NRC Safety Evaluation letter Safety Evaluation for Degraded Grid Protection (TACS 76743/76744/76745), dated November 14, 1990 (ML14231B303).

These 230 kV systems and Keowee emergency supply functions are tested by the licensees surveillance program under Technical Specification 3.8.1 including functional testing requirements. Oconees technical specifications define CHANNEL FUNCTIONAL TEST as:

A CHANNEL FUNCTIONAL TEST shall be the injection of a simulated or actual signal into the channel as close to the sensor as practicable to verify OPERABILITY, including required alarms, interlocks, display, and trip functions.

B. Onsite Power Each Oconee onsite electrical configuration includes a main generator whose output feeds a main transformer and a unit auxiliary transformer. The unit auxiliary transformer secondary windings feed 6.9 kV non-safety auxiliary buses (for RCPs) and 4.16 kV auxiliary Normal buses.

The Normal source is aligned, through a double breaker-double bus scheme, to the units two Main Feeder Buses (MFB). The two MFBs supply power to three redundant 4.16 kV ES (for ES loads) switchgear bus sections; TC, TD and TE. Unit 3 is similar. In addition to the normal power path from the units auxiliary transformer, the MFBs can also be fed from the unit's Startup Transformer or the two Standby Buses (Standby Bus 1, Standby Bus 2). The Standby Buses can, in turn, be each be supplied from either transformer: CT4 which is powered from the Keowee hydro units, or CT5 powered from the Lee Station gas turbine generator.

The onsite emergency power system uses the Emergency Power Switching Logic (EPSL) system, in part, for sensing and control of MFB voltages. The EPSL is designed to automatically select an emergency source from either the Startup Transformer or the Standby Bus in the event of loss or degradation of Normal power. In support of this function, the Keowee Emergency Start logic is designed to automatically start both Keowee units to supply emergency power if this source is required. The EPSL circuitry is designed to ensure that a reliable source of power is available to the 4.16 kV MFBs under all modes of operation. These circuits are designed to further ensure that during or after any postulated accident, a continuous supply of power is available to bring the reactor to a safe shutdown condition. The EPSL ensures power to the MFB by monitoring all available sources of power and closing or tripping the appropriate 4.16 kV circuit breakers. The EPSL contains undervoltage monitoring circuits that monitor each phase of the 4.16 kV outputs of the unit auxiliary (Normal source) and Startup transformers, and each phase of the two Standby Buses. A load shed circuit is provided which is designed to automatically shed (trip) non-essential loads before a transfer to a Standby Bus occurs. A transfer to Standby and retransfer to Startup circuit is designed to, in a power-seeking configuration, automatically select the most readily available source to supply the unit's MFB (and by extension, the ES buses). These arrangements are described in more detail in OSS-0254.00-00-2000, Design Basis Specification for the 4KV Essential Auxiliary Power System, and NRC safety evaluation report dated November 22, 1982 (ML15112B085).

Review of the Oconee design illustrates that the three ES buses do not have undervoltage monitoring equipment directly connected to the buses for the purpose of degraded voltage monitoring; instead the licensee uses an inverse-time characteristic, safety-related undervoltage

protective relaying, the Loss of Power (LOP) relays which provide input to the EPSL system and which monitors the voltage on the upstream MFBs. These relays are similar in function to typical loss of voltage relay designs in that they provide a loss of voltage monitoring function; they differ in that the setpoints for these relays are set to actuate at approximately 88% of nominal bus voltage whereas typical loss of voltage relays operate around 70%. The relays were originally Westinghouse CV-7 type relays and are designed to provide faster operation as input voltage decreases, i.e., the lower the voltage, the sooner the trip. This configuration, while providing one level of degraded bus voltage protection on the MFBs, does not specifically meet the requirement for having redundant levels of undervoltage protection monitoring of onsite safety buses. However, when taken holistically with the other safety-related degraded voltage monitoring systems, the ES buses are protected as required by current regulation.

Numerous technical specifications and surveillance tests address the operability of the onsite electrical distribution system operation. These requirements are discussed in the response to the Task Interface Agreement, and also include:

TS 3.3.17, Emergency Power Switching Logic (EPSL) Automatic Transfer Function SR 3.3.17.1 Perform CHANNEL FUNCTIONAL TEST. 18 months TS 3.3.18, Emergency Power Switching Logic (EPSL) Voltage Sensing Circuits SR 3.3.18.1 Perform CHANNEL FUNCTIONAL TEST. 18 months TS 3.3.19, Emergency Power Switching Logic (EPSL) 230 kV Switchyard Degraded Grid Voltage Protection (DGVP)

SR 3.3.19.1 Perform a CHANNEL FUNCTIONAL TEST every 18 months SR 3.3.19.2 Perform a CHANNEL CALIBRATION (18 months) of the voltage sensing channel with the setpoint allowable values:

• Degraded voltage 219 kV and a 222 kV with a time delay of 9 seconds +/-1 second.

TS 3.3.20, Emergency Power Switching Logic (EPSL) CT-5 Degraded Grid Voltage Protection SR 3.3.20.1 Perform a CHANNEL FUNCTIONAL TEST every 18 months SR 3.3.20.2 Perform a CHANNEL CALIBRATION (18 months) of the voltage sensing channel with the setpoint allowable value as follows:

• Degraded voltage 4143 V and 4185 V with a time delay of 9 seconds +/- 1 second for the first level undervoltage inputs; and

• Degraded voltage 3871 V and 3901 V for the second level undervoltage inputs.

3.3.21, Emergency Power Switching Logic (EPSL) Keowee Emergency Start Function SR 3.3.21.1 Perform CHANNEL FUNCTIONAL TEST every 18 months 3.3.22, Emergency Power Switching Logic (EPSL) Manual Keowee Emergency Start Function SR 3.3.22.1 Perform CHANNEL FUNCTIONAL TEST every 12 months As previously described for the offsite surveillance requirements, a CHANNEL FUNCTIONAL TEST shall be the injection of a simulated or actual signal into the channel as close to the sensor as practicable to verify OPERABILITY, including required alarms, interlocks, display, and trip functions.

Conclusion - Issue Two For this concern, the Panel understands this to be related to the absence of safety-related degraded voltage relay protection physically on the ES buses (TC, TD, TE), and the use of non-safety related DVRs on the 230 kV buses acting in substitution for one of the required levels of undervoltage protection described throughout the material. This was identified as a safety concern.

The Panel agrees that the Oconee units have degraded voltage relays installed on the 230 kV switchyard buses, and this power source is in standby and not directly powering the 4.16 kV ES safety-related buses during normal plant operation. However, the licensees design basis documents in detail that the 230 kV system equipment, including the undervoltage relays required to function during DBEs (in support of the 4 kV essential auxiliary power system) shall be considered QA-1. Oconee includes safety-related in this quality class. The 230 kV Yellow bus is designed to provide both offsite power and after realignment, emergency power from the Keowee hydro units via an overhead transmission line. Because the 230 kV Yellow bus is classified as an emergency power source the licensee has categorized the equipment necessary to function during design basis events as QA-1. This classification, based on design basis document information, encompasses safety-related equipment. This equipment classification includes the protective relaying associated with realigning the 230 kV system for emergency power to the onsite distribution system.

While the MFB/ES buses are aligned to the normal source (Unit Aux. Transformer), the undervoltage relays associated with the EPSL system are active. If an undervoltage condition was present on the MFBs due to degradation of the normal source, the EPSL circuitry would be expected to automatically seek a viable voltage source. There are several redundant power sources available for the MFB/ES buses under all operating modes.

The Panel agrees that Oconee Nuclear Station does not have redundant safety-related degraded voltage protective relays physically attached to the 4.16 kV ES buses (TC, TD, TE) and that one (string) division of safety-related equipment is powered from each of these buses, including 4.16 kV loads, 600V load centers and motor control centers (MCCs). The Panel recognizes that the typical combination of the loss of voltage relaying system and the degraded voltage relaying system provides adequate defense-in-depth protection for the safety-related distribution system for all conditions of voltage loss or sustained degradation, regardless of the power supply. While two levels of dedicated undervoltage protection on the safety buses is the norm, the Oconee system meets current regulatory requirements to ensure safety-related equipment has adequate power available under all postulated accident conditions.

The Panel also agrees that while the offsite transmission system is a possible cause of an undervoltage condition on the ES buses, and that numerous other conditions may cause an undervoltage condition on the ES buses even when there is nominal voltage present on the offsite transmission system; including equipment failures, concurrent large motor starting, switching of buses within a unit or between units, bus transfers, unanalyzed design conditions, and design errors. These events (and others not listed) highlight the need for a first and second level of undervoltage protection on the typical onsite electrical buses, and automatic action by these protective systems under certain degraded conditions ensure the safety functions would

be met providing reasonable assurance of success assuming latent failures. However, Oconee Nuclear Station does not have a typical onsite electrical distribution system.

During normal operation, station auxiliary loads are powered from secondary/tertiary windings on the Unit Auxiliary Transformer. The 4.16 kV windings are aligned to the MFBs through circuit breakers designated as N breakers. The MFBs can also be connected to the secondary windings of the Unit Startup Transformer (E breakers) which is fed from the 230 kV switching system, and to the Standby system (S breakers) powered from alternative independent power sources. MFB breakers can be tripped and realigned by undervoltage sensing circuitry (Emergency Power Switching Logic) which senses loss of or degraded voltage to the MFBs.

This protective circuitry performs similar functions for the MFB/ES bus combinations as would typical undervoltage relaying structured as Degraded and Loss of Voltage protective systems.

The MFBs, which are electrically connected to the ES buses, are electrically protected with an assortment of protective relaying, including undervoltage and differential relays. Electrical drawing O-0702-A-0, One-line Diagram 6900v & 4160v Station Auxiliary Sys, Revision 22, shows this protective scheme for the Unit 3 MFBs and drawing O-702-A, One-line Diagram 6900v & 4160v Auxiliary Sys, Revision 38, shows the protective scheme for Units 1 and 2.

Based on review of available technical materials, design basis documents, NRC and licensee correspondence and other documents/analysis described in this report, and the capabilities of the Emergency Power Switching Logic system, the need for additional undervoltage sensing or protective relaying is not necessary to provide reasonable assurance that undervoltage conditions on the onsite or offsite distribution system would prevent the ES bus-connected loads from fulfilling their design basis function. An additional set of undervoltage sensing circuits, tied directly onto the ES buses which would actuate the EPSL circuitry would be an option to attain strict compliance, however the existing design does not require the additional safety system relaying. Based on review of station technical specifications, surveillance requirements and bases, the systems, structures and components appear to be appropriately categorized and surveilled to provide reasonable assurance of operability.

Issue 3 Summary of Issue Manual Actions Are Credited for Required Automatic Protective Actions for Degraded Voltage Protection at the Three Oconee Units.

DPO Teams Outcome The DPO Panel determined that part of the EPSL systems (addressed in TS LCO 3.3.17 & 18) voltage sensing circuits are safety-related (SR)-1E, are part of the SR-1E main feeder busses (MFBs), and automatically align the SR-1E safety busses away from degraded supplies at all times as required by the 1977 Multi-plant Action Letter, which mitigates the possible failure of redundant safety-related equipment due to delayed manual actions at the 230 and 100 kV supplies (aligning instead the onsite emergency Keowee supplies to the MFBs).

The DPO Panel agrees with the DPO submitter that such automatic capability is required by regulations cited in the 1977 Multi-plant Action Letter.

Detailed Problem Statement The use of manual actions in lieu of automatic features, as required by NRC staff position established in Enclosure 1, SAFETY EVALUATION AND STATEMENT OF STAFF POSITIONS RELATIVE TO THE EMERGENCY POWER SYSTEMS FOR OPERATING REACTORS, in a June 3, 1977 compliance letter from NRC to Duke Power Company, Section B.1.d required, in part, that The voltage monitors shall automatically initiate the disconnection of offsite power sources whenever the voltage set point and time delay limits have been exceeded. Manual actions are credited for required automatic protective actions for degraded voltage protection at Oconee three units. This is inconsistent with actions required to be met by all licensees as part of the NRC generic Multi-plant Action B-23 resolution. This is a safety concern because before any manual actions can be taken, degraded voltage would potentially damage redundant safety related equipment during normal plant operation and complicate safe shutdown of the units following a plant trip or during a design basis event/accident condition.

The present DVR design does not meet NRC regulation (10 CFR Part 50.55a(h)(2)) as it pertains to single failure criteria). This is a safety concern.

Discussion and Evaluation The DPO Panel determined that safety-related relaying associated with the EPSL power seeking circuit is part of the MFBs (which supply the ES busses) and satisfies the requirement of safety-related DVRs on the ES busses. These circuits function automatically at all times to ensure adequate power is supplied to the ES busses in accordance with the requirements specified in the 1977 Multi-plant Action Letter. This is detailed in the evaluation of Issue 2. This automatic action by this circuit will power the safety busses from the Keowee circuit regardless of the state of the offsite circuits.

Conclusion - Issue Three

1. The DPO Panel agrees with DPO submitter in that automatic actions to remove degraded supplies from SR-1E busses are required by the 1977 Multi-plant Action Letter (which correctly cites GDC 17 and 10 CFR 50.55 as regulatory requirements for this capability) to prevent damage to redundant SR-1E equipment.

2. Oconees license basis for GDC 17 (Criterion 39 from their FSAR) also requires this automatic action.

3. Manual actions cited in the TIA response are with respect to the EPSL relaying monitoring the 230 kV and 100 kV (CT-5) only when no engineering safeguards actuation signal (ESAS) signal is present.

4. Disagreement with the DPO submitter (and the TIA response) in that the EPSL systems (addressed in TS LCO 3.3.17 & 18) voltage sensing circuits are SR-1E, are part of the SR-1E main feeder busses (MFBs), and automatically align the SR-1E safety busses away from degraded supplies at all times as required by the 1977 Multi-plant Action Letter which mitigates the possible failure of redundant safety related equipment due to delayed manual actions at the 230 and 100 kV levels supplies (aligning instead the onsite emergency Keowee supplies to the MFBs).

5. The TIA response missed the TS 3.3.17 and 3.3.18 circuits function in its evaluation of the issue in terms of satisfying the requirements cited in the 1977 Multi-plant Action Letter.

Issue 4 Summary of Issue Technical Specifications Do Not Have Requirements for Limiting Conditions for Operation, Surveillance Tests, Trip Setpoints, and Allowable Values for the Second-Level Voltage Protection Monitors.

DPO Teams Outcome The DPO Panel determined that part of the EPSL power seeking circuit does indeed automatically align the SR-1E safety busses away from degraded supplies at all times as required by the 1977 Multi-plant Action Letter and are addressed in TSs (TS LCO 3.3.17 & 18).

However, the trip setpoints are not controlled in these TSs as is allowed by the exemption in 10 CFR 50.36.

Detailed Problem Statement The licensee failed to provide Technical Specification requirements, as required by Enclosure 1, SAFETY EVALUATION AND STATEMENT OF STAFF POSITIONS RELATIVE TO THE EMERGENCY POWER SYSTEMS FOR OPERATING REACTORS, in a June 3, 1977 compliance letter from NRC to Duke Power Company, Section B.1.f which required, in part, that The Technical Specifications shall include limiting conditions for operation, surveillance requirements, trip set points with minimum and maximum limits, and allowable values for the second-level voltage protection monitors. No second-level voltage protection monitors exist, and the existing protection monitors do not have the required technical specification requirements. This condition does not meet the NRC regulation 10 CFR 50.36(c)(3) (i.e.

setpoints and time delays to be added in the TS) and the staff positions provided in the NRC compliance letter dated June 3, 1977 and BTP PSB-1.

Discussion and Evaluation The DPO Panel determined that safety-related relaying associated with the EPSL power seeking circuit is part of the MFBs (which supply the ES busses) and satisfies the requirement of safety-related DVRs on the ES busses. In addition, these circuits function automatically at all times to ensure adequate power is supplied to the ES busses in accordance with the requirements specified in the 1977 Multi-plant Action Letter. This is detailed in the evaluation of Issue 2.

This EPSL power seeking circuit is addressed in TS Sections 3.3.17, Emergency Power Switching Logic (EPSL) Automatic Transfer Function and 3.3.18, EPSL Voltage Sensing Circuits. The DPO submitter is correct in stating that the DVR setpoints are not listed in the Technical Specifications. Normally, nuclear plants are required to have DVR setpoints defined in the plants TSs in accordance with 10 CFR 50.36(c)(1)(ii)(A) since these setpoints represent a limiting safety system setting (LSSS) and are necessary to prevent core damage during a

design basis event. However, 10 CFR 50.36(c)(2)(iii) provides an exemption and states that, A licensee is not required to propose to modify TSs that are included in any licensee issued before August 18, 1995 to satisfy the criteria in paragraph (c)(2)(ii) of this section. Oconee satisfies the 10 CFR Part 50.36(c)(2)(ii) LCO requirement through TS 3.3.17 and TS 3.3.18.

Since Oconees operating license and TSs were issued in the early 1970s (i.e., prior to August 18, 1995), the licensee is not required to propose to modify TSs to include the DVR setpoints and can invoke the exemption allowed under 10 CFR 50.36(c)(2)(iii).

Conclusion - Issue Four

1. The DPO Panel disagrees with the DPO submitter in that the EPSL system, which performs the required actions per the 1977 Multi-plant Action Letter, are in Technical Specifications (TS LCO 3.3.17 & 18).

2. The DPO Panel agrees with the DPO submitter in that trip setpoints and allowable values for second level voltage protection (EPSL system) are also required to be included in Technical Specifications in accordance with 50.36(c)(3) and also (c)(1)(ii)(A) and are not currently included in TSs. However, 50.36(c)(2)(iii) allows the licensee to not modify their TSs to include these trip values since their license was issued prior to August 18, 1995.

Issue 5 Summary of Issue The conclusions reached in an NRC Staff Safety Evaluation were not in accordance with the Oconee Licensing Basis and are inconsistent with NRC guidance.

DPO Panels Outcome The DPO Panels review identified that the conclusions reached in the Safety Evaluation were appropriate for Oconees licensing basis, however the information used to establish the conclusion was not clearly defined or articulated. The Oconee Nuclear Stations electrical distribution system and associated licensing basis has undergone several changes over their operating history. As discussed in the Safety Evaluation, the Panels research did identify historical grid events in the northeastern portion of the Eastern Interconnection which resulted in significant power interruptions before and during the period under review and supported the earlier staffs conclusion in the Safety Evaluation. However, the Panel was unable to identify any similar significant historical grid weaknesses in the geographical areas surrounding Oconee; the Panel determined the earlier NRC staff positions appeared conservative based on the Panels understanding of the existing information at the time. The Panel concluded that the decision to not enforce all aspects of the 1977 generic letter/Branch Technical Position PSB-1 was appropriate, albeit not thoroughly explained.

Detailed Problem Statement The conclusions reached in the NRC staff Safety Evaluation, written in a letter to Duke Power Company dated November 14, 1990, were not in accordance with the Oconee licensing basis and are inconsistent with NRC guidance.

Specifically, the staff reviewers speculation in the SE that the quality of the local grid servicing the Oconee site may have had similar weaknesses to what existed in the Northeast (prior to 1990) led to a conclusion that it was not prudent to impose the complete requirements of the Branch Technical Position and the licensees degraded grid protection was acceptable. The above staff approval is in error (staff cannot establish regulatory positions through an SE) and does not make any technical sense (contrary to the NRC actions) because the degraded voltage conditions become more problematic when the grid is weak. Therefore, the NRC required automatic Class 1E degraded voltage protection at the safety buses to prevent common cause failure of redundant safety-related equipment in accordance with compliance letter dated June 3, 1977 and BTP PSB-1. This is inconsistent with actions required to be met by all licensees as part of the NRC generic Multi-plant Action B-23 resolution. This is safety concern.

Background Information On April 30, 1990, Duke Power Company submitted Licensee Event Report notification LER 269 90-04 (ML15224A148) to the NRC describing two conditions that were identified to be contrary to plant Technical Specifications related to potential impacts from degraded voltage in the 230 kV switchyard. Specifically, the LER identified that during certain 230 kV switchyard degraded voltage conditions, both the 230 kV switchyard and the Keowee overhead emergency power path could be unavailable to the Oconee Units. In the LER the licensee reported a design deficiency in the degraded grid protection circuitry. The licensee noted that when the grid voltage falls below 211 kV, emergency power is supplied to each unit via the underground path from the Keowee hydroelectric station but the redundant Keowee overhead path for emergency power is not available until the grid voltage falls below 160 kV. If the grid voltage should remain below 211 kV but above 160 kV, only the single underground path would be available, leaving all three Oconee units vulnerable to a single failure. During degraded grid conditions this could cause the inability of safety systems to mitigate the consequences of a design basis accident/transient unless the operator took action to manually align switchyard breakers for the overhead path. The licensee identified that this design deficiency had existed since initial licensing. In a subsequent letter dated May 8, 1990, (ML14231B300), the licensee provided a conceptual description of the permanent hardware modification intended to eliminate the design deficiencies. New undervoltage relays with setpoints of 222.5 kV were installed on the primary side of each unit's Startup Transformer (previously described in Issue 2).

Two-out-of-three logic was used to generate an undervoltage signal. After a fixed 9 second time delay this signal then generates alarms in the control rooms and, if an ES signal from any unit's Engineered Safeguards Protective System exists, will then realign and isolate portions of the 230kV switchyard.

Note: This additional protective relaying system works in conjunction with the Emergency Power Switching Logic on the 4.16 kV MFBs to ensure adequate voltage is available to the ES buses and provides an additional level of protection to the External Grid Trouble Protective System described in Issue 2.

After additional dialogue and analysis between Duke and the NRC, the NRC issued a Safety Evaluation Report, Safety Evaluation for Degraded Grid Protection (TACS 6743/76744/76745),

(ML14231B303), dated November 14, 1990, for the licensees proposed modifications to correct the deficiencies. The Safety Evaluation states, in part, that the guidance for the staff's review of the proposed modification is contained in Branch Technical Position (BTP) PSB-1, Adequacy of

Station Electrical Distribution System Voltages. The positions outlined in the BTP PSB-1 were derived from the staff positions outlined in (the 1977 generic letter) Enclosure 1, Safety Evaluation and Statement of Staff Positions Relative to the Emergency Power Systems for Operating Reactors. The BTP positions presented in the (1990) Safety Evaluation for Degraded Grid Protection differ slightly from those originally described in the original enclosure to the 1977 generic letter. The contents of the 1990 Safety Evaluation did not repeat the requirement for a second level of under-or-over voltage protection with a time delay but did state that setpoints and time delays shall be determined from an analysis of Class 1E equipment voltage requirements. For the licensees compliance with this requirement the safety evaluation repeated the time delay and voltage setpoints for the 230 kV power system. The 1990 Safety Evaluation also repeated a requirement for the voltage sensors of the undervoltage circuitry shall be Class 1E and shall be located at and electrically connected to Class 1E switchgear. The compliance statement from the staff describes that the licensee stated, all relays, timers, and auxiliary relays used in the new undervoltage scheme would be Class 1E, however the statement does not discuss the specific requirement related to the location of the voltage sensors.

The 1990 Safety Evaluation concluded that the licensee's proposed modification did not fully meet BTP PSB-1 in several areas. The Safety Evaluation also stated that requirements similar to those contained in the BTP were generically applied to every plant (circa 1978), and in the northeastern part of the country, low grid quality necessitated the staff to back away somewhat from the BTP requirements, particularly for the requirement to automatically separate the onsite Class 1E electrical distribution system from the degraded grid. The conclusions stated that for the northeast plants, the staff permitted the use of alarms, procedures, and manual operator actions, in lieu of automatic action, to ensure that the safety-related components of the Class 1E systems would not be adversely affected during low voltage conditions. The Safety Evaluation also stated that this compromise to the requirements of the BTP was granted due to the known weakness of the New England grid whereby the forced shutdown of one nuclear plant could lead to shutdown of other plants in a cascading manner. The Safety Evaluation further concluded that the proposed modification will add another layer of undervoltage protection to the existing, degraded grid protection circuitry and due to the complexity of the plant's existing undervoltage protection scheme on the onsite electrical distribution system coupled with the speculation that the quality of the grid servicing the Oconee site may have similar weaknesses to what exists in the Northeast, the staff concluded that it was not prudent to impose the complete requirements of the BTP. The staff found that the licensee's proposed degraded grid protection modification was acceptable.

Discussion and Evaluation The Panel understands Issue 5 to be two-fold:

1. The NRC Safety Evaluation which inferred that the quality of the local grid servicing the Oconee site may have had similar weaknesses to what existed in the Northeast (prior to 1990) and which led to a staff conclusion that it was not prudent to impose the complete requirements of the Branch Technical Position was in error, was not technically sound, did not meet the requirements of the Oconee licensing basis, and did not comply with the Multi-plant Action B-23 resolution required to be met by all licensees; and

2. A Safety Evaluation was an inappropriate vehicle to establish a regulatory position.

In response to the first part of this issue, the DPO Panel reviewed documents related to historical impacts to onsite and offsite power systems including weather related phenomenon in the same geographical area (Northeastern area and Oconee area) and during the time period in question. The Panel reviewed NUREGs, Operating Experience, Inspection Reports, Licensee Event Reports, Department of Energy information, Federal Energy Regulatory Commission data, and North American Reliability Corporation data in an attempt to identify trends or weaknesses in the localized bulk power system in support of the speculative statement in the 1990 Safety Evaluation related to historical grid instabilities and weaknesses.

The Federal Energy Regulatory Commission, or FERC, is an independent federal agency that regulates the interstate transmission of electricity and protects the reliability of the high voltage interstate transmission system, discussed here as the grid, through mandatory reliability standards. FERC houses a library with documents related to history of grid behaviors. The Panel reviewed a July 1978 report developed by Systems Control Inc. for the Division of Electric Energy Systems in the Department of Energy (SCI Project 5236-100, Impact Assessment of the 1977 New York City Blackout) which describes the July 13, 1977 New York City blackout.

The report quotes a Consolidated Edison (owner/operator of the most affected equipment) study which found, in part, that a combination of natural phenomena including system response to lightning strikes, improperly operating protective devices, inadequate presentation of data to the system dispatcher, and communication difficulties all combined to create conditions which cascaded to the point of total collapse of the Consolidated Edison system. The blackout lasted approximately 26 hours3.009259e-4 days <br />0.00722 hours <br />4.298942e-5 weeks <br />9.893e-6 months <br /> and was mostly restricted to New York City and surrounding areas.

Another earlier blackout event occurred on November 9, 1965, in the northeastern region due to protective relaying that had been incorrectly programmed resulting in cascading failures of overloaded transmission lines and subsequent isolation of large parts of the northeastern region for approximately 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. This blackout affected a much larger geographical area, including parts of Ontario, Canada and Connecticut, Massachusetts, New Hampshire, New Jersey, New York, Rhode Island, Pennsylvania, and Vermont. A primary cause of both of these blackouts was human error and equipment failures, which could also affect grid systems in other geographical areas. The Panel found no other references to similar significant events in the northeast grid or Oconee area grid during the period in question, and postulated these events bounded the weaknesses upon which the staff based their earlier conclusion.

The Panel also reviewed NUREG-1032, Evaluation of Station Blackout Accidents at Nuclear Power Plants published in June 1988, which evaluated LOOP data from U.S. nuclear reactors between 1968-1985 - a period of approximately 17 years. Table 3.1 of the NUREG, Total losses of offsite power at U.S. nuclear power plant sites, 1968 through 1985 showed that of the 64 nationwide events resulting in total loss of offsite power to a plant, six were attributed to weather events, and 12 were attributed to grid stability issues. The NUREG states that plant location played an important role in loss-of-offsite-power events and explained that factors shown to be significant were (1) the reliability of the grid from which the nuclear power plant draws its preferred power supply and (2) the likelihood of severe weather that can cause damage to the grid distribution system and hence a loss of power to the plant. This information in this NUREG was available to the staff at the time of their decision and the Panel believes may have been considered in their decision-making process.

On August 14, 2003, a widespread loss of the Nation's electrical power grid resulted in LOOPs at nine U.S. commercial NPPs. As a result, the NRC initiated a comprehensive program to

as guidance for the staff's review of the proposed modifications, and which the Branch Technical Position was based. The conclusions reached by the staff in the 1990 Safety Evaluation that it was not prudent to impose the complete requirements of the BTP due, in part, to the speculation that the quality of the grid servicing the Oconee site may have similar weaknesses to that which existed in the Northeast required the Panel to search for and review historical documents related to grid performance (not regulated or controlled by the NRC), and NRC-funded research into similar technical areas during the time period of concern.

The statement of conclusion in the Safety Evaluation relating to known weakness of the New England grid whereby the forced shutdown of one nuclear plant could lead to shutdown of other plants in a cascading manner appears to be related to either inadequate reactive power support requirements or otherwise degraded local grid transmission capabilities. While the evaluation quotes known weakness in the New England grid, the Panels research was able to identify only generic weaknesses related to equipment and human errors in the northeastern area.

Because this conclusion was drawn in the late 1970s and no involved NRC staff members were currently available for a discussion on these points, the Panel was unable to verify the specific weaknesses in the staffs conclusion. The Panels review of the existing historical material does suggest support for the staffs claim that the Northeastern grid did have existing weaknesses at the time, however the Safety Evaluation did not clarify, nor support this position in making conclusions. The Panels research did identify two large-scale blackouts in the northern region and Canada, attributed to various issues including human and equipment errors that led to localized grid collapse, which appeared to support parts of the earlier staffs conclusions.

Another statement of conclusion related to the speculation that the quality of the grid servicing the Oconee site may have similar weaknesses to what exists in the Northeast could not be verified by the Panels research. The staffs historical position could be interpreted as a conservative regulatory decision in the face of speculative weaknesses in the Oconee area grid.

As stated, the research did identify historical weaknesses in the northeastern regional grid that resulted in widespread failures due to human and equipment error, but the staffs assertion of presumption that the grid in the Oconee area may have had similar weaknesses did not appear to be supported by the limited research done by the Panel.

The Panel must conclude that the earlier NRC staffs conclusion to not impose all requirements of the 1977 generic letter or BTP PSB-1 onto the Oconee electrical system was made with the best knowledge available at the time. The Panels research agreed with the staffs conclusions in part because the Oconee Nuclear Stations electrical system is unique in its uses of hydroelectric units and gas turbine units to provide redundant, independent sources of emergency power. Coupled with the undervoltage protection schemes on the 230 kV and Main Feeder Buses, the ES buses have adequate sources of emergency power under all modes of plant operation and analyzed conditions without imposition of all the requirements of the 1977 generic letter or the BTP. The Panel concludes that the staffs decision to not mandate all the guidance specified in the BTP, relative to the robustness of the Oconee local grid was appropriate, albeit confusing and not well explained.

Issue 6 Summary of Issue The Staff Granted an Informal Exemption from the Design and Licensing Bases Requirements for DVRs and Loss of Voltage Requirements.

DPO Teams Outcome Oconee does not require an exemption in accordance with 10 CFR 50.12. Specifically, the Panel was not able to identify a non-compliance with NRC regulations or Technical Specification requirements.

Detailed Problem Statement It appears that the staff at the time of approving the license amendments granted an informal exemption from the design and licensing bases requirements for DVRs and loss of voltage requirements through the 10 CFR 50.90 license amendment process. Since the licensee did not request exemptions from applicable regulations in accordance with 10 CFR 50.12, the licensees current design bases configuration of the degraded voltage and loss of power protection schemes at ONS are not in compliance with 10 CFR 50.36, 10 CFR 50.55a(h)(2),

and NRC requirements imposed as part of NRC generic Multi-plant Action B-23 resolution.

Discussion and Evaluation The legally binding requirements for Oconee associated with DVRs are AEC Criterion 39, 10 CFR 50.36, 10 CFR 50.55a(h)(2), and Technical Specifications.

Atomic Energy Commission (AEC) design Criterion 39 for Oconee states, Alternate power systems shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning required of the engineered safety features. As a minimum, the on-site power system and the off-site power system shall each, independently, provide this capacity assuming a failure of a single active component in each power system.

As discussed previously, the DVR relays are designated as safety-related, Class 1E and operate on a two-out-of-three coincidence logic. Thus, Oconees DVR design and configuration meets the requirements of AEC Criterion 39. Furthermore, the Panel found that Oconees electrical system is unique in its use of hydroelectric and gas turbine units to provide redundant, independent sources of emergency and offsite power. Coupled with the undervoltage protection schemes on the 230 kV and MFBs, the ES buses have adequate sources of emergency power under all modes of plant operation and analyzed conditions, including a single active failure.

Regarding 10 CFR 50.36 and Technical Specification requirements, the Panel found that 10 CFR 50.36(c)(2)(iii) provides an exemption for Oconee and states that, A licensee is not required to propose to modify TSs that are included in any license issued before August 18, 1995 to satisfy the criteria in paragraph (c)(2)(ii) of this section. Oconee satisfies the 10 CFR Part 50.36(c)(2)(ii) LCO requirement through TS 3.3.17 and TS 3.3.18. Since Oconees operating license and original TSs were issued in the early 1970s (i.e., prior to August 18, 1995), the licensee is not required to propose to modify TSs to include the DVR setpoints and

can invoke the exemption allowed under 10 CFR 50.36(c)(2)(iii). Therefore, the surveillance requirements of TS 3.3.17 and 3.3.18 are not required to include specific DVR setpoint values and the surveillance requirement to Perform CHANNEL FUNCTIONAL TEST in accordance with the surveillance frequency control program is acceptable.

Title 10 of CFR 50.55a(h)(2) states, For nuclear power plants with construction permits issued before January 1, 1971, protection systems must be consistent with their licensing basis or may meet the requirements of IEEE Std. 603-1991 The Panel found that the DVR protection system at Oconee is in compliance with their licensing basis so 10 CFR 50.55a(h)(2) is satisfied. Notwithstanding, IEEE Std. 603-1991 imposes single failure requirements on safety systems. Since Oconees DVR relays are designated as safety-related, Class 1E and operate on a two-out-of-three coincidence logic, they also meet the single failure requirements of IEEE Std. 603-1991.

Finally, while not legally binding in themselves, other NRC letters and correspondence over the years interpreted the regulations associated with degraded voltage events. For instance, the Generic Letter to Oconee dated June 3, 1977 stated that, The voltage monitors shall automatically initiate the disconnection of offsite power sources whenever the voltage setpoint and time delay limits have been exceeded. The GL further states that the voltage monitors shall be designed to satisfy the requirements of IEEE Std. 279-1971. Similarly, the NRC staff reiterated this position in GL 79-36, Adequacy of Station Electric Distribution System Voltages, dated August 8, 1979 following the events at Millstone and ANO. The NRC staff position became known as Multi-plant Action (MPA) B-23 and was subsequently included in Branch Technical Position (BTP) Power Systems Branch (PSB)-1, Adequacy of Station Electric System Distribution Voltage, in Appendix 8-A to Chapter 8 of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants. While not legally required, the DPO Panel found that Oconees DVR configuration meets the interpretation of the regulations discussed in the June 3, 1977 Generic Letter to Oconee and the BTP PSB-1.

Conclusion - Issue Six The Oconee DVR configuration is in compliance with AEC Criterion 39, 10 CFR 50.36, 50.55a(h)(2), and Technical Specifications and is capable of responding to design basis events.

The Panel found that Oconee does not require an exemption in accordance with 10 CFR 50.12 since the licensee is in compliance with NRC regulations and Technical Specification requirements.

RECOMMENDATIONS

1. While a verbal meeting was held with the DPO submitter in October 2018 to disposition the NRR Electrical Branchs comments to the draft TIA response, a more formal disposition and addressing of the comments in written form in the final TIA response would have been beneficial from the standpoint of the Principles of Good Regulation (i.e., Openness and Transparency) for internal staff and in this case, the DPO submitter. Including a written disposition of the comments in the TIA response could have, in fact, eliminated the need for this DPO Panel resulting in an overall saving of agency resources.

2. A review of the process, as applied to the response to TIA 2014-04, should be considered to ascertain whether there were any missed opportunities to have researched Oconees DVR configuration to the same depth as that performed by the DPO Panel. Specifically, the Panel reviewed and evaluated specific licensee procedures and drawings to verify that Oconees DVR configuration (i.e., the ABB CV-7, 27N and 27E, undervoltage relays on the 4.16 kV MFBs) meets regulatory requirements. Having evaluated the electrical distribution system design configuration to the same depth during development of the TIA response may have eliminated the need for this DPO Panel resulting in an overall saving of agency resources.

3. More dialogue in RIS 2011-12, Adequacy of Station Electric Distribution System Voltages on pre-GDC plants, such as a discussion of the 10 CFR 50.36(c)(2)(iii) exemption and 50.55(a)(2), could lead to an increased understanding of the licensing basis associated with plants that were issued construction and operating licenses before GDC 17 came into effect.

Such additional research and documentation in 2011 may have addressed at least some of the DPO submitters concerns. Supplementing RIS 2011-012 regarding pre-GDC plants should be considered as a knowledge transfer tool to future regulators.

A-1 Appendix A Documents Reviewed DPO 2019-001 Licensee Documents Number Title Revision/Date O LD-2004-03 230 kV Switchyard External Grid Trouble 2 Protection System and Switchyard Isolated Logic Diagram Channel #1 O LD-2004-04 230 kV Switchyard External Grid Trouble 2 Protection System and Switchyard Isolated Logic Diagram Channel #2 O-0702-A-002 One line Diagram 6900V & 4160V Station 22 Auxiliary Sys O-702-A One line Diagram 6900V & 4160V Auxiliary 38 Sys O-777 Connection Diagram Main Feeder Bus 11 Monitor Relay Panel #1MFBMRP O-2702 One Line Diagram 6900V & 4160V Sta 25 Auxiliary Sys O-2702-A One Line Diagram 6900V & 4160V Sta 16 Auxiliary Sys OEE-76 External Grid Trouble Protective System 11 One Line OEE-117-1R Elementary Diagram Main Feeder Bus 3 Monitor Undervoltage Relays O-0804-E Three Line Diagram 230 kV Switchyard 10 PCBs # 31 & 33 OEE-48F Elementary Diagram 230KV Switchyard 4 Control PCB No. 18 Control and Degraded Grid 79121709424 NRC Letter, with Enclosures, from A. June 3, 1977 Schwencer, Chief, Operating Reactors Branch #1, Division of Operating Reactors to Duke Power Company RE: OCONEE NUCLEAR STATION, UNITS 1, 2 AND 3 7912120806 Letter, with Enclosure, from Duke Power July 21, 1977 (Legacy ADAMS) Company to Mr. Edson G. Case, Acting Director, Office of Nuclear Reactor Regulation -

Response to NRC Staff Position on Degraded System Conditions

A-2 7911190591 Letter, with Enclosure, from Duke Power October 7, 1977 (Legacy ADAMS) Company to Mr. Edson G. Case, Acting Director, Office of Nuclear Reactor Regulation -

Submittal of Technical Specifications 7901080347 Letter from NRC, Robert W. Reid, Chief December 20, 1978 (Legacy ADAMS) Operating Reactors Branch #4 Division of Operating Reactors to Duke Power Company - Acceptance of Design 9005110280 Letter from Duke Power Company to NRC - May 8, 1990 (Legacy ADAMS) Oconee Nuclear Station Docket Nos. 50-269, -270, -287 Switchyard Degraded Voltage 9011190197 Letter from NRC, Leonard A. Wiens, Project November 14, 1990 (Legacy ADAMS) Manager, Project Directorate II-3, Division of Reactor Projects 0 I/II, NRR; Safety Evaluation for Degraded Grid Protection Letter from NRC, John. F. Stolz, Chief Operating Reactors Branch #4 Division of Licensing to Duke Power Company - Safety Evaluation based on EG&G Technical Evaluation Report, EGG-EA-6131 Licensee Event Report Unanticipated System Interaction During March 1, 1990 269/90-004 Undervoltage Condition in the 230KV Switchyard Results in Failure to Comply with Technical Specifications Licensee Event Report Unanticipated System Interaction During March 1, 1990 269/90-005 Undervoltage Condition in the 230KV Switchyard Results in Failure to Comply with Technical Specifications Licensee Event Report Potential Single Failure During a January 8, 1991 269/91-01 LOCA/LOOP Event May Result in The Loss of Emergency Power Due to Design Deficiency Licensee Event Report Loss of Off-site Power and Unit Trip Due to October 19, 1992 270/92-04 Management Deficiency, Less Than Adequate Corrective Action Program OSS-0254.00-00-2004 Design Basis Specification for the 230 kV 23 Switchyard System OSS-0254.00-00-2000 Design Basis Specification for the 4KVA 24 Essential Auxiliary Power System OSS-0254.00-00-2004 Design Basis Specification for the 230 kV 23 Switchyard System ML17034A161 Oconee Nuclear Station - NRC Integrated February 3, 2017 Inspection Report 05000269/2016004, 0500270/2016004, and 05000287/2016004 ONS-2015-065 Duke Energy Carolinas, LLC; Oconee May 22, 2015

A-3 (ML15154A490) Nuclear Station; Docket Nos. 50-269, 50-270 and 50-287; TIA 2014-004, Request for Technical Assistance regarding the Adequacy of the Oconee Station Design and Licensing Bases for the Degraded Voltage relay Protection Design OSC-4300 (ELEC) Protective Relay Settings 37 PT/2/A/0610/001 A EPSL Normal Source Voltage Sensing 36, Completed Circuit 10/28/17 PT/2/A/0610/001 B EPSL Startup Source Voltage Sensing 39, Completed Circuit 11/11/15 IP/2/A/4980/027 A CV-2/CV-7 and CV-2/CV-7 Class 1E Relay 30, Completed Test 10/21/15 IP/2/A/4980/027 A CV-2/CV-7 and CV-2/CV-7 Class 1E Relay 30, Completed Test 10/23/15 Work Order Package U2, PM The Normal Bus Source Sensing October 21, 2015 02186620 01 Relays Work Order Package U2, PM The Startup Bus Source Sensing October 23, 2015 02186619 01 Relays Work Order Package U2, PM The Normal Bus Source Sensing November 4, 2017 02137184 01 Relays Work Order Package U2, PM The Startup Bus Source Sensing November 23, 2017 02137531 01 Relays NRC Documents Number Title Revision/Date Generic Letter 88-15 Electric Power Systems - Inadequate September 12, 1988 (8809120085) Control Over Design Processes ML18226A215 Oconee Nuclear Station, Units 1, 2, AND January 22, 2019 3 - Response to Task Interface Agreement 2014-04, Adequacy of The Oconee Nuclear Station Design and Licensing Bases for Degraded Voltage Protection (TAC NOS. MF4622, MF4623, AND MF4624; EPID L-2014-LRA-003)

NUREG-0138 Staff Discussion of 15 Technical Issues November 1976 (ML13267A423) Listed in Attachment to November 3, 1976 Memorandum from Director, NRR to NRR Staff.

NUREG-0800, Standard Review Plan, Branch Technical 2, July 1981 Appendix 8-A Positions (PSB)

NUREG-1032 Evaluation of Station Blackout Accidents June 1988 at Nuclear Power Plants NUREG-1409 Backfitting Guidelines July 1990

A-4 NUREG-1784 Operating Experience Assessment - December 2003 (ML033530400) Effects of Grid Events on Nuclear Power Plant Performance NUREG/BR-0058 Regulatory Analysis Guidelines of the US 5 (ML17100A480) Nuclear Regulatory Commission NUREG/CR-6890, Reevaluation of Station Blackout Risk at December 2005 Volume 1 Nuclear Power Plants NUREG/CR-6890, Reevaluation of Station Blackout Risk at August 2018 INL/EXT-18-45359 Nuclear Power Plants - 2017 Update Summary NUREG/CR-5496 Evaluation of Loss of Offsite Power June 1998 (ML081330022) Events at Nuclear Power Plants: 1980-1996 ML15112B085 Safety Evaluation by The Office of November 22, 1982 Nuclear Reactor Regulation Supporting Amendment No. 117 To Facility Operating License No. DPR-38 Amendment NO. 117 To Facility Operating License No. DPR-47 Amendment No. 114 To Facility Operating License No. DPR-55 Duke Power Company Oconee Nuclear Station, Units Nos. 1, 2 AND 3 Dockets Nos. 50-269, 50-270 and 50-287 RIS 2011-012 Adequacy of Station Electric Distribution 1, December 29, 2011 (ML11357A142) System Voltages ML012060036 (CL) Safety Evaluation by The Office of December 16, 1998 ML15261A512 (SE) Nuclear Reactor Regulation to ML15261A511 (TSs) Amendment No. 300 To Facility ML15253A343 (Se2) Operating License No. DPR-38 Amendment NO. 300 To Facility Operating License No. DPR-47 And Amendment No. 300 To Facility Operating License No. DPR-55 Duke Power Company Oconee Nuclear Station, Units Nos. 1, 2 AND 3 Dockets Nos. 50-269, 50-270 and 50-287 ML120650755 Backfit Appeal Panel Response March 9, 2012 Associated with Component Design bases Inspection at Edwin I. Hatch Nuclear Plant ML112730194 Edwin I. Hatch Nuclear Plant - NRC September 29, 2011 Response to Backfit Appeal NRR Office Instruction, Control of Licensing Basis for Operating January 7, 2004 LIC-100 Reactors NRR Office Instruction, Integrated Risk-Informed Decision- June 2, 2014 LIC-504 Making Process for Emergent Issues

A-5 Management Directive Management of Backfitting, Forward September 20, 2019 8.4 Fitting, Issue Finality, and Information Requests Management Directive NRC Differing Professional Opinion August 11, 2015 10.159 Program (ML18073A298)

Regulatory Guide 1.174 An Approach for Using Probabilistic Risk 3, January 2018 (ML17317A256) Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis SECY-98-144 White paper on Risk-Informed and June 22, 1998 Performance Based Regulation SECY-18-0049 Management Directive and Handbook May 29, 2019 8.4, Management of backfitting, Issue Finality, and Information Collection COMSECY-16-0020 Recommendation on Revision of December 20, 2016 Guidance Concerning Consideration of Cost and Applicability of Compliance exception to Backfit Rule COMSAJ-97-008 Discussion on Safety and Compliance August 25, 1997 Other Documents Number Title Revision/Date IEEE Std. 279-1968 IEEE Standard Criteria for the Nuclear August 30, 1968 Power Plant Protection Systems IEEE Std. 279-1971 IEEE Standard: Criteria for Protection November 3, 1970 Systems for Nuclear Generating Stations IEEE Std. 741 IEEE Standard Criteria for the Protection Various of Class 1E Power Systems and Equipment in Nuclear Power Generating Stations IEEE Std 603-1991 IEEE Standard for Safety Systems for June 27, 1991 Nuclear Generating Stations Final Report Impact Assessment of the 1977 New York July 1978 SCI Project 5236-100 City Blackout

B-1 Appendix B NRC Staff Interviewed DPO-2019-001 To conduct the review, the Panel developed a potential list of staff to interview, and solicited input from the DPO submitter on staff that should be interviewed. Through the course of the interviews, additional staff were identified that should be interviewed given their potential role and knowledge of the subject DPO. The Panel interviewed the following staff:

1. Adam Ruh, Senior Resident Inspector (Acting), Oconee Nuclear Station

2. Jason Parent, Resident Inspector, Oconee Nuclear Station

3. Tim Reed, Senior Project Manager, NRR/DORL/LPL4

4. Kayla Gamin, Attorney, Operating Reactors, OGC/GCHA/AGCOR

5. Pete Snyder, Safety and Plant Systems Engineer, NRR/DSS/STSB

6. Audrey Klett, Project Manager (Op Reactor Licensing), NRR/DORL/LPL2-1

7. Roy Mathew, Senior Electrical Engineer, NRR/DE/EEOB

8. Ian Gifford, Program Manager, OE/CRB

9. Gladys Figueroa Toledo, OE/CRB

10. Robert Buell, Idaho National Labs, SAPHIRE Users Group

D-1 Appendix D Risk Insights Non-Specific Risk Analysis Region III Office Plant Name/ Summary

Title:

Risk Analysis of Concerns Raised Unit Number: Oconee, Through Differing Professional Opinion (DPO) 2019-Units 1, 2 and 3 001 Analysis Number: OCO-1901 Insp. Report Number: issue first documented in 05000269/270/287/2014-007 EA Number (if applicable): Result: Quantitative results: mean values range Unknown at this time; may not from CDF = 5E-10 to 9E-7; Qualitative results:

be applicable. would be less than the number above due to additional mitigation credit EXECUTIVE

SUMMARY

A risk analysis1 was performed at the request of the Differing Professional Opinion panel in order to inform a regulatory decision on Oconee Units 1, 2 and 3. The DPO Submitter (hereafter referred to as the claimant) had concerns in three specific areas, namely, 1)

Degraded Voltage Relays (DVRs) are not installed on the safety-related (SR) buses, 2) the licensee uses manual actions to mitigate degraded voltage conditions in conjunction with monitoring Loss of Power (LOP) relays on the SR buses, and 3) relay setpoints and time delays are not in the associated Technical Specifications.

Three different risk assessment approaches were performed (which do not directly correlate or map onto the three concerns identified above):

A) A conditional analysis was performed focusing on the impact of the issue of concern using various assumed higher safety-related electrical bus failure rates coincident with any initiating event including a Loss of Offsite Power (LOOP). This is being called a sunny day event since a degraded grid condition was not the cause of the risk-impact.

B) Another approach was a rainy-day failure where a degraded grid condition (estimated based on data provided by the residents) causes the event and a subsequent demand for emergency core cooling equipment. This was a manual-calculation using an exposure time factor - which was converted to an initiating event frequency - and a 1 With no established methodology for this type of risk assessment, it was performed outside of normal processes (e.g., Significance Determination Process, Notice of Enforcement Discretion, MD 8.3, or LIC-504). The analyst broadly followed direction provided by the DPO Panel (e.g., level of effort to expend, item of merit to use, failure memory vs. forward looking, etc.) and technical guidance/best practices found in the RASP manual, informed by Senior Reactor Analyst judgement.

NRC Inspection Report 05000269 / 270 / 287 /2014-007 Conditional Core Damage Probability (CCDP) assuming that all running equipment would be failed, or highly degraded, due to the degraded voltage conditions.

C) A rainy-day failure where a degraded grid condition (estimated based on data provided by the residents) and a concurrent event causes a subsequent demand for emergency core cooling equipment. As in case B, this was a manual-calculation using an exposure time factor - which was converted to an initiating event frequency - and a CCDP however it was different in that it assumed no remaining mitigation aside from the Safe Shutdown Facility (SSF). This constitutes a bounding calculation in that assumes no mitigation credit from High Pressure Injection system, and other sources and was attempted in order to show a maximum impact.

Additionally, in this analysis aleatory uncertainty, external events, remaining mitigation credit and epistemic uncertainties were all considered. Additionally, a formal and independent review was performed.

The quantitative mean values range from a delta-CDF of 5E-10/year to 9E-7/year. The aleatory uncertainty ranged even more widely with the 5% confidence value for Case B of 1.0E-10/year, to a 95% value of 1.4E-6/year for Case C (the assumed worst case). The main driver that the risk is significantly less than Oconees baseline operational risk is that the frequencies for a degraded-grid voltage condition are so low, whether for the United States in general, or the South East Reliability Council specifically. However, even if the frequencies of such events were several orders of magnitude higher, the defense in depth electrically (e.g., ability to cross feed between units, the number of electrical feeds from offsite) and mechanically (Safe Shutdown Facility - designed to cope with a Station Blackout (SBO), Low Pressure Service Water, etc.) would ensure the risk impact of this postulated latent condition would be very low.

This analysis was performed with the goal of adhering to the Principles of Good Regulation, particularly Openness and Reliability, using the best available information from realistic operational data as well as state-of-the-art risk analysis techniques.

This assessment takes no position on the validity of the claimants assertions that Oconees DVR and LOV protection schemes do not meet various codes, standards and Branch Technical Positions. The analysis assessed the potential change in risk to the public assuming various credible scenarios in an attempt to map the concern onto the plant regardless whether the claimants issues were valid. However, it is important to note that while compliance is an important facet to the agencys assessment and oversight of nuclear facilities, risk, regulatory impact, safety margins, defense-in-depth, public perception et. al. also factor into our regulatory decisions. There may be a risk reduction if the three units at Oconee had protection applied at the 4160V safety related buses, but it is also possible that there could be a risk increase and/or degraded reliability. See the discussion on Epistemic Uncertainty below.

EVENT OR CONDITION

SUMMARY

Background Information The emergency power system for Oconee Nuclear Station is the Keowee Hydro Station. The Engineered Safeguards Protective Systems uses two trains of emergency start signals, each of which starts both Keowee generators for emergency power and isolates the 230kV switchyard from the offsite power. The Keowee Hydro Station contains two units rated 87,500kVA each, 2

NRC Inspection Report 05000269 / 270 / 287 /2014-007 which generate at 13.8kVAC. Upon loss of power from the Oconee generating unit and 230kV switchyard, power is supplied from both Keowee units through two separate and independent routes. One route is an approximately 4000ft underground 13.8kV cable feeder to Transformer CT4, which supplies the redundant 4160V standby power buses. The second route is a 230kV transmission line to the 230kV switchyard yellow bus at Oconee which supplies each unit's startup transformer. The startup transformers then supply the 4160V startup bus (which allows cross connection between the three units) and ultimately Main Feeder Buses #1 and #2 in each of the three units. The Main Feeder Buses directly supply the safety-related TC, TD and TE buses. The under-voltage protection for the electrical system at Oconee is applied at the 230kV level, not at the TC, TD, and TE safety-related 4160V buses. Please see Attachment #1 for details.

In 2014, Region II staff completed a Component Design Basis Inspection (CDBI) at the Oconee site. During the inspection the inspectors identified concern(s) regarding the licensees DVR, specifically 1) the relays are not installed on the safety-related buses, 2) the licensee uses manual actions to mitigate degraded voltage conditions in conjunction with monitoring LOP relays on the SR buses, and 3) relay setpoints and time delays are not in the associated Technical Specifications. Region II initiated Task Interface Agreement (TIA) 2014-04 to clarify whether these issues were within the current design/licensing basis of Oconee. [It is worth noting that another issue was identified by the CDBI team and which was addressed by a similar TIA involved the cable vault and the lack of separation and segregation of the cables to/from Keowee hydro-electric facility. This issue was addressed through the Significance Determination Process in NRC Inspection Report 05000269/270/287/2018-090 as a Green violation.]

In August 2019, the DPO panel agreed that a risk analysis should be performed in order to determine the regulatory importance of this issue, should the panel agree that a compliance issue exists. This analysis was undertaken with a goal of risk-informing the various regulatory options being considered, namely backfit.

Condition Being Assessed In this analysis, the condition being assessed (the lack of degraded voltage protection applied at the 4160V level) has a large amount of epistemic uncertainty. In other words, for a variety of events and conditions the DVR protection applied at the 230kV level (and other protective relaying) may or may not adequately protect the safety-related buses, absent any operator actions. The DPO Panel was unable through engagement with the claimant to determine exactly what events and/or conditions would lead to the safety-related buses being challenged, but which would not be protected via other medium-voltage devices (at the 4160V level), or via the switchyard protection at the yellow bus level. Consequently the condition is being approximated via a number of different surrogates (e.g., increased likelihood of electrical bus failure, degraded grid voltage conditions, etc.). See the uncertainty section below for a more detailed write-up of the epistemic uncertainties.

ANALYSIS RESULTS Change in Core Damage Frequency and Comparison with Other Risk Processes. The increase in core damage frequency (CDF) for this event is 1.0x10-10 to 9.9x10-7. Under the Significance Determination Process this would be considered of very low risk significance.

3

NRC Inspection Report 05000269 / 270 / 287 /2014-007

b. Mechanical cross tie capability - Each Oconee unit has a Turbine Driven Auxiliary Feedwater Pump. Piping that runs the width of the three combined Turbine Buildings cross connects the discharge of all three pumps and the isolation valves are manually operated, consequently any single turbine driven pump can supply feedwater to 1 or even all 3 units and has the capacity to do so.

5. Recovery Actions: One of the technical concerns that the claimant had was that Duke had been substituting operator actions for automatic protection. No credit was applied in this analysis for operators divorcing from the grid, or taking other proceduralized actions, even though this had some probability of success. This was not accounted for in the analysis and represents additional margin.

6. Additional Margins in the Analysis :

a. Approach A - since the increased bus failure was applied globally to all three buses, there was conservatism imbedded in the results. Normally, even when a common cause vector is affecting multiple SSCs simultaneously, usually a subset of the population will fail. Assuming all three buses are impacted produces a higher risk result, but it is somewhat moderated by the use of an increased likelihood being used as opposed to a hard failure e.g., True or 1.0 in the SPAR model. Additionally the analyst conservatively applied the condition to all sequences, when in reality only LOOP (and TRANS sequences that have a consequential loss of offsite power) would be relevant.

b. Approach B - The analyst assumed that all running components would fail and set the basic events equal to True. This was overly conservative in two respects: 1) it is unlikely that all running components would fail during a degraded voltage grid condition, and 2) setting the basic event equal to True caused the Common Cause Failure probabilities to increase significantly. In reality, non-running components would be protected from damage during the electrical transient.

c. Approach C - In an attempt to produce a more bounding result than was generated in Approach B the analyst assumed all in-plant mitigation equipment would fail. Only the SSF, which is designed for extended SBO for all three of the Oconee units was assumed to be functional. (No credit for Phase 2 Mitigating Strategies equipment - commonly known as FLEX equipment - was taken because if Phase 1 failed, the time to core damage would be much less than the time to implement Phase 2 strategies for a B&W plant.)

7. Ex-Core Fuel Damage: As a standard assumption the analysis did not account for ex-core sources, such as spent fuel in the pool, or other sources. Only damage to in-core fuel was considered.

Calculations: The analyst acquired data from the Oconee Resident Inspectors regarding the history of entry into degraded voltage grid conditions. See Attachment #6 for the relevant data.

This calculation was used for Approach B and Approach C. Plant computer parameters for 3 years (2017-2019) for the switchyard yellow bus were reviewed and the entries into a degraded voltage condition were counted. Though the duration of these conditions was 7

D-9 those external events to cause a degraded grid condition. Those events could cause a hard failure, i.e., a LOOP but those would not reveal conditions that the claimant is concerned about.

Seismic - The seismic-induced LOOP frequency at Oconee is 8.57E-5/year which is almost 2 orders of magnitude greater than the IE frequency used for the internal events portion of this analysis. See Attachment #5 for details. However assuming that the seismic event would cause the LOOP (and not a degraded grid condition, which was not deemed credible by the analyst) Oconee would then be divorced from the grid and the Keowee units would supply power to all three units.

LARGE EARLY RELEASE FREQUENCY (LERF)

The LERF factors for the Loss of Offsite Power and for Loss of 4KV Bus 3TC (LBUS3TC) are 0.0. In other words, the accident sequences of concern have little or no capability to cause a prompt radiological release nor one that would pose immediate health effects to members of the public. The item of merit should remain core damage frequency.

ATTACHMENTS

1. Diagram of the Oconee Electrical System (see Appendix C)

2. Events and Condition Assessment Run 9.23.2019 - All 3 Buses at Two Orders of Magnitude, for Case A

3. Events and Condition Assessment Run 9.27.2019 - All Running Equipment Set to True, for Case B

4. SSF Cutsets dated 9.30.2019, for Case C

5. Frequencies of Seismically-Induced LOOP Events for SPAR Models, Revision 2, January 2007

6. Historical Data on Oconee Yellow Bus Voltage Conditions - 2017-2019

7. Draft Version of MD8.4, Handbook on Management of Backfitting, Forward Fitting, Issue Finality and Information Requests Analyst: John David Hanna Date: October 3, 2019 Reviewed By: Laura Kozak Date: October 8, 2019

[1] With no established methodology for this type of risk assessment, it was performed outside of normal processes (e.g., Significance Determination Process, Notice of Enforcement Discretion, MD 8.3, or LIC-504). The analyst broadly followed direction provided by the DPO Panel (e.g., level of effort to expend, item of merit to use, failure memory vs. forward looking, etc.) and technical guidance/best practices found in the RASP manual, informed by Senior Reactor Analyst judgement.

[2] Baseline operational risk for Oconee is 1.5E-5/year according to the NRCs SPAR Model.

[3] Although the Oconee SPAR model is a combined model, it is showing Unit 3 impacts. When a specific basic event does not have a unit denoted, it is a Unit 3 impact. Also, this model revision was modified by INL to correct some modeling issues. If desired, a copy of the model is on NLs provisional/test model web page.

9

D-10 Attachment 1 Diagram of the Oconee Electrical System See Appendix C

D-11 Attachment 2 Events and Condition Assessment Run 9.23.2019 - All 3 Buses at Two Orders of Magnitude, for Case A See Next Page

Events and Conditions Assessment PWR D SPAR MODEL FOR OCONEE 1, 2, & 3 Sep 27, 2019 2:39 PM Condition Assessment Summary Event Date 09/27/2019 2:00:00 PM to 09/27/2020 2:00:00 PM Duration 1 year CCDP 1.55E-5 CDP 1.54E-5 Delta CDP 1.21E-7 Solve Settings Cut Set Truncation Normal 1.00E-11 Size Truncation None Solve Method Multlple Pass Untitled Summary of Conditional Event Changes Event Description Cend Type Cond Value Nominal Nominal Typ e Value 3 3 3 3 3 3 CCDP Uncertainty Distribution Median Point Estimate II/lean Seed Sample ,vtethod Size 2.69E-6 9.71E-6 1.55E-5 5.02E*5 12345 4075 Monle Garlo Model Version: 8.60 Page 1 Software Saphire 8.1.8 Model Date: 05/03/2019

Events and Conditions Assessment PWR D SPAR MODEL FOR OCONEE 1, 2, & 3 Sep 27, 2019 2:39 PM CDP Uncertainty Distribution 1E-6 1E-5 1E-4 1E-3 Importance Distribution Median Point Estimate Mean Seed Sample Method Size

-4.95E-8 7.30E8 1.21E-7 4.20E*7 12345 4075 Monte Carlo Model Version: Page 3 Software Saphire 8 60 Model Date:

Events and Conditions Assessment PWR D SPAR MODEL FOR Sep 27 2019 2 39 PM 3 ' C 2.89E-8 2.23 4 C 2.89E-8 2.23 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 1.37E-6 100 Displaying 125 Cut Sets. (125 Original) 1 C 2.15E-7 15.71 2 C 2.03E-7 14.81 3 C 2.03E-7 14.81 4 C 1.33E-7 9.70 5 C 1.33E-7 9.70 6 C 6.97E-8 5.09 7 C 6.97E-8 5.09 8 C 6.86E-8 5.01 9 C 6.64E-8 4.85 10 C 5.15E-8 3.76 11 C 3.08E-8 2.25 12 C 3.08E-8 2.25 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 2.57E-8 100 Displaying 31 Cut Sets. (31 Original) 1 C 6.39E-9 24.89 2 C 3.75E-9 14.61 3 C 3.23E-9 12.60 4 C 2.80E-9 10.92 5 C 2.80E-9 10.92 6 C 9.99E-10 3.89 7 C 9.99E-10 3.89 8 C 8.15E-10 3.18 9 C 7.87E-10 3.07 10 C 6.39E-10 2.49 11 C 4.74E-10 1.85 12 C 4.71E-10 1.84 13 C 2.91E-10 1.13 14 C 2.91E-10 1.13 15 C 2.80E-10 1.09 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 6.55E-8 100 Displaying 185 Cut Sets. (185 Original) 1 C 1.42E-8 21.70 2 C 3.44E-9 5.25 3 C 2.81E-9 4.28 4 C 2.75E-9 4.20 5 C 2.60E-9 3.96 6 C 2.60E-9 3.96 7 C 2.13E-9 3.25 8 C 1.80E-9 2.75 Model Version: Page 6 Software Saphire 8 60 Model Date:

Events and Conditions Assessment PWR D SPAR MODEL FOR Sep 27* 2019 2: 39 PM 9 C 1.58E-9 2.41 10 C 1.38E-9 2.10 11 C 1.29E-9 1.97 12 C 1.27E-9 1.93 13 C 1.19E-9 1.82 14 C 1.19E-9 1.82 15 C 1.13E-9 1.72 16 C 1.12E-9 1.71 17 C 1.10E-9 1.68 18 C 1.04E-9 1.59 19 C 1.04E-9 1.59 20 C 7.87E-10 1.20 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 5.98E-7 100 Displaying 141 Cut Sets. (141 Original) 1 C 2.66E-7 44.41 2 C 2.66E-7 44.41 3 C 1.33E-8 2.22 4 C 1.33E-8 2.22 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 9.68E-7 100 Displaying 82 Cut Sets. (82 Original) 1 C 9.00E-7 93.02 2 C 3.00E-8 3.10 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 2.94E-8 100 Displaying 14 Cut Sets. (14 Original) 1 C 1.14E-8 38.64 2 C 6.66E-9 22.67 3 C 2.63E-9 8.94 4 C 1.86E-9 6.32 5 C 1.54E-9 5.25 6 C 1.38E-9 4.69 7 C 1.32E-9 4.51 8 C 1.09E-9 3.71 9 C 8.09E-10 2.75 10 C 3.07E-10 1.04 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 1.97E-8 100 Displaying 62 Cut Sets. (62 Original) 1 C 3.51E-9 17.85 Model Version: Page 7 Software Saphire 8 60 Model Date:

Events and Conditions Assessment PWR D SPAR MODEL FOR Sep 27 2019 2 39 PM I

2 C 3.51E-9 17.85 3 C 1.79E-9 9.10 4 C 1.79E-9 9.10 5 C 1.45E-9 7.36 6 C 8.08E-10 4.11 7 C 8.08E-10 4.11 8 C 7.26E-10 3.69 9 C 7.26E-10 3.69 10 C 4.02E-10 2.04 11 C 4.02E-10 2.04 12 C 3.21E-10 1.63 13 C 2.17E-10 1.10 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 1.14E-8 100 Displaying 30 Cut Sets. (30 Original) 1 C 2.51E-9 22.06 2 C 1.71E-9 15.00 3 C 1.66E-9 14.56 4 C 1.00E-9 8.81 5 C 8.65E-10 7.59 6 C 7.49E-10 6.58 7 C 7.49E-10 6.58 8 C 2.67E-10 2.35 9 C 2.67E-10 2.35 10 C 2.49E-10 2.18 11 C 2.18E-10 1.91 12 C 2.10E-10 1.85 13 C 1.71E-10 1.50 14 C 1.27E-10 1.11 15 C 1.26E-10 1.11 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 1.68E-8 100 Displaying 52 Cut Sets. (52 Original) 1 C 2.97E-9 17.69 2 C 1.49E-9 8.87 3 C 1.49E-9 8.87 4 C 1.37E-9 8.14 5 C 1.19E-9 7.07 6 C 6.85E-10 4.08 7 C 6.85E-10 4.08 8 C 6.80E-10 4.05 9 C 5.96E-10 3.55 Model Version: Page 8 Software Saphire 8 60 Model Date:

Events and Conditions Assessment PWR D SPAR MODEL FOR Sep 27, 2019 2:39 PM 10 C 5.96E-10 3.55 11 C 3.41E-10 2.03 12 C 3.41E-10 2.03 13 C 2.97E-10 1.77 14 C 2.97E-10 1.77 15 C 2.42E-10 1.44 16 C 2.42E-10 1.44 17 C 2.42E-10 1.44 18 C 2.42E-10 1.44 19 C 2.33E-10 1.39 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 8.61E-9 100 Displaying 47 Cut Sets. (47 Original) 1 C 9.05E-10 10.50 2 C 9.05E-10 10.50 3 C 6.15E-10 7.14 4 C 6.15E-10 7.14 5 C 5.97E-10 6.93 6 C 5.97E-10 6.93 7 C 3.73E-10 4.33 8 C 3.61E-10 4.19 9 C 3.61E-10 4.19 10 C 3.11E-10 3.61 11 C 3.11E-10 3.61 12 C 2.70E-10 3.13 13 C 2.70E-10 3.13 14 C 2.70E-10 3.13 15 C 2.70E-10 3.13 16 C 9.61E-11 1.12 17 C 9.61E-11 1.12 18 C 9.61E-11 1.12 19 C 9.61E-11 1.12 20 C 8.95E-11 1.04 21 C 8.95E-11 1.04 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 2.33E-8 100 Displaying 74 Cut Sets. (74 Original) 1 C 5.92E-9 25.37 2 C 3.47E-9 14.89 3 C 8.50E-10 3.65 4 C 7.46E-10 3.20 Model Version: Page 9 Software Saphire 8 60 Model Date:

Events and Conditions Assessment PWR D SPAR MODEL FOR Sep 27 2019 2 39 PM 5

' C 7.46E-10 3.20 6 C 6.91E-10 2.96 7 C 6.91E-10 2.96 8 C 6.90E-10 2.96 9 C 5.99E-10 2.57 10 C 5.99E-10 2.57 11 C 5.99E-10 2.57 12 C 4.99E-10 2.14 13 C 4.38E-10 1.88 14 C 4.38E-10 1.88 15 C 4.05E-10 1.74 16 C 4.05E-10 1.74 17 C 3.72E-10 1.59 18 C 3.72E-10 1.59 19 C 3.51E-10 1.51 20 C 3.51E-10 1.51 21 C 3.51E-10 1.51 Referenced Events Event Description Probability 2.29E-3 2.29E-3 2.29E-3 2.49E-3 2.49E-3 4.13E-5 7.55E-4 7.55E-4 1.97E-5 4.60E-3 4.60E-3 8.16E-4 3.69E-3 3.69E-3 3.69E-3 3.65E-2 4.26E-3 4.26E-3 5.24E-3 8.00E-4 1.00E-3 6.00E-2 1.94E-7 1.94E-7 1.57E-4 6.66E-1 2.16E-6 Model Version: Page 10 Software Saphire 8 60 Model Date:

Events and Conditions Assessment PWR D SPAR MODEL FOR Sep 27, 2019 2:39 PM Event Description Probability 3.87E-4 7.84E-4 4.60E-3 8.16E-4 8.16E-4 8.16E-4 8.16E-4 4.26E-6 6.26E-6 1.00E-1 2.00E-3 6.00E-3 4.00E-3 5.09E-2 4.00E-2 2.00E-3 4.00E-2 1.00E-3 3.50E-3 3.50E-3 3.49E-2 1.20E-2 3.10E-5 1.00E+O 3.61E-2 5.73E-3 1.50E-4 1.66E-3 4.01E-4 1.50E-3 6.76E-1 1.66E-2 7.84E-4 4.60E-3 4.60E-3 8.16E-4 8.161::-4 8.16E-4 2.00E-2 5.00E-2 1.00E-2 1.00E-3 1.00E-3 1.00E-3 8.16E-4 2.00E-1 5.30E-3 1.70E-3 3.24E-3 3.55E-2 1.46E-3 Model Version: Page 11 Software Saphire 8 60 Model Date:

Events and Conditions Assessment PWR D SPAR MODEL FOR Sep 27, 2019 2 39 PM Event Description Probability 6.25E-2 7.32E-4 1.00E-1 7.32E-4 1.00E-1 1.40E-2 1.00E-3 2.00E-3 2.00E-3 1.60E-6 1.40E-5 1.20E-6 4.40E-1 1.00E-2 RIR > 2.00E+OO Event Tree Importance Grou Event Occur. Prob. FV RIR RRR Bb RII RRI Uncert.

FV > 5.00E-03 Event Tree Importance Group Event Occur. Prob. FV RIR RRR Bb RII RRI Uncert.

296 4.00E-3 6.07E-1 1.52E+2 2.54E+O 2.35E-3 2.34E-3 9.41E-6 1.33E-5 335 1.50E-3 4.53E-1 3.03E+2 1.83E+O 4.69E-3 4.68E-3 7.03E-6 4.45E-6 210 1.66E-3 1.44E-1 8.78E+1 1.17E+O 1.35E-3 1.35E-3 2.24E-6 1.42E-6 421 4.00E-2 1.24E-1 3.98E+O 1 . 14E+O 4 . 82E-5 4 . 63E-5 1.93E-6 O. OOE+O 169 4.01E-4 1.21E-1 3.03E+2 1.14E+O 4.69E-3 4.69E-3 1.88E-6 2.97E-6 39 4.00E-2 8.71E-2 3.07E+O 1.10E+ O 3.35E-5 3.22E-5 1.35E-6 3.74E-6 377 3.61E-2 8.62E-2 3.30E+O 1.09E+O 3.70E-5 3.57E-5 1.34E-6 O. OOE+O 106 1.50E-4 6.26E-2 4.18E+2 1.07E+O 6.47E-3 6.47E-3 9.71E-7 1.77E-6 206 1.00E-1 6.18E-2 1.56E+O 1 07E+ O 9.59E-6 8.63E-6 9.59E-7 1.24E-6 206 1.00E-1 6.18E-2 1.56E+O 1 07E+ O 9.59E-6 8.63E-6 9.59E-7 1.24E-6 4 6.00E-3 5.BOE- 2 1.06E+1 1.06E+O 1 . 50E-4 1.49E-4 9.00E-7 O. OOE+O 223 1.00E-2 5.29E-2 6.17E+O 1.06E+O 8.11E-5 8.03E-5 8.17E-7 1.15E-6 27 1.00E-2 4.61E-2 5.55E+O 1.05E+O 7.13E-5 7.06E-5 7.15E-7 1.27E-6 294 1.66E-2 4.23E-2 3.51E+O 1.04E+ O 3.96E-5 3.89E-5 6.57E-7 O.OOE+O 257 2.00E-2 3.33E-2 2.62E+O 1.03E+ O 2.57E-5 2.52E-5 5.15E-7 7.28E-7 14 5.09E-2 2.75E-2 1.51E+O 1.03E+ O 8.34E-6 7.91E-6 4.25E-7 2.89E-7 50 4.00E-3 2.75E-2 7.81E+O 1.03E+ O 1.06E-4 1.06E-4 4.24E-7 6.00E-7 57 3.49E-2 2.65E-2 1.73E+O 1.03E+ O 1 . 18E-5 1 . 13E-5 4 . 11 E-7 5.56E-7 3 2.31E-6 2.08E-2 8.99E+3 1.02E+O 1 . 39E-1 1.39E-1 3.22E-7 O.OOE+O 3 1.00E+O 2 . 0 BE-2 1.00E+O 1.02E+ O 3 . 22E-7 O. OOE+O 3.22E-7 O. OOE+O 68 3.50E-3 2.06E-2 6.78E+O 1.02E+O 9.01E-5 8.97E-5 3.20E-7 4.46E-7 Model Version: Page 12 Software Saphire 8 60 Model Date:

I

• Events and Conditions Assessment PWR D SPAR MODEL FOR OCONEE Sep 27 2019 2:39 PM 1, 2, & 3 Event Prob. FV RIR RRR Bb RH RRI Uncert.

68 -

Occur.

3.50E-3 2.06E-2 6.78E+O 1.02E+ O 9.01E-5 8.97E-5 3.20E-7 4.46E-7 448 4.13E-5 2.03E-2 4.63E+2 1.02E+O 7.17E-3 7.17E-3 3.15E-7 1.04E-6 815 6.00E-2 1.83E-2 1.29E+O 1.02E+O 4.74E-6 4.45E-6 2.84E-7 4.07E-7 32 3.24E-3 1.53E-2 5.69E+O 1.02E+ O 7.29E-5 7.27E-5 2.37E-7 3.17E-7 1 1.00E-1 1.49E-2 1.13E+O 1.01E+O 2.21E-6 1.99E-6 2.21E-7 O. OOE+O 685 3.40E-1 1.37E-2 1.03E+O 1 . 01 E+O 6.27E-7 4.14E-7 2.13E-7 1.13E-7 492 5.99E-3 1.28E-2 3.13E+O 1.01E+O 3.33E-5 3.31E-5 1.99E-7 6.15E-8 398 5.48E-1 1.18E-2 1.01E+O 1.01E+O 3.35E-7 1.51E-7 1.84E-7 3.07E-8 50 5.91E-6 1.16E-2 1.96E+3 1.01E+O 3.04E-2 3.04E-2 1.80E-7 3.28E-7 373 1.00E+O 1.09E-2 1.00E+O 1.01E+O 1.69E-7 O.OOE+O 1.69E-7 O.OOE+O 264 4.12E-1 1.08E-2 1.02E+O 1.01E+O 4.09E-7 2.41E-7 1.68E-7 3.84E-8 376 1.20E-1 1.07E-2 1.08E+O 1.01E+O 1.38E-6 1.22E-6 1.66E-7 1.07E-7 361 9.20E-1 1.06E-2 1.00E+O 1.01E+O 1.78E-7 1.43E-8 1.64E-7 9.48E-9 262 1.20E-1 1.04E-2 1.08E+O 1 . 01E+O 1 . 35E-6 1 . 18E-6 1 . 61E-7 1 . 04E-7 289 3.00E-1 9.76E-3 1.02E+O 1.01E+O 5.05E-7 3.53E-7 1.51E-7 O.OOE+O 363 6.00E-2 9.53E-3 1.15E+O 1.01E+O 2.46E-6 2.32E-6 1.48E-7 9.99E-8 14 2.00E-3 9.23E-3 5.58E+O 1.01E+O 7.13E-5 7.11E-5 1.43E-7 2.02E-7 12 2.00E-3 9.22E-3 5.58E+O 1.01E+ O 7.13E-5 7.11E-5 1.43E-7 2.02E-7 10 2.00E-3 9.21E-3 5.58E+O 1.01E+O 7.12E-5 7.10E-5 1.43E-7 2.01E-7 42 1.20E-2 9.12E-3 1.75E+O 1.01E+ O 1 . 18E- 5 1.16E-5 1.41E-7 1.96E-7 347 6.76E-1 9.02E-3 1.00E+O 1.01E+ O 2 . 07E-7 6 . 71E-8 1.40E-7 4.99E-8 274 9.40E-3 8.86E-3 1.93E+O 1.01E+O 1.46E-5 1.45E-5 1.37E-7 1.94E-7 39 5.00E-2 8.06E-3 1.15E+O 1.01E+O 2.49E-6 2.37E-6 1.25E-7 O.OOE+O 39 1.00E-3 8.06E-3 9.02E+O 1.01E+O 1.25E-4 1.24E-4 1.25E-7 1.76E-7 2 2.00E-2 7.62E-3 1.37E+O 1.01E+O 5.85E-6 5.73E-6 1.17E-7 1.66E-7 57 4.60E-3 7.57E-3 2.63E+O 1.01E+ O 2.54E-5 2.53E-5 1.17E-7 1.17E-7 144 3.65E-2 7.46E-3 1.20E+O 1.01E+O 3.18E-6 3.06E-6 1.16E-7 3.12E-8 3 4.00E-2 6.53E-3 1.14E+O 1.01E+ O 2 . 29E-6 2 . 20E-6 9 . 17E-8 1 .3 0E- 7 1 1.00E-7 6.44E-3 6.44E+4 1.01E+O 1.00E+O 1.00E+O 1.00E-7 1.83E-7 1 1.00E+O 6.44E-3 1.00E+O 1.01E+ O 1.00E-7 O. OOE+O 1.00E-7 O. OOE+O 87 1.69E-3 6.42E-3 4.79E+O 1.01E+O 5.89E-5 5.89E-5 9.97E-8 O.OOE+O 289 5.73E-3 6.26E-3 2.09E+O 1.01E+O 1.69E-5 1.68E-5 9.71E-8 2.75E-8 243 1.20E-6 5.88E-3 4.70E+3 1.01E+O 7.28E-2 7.28E-2 9.12E-8 1.11E-7 263 3.55E-2 5.71E-3 1.16E+O 1.01E+ O 2.50E-6 2.41E-6 8.86E-8 1.26E-7 Model Version: Page 13 Software Saphire 8 60 Model Date:

D-25 Attachment 3 Events and Condition Assessment Run 9.27.2019 - All Running Equipment Set to True, for Case B See Next Page

Events and Conditions Assessment PWR D SPAR MODEL FOR OCONEE 1, 2, & 3 Sep 27, 2019 2:05 PM Condition Assessment Summary Event Date 09/27/2019 1:00:00 PM to 09/27/2020 1:00:00 PM Duration 1 year CCDP 1.52E-4 CDP 1.54E-5 Delta CDP 1.37E-4 Solve Settings Cut Set Truncation Normal 1.00E-11 Size Truncation None Solve Method Multiple Pass Untitled Summary of Conditional Event Changes Event Description Conu "'."# " ridi Value ...-.--

Type

_,,_I Nominal Value T True 3 2.29E-5 T True 3 9.00E-5 T True C 3.87E-4 T True C 3.87E-4 T True 3 1.35E-4 R 2.16E-2 R 1.94E-6 R 5.56E-3 R 2.16E-6 R 1.42E-2 R 5.51E-6 R 2.88E-2 R 3.89E-6 Implied Event Changes as per RASP Guidance Event Description Cond Type Cond Value Nominal Nominal Type Value F False 1 1.09E-3 T True 1 4.56E-3 F False 1 7.84E-4 T True 1 4.60E-3 F False 1 7.84E-4 T True 1 2.42E-4 F False 1 8.26E-4 T True 1 9.66E-3 R O.OOE+O R 9.12E-6 Model Version: 8.60 Page 1 Software Saphire 8.1.8 Model Date: 05/03/2019

Events and Conditions Assessment PWR D SPAR MODEL FOR OCONEE 1, 2, & 3 Sep 27, 2019 2:05 PM CDP Uncertainty Distribution tE-6 Importance Distribution Median Point Estimate Mean Seed Sample Method Size 1.78E. 5 6.26E-'5 1. 0f E-4 2.48E-4 12345 317S Monte Carlo Model Version: 8.60 Page 3 Software Saphlre 8.1.8 Model Date: 05/03/2019

Events and Conditions Assessment PWR D SPAR MODEL FOR OCONEE 1, 2, & 3 Sep 27, 2019 2:05 PM Importance Distribution 1E-6 1E-6 1E-4 1E-3 Event Tree Dominant Results Only items contributing at least 1.0% to the total CCDP are displayed .

Event Tree CCDP CDP Delta CDP Description 8.27E-5 6.98E-6 7.58E-5 2.20E-5 1.87E-6 2.01E-5 1.63E-5 1.32E-6 1.49E-5 7.95E-6 9.66E-7 6.98E-6 7.57E-6 6.51E-7 6.92E-6 6.16E-6 1.79E-7 5.98E-6 2.36E-6 8.86E-8 2.27E-6 2.15E-6 1.33E-7 2.02E-6 Total 1.52E-4 100%

Dominant Sequence Results Only items contributing at least 1.0% to the total CCDP are displayed.

Event Tree Sequence CCDP CDP Delta Flagset Description CDP 03 7.32E-5 6.63E-6 6.66E-5 03 1.96E-5 1.77E-6 1.78E-5 07 1.44E-5 1.28E-6 1.31E-5 09 8.44E-6 1.89E-8 8.42E-6 2 7.60E-6 9.63E-7 6.64E-6 05 6.65E-6 5.93E-7 6.06E-6 2 5.91E-6 1.77E-7 5.73E-6 06 2.2SE-6 9.60'E-9 2.27E-6 Model Version: 8.60 Page 4 Software Saphire 8.1.8 Model Date: 05/03/2019

Events and Conditions Assessment PWR D SPAR MODEL FOR OCONEE 1, 2, & 3 Sep 27 2019 2 05 PM Event Tree Sequence CCDP CDP Delta Flagset Description CDP 11 1.70E-6 5.94E-8 1.64E-6 08 1.65E-6 7.26E-9 1.64E-6 05 1.60E-6 1.76E-8 1.58E-6 Total 1.52E-4 100%

Referenced Fault Trees Fault Tree Description Cut Set Report -

1. Case Prob/Freq Total% Cut Set 7.32E-5 100 Displaying 64 Cut Sets. (64 Original) 1 C 3.00E-5 40.98 2 C 2.13E-5 29.13 3 C 6.90E-6 9.43 4 C 6.00E-6 8.20 5 C 1.50E-6 2.05 6 C 1.50E-6 2.05 7 C 1.22E-6 1.67 8 C 1.22E-6 1.67 9 C 1.22E-6 1.67 10 C 1.22E-6 1.67 11 C 1.18E-6 1.61 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 1.96E-5 100 Displaying 50 Cut Sets. (50 Original) 1 C 8.02E-6 40.98 2 C 5.70E-6 29.13 3 C 1.84E-6 9.43 4 C 1.60E-6 8.20 5 C 4.01E-7 2.05 6 C 4.01E-7 2.05 7 C 3.27E-7 1.67 8 C 3.27E-7 1.67 9 C 3.27E-7 1.67 10 C 3.27E-7 1.67 11 C 3.14E-7 1.61 Cut Set Report -

Model Version: 8.60 Page 5 Software Saphire 8.1.8 Model Date: 05/03/2019

Events and Conditions Assessment PWR D SPAR MODEL FOR OCONEE 1, 2, & 3 Sep 27 2019 2 05 PM

1. Case Prob/Freq Total% Cut Set 1.44E-5 100 Displaying 115 Cut Sets. (115 Original) 1 C 2.89E-6 20.11 2 C 2.89E-6 20.11 3 C 2.05E-6 14.30 4 C 2.05E-6 14.30 5 C 6.64E-7 4.63 6 C 6.64E-7 4.63 7 C 5.78E-7 4.02 8 C 5.78E-7 4.02 9 C 1.44E-7 1.01 10 C 1.44E-7 1.01 11 C 1.44E-7 1.01 12 C 1.44E-7 1.01 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 8.44E-6 100 Displaying 76 Cut Sets. (76 Original) 1 C 8.35E-6 98.89 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 7.60E-6 100 Displaying 32 Cut Sets. (32 Original) 1 C 3.00E-6 39.47 2 C 2.13E-6 28.06 3 C 9.00E-7 11.84 4 C 6.90E-7 9.08 5 C 1.50E-7 1.97 6 C 1.50E-7 1.97 7 C 1.22E-7 1.61 8 C 1.22E-7 1.61 9 C 1.22E-7 1.61 10 C 1.22E-7 1.61 11 C 1.18E-7 1.55 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 6.65E-6 100 Displaying 143 Cut Sets. (143 Original) 1 C 1.33E-6 19.96 2 C 1.33E-6 19.96 3 C 9.44E-7 14.19 4 C 9.44E-7 14.19 5 C 3.05E-7 4.59 6 C 3.05E-7 4.59 7 C 2.66E-7 3.99 8 C 2.66E-7 3.99 Cut Set Report -

I Case I Prob/Freq j Total% j Cut Set Model Version: 8.60 Page 6 Software Saphire 8.1.8 Model Date: 05/03/2019

Events and Conditions Assessment PWR D SPAR MODEL FOR OCONEE 1, 2, & 3 Se 27, 2019 2:05 PM Total 5.91E-6 100 Displaying 1 Cut Sets. (1 Original}

C 5.91E-6 100.00 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 2.28E-6 100 Displaying 65 Cut Sets. (65 Original}

1 C 2.23E-6 97.92 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 1.70E-6 100 Displaying 107 Cut Sets. (107 Original}

1 C 3.44E-7 20.22 2 C 2.81E-7 16.50 3 C 2.75E-7 16.17 4 C 2.60E-7 15.26 5 C 2.60E-7 15.26 6 C 1.13E-7 6.64 7 C 4.20E-8 2.47 8 C 4.20E-8 2.47 Cut Set Report -

1. Case Prob/Freq Total% Cut Set 1.65E-6 100 Displaying 117 Cut Sets. (117 Original) 1 C 8.04E-7 48.77 2 C 8.04E-7 48.77 Cut Set Report

1. Case Prob/Freq Total% Cut Set 1.60E-6 100 Displaying 137 Cut Sets. (137 Original}

1 C 3.51E-7 22.02 2 C 3.51E-7 22.02 3 C 2.50E-7 15.65 4 C 2.50E-7 15.65 5 C 8.0BE-8 5.06 6 C 8.0BE-8 5.06 7 C 1.76E-8 1.10 8 C 1.76E-8 1.10 9 C 1.62E-8 1.02 10 C 1.62E-8 1.02 Referenced Events Event Description Probability 7.55E-4 7.55E-4 1.97E-5 8.16E-4 8.00E-4 1.00E-3 Model Version: 8.60 Page 7 Software Saphire 8.1.8 Model Date: 05/03/2019

Events and Conditions Assessment PWR D SPAR MODEL FOR OCONEE 1, 2, & 3 Sep 27 2019 2 05 PM

' Description Probability Event 6.00E-2 5.56E-3 6.00E-3 4.00E-3 2.00E-3 4.00E-2 3.50E-3 3.50E-3 3.49E-2 3.61E-2 5.91E-6 5.73E-3 1.50E-4 4.01E-4 1.50E-3 6.76E-1 1.66E-2 1.42E-2 7.84E-4 4.60E-3 8.16E-4 8.16E-4 8.16E-4 8.16E-4 2.00E-2 1.00E-3 1.00E-3 6.00E-3 3.55E-2 7.32E-4 1.00E-1 7.32E-4 1.00E-1 RIR > 2.00E+OO Event Tree Importance Group Event Occur. Prob. FV RIR RRR Bb RII RRI Uncert.

FV > 5.00E-03 Event Tree Importance Group Event Occur. Prob. FV RIR RRR Bb RII RRI Uncert.

525 1.50E-3 5.44E-1 3.63E+2 2.19E+O 5.49E-2 5.48E-2 8.23E-5 5.20E-5 941 2.00E-2 3.38E-1 1.70E+1 1.49E+O 2.46E-3 2.41E-3 4.96E-5 6.97E-5 773 1.42E-2 2.41E-1 1.70E+1 1.30E+O 2.45E-3 2.42E-3 3.51E-5 3.74E-5 520 4.00E-2 1.55E-1 4.70E+O 1.18E+O 5.83E-4 5.59E-4 2.34E-5 O.OOE+O 277 4.01E-4 1.45E-1 3.62E+2 1.17E+O 5.46E-2 5.46E-2 2.19E-5 3.46E-5 642 3.61E-2 1.08E-1 3.87E+O 1.12E+O 4.51E-4 4.34E-4 1.63E-5 O.OOE+O 1749 5.56E-3 9.46E-2 1.68E+1 1.10E+O 2.40E-3 2.39E-3 1.38E-5 1.23E-5 Model Version: 8.60 Page 8 Software Saphire 8.1.8 Model Date: 05/03/2019

Events and Conditions Assessment PWR D SPAR MODEL FOR OCONEE 1, 2, & 3 Sep 27, 2019 2 05 PM Event Occur. Prob. FV RIR RRR Bb RII RRI Uncert.

416 4.60E-3 7.78E-2 1.70E+1 1.08E+O 2.43E-3 2.42E-3 1.13E-5 1.12E-5 381 1.00E-1 7.77E-2 1.70E+O 1 . 08E+O 1 . 17E-4 1 . 06E- 4 1.18E-5 1.52E-5 381 1.00E-1 7.77E-2 1.70E+O 1 . 08E+O 1.17E-4 1.06E-4 1.18E-5 1.52E-5 344 4.00E-3 6.23E-2 1.59E+1 1.06E+O 2.26E-3 2.25E-3 9.04E-6 1.28E-5 133 1.50E-4 5.24E-2 3.50E+2 1.06E+O 5 . 29E-2 5 . 29E- 2 7.93E-6 1.45E-5 604 1.66E-2 5.00E-2 3.96E+O 1 05E+ O 4 . 56E-4 4.48E-4 7.57E-6 O.OOE+O 1 1.00E+O 3 . 91E-2 1 . 00E+O 1.04E+O 5.91E-6 O.OOE+O 5.91E-6 O.OOE+O 20 5.91E-6 3.91E-2 6.61E+3 1.04E+O 1.00E+O 1.00E+O 5.91E-6 1.08E-5 804 3.55E-2 1.96E-2 1.53E+O 1.02E+O 8.36E-5 8.06E-5 2.97E-6 4.21E-6 2209 6.00E-2 1.89E-2 1.30E+O 1 . 02E+O 4 . 77E-5 4.49E-5 2.87E-6 4.10E-6 182 1.00E-3 1.69E-2 1.70E+1 1.02E+O 2.42E-3 2.42E-3 2.44E-6 3.43E-6 177 1.00E-3 1.66E-2 1.67E+1 1.02E+O 2.39E-3 2.38E-3 2.39E-6 3.37E-6 286 1.66E-3 1.60E-2 1.06E+1 1.02E+O 1.46E-3 1.46E-3 2.42E-6 1.53E-6 201 5.73E-3 1.56E-2 3.70E+O 1 . 02E+O 4 . 12E- 4 4.09E-4 2.36E-6 6.67E-7 1263 6.76E-1 1.42E-2 1.01E+O 1.01E+ O 3.18E-6 1.03E-6 2.15E-6 7.66E-7 175 8.16E-4 1.38E-2 1.70E+1 1.01E+O 2.42E-3 2.42E-3 1.99E-6 1.20E-6 170 8.16E-4 1.37E-2 1.70E+1 1.01E+O 2 . 42E-3 2.42E-3 1.99"E-6 1.20E-6 170 8.16E-4 1.35E-2 1.67E+1 1.01E+O 2.38E-3 2.38E-3 1.95E-6 1.18E-6 170 8.16E-4 1.35E-2 1.67E+1 1.01E+O 2.38E-3 2.38E-3 1.95E-6 1.18E-6 173 7.84E-4 1.33E-2 1.70E+1 1.01E+O 2.42E-3 2.42E-3 1.91E-6 1.28E-6 29 4.00E-2 8.93E-3 1.21E+O 1.01E+ O 3.35E-5 3.22E-5 1.35E-6 3.74E-6 357 7.32E-4 8.78E-3 1.30E+1 1.01E+O 1 . 81 E-3 1.81E-3 1.33E-6 1.08E-6 357 7.32E-4 8.78E-3 1.30E+1 1.01E+O 1 . 81 E-3 1.81E-3 1.33E-6 1.08E-6 127 3.87E-4 6.55E-3 1.70E+1 1.01E+O 2.42E-3 2.42E-3 9.45E-7 8.69E-7 1544 1.20E-1 6.48E-3 1.05E+O 1.01E+O 8.17E-6 7.19E-6 9.80E-7 6.31E-7 2011 1.00E+O 6.47E-3 1.00E+O 1.01E+ O 9 . 79E-7 O. OOE+O 9 . 79E - 7 O. OOE+O 1482 9.20E-1 6.44E-3 1.00E+O 1.01E+O 1.06E-6 8.47E-8 9.74E-7 5.63E-8 5 6.00E-3 5.95E-3 1.94E+O 1.01E+O 1.43E-4 1.42E-4 8.58E-7 O.OOE+O 35 1.00E-2 5.35E-3 1.52E+O 1.01E+ O 8.02E-5 7.94E-5 8.08E-7 1.43E-6 133 4.00E-3 5.31E-3 2.22E+O 1 . 01E+O 1.86E-4 1.85E-4 7.64E-7 1.05E-6 Model Version: 8.60 Page 9 Software Saphire 8.1.8 Model Date: 05/03/2019

D-35 Attachment 4 SSF Cutsets dated 9.30.2019, for Case C See Next Page

D-38 Attachment 5 Frequencies of Seismically-Induced LOOP Events for SPAR Models, Revision 2, January 2007 See Next Page

Risk Assessment of Operating Events Frequencies of Seismically-Induced LOOP Events for SPAR Models Revision 2 January 2007

Table of Contents

1. Objective ................................................................................................................................ 3

2. Input ....................................................................................................................................... 3

3. Summary of Results .............................................................................................................. 3

4. Comments ............................................................................................................................. 3 Attachment A Calculations ............................................................................................................ 8 A-1. Input -1: Seismic Event Frequencies ....................................................................................... 8 A-2 Input-2: SSC Fragilities leading to LOOP ................................................................................ 8 A-3 Calculation of LOOP Frequency ........................................................................................ 8 A-4 Summary of Results ................................................................................................................... 8 List of Tables and Figures Table 1. Frequencies of Seismically-Induced LOOP Events .......................................................... 5 Table 2 LOOP Frequency Comparisons - Power Operation ......................................................... 7 Table 3 LOOP Frequency Comparisons - Shutdown Operation.................................................... 7 Table AA-1 Seismic Initiating Event Frequencies ......................................................................... 10 Table AA-2 Fragilities of SSCs causing seismically induced LOOP ............................................ 11 Table AA-3 Calculation of mean failure probability of SSCs (causing LOOP) as a function of g level .............................................................................................................................................. 12 Table A-1. Clinton ........................................................................................................................ 16 Table A-2. Comanche Peak ......................................................................................................... 17 Table A-3 Duane Arnold .............................................................................................................. 18 Table A-4 Limerick ....................................................................................................................... 19 Table A-5. Pilgrim ........................................................................................................................ 20 Table A-6. Robinson .................................................................................................................... 21 Table A-7. Vogtle ......................................................................................................................... 22

Frequencies of Seismically-Induced LOOP Events for SPAR Models

1. Objective This report provides frequencies of seismically-induced LOOP events for US NPPs. These LOOP frequencies could be used for external events scenarios in event importance calculations. The intended user is the US NRC SRAs.

2. Input The inputs to these calculations are:

i) seismic initiating event frequencies (seismic hazard distribution) as a function of seismic g level (NUREG-1488, April 1994);

ii) SSC (for example ceramic insulator) fragilities as a function of g level (NUREG-6544, April 1998).

Attachment A provides the details.

3. Summary of Results The input data is combined as a weighted average over the g levels to obtain mean value estimates, as shown in Attachment A. The following information is provided as shown in Table 1:

1. Seismic initiating event mean frequency of a 0.05g or higher earthquake per year;

2. Given an earthquake occurs, the conditional LOOP probability caused by the earthquake (based on failure of ceramic insulators);

3. Frequency of seismically induced LOOP event (per year).

Tables 2 and 3 compare the seismically induced LOOP frequency with frequencies of other internal LOOP events. Average durations of the LOOP events are also provided in the same tables.

4. Comments i) These results show that the seismically-induced LOOP frequencies are at least two orders of magnitude lower than LOOP frequencies calculated for internal events. However, the power recovery may not be feasible for an extended time period, following a seismic event.

This fact should be factored into the calculation of plant risk due to seismically-induced LOOP events.

ii) A small fraction of these LOOP events (at high seismic g values) will have additional SSC failures that would cause other initiating events, such as small LOCA, large LOCA, etc.

iii) For the sites to the east of the Rocky Mountains, a calculational tool is set up in terms of an MS EXCEL workbook and is used repeatedly to calculate the seismically-induced LOOP Seismically-induced LOOP Frequencies 3 1/200

frequencies for 61 sites. The same generic ceramic insulator seismic fragility distribution is used for these calculations.

iv) For the four sites west of the Rocky Mountains, plant-specific seismic event frequency distributions (seismic hazard curves) are obtained from IPEEE submittals (they are not given in the reference NUREG). The seismic fragility distributions for LOOP are also obtained from the same source. Then, the same calculational tool is used for LOOP frequency calculations.

v) The calculations can be readily customized for plant-specific SSC fragilities (e.g. ceramic insulators) and/or hazard curves. The MS EXCEL workbook named Seismically-Induced LOOP - Tables.xls is available for this purpose.

Seismically-induced LOOP Frequencies 4 1/200

Table 1. Frequencies of Seismically-Induced LOOP Events Plant Seismic Cond. Seis. Indu. Plant # of IEV Prob. of LOOP Type Units Frequency LOOP Frequency A B A*B B&W /

1-2 ANO 1 & 2 1.27E-03 6.59E-02 8.39E-05 CE 2 3-4 Beaver Valley 1 & 2 8.78E-04 8.52E-02 7.48E-05 W 2 5 Braidwood 1 & 2 4.30E-04 6.64E-02 2.85E-05 W 2 6-7 Browns Ferry 2 & 3 9.12E-04 5.63E-02 5.14E-05 BWR 2 8 Brunswick 1 & 2 1.53E-03 6.95E-02 1.06E-04 BWR 2 9 Byron 1 & 2 5.09E-04 7.23E-02 3.68E-05 W 2 10 Callaway 1.08E-03 3.82E-02 4.14E-05 W 1 11 Calvert Cliffs 1 & 2 7.67E-04 8.24E-02 6.33E-05 CE 2 12 Catawba 1 & 2 1.20E-03 6.27E-02 7.52E-05 W 2 13 Clinton 1.55E-03 6.87E-02 1.06E-04 BWR 1 14 Columbia (ex-WNP-2) 1.30E-03 1.37E-01 1.78E-04 BWR 1 15 Comanche Peak 1 & 2 1.41E-04 5.52E-02 7.78E-06 W 2 16 Cook 1 & 2 5.01E-04 7.77E-02 3.89E-05 W 2 17 Cooper 1.16E-03 1.15E-01 1.33E-04 BWR 1 18 Crystal River 3 1.48E-04 7.76E-02 1.15E-05 B&W 1 19 Davis-Besse 1.07E-03 6.12E-02 6.55E-05 B&W 1 20 Diablo Canyon 1.85E-02 5.71E-02 1.06E-03 W 2 21 Dresden 4.58E-04 7.23E-02 3.31E-05 BWR 2 22 Duaine Arnold 1.55E-04 6.28E-02 9.72E-06 BWR 1 23 Farley 1 & 2 2.00E-04 7.17E-02 1.43E-05 W 2 24 Fermi 2 6.01E-04 5.29E-02 3.18E-05 BWR 1 25 FitzPatrick 7.34E-04 4.95E-02 3.63E-05 BWR 1 26 Fort Calhoun 8.78E-04 1.21E-01 1.06E-04 CE 1 27 Ginna 8.48E-04 7.07E-02 6.00E-05 W 1 28 Grand Gulf 3.31E-04 7.12E-02 2.35E-05 BWR 1 29 Hatch 1 & 2 6.13E-04 6.83E-02 4.19E-05 BWR 2 30 Hope Creek 9.72E-04 8.09E-02 7.86E-05 BWR 1 31-32 Indian Point 2 1.15E-03 7.54E-02 8.69E-05 W 2 33 Kewaunee 3.04E-04 9.38E-02 2.85E-05 W 1 34 LaSalle 1 & 2 8.25E-04 8.66E-02 7.14E-05 BWR 2 35 Limerick 1 & 2 1.22E-03 7.66E-02 9.35E-05 BWR 2 36 McGuire 1 & 2 1.08E-03 5.86E-02 6.35E-05 W 2 37-38 Millstone 2 & 3 9.97E-04 7.49E-02 7.46E-05 CE / W 2 39 Monticello 3.56E-04 1.01E-01 3.58E-05 BWR 1 40-41 Nine Mile Point 1 & 2 7.30E-04 4.98E-02 3.63E-05 BWR 2 42 North Anna 1 & 2 1.15E-03 7.42E-02 8.55E-05 W 2 43 Oconee 1, 2, & 3 1.28E-03 6.69E-02 8.57E-05 B&W 3 44 Oyster Creek 8.53E-04 6.98E-05 6.98E-05 BWR 1 45 Palisades 3.92E-04 7.78E-02 3.05E-05 CE 1 46 Palo Verde 1, 2, & 3 3.00E-02 1.79E-03 5.37E-05 CE 3 Seismically-induced LOOP Frequencies 5 1/200

47 Peach Bottom 2 & 3 1.06E-03 7.63E-02 8.08E-05 BWR 2 48 Perry 4.48E-04 6.96E-02 3.12E-05 BWR 1 49 Pilgrim 2.81E-03 1.16E-01 3.25E-04 BWR 1 50 Point Beach 1 & 2 3.13E-04 9.32E-02 2.91E-05 W 2 51 Prairie Island 1 & 2 3.15E-04 1.04E-01 3.28E-05 W 2 52 Quad Cities 1 & 2 3.66E-04 6.37E-02 2.33E-05 BWR 2 53 River Bend 1.97E-04 7.45E-02 1.46E-05 BWR 1 54 Robinson 2 2.72E-03 8.78E-02 2.39E-04 W 1 55-56 Saint Lucie 1 & 2 1.47E-04 9.02E-02 1.33E-05 CE 2 57 Salem 1 & 2 9.59E-04 8.06E-02 7.73E-05 W 2 58 San Onofre 2 & 3 5.20E-03 4.71E-01 2.45E-03 CE 2 59 Seabrook 2.34E-03 8.08E-02 1.89E-04 W 1 60 Sequoyah 1 & 2 1.33E-03 7.46E-02 9.92E-05 W 2 61 Shearon Harris 5.85E-04 6.25E-02 3.65E-05 W 1 62 South Texas 1 & 2 1.63E-04 8.59E-02 1.40E-05 W 2 63 Surry 1 & 2 6.03E-04 7.83E-02 4.72E-05 W 2 64 Susquehanna 1 & 2 8.46E-04 7.12E-02 6.02E-05 BWR 2 65 TMI-1 1.11E-03 7.68E-02 8.51E-05 B&W 1 66 Turkey Point 3 & 4 1.23E-04 7.97E-02 9.78E-06 W 2 67 V.C. Summer 1.83E-03 6.36E-02 1.17E-04 W 1 68 Vermont Yankee 1.29E-03 6.20E-02 8.02E-05 BWR 1 69 Vogtle 1 & 2 2.50E-03 7.05E-02 1.76E-04 W 2 70 Waterford 2.86E-04 8.56E-02 2.45E-05 CE 1 71 Watts Bar 1.26E-03 7.44E-02 9.36E-05 W 1 72 Wolf Creek 3.29E-04 5.70E-02 1.87E-05 W 1 Average = 1.20E-04 Sum = 103 Note: Bold numbers in the first column identify the four sites to the West of Rocky Mountains.

Seismically-induced LOOP Frequencies 6 1/200

Table 2 LOOP Frequency Comparisons - Power Operation Mean 95% Mean 95%

Frequency Duration Duration (hrs) 1 Plant centered 2.38E-03 9.15E-03 0.5 2 2 Switchyard centered 8.74E-03 3.36E-02 1.3 5 3 Grid related 1.67E-02 6.41E-02 2.7 9.3 4 Severe weather related 2.98E-03 1.15E-02 5.4 25.1 5 Extreme weather related 2.32E-03 8.91E-03 78 187.4 6 Seismically induced 1.2E-04 78 187.4 Sum = 3.32E-02 Table 3 LOOP Frequency Comparisons - Shutdown Operation Mean 95% Mean 95%

Frequency Duration Duration (hrs) 1 Plant centered 5.16E-02 2.03E-01 0.5 2 2 Switchyard centered 1.02E-01 2.92E-01 1.3 5 3 Grid related 9.26E-03 3.56E-02 2.7 9.3 4 Severe weather related 2.51E-02 9.65E-02 5.4 25.1 5 Extreme weather related 1.32E-03 5.08E-03 78 187.4 6 Seismically induced 1.2E-04 78 187.4 Sum = 1.89E-01 Source = INEEL/EXT-04-02326 October 20004 Seismically-induced LOOP Frequencies 7 1/200

Attachment A Calculations This attachment documents the calculational details of the frequencies of seismically-Induced LOOP events given in the main body of the report.

A-1. Input -1: Seismic Event Frequencies.

The seismic event frequencies for 69 NPP sites east of the Rocky Mountains are given in NUREG- 1488 (April 1994). Data taken from this source for seven example plants East of the Rock Mountains is given in Table AA-1. Similar data for plants to the West of the Rock Mountains may be obtained from the utilities, or their IPEEEs.

A-2 Input-2: SSC Fragilities leading to LOOP Generally, the ceramic insulators with the lowest fragilities among the SSCs modeled in the PRAs govern the occurrence of LOOP following a seismic event. The generic fragility data for ceramic insulators is taken from NUREG-6544 (April 1998) as shown in Table AA-2. The mean failure probabilities at different g level earthquakes are calculated by using the equation:

Pfail(a) = [ ln(a/am) / sqrt(2r + u2)]

Where is the standard normal cumulative distribution function and a = median acceleration level of the seismic event; am = median of the component fragility (or median capacity);

r = logarithmic standard deviation representing random uncertainty; u = logarithmic standard deviation representing systematic or modeling uncertainty.

Fragilities of SSCs that would cause LOOP for the plants West of the Rocky Mountains can also be calculated by using the information taken from their IPEEEs.

Calculations of mean failure probabilities of SSCs as a function of g level for various cases are shown in Tables AA-2 and AA-3.

A-3 Calculation of LOOP Frequency Once the initiating event frequencies at different g levels and their corresponding conditional LOOP probabilities are known, as given in Tables AA-1 through AA-3, the frequency of seismically-induced LOOP event can be calculated as a weighed average of frequencies at different g intervals. This is shown for seven plants in Tables A-1 through A-7. The summary Table 1 has the seismically induced LOOP frequencies for all SPAR models.

A-4 Summary of Results The summary of results for Seismically-induced LOOP Frequencies 8 1/200

1. Seismic initiating event frequencies

2. Conditional probability of LOOP given seismic event

3. Frequency of seismically-induced LOOP event Seismically-induced LOOP Frequencies 9 1/200

for SPAR models is given in Table A-1.

The calculations can be readily customized for plant-specific SSC fragilities and/or hazard curves.

The seismically-induced LOOP frequency calculations for the 72 SPAR model plants are performed in a MS EXCEL workbook, which can be found by accession number ML062540239 in ADAMS.

Seismically-induced LOOP Frequencies 10 1/200

Table AA-1 Seismic Initiating Event Frequencies g value mean frequency of exceedance (per year)

Clinton Comanche Duane Limerick Pilgrim Robinson Vogtle Peak Arnold 0.05 1.55E-03 1.41E-04 1.55E-04 1.22E-03 2.81E-03 2.72E-03 2.50E-03 0.08 8.08E-04 6.79E-05 8.11E-05 6.99E-04 1.78E-03 1.57E-03 1.36E-03 0.15 2.46E-04 1.88E-05 2.38E-05 2.29E-04 7.15E-04 5.47E-04 4.15E-04 0.25 9.42E-05 6.42E-06 8.21E-06 8.35E-05 3.27E-04 2.26E-04 1.55E-04 0.30 6.54E-05 4.19E-06 5.36E-06 5.55E-05 2.41E-04 1.60E-04 1.06E-04 0.40 3.57E-05 2.02E-06 2.58E-06 2.75E-05 1.44E-04 8.99E-05 5.68E-05 0.50 2.17E-05 1.10E-06 1.40E-06 1.52E-05 9.38E-05 5.57E-05 3.42E-05 0.65 1.17E-05 5.08E-07 6.42E-07 7.10E-06 5.45E-05 3.06E-05 1.83E-05 0.80 6.89E-06 2.66E-07 3.34E-07 3.73E-06 3.43E-05 1.85E-05 1.09E-05 1.00 3.79E-06 1.28E-07 1.59E-07 1.79E-06 2.02E-05 1.04E-05 6.18E-06 Seismic IE Freq. = 1.55E-03 1.41E-04 1.55E-04 1.22E-03 2.81E-03 2.72E-03 2.50E-03 For 69 NPP sites east of Rocky Mountains, NUREG-1488 provides Seismic IEV frequencies.

For other plants West of Rocky Mountains, this information can be obtained either from the plant, or from the literature, as needed.

Seismically-induced LOOP Frequencies - R2 10 1/200

Table AA-2 Fragilities of SSCs causing seismically induced LOOP median r u HCLPF capacity used for all sites except those West of Generic Ceramic Insulators 0.3 0.3 0.45 0.1 the Rocky Mountains Switchyard Fragility 0.31 0.25 0.43 0.1 Columbia Offsite Power 1.40 0.2200 0.2 0.7 Diablo Canyon Ceramic Insulators 0.3 0.3 0.45 0.1 Palo Verde Seismically-induced LOOP Frequencies - R2 11 1/200

Table AA-3 Calculation of mean failure probability of SSCs (causing LOOP) as a function of g level Ceramic Insulators median r u HCLPF HCLPF capacity (calculated) 0.3 0.3 0.45 0.1 0.087 g value pf (median) pf(mean) g value pf(mean) 0.05 1.17E-09 4.62E-04 0.05 0.0005 0.08 5.27E-06 7.26E-03 0.1 0.0211 0.15 1.04E-02 1.00E-01 0.15 0.1000 0.25 2.72E-01 3.68E-01 0.2 0.2267 0.3 5.00E-01 5.00E-01 0.25 0.3680 0.4 8.31E-01 7.03E-01 0.3 0.5000 0.5 9.56E-01 8.28E-01 0.35 0.6122 0.65 9.95E-01 9.24E-01 0.4 0.7026 0.8 9.99E-01 9.65E-01 0.45 0.7733 1 1.00E+00 9.87E-01 0.5 0.8275 0.55 0.8688 0.6 0.9000 pf = probability of failure 0.65 0.9236 median pf is not used; for comparison only. 0.7 0.9414 Note that median overshoots mean above 0.3g 0.75 0.9549 0.8 0.9651 0.85 0.9729 0.9 0.9789 0.95 0.9835 1 0.9870 For SSC fragilities, a simple generic list is available in NUREG-6544 Table 6-1.

Columbia Switchyard Fragility median r u HCLPF HCLPF capacity (calculated) 0.31 0.25 0.43 0.1 0.101 pf g value (median) pf(mean) 0.05 1.47E-13 1.22E-04 0.1 1.25E-04 1.15E-02 0.2 8.83E-02 1.89E-01 0.3 5.00E-01 4.74E-01 0.4 8.31E-01 6.96E-01 0.5 9.56E-01 8.32E-01 Seismically-induced LOOP Frequencies - R2 12 1/200

0.6 9.90E-01 9.08E-01 0.7 9.98E-01 9.49E-01 0.8 9.99E-01 9.72E-01 0.9 1.00E+00 9.84E-01 1 1.00E+00 9.91E-01 Diablo Canyon Table 3-8 (page 3-53) of IPEEE Submittal median r u HCLPF HCLPF Offsite Power capacity (calculated) 1.40 0.2200 0.2 0.7 0.702 g value pf(mean) 0.2 2.99E-11 0.5 2.67E-04 0.8 2.99E-02 1 1.29E-01 1.2 3.02E-01 1.5 5.92E-01 2 8.85E-01 2.5 9.74E-01 3 9.95E-01 4 1.00E+00 San Onofre Table 3.6-1 (page 3.83) of IPEEE Submittal SA(g) r u HCLPF HCLPF Switchyard (calculated) 0.74 0.2 0.34 0.304 g value pf(mean)

IPEEE reports fragility in spectral acceleration; use generic fragility in units of PGA from Table AA-3 for failure probability calculations.

Ceramic Insulators used for Palo Verde median r u HCLPF HCLPF capacity (calculated) 0.3 0.3 0.45 0.1 0.087 pf g value (median) pf(mean) g value pf(mean)

Seismically-induced LOOP Frequencies - R2 13 1/200

0.01 0.00E+00 1.61E-10 0.05 0.0005 0.02 0.00E+00 2.77E-07 0.1 0.0211 0.05 1.17E-09 4.62E-04 0.15 0.1000 0.07 6.15E-07 3.56E-03 0.2 0.2267 0.1 1.25E-04 2.11E-02 0.25 0.3680 0.15 1.04E-02 1.00E-01 0.3 0.5000 0.2 8.83E-02 2.27E-01 0.35 0.6122 0.3 5.00E-01 5.00E-01 0.4 0.7026 0.5 9.56E-01 8.28E-01 0.45 0.7733 1 1.00E+00 9.87E-01 0.5 0.8275 0.55 0.8688 0.6 0.9000 pf = probability of failure 0.65 0.9236 median pf is not used; for comparison only. 0.7 0.9414 Note that median overshoots mean above 0.3g 0.75 0.9549 0.8 0.9651 0.85 0.9729 0.9 0.9789 0.95 0.9835 1 0.9870 Seismically-induced LOOP Frequencies - R2 14 1/200

Seismically-induced LOOP Frequencies - R2 15 1/200 Table A-1. Clinton g value mean f per LOOP EQ g Interval IEV Interval Weighted year Probability interval Frequency Conditional Average LOOP Probability 0.05 1.55E-03 4.62E-04 .05-.08 7.39E-04 1.83E-03 1.35E-06 0.08 8.08E-04 7.26E-03 .08-.15 5.63E-04 2.70E-02 1.52E-05 0.15 2.46E-04 1.00E-01 .15-.25 1.51E-04 1.92E-01 2.91E-05 0.25 9.42E-05 3.68E-01 .25-.30 2.88E-05 4.29E-01 1.23E-05 0.30 6.54E-05 5.00E-01 .30-.40 2.97E-05 5.93E-01 1.76E-05 0.40 3.57E-05 7.03E-01 .40-.50 1.40E-05 7.63E-01 1.07E-05 0.50 2.17E-05 8.28E-01 .50-.65 1.01E-05 8.74E-01 8.79E-06 0.65 1.17E-05 9.24E-01 .65-.80 4.76E-06 9.44E-01 4.49E-06 0.80 6.89E-06 9.65E-01 .80-1 3.10E-06 9.76E-01 3.03E-06 1.00 3.79E-06 9.87E-01 >1 3.79E-06 1.00E+00 3.79E-06 Sum = 1.55E-03 1.06E-04 SE Initiating Event Frequency = 1.55E-03 CCDP = 6.87E-02 Seismically induced LOOP probability = 6.87E-02 Seismically induced LOOP frequency = 1.06E-04 Seismically-induced LOOP Frequencies - R2 16 1/200

Table A-2. Comanche Peak g value mean f per LOOP EQ g Interval Interval Weighted year Probability interval IEV Conditional Average Frequency LOOP Probability 0.05 1.41E-04 4.62E-04 .05-.08 7.31E-05 1.83E-03 1.34E-07 0.08 6.79E-05 7.26E-03 .08-.15 4.91E-05 2.70E-02 1.32E-06 0.15 1.88E-05 1.00E-01 .15-.25 1.24E-05 1.92E-01 2.37E-06 0.25 6.42E-06 3.68E-01 .25-.30 2.23E-06 4.29E-01 9.57E-07 0.30 4.19E-06 5.00E-01 .30-.40 2.17E-06 5.93E-01 1.29E-06 0.40 2.02E-06 7.03E-01 .40-.50 9.20E-07 7.63E-01 7.02E-07 0.50 1.10E-06 8.28E-01 .50-.65 5.92E-07 8.74E-01 5.18E-07 0.65 5.08E-07 9.24E-01 .65-.80 2.42E-07 9.44E-01 2.28E-07 0.80 2.66E-07 9.65E-01 .80-1 1.38E-07 9.76E-01 1.35E-07 1.00 1.28E-07 9.87E-01 >1 1.28E-07 1.00E+00 1.28E-07 Sum = 1.41E-04 7.78E-06 SE Initiating Event Frequency = 1.41E-04 CCDP = 5.52E-02 Seismically induced LOOP probability = 5.52E-02 Seismically induced LOOP frequency = 7.78E-06 Seismically-induced LOOP Frequencies - R2 17 1/200

Table A-3 Duane Arnold g value mean f per LOOP EQ g Interval Interval Weighted year Probability interval IEV Conditional Average Frequency LOOP Probability 0.05 1.55E-04 4.62E-04 .05-.08 7.38E-05 1.83E-03 1.35E-07 0.08 8.11E-05 7.26E-03 .08-.15 5.73E-05 2.70E-02 1.54E-06 0.15 2.38E-05 1.00E-01 .15-.25 1.56E-05 1.92E-01 2.99E-06 0.25 8.21E-06 3.68E-01 .25-.30 2.85E-06 4.29E-01 1.22E-06 0.30 5.36E-06 5.00E-01 .30-.40 2.78E-06 5.93E-01 1.64E-06 0.40 2.58E-06 7.03E-01 .40-.50 1.19E-06 7.63E-01 9.05E-07 0.50 1.40E-06 8.28E-01 .50-.65 7.55E-07 8.74E-01 6.60E-07 0.65 6.42E-07 9.24E-01 .65-.80 3.08E-07 9.44E-01 2.91E-07 0.80 3.34E-07 9.65E-01 .80-1 1.74E-07 9.76E-01 1.70E-07 1.00 1.59E-07 9.87E-01 >1 1.59E-07 1.00E+00 1.59E-07 Sum = 1.55E-04 9.72E-06 SE Initiating Event Frequency = 1.55E-04 CCDP = 6.28E-02 Seismically induced LOOP probability = 6.28E-02 Seismically induced LOOP frequency = 9.72E-06 Seismically-induced LOOP Frequencies - R2 18 1/200

Table A-4 Limerick g value mean f LOOP EQ g Interval Interval Weighted per year Probability interval IEV Conditional Average Frequency LOOP Probability 0.05 1.22E-03 4.62E-04 .05-.08 5.21E-04 1.83E-03 9.54E-07 0.08 6.99E-04 7.26E-03 .08-.15 4.70E-04 2.70E-02 1.27E-05 0.15 2.29E-04 1.00E-01 .15-.25 1.46E-04 1.92E-01 2.79E-05 0.25 8.35E-05 3.68E-01 .25-.30 2.80E-05 4.29E-01 1.20E-05 0.30 5.55E-05 5.00E-01 .30-.40 2.80E-05 5.93E-01 1.66E-05 0.40 2.75E-05 7.03E-01 .40-.50 1.23E-05 7.63E-01 9.38E-06 0.50 1.52E-05 8.28E-01 .50-.65 8.10E-06 8.74E-01 7.08E-06 0.65 7.10E-06 9.24E-01 .65-.80 3.37E-06 9.44E-01 3.18E-06 0.80 3.73E-06 9.65E-01 .80-1 1.94E-06 9.76E-01 1.89E-06 1.00 1.79E-06 9.87E-01 >1 1.79E-06 1.00E+00 1.79E-06 Sum = 1.22E-03 9.35E-05 SE Initiating Event Frequency = 1.22E-03 CCDP = 7.66E-02 Seismically induced LOOP probability = 7.66E-02 Seismically induced LOOP frequency = 9.35E-05 Seismically-induced LOOP Frequencies - R2 19 1/200

Table A-5.

Pilgrim g value mean f LOOP EQ g Interval Interval Weighte per year Probability interval IEV Conditional d Frequency LOOP Average Probability 0.05 2.81E-03 4.62E-04 .05-.08 1.04E-03 1.83E-03 1.90E-06 0.08 1.78E-03 7.26E-03 .08-.15 1.06E-03 2.70E-02 2.86E-05 0.15 7.15E-04 1.00E-01 .15-.25 3.88E-04 1.92E-01 7.45E-05 0.25 3.27E-04 3.68E-01 .25-.30 8.62E-05 4.29E-01 3.70E-05 0.30 2.41E-04 5.00E-01 .30-.40 9.69E-05 5.93E-01 5.74E-05 0.40 1.44E-04 7.03E-01 .40-.50 5.03E-05 7.63E-01 3.84E-05 0.50 9.38E-05 8.28E-01 .50-.65 3.93E-05 8.74E-01 3.44E-05 0.65 5.45E-05 9.24E-01 .65-.80 2.02E-05 9.44E-01 1.90E-05 0.80 3.43E-05 9.65E-01 .80-1 1.41E-05 9.76E-01 1.38E-05 1.00 2.02E-05 9.87E-01 >1 2.02E-05 1.00E+00 2.02E-05 Sum = 2.81E-03 3.25E-04 SE Initiating Event Frequency = 2.81E-03 CCDP= 1.16E-01 Seismically induced LOOP probability = 1.16E-01 Seismically induced LOOP frequency = 3.25E-04 Seismically-induced LOOP Frequencies - R2 20 1/200

Table A-6. Robinson g value mean f LOOP EQ g Interval Interval Weighted per year Probability interval IEV Conditional Average Frequency LOOP Probability 0.05 2.72E-03 4.62E-04 .05-.08 1.15E-03 1.83E-03 2.11E-06 0.08 1.57E-03 7.26E-03 .08-.15 1.02E-03 2.70E-02 2.74E-05 0.15 5.47E-04 1.00E-01 .15-.25 3.21E-04 1.92E-01 6.16E-05 0.25 2.26E-04 3.68E-01 .25-.30 6.56E-05 4.29E-01 2.81E-05 0.30 1.60E-04 5.00E-01 .30-.40 7.01E-05 5.93E-01 4.15E-05 0.40 8.99E-05 7.03E-01 .40-.50 3.42E-05 7.63E-01 2.60E-05 0.50 5.57E-05 8.28E-01 .50-.65 2.51E-05 8.74E-01 2.20E-05 0.65 3.06E-05 9.24E-01 .65-.80 1.21E-05 9.44E-01 1.15E-05 0.80 1.85E-05 9.65E-01 .80-1 8.06E-06 9.76E-01 7.87E-06 1.00 1.04E-05 9.87E-01 >1 1.04E-05 1.00E+00 1.04E-05 Sum = 2.72E-03 2.39E-04 SE Initiating Event Frequency = 2.72E-03 CCDP= 8.78E-02 Seismically induced LOOP probability = 8.78E-02 Seismically induced LOOP frequency = 2.39E-04 Seismically-induced LOOP Frequencies - R2 21 1/200

Table A-7.

Vogtle g value mean f LOOP EQ g Interval Interval Weighted per year Probability interval IEV Conditional Average Frequency LOOP Probability 0.05 2.50E-03 4.62E-04 .05-.08 1.14E-03 1.83E-03 2.09E-06 0.08 1.36E-03 7.26E-03 .08-.15 9.41E-04 2.70E-02 2.54E-05 0.15 4.15E-04 1.00E-01 .15-.25 2.61E-04 1.92E-01 5.00E-05 0.25 1.55E-04 3.68E-01 .25-.30 4.86E-05 4.29E-01 2.08E-05 0.30 1.06E-04 5.00E-01 .30-.40 4.92E-05 5.93E-01 2.92E-05 0.40 5.68E-05 7.03E-01 .40-.50 2.26E-05 7.63E-01 1.72E-05 0.50 3.42E-05 8.28E-01 .50-.65 1.59E-05 8.74E-01 1.39E-05 0.65 1.83E-05 9.24E-01 .65-.80 7.36E-06 9.44E-01 6.95E-06 0.80 1.09E-05 9.65E-01 .80-1 4.76E-06 9.76E-01 4.64E-06 1.00 6.18E-06 9.87E-01 >1 6.18E-06 1.00E+0 6.18E-06 Sum = 2.50E-03 1.76E-04 SE Initiating Event Frequency = 2.50E-03 CCDP = 7.05E-02 Seismically induced LOOP probability = 7.05E-02 Seismically induced LOOP frequency = 1.76E-04 Seismically-induced LOOP Frequencies - R2 22 1/200

D-62 Attachment 6 Historical Data on Oconee Yellow Bus Voltage Conditions - 2017-2019 See Next Page

D-63 D-64 D-65 D-66 D-67 D-68 Attachment 7 Draft Version of MD8.4, Handbook on Management of Backfitting, Forward Fitting, Issue Finality and Information Requests See online MD Catalog (ADAMS No. ML18093B087)

F-1 Appendix F Additional Information DPO-2019-001 Ho Nieh, NRR Director, requested the DPO Panel consider and document insights on additional items as part of the DPO review:

1. Provide insights in terms of how the DPO issue should be considered in light of the recently issued Commission SRM on backfitting.

a. Regarding backfit considerations, discuss whether there is clarity in Degraded Voltage Relay protection requirements or have regulatory positions changed over time.

b. Review regulatory requirements and history associated with DVRs.

c. Has the agencys position changed?

2. Discuss safety significance of the issue presented as it relates to:

a. Principles of Good Regulation: Reliability: Regulations should be based on the best available knowledge from research and operational experience.

b. Safety: is there a risk reduction, and increased reliability through DVRs?

c. Does BTP/PSB-1 guidance reflect best available information; is it risk-informed?

3. Discuss Oconee operational experience such as grid events of late.

a. Discuss Adequate Protection, Compliance exception, and safety significance; is there is plant risk reduction for this issue?

DPO Panel Responses Q1. Provide insights in terms of how the DPO issue should be considered in light of the recently issued Commission SRM on backfitting.

a. Regarding backfit considerations, discuss whether there is clarity in Degraded Voltage Relay protection requirements or have regulatory positions changed over time.

b. Review regulatory requirements and history associated with DVRs.

c. Has the agencys position changed?

Answer:

a. Backfitting Considerations Under 10 CFR 50.109, backfitting is the modification of or addition to systems, structures, components, or design of a facility; or the design approval or manufacturing license for a facility; or the procedures or organization required to design, construct or operate a facility; any of which may result from a new or amended provision in the Commission's regulations or the imposition of a regulatory staff position interpreting the Commission's regulations that is either new or different from a previously applicable staff position.

F-2 When considering a potential backfit, the DPO Panel reviewed the recently issued MD 8.4, Management of Facility-Specific Backfitting and Information Collection guidance and SECY 18-0049 which revised backfitting instructions and provided guidance for risk-informing such agency actions. Specifically, MD 8.4 discusses three principal justifications for the agency to impose a backfit: adequate protection, compliance, and cost-justified substantial increase in protection. MD 8.4, Step I.A.7 states that the, NRC must first consider whether regulatory action is necessary to ensure adequate protection of public health and safety, and if so whether there is an imminent threat to public health and safety.

Regarding adequate protection, the DPO Panel concluded that there is not an imminent threat to public health and safety (see Risk Analysis in Attachment D). Specifically, the Panel compared the increase in core damage frequency (CDF) from the baseline value using three postulated scenarios. The results yielded mean CDF values ranging from 5E-10/year to 9E-7/year, or approximately 2 to 5 orders of magnitude less than the baseline operational risk. The DPO Panel found that the relatively low risk results reflect: 1) the robustness of the overall system design at the Oconee site, and 2) the low likelihood of a sustained degraded grid voltage condition coincident with an event that would require operation of the ECCS systems. Furthermore, the Panel concluded that given that there are inverse-time characteristic, safety-related undervoltage relays physically attached to the 4.16 kV MFBs, there was limited safety benefit of either relocating the DVR relays from the 230 kV Switchyard Degraded Grid Voltage Protection system to the 4.16 KV busses, or adding additional DVRs to the ES busses.

Regarding a compliance backfit, MD 8.4, Step I.A.7 goes on to state, If regulatory action is not necessary to ensure adequate protection, then the NRC needs to determine if the proposed action (i.e., installing DVR relays on the 4.16 kV ES busses) satisfies the compliance backfit criteria. MD 8.4, Step III.B.5 goes on to state: Use of the compliance exception is limited to the following situations that define omission or mistake of fact:

1. the NRC staff, whether by its own error or by the licensee or third-party error or omission at or before the time of its determination that a known and established standard of the Commission was satisfied, (1) incorrectly perceived facts, (2) performed or failed to recognize flawed analyses, or (3) failed to draw proper inferences from those facts or analyses, as judged by the standards and practices that were prevailing among professionals or experts in the relevant area at the time of the determination in question Furthermore, MD 8.4, Step III.B.6 goes on to state that the compliance exception should not be applied to the following:

2. Recharacterization of whether a particular set of otherwise understood circumstances satisfies the standard at issue based upon professional standards and processes developed or accepted after the time of the determination.

The DPO Panel determined that the NRC staff in reviewing Oconees DVR configuration and modifications did not incorrectly perceived facts, perform or fail to recognize flawed analyses, or fail to draw proper inferences from those facts or analyses. In addition, the DPO Panel determined that the NRC staff did not recharacterize DVR circumstances based

F-3 on processes developed after the time of the plant licensing or the approval of license amendment requests. Furthermore, the Panel was not able to identify a non-compliance associated with Oconees DVR configuration regarding 10 CFR 50.36; Technical Specifications; Oconees Technical Specifications, Sections 3.3.17 and 3.3.18; AEC 39; and Title 10 of CFR 50.55a(h)(2).

Regarding a cost-justified substantial increase in protection, the Panel considered:

the substantial cost to Oconee to modify the DVR relays to be relocated from the current location on the MFBs to the 4.16 kV ES busses (estimated to be in the millions of dollars given the engineering analysis and modifications necessary to ES and safety-related circuitry and systems),

the minimum risk benefit of relocating the DVR relays to the 4.16 kV ES busses (i.e.,

mean CDF values ranging from 5E-10/year to 9E-7/year, see Attachment D), and that none of the thresholds for Agency action regarding risk (see Attachment E) were met.

The DPO Panel determined that there is not a cost-justified substantial increase in protection associated with relocating the DVRs from the 4.16 kV MFBs to the ES busses. In fact, the risk analysis (Appendix D) showed that there could be negative risk impacts if the licensee were to make modifications to the plant and apply DVR protection on the 4.16 kV ES busses. For example, the TC, TD and TE buses would need to be de-energized for periods of time in order to install the modifications, thus increasing the risk to the public while high risk components remain de-energized. Also, there may be unintended consequences (common mode failure, infant mortality, etc.) that may swamp the low levels of risk benefit from adding the relays.

In summary, the DPO Panel determined that there is no adequate protection, compliance, or cost-justified substantial increase in protection basis for modifying the current Oconee DVR configuration.

Clarity of DVR Protection Requirements There is clarity in degraded voltage relay protection requirements. All power reactor licensees, except Oconee, have implemented the required two levels of protective undervoltage monitoring and relays; however there has been disagreement, historically, on the implementation methodologies as identified by inspection findings and agency actions.

Guidance was issued by both the NRC, in Regulatory Issues Summary 2011-12, Adequacy Of Station Electric Distribution System Voltages, (ML113050583) and by NEI, in 15-01, An Analytical Approach for Establishing Degraded Voltage Relay (DVR) Settings (ML15089A329) describing implementation and setpoint methodologies, and IEEE Standard 741, Standard Criteria for the Protection of Class 1E Power Systems and Equipment in Nuclear Power Plants has been used by the industry and NRC staff for decades. The NRC has not changed regulatory positions related to the requirement of safety-related protective undervoltage monitoring on the vital buses.

b. Regulatory Requirements and History Associated with DVRs As regards Oconee, the regulatory requirements associated with DVRs are found in 10 CFR 50.36; Technical Specifications; Oconees Technical Specifications, Sections 3.3.17 and

F-4 3.3.18; AEC 39; and Title 10 of CFR 50.55a(h)(2). (See previous answer to DPO submitter Issue 1).

While not legally binding, other NRC letters and correspondence over the years interpreted the regulations associated with degraded voltage events. For instance, the Generic Letter to Oconee dated June 3, 1977 stated that, The voltage monitors shall automatically initiate the disconnection of offsite power sources whenever the voltage setpoint and time delay limits have been exceeded. The GL further states that the voltage monitors shall be designed to satisfy the requirements of IEEE Std. 279-1971. This automatic feature was meant to ensure the adequacy of the offsite power system and the onsite distribution system and ensures that the electrical system has sufficient capacity and capability to automatically start and operate under all required safety loads. Similarly, the NRC staff reiterated this position in GL 79-36, Adequacy of Station Electric Distribution System Voltages, dated August 8, 1979 following the event at ANO. The NRC staff position became known as Multi-plant Action (MPA) B-23 and was subsequently included in Branch Technical Position (BTP)

Power Systems Branch (PSB)-1, Adequacy of Station Electric System Distribution Voltage, in Appendix 8-A to Chapter 8 of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants. The DPO Panel found that Oconee meets the interpretation of the regulations discussed in the June 3, 1977 Generic Letter to Oconee and the BTP PSB-1.

In summary, the Oconee DVR configuration is in compliance with 10 CFR 50.36, AEC 39, and Technical Specifications and is capable of responding to design basis events.

Regarding the history associated with DVRs, IEEE Std 741, IEEE Standard Criteria for the Protection of Class 1E Power Systems and Equipment in Nuclear Power Generating Stations provides principal design criteria, design features, and testing requirements for the protection of Class 1E power systems and equipment supplied from those systems, including the use of undervoltage relays to meet the NRC requirements for degraded voltage protection. This IEEE standard is widely used throughout the industry and NEI.

Annex A to this standard provides considerations for:

Protection of Class 1E equipment for loss of voltage or degraded voltage conditions; and Determination of the proper settings for loss of voltage and degraded voltage protection systems and their associated time delays.

The Annex recommends that two levels of undervoltage detection and protection be provided on the Class 1E electrical distribution system. The first level of undervoltage protection is provided by the loss of voltage relays whose function is to detect and disconnect the Class 1E buses from the preferred power supply upon a total loss of voltage.

The second level of undervoltage protection is provided by the degraded voltage relays, which are set to detect a low-voltage condition. These relays alarm to alert the operators to the degraded condition and disconnect the Class 1E buses from the preferred power supply if the degraded voltage condition exists for a time interval that could prevent the Class 1E equipment from achieving its safety function or from sustaining damage due to prolonged operation at reduced voltage. The combination of the loss of voltage relaying system and degraded voltage relaying system provides protection for the Class 1E distribution system for conditions of voltage collapse or sustained voltage degradation.

F-5 The genesis of the need for a second level of protective undervoltage relaying for safety-related electrical systems was the Millstone events in 1976, and the ANO event in 1978. Electrical grid events at the Millstone Station demonstrated that when the Class 1E buses are supplied by the offsite power system, sustained degraded voltage conditions on the grid can cause adverse effects on the operation of Class 1E loads. These degraded voltage conditions may not be detected by typical Loss-of-Voltage relays (LVRs) which are designed to detect loss of power to the bus from the offsite circuit(s). NOTE: Loss-of-voltage relays are undervoltage relays with setpoints adjusted to operate at the lowest voltage level allowed before permanent damage to equipment is expected. LVRs low voltage dropout setting is generally in the range of 0.7 per unit voltage or less, with a time delay of less than 2 seconds. The actual relays are typically connected to instrument potential transformers which read the actual voltage and step it down to the 120-volt range for the relays.

The ANO event in September of 1978 demonstrated that degraded voltage conditions could exist on the Class 1E buses even with normal transmission network (grid) voltages, due to deficiencies in equipment between the grid and the Class 1E buses (Offsite/Station electric power system design) or by the starting transients experienced during certain accident events not originally considered in the sizing (design) of these circuits.

Because of the Millstone events, the NRC requested that all licensees implement a second level of degraded voltage protection as described in a 1977 Generic Action (Multi-plant Action B-23) to ensure automatic protection of safety buses and loads. Multi-plant Action B-23 provided guidance which applied to all operating reactors at that time and plants licensed since, on how to comply with the requirements in 10 CFR Part 50, Appendix A, GDC 17.

Historical examples of electrical issues, both offsite and onsite, adversely affecting vital bus voltages or degraded voltage relaying functions are ubiquitous throughout the industry.

Notable examples are documented in many NRC generic communications, including:

Related Information Notices: Title Information Notice No. 79-04 Degradation of Engineered Safety Features (ANO Event)

Information Notice No. 89-83 Sustained Degraded Voltage on the Offsite Electrical Grid and Loss of Other Generating Stations as a Result of a Plant Trip Information Notice No. 91-29 Deficiencies Identified During Electrical Distribution System Functional Inspections Information Notice No.92-40 Inadequate Testing of Emergency Bus Undervoltage Logic Circuitry Information Notice No.95-37 Inadequate Offsite Power System Voltages During Design-Basis Events Information Notice No.2000-06 Offsite Power Voltage Inadequacies Information Notice No.2005-21 Plant Trip and Loss of Preferred AC Power from Inadequate Switchyard Maintenance Information Notice No.2007-09 Equipment Operability Under Degraded

F-6 Voltage Conditions Information Notice No.2007-14 Loss of Offsite Power and Dual-Unit Trip at Catawba Nuclear Generating Station Information Notice No.2009-16 Spurious Relay Actuations Result in Loss of Power to Safeguards Buses Related Generic Letters: Title Generic Letter No. 79-36 Adequacy of Station Electric Distribution Systems Voltages (Millstone Event)

Generic Letter No. 88-15 Electric Power Systems - Inadequate Control Over Design Processes These generic communications reflect that the electrical distribution system, both offsite and onsite, can be adversely affected by many different factors. The use of redundant electrical protective safety features reduces the potential for failure of the emergency safety equipment and provide reasonable assurance that the equipment will function under all design basis conditions.

Oconee also has had issues with their electrical distribution system design. Licensee Event Report (LER) 269/90-04 was submitted due to identified unanticipated system interactions during undervoltage condition in the 230 kV switchyard which resulted in failure to comply with Technical Specifications. The licensee determined that switchyard voltages could drop below the minimum voltage level required for worst case loading during a unit trip and LOCA on the tripped unit. Further review of the degraded voltage scenario revealed that one of the two required on-site emergency power paths, the Keowee Overhead, could be unavailable for automatic connection to the Oconee 230 kV switching station because of the relative setpoints of the undervoltage relays serving the startup breaker logic and the external grid trouble protection system.

Oconee also identified, as a result of their review for LER 90-04 that the Startup Feeder (E) breakers could potentially close on the 230 kV switchyard while switchyard voltage was degraded. Degraded grid protection was not provided due to the non-conservative setpoints of the undervoltage relays serving the E breaker logic. This event could have led to a degradation of Engineered Safeguards equipment under certain accident scenarios. This issue was captured and reported under LER 269/90-05.

The requirement to have two levels of undervoltage protection on electrical busses used to power safety-related equipment is not new. It was recognized by a generic letter providing the staffs interpretation of GDC 17 in 1977; electrical design practices to use undervoltage protection (at least one level) is many decades old. Regarding Oconee, the Panel verified that the station has inverse time characteristic, safety-related undervoltage relays physically attached to the 4160 VAC MFBs (which are electrically connected to the ES busses). The inverse-time characteristic of these relays means that they provide two levels of undervoltage protection (i.e., loss of voltage and degraded voltage) described in the 1977 generic letter. These safety-related, undervoltage relays meet the requirements of AEC 39, 10 CFR 50.36, and Technical Specifications in that they will automatically actuate to seek a reliable source of power in the event of a design basis accident or degraded voltage event.

F-7 No manual actions are required. Finally, the Panel found that the ES buses have adequate sources of emergency power under all modes of plant operation and analyzed conditions.

c. DVR Regulatory Position Over Time The agencys position related to the requirement for two levels of undervoltage protection on safety-related busses has not changed since approximately 1977.

Q2. Discuss safety significance of the issue presented as it relates to:

a. Principles of Good Regulation - Reliability: Regulations should be based on the best available knowledge from research and operational experience.

b. Safety: is there a risk reduction, and increased reliability through DVRs

c. Does BTP/PSB-1 guidance reflect best available information; is it risk-informed?

Answer:

a. Principles of Good Regulation (POGR): Reliability The ability to mitigate design basis accidents is a regulatory requirement. This ability requires the availability of reliable alternating current (AC) electrical power. This electrical power must meet the requirements of GDC-17 (and in Oconees case, AEC 39) in that each nuclear power plant must have an offsite power system and an onsite power system meeting capability, capacity, and reliability requirements. If the preferred system becomes incapable of providing the necessary power, the site emergency power system must automatically engage and power the safety-related loads in sufficient time to ensure fuel design limits are maintained. This time margin is typically narrow, on the order of several minutes, and engaging the required equipment must be an automatic function (10 CFR 50.55a(h) through IEEE Std 279) to provide reasonable assurance that the timing will be met. Adequate voltage must be available to the engineered safety features loads to ensure designed performance. Failure, or intermittent success of the vital AC power systems can prevent the ES equipment from successfully mitigating a design basis accident. This is a well-understood phenomenon and is part of a plants design basis.

For this principle, reliability means consistent application of the adequate protection mandate. The DPO Panel considered the following: Are the positions we are imposing based on the best available knowledge of the issue; are we meeting the adequate protection level, or are we imposing unnecessary obligations due to historical application of deterministic criteria?

The Panel recognizes that operating experience has improved our knowledge of nuclear power plant operation. We also recognize that not all historically-applied deterministic requirements are necessary to support adequate protection, based on advances in the body of knowledge; and adequate protection does not mean zero risk. The Panel also recognizes, however, that some engineering systems and processes still require the use of automatic actions to ensure success, and that the human element component of nuclear plant operation is not foolproof. With this knowledge, the panel believes it is reasonable and necessary that the requirements for two levels of undervoltage protection on the vital electrical buses be supported.

F-8 Because the lifecycle of anomalies on electrical distribution systems are often measured in small fractions of a second, designers work to develop protective devices which can identify the anomaly and automatically engage the protective action in time to prevent equipment lockout or damage. Undervoltage relays are examples of fast-acting protective equipment used on electrical systems to reduce or eliminate the detrimental effects of low voltage levels. The relays typically trip the circuit breaker on the out-of-tolerance source and realign the system to a good source. This realignment typically occurs within a few seconds without operator action. For equipment that must operate under all condition, redundant levels of protective relaying are typically provided.

Oconees DVR configuration meets the POGR/Reliability in that degraded voltage protection system is safety-related, Class 1E and is designed to perform its safety function with a single, active failure. Furthermore, the DVRs have an inverse-time characteristic and will automatically actuate to seek a reliable source of power in the event of a design basis accident or degraded voltage event.

b. Safety: Risk Reduction and Increased Reliability Through DVRs Generically, a second level of undervoltage protection on the ES equipment was mandated to increase equipment reliability, and provide reasonable assurance that the ES equipment would be aligned to a viable power source under design basis conditions, including degraded grid voltage as well as during conditions in which latent defects in design, failure of maintenance activities, equipment failure, human error, etc. could result in failure of a single level of protective relaying.

Notwithstanding, Oconee has only one set of undervoltage devices sensing voltage upstream of the ES buses located on the MFBs. As noted previously, the ES busses are electrically connected to the MFBs by a normally closed breaker and are at the same 4.16 kV electrical potential. The single DVRs have an inverse time characteristic which means that they provide two levels of undervoltage protection (i.e., loss of voltage and degraded voltage). These safety-related, undervoltage relays meet the requirements of AEC 39, 10 CFR 50.36, Technical Specifications, and 50.55a(h)(2) under which Oconee was licensed. The DVRs will automatically actuate to seek a reliable source of power in the event of a design basis accident or degraded voltage event.

It is not certain that adding a set of new DVRs on the ES busses (or relocating the current undervoltage relays to the ES busses) would reduce risk and increase reliability.

Specifically, the Panels risk analysis (Appendix D) found that the mean CDF values ranged from 5E-10/year to 9E-7/year, or approximately 2 to 5 orders of magnitude less than the baseline operational risk. The DPO Panel found that the relatively low risk results reflect: 1) the robustness of the overall system design at the Oconee site, and 2) the low likelihood of a sustained degraded grid voltage condition coincident with an event that would require operation of the ECCS systems. Furthermore, the Panel determined that there could be negative risk impacts if the licensee were to make modifications to the plant and apply DVR protection on the 4.16 kV ES busses. For example, the TC, TD and TE buses would need to be de-energized for periods of time in order to install the modifications, thus increasing the risk to the public while high risk components remain de-energized. Also, there may be unintended consequences (common mode failure, infant mortality, etc.) that may swamp the low levels of risk benefit from adding the relays.

F-9

c. Does BTP/PSB-1 guidance reflect best available information? Is it risk-informed?

Following Oconees original licensing actions (1967 through 1973), the 1977 generic letter was the best information available, having been formulated by NRC staff based on both professional and operating experience. Positions from the 1977 generic letter, and later the BTP, have since been incorporated into the SRP, and the requirements for two levels of undervoltage protection on the vital buses for all nuclear power plants remain. Similar protective devices are expected to be used on modular reactor electrical systems as well.

To the knowledge of the Panel, undervoltage relays are still used throughout the electrical power industry, in both nuclear and non-nuclear applications. One difference in application is the requirement to have a second level of protection on equipment that must mitigate the effects of nuclear decay heat, which is not present in other types of electrical power plants.

Neither the 1977 generic letter nor the BTP (post-1977) appear to have been risk-informed in a formal manner. While some consideration was probably given to the adequate protection requirement and what was reasonable assurance of success, the overarching need to ensure that vital equipment was not adversely affected by failure of the loss of voltage protective relaying (first level or relaying) would have still required the imposition of requirements for a second level of protection.

Q3. Discuss Oconee operational experience such as grid events of late.

Answer:

See Appendix D, Attachment 6. The Panel acquired data from the Oconee Resident Inspectors regarding the history of entry into degraded voltage grid conditions. Plant computer parameters for 3 years (2017-2019) for the switchyard Yellow bus were reviewed and the entries into a degraded voltage condition were counted. There were nine occurrences of a degraded voltage alarm on the Yellow Bus over the three year period. Though the duration of these conditions was momentary, the analyst assumed that they lasted for 1 minute each for a total of 9 minutes.

This represents an exposure time for a degraded grid condition to propagate, as opposed to a strictly initiating event frequency.

365 3 24 60 1.57 10 9

5.71 10 1.57 10 /

Document 4: DPO Decision UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 February 7, 2020 MEMORANDUM TO: Roy K. Mathew, Senior Electrical Engineer Electrical Engineering Operating Reactors Branch Division of Engineering and External Hazards Office of Nuclear Reactor Regulation FROM: Ho K. Nieh, Director /RA/

Office of Nuclear Reactor Regulation

SUBJECT:

DIFFERING PROFESSIONAL OPINION ON THE OCONEE TASK INTERFACE AGREEMENT 2014-04, NRC STAFFS RESPONSE CONCERNING DEGRADED VOLTAGE PROTECTION (DPO-2019-001)

The purpose of the memorandum is to respond to your differing professional opinion (DPO) submitted on July 11, 2018, in accordance with Management Directive 10.159, The Nuclear Regulatory Commission Differing Professional Opinions Program (Agencywide Documents Access and Management System (ADAMS) ML15132A664). Your DPO, titled Oconee Task Interface Agreement 2014 NRC Staffs Response Concerning Degraded Voltage Protection (ADAMS Accession No. ML19136A282), concerns the staffs response to Oconee Task Interface Agreement (TIA) 2014-04 associated with degraded voltage protection (ADAMS Accession No. ML18051B257).

I found your DPO to be thoroughly researched and of high technical quality. I commend you for your commitment and dedication to the NRC mission. Your willingness to raise concerns with your colleagues and managers and ensure that your concerns are heard and understood is admirable and vital to ensuring a healthy safety culture within the Agency.

My response to your DPO, including associated follow-up actions, is described in the Enclosure.

Enclosure:

As stated CONTACT: Luis Betancourt, NRR (301) 415-6146 Tim Reed, NRR/DORL (301) 415-1462

SUBJECT:

DIFFERING PROFESSIONAL OPINION ON THE OCONEE TASK INTERFACE AGREEMENT 2014-04, NRC STAFFS RESPONSE CONCERNING DEGRADED VOLTAGE PROTECTION (DPO-2019-001) DATED FEBRUARY 7, 2020 DISTRIBUTION:

R. Mathew, NRR H. Nieh, NRR M. Gavrilas, NRR R. Taylor, NRR A. Veil, NRR G. Wilson, OE P. Peduzzi, OE G. Figueroa-Toledo, OE I. Gifford, OE L. Betancourt, NRR R. Anzalone, NRR T. Reed, NRR ADAMS ACCESSION No.: ML20027C726 *via e-mail OFFICE NRR NRR* NRR NAME LBetancourt TReed HNieh DATE 01/31/20 01/31/20 02/07/20 OFFICIAL RECORD COPY

DIRECTORS DECISION FOR DIFFERING PROFESSIONAL OPINION (DPO)

OCONEE TASK INTERFACE AGREEMENT 2014 NRC STAFFS RESPONSE CONCERNING DEGRADED VOLTAGE PROTECTION (DPO-2019-001)

Background

During a 2014 Component Design Basis Inspection (CDBI) at Oconee Nuclear Station, Units 1, 2, and 3 (Oconee), Region II (RII) staff identified several concerns regarding the adequacy of the licensees degraded voltage relay (DVR) design and licensing bases. These concerns were documented in Unresolved Item 2014007-04, Degraded Voltage Relay Scheme, from the CDBI Report Nos. 05000269/2014007, 05000270/20140007, and 05000287/2014007, dated June 27, 2014 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML14178A535). To resolve these concerns, Region II developed Task Interface Agreement (TIA) 2014-04, dated November 7, 2014 (ADAMS Accession No. ML14311A862), to request assistance from the Office of Nuclear Reactor Regulation (NRR). By e-mail dated July 27, 2018, (ADAMS Accession No. ML18211A217), Region II staff revised its request by modifying the scope of the TIA and requesting NRR staff clarify whether the issues discussed in the TIA are consistent with the Oconee licensing basis and staff positions applicable to Oconee. The TIA response was subsequently issued on January 22, 2019 (ADAMS Accession No. ML18226A215). Your DPO, submitted on May 8, 2019, concerns the NRR response to TIA 2014-04.

The DPO Ad Hoc Review Panel (the Panel) issued their report to me on December 12, 2019, after reviewing the applicable documents, conducting internal interviews with relevant individuals, and completing their deliberations. I discussed your insights and comments based on the Panel report findings on January 8, 2020. On January 13, 2020, I discussed the Panel report with the DPO Panel Chair.

To inform my decision regarding your DPO, I reviewed your DPO submittal, the Panels report, and considered our discussion on January 8, 2020. I also assigned independent staff to assist in my evaluation and the documentation of my decision.

Summary of Issues The Panel identified that individual DPO concerns could be grouped into six distinct areas:

1) Licensing and design basis requirements for DVR protection

2) Lack of safety-related DVRs at the safety-related 4.16 kilovolts (kV) busses

3) Allowance of manual actions in place of automatic actions for degraded voltage protection

4) Lack of Technical Specifications (TS) requirements for DVR protection monitors

5) Incorrect safety evaluation (SE) conclusions

6) Granting of an informal exemption from the design and licensing bases requirements for DVRs Enclosure

My Assessment of the Panel Conclusions The Panel concluded that the Oconee DVR configuration is in compliance with Atomic Energy Commission (AEC) Criterion 39, Emergency Power for Engineered Safety Features; Title 10 of the Code of Federal Regulations (10 CFR) 50.36, Technical Specifications; and 10 CFR 50.55a(h)(2) requirements and is capable of responding to design basis events. The Panel also concluded that the DVR relays connected to the 4.16 kV main feeder busses (which are electrically connected to the Engineered Safeguard Feature busses) and are within the safety-related boundary. The Panel considered the robustness of the actual configuration and procedures associated with Oconees DVR scheme and performed a risk analysis in order to inform their decisionmaking.

The Panel concluded that the TIA 2014-04 response was correct, but that attributes of NRCs Principles of Good Regulation (i.e., Openness and Transparency) could have been strengthened. The Panel highlighted the disagreement between the DPO submitter and the Division of Operating Reactor Licensing Project Managers, subject matter experts (SMEs), the Electrical Engineering Operating Reactors Branch acting Branch Chief, and the backfit SME.

The Panel also concluded the DPO could have been mitigated by improving technical consistency and clarity in documenting the disposition of the submitters comments in the final TIA 2014-04 response.

I reviewed the Panels conclusions and agree that the Oconee DVR configuration is in compliance with its licensing basis. Specifically, Oconee is in compliance with the associated TS, meets the intent of the June 3, 1977, Multi-plant Action Letter, and is acceptable in view of Branch Technical Position (BTP) PSB-1, Adequacy of Station Electric Distribution System Voltages, Revision 0, regarding station electric distribution system requirements and voltages, consistent with the NRC SE response (ADAMS Accession No. ML14231B303) dated November 14, 1990, Safety Evaluation for Degraded Grid Protection (TACs 76743/76744/76745). I also agree with the Panel that this issue is of very low safety significance, and it is this perspective which guides the remainder of my conclusion.

The Panel also noted that the DPO Submitter was correct in that regulations (GDC 17, as well as AEC Criterion 39 as is cited in Oconees license bases) require automatic degraded voltage protection as described in the 1977 Multi-plant Action Letter. Notwithstanding the good work and effort by the Panel, I do not agree that General Design Criteria (GDC) 17 (both the AEC draft GDC and the final GDC issued on 1971) require DVR protection. The basis for my conclusion is described below.

Power reactor applications, reviewed by the AEC or the NRC, submitted principal design criteria (PDC) that were developed and proposed by the applicant to implement the GDC (either the draft version of 1967 or the final version in Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50 Domestic Licensing of Production and Utilization Facilities).

The GDC, in Appendix A to 10 CFR Part 50, set forth the minimum requirements for design, fabrication, construction, testing and performance for systems, structures and components important to safety. Proposed PDC, provided by the power reactor applicant, are intended to meet or exceed the GDC and are provided in the Preliminary Safety Analysis Report (PSAR) to support the AEC/NRC review of the application. The AEC or NRC, if and when it determines the design meets the requirements of the Atomic Energy Act of 1954, as amended, and the Commissions regulations, issues a Construction Permit (CP). The approved design is then carried forward to issuance of the Operating License (OL) where the Commission must find that the facility was built in accordance with the PDCs and any changes under 10 CFR 50.57,

Issuance of Operating License. Accordingly, following issuance of the CP and the OL, the Commission reached the conclusion that the design basis of the power reactor, as reflected in the proposed PDC meets or exceeds the criteria set forth in the GDCs. The GDC have never been revised subsequent to their final issuance in 1971, and accordingly, their meaning and intent (explained in the supporting Statement of Considerations) remains unchanged as at issuance in 1971.

Oconee received both its CP1 and OL2 (i.e., its design was approved and its OL issued in view of that approved design) prior to the degraded voltage events3 that led the Commission to take regulatory actions to address degraded voltage conditions. The operational experience from these events was information and knowledge not known and understood in 1971 (or before),

when the GDCs were issued in Appendix A to 10 CFR Part 50. As a direct result, PDC developed prior to 1977 to meet or exceed the minimum requirements of the GDC could not have considered this information, and as such these requirements, and the associated approved PDCs, do not include a requirement for automatic degraded voltage systems.

Similarly, the Institute of Electrical and Electronics Engineers (IEEE) Standard (Std.) 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations, referenced in 10 CFR 50.55a(h)(2), could not have been understood to address degraded voltage conditions that occurred many years after the standard was issued.

As such, the approved design basis for Oconee did not address degraded voltage conditions, and this is why the NRC in 1977 needed to take the subsequent actions to issue two generic actions and develop BTP PSB-1. It is these follow-on regulatory actions that put in place DVR requirements for existing operating reactors (including Oconee) which resulted in the Oconee licensing basis now including requirements for DVR.

The Panel discusses the requirements in 10 CFR 50.36, Technical Specifications, and refers to paragraphs (c)(2) and (c)(3). 10 CFR 50.36(c)(2)(ii) states that a licensee is not required to propose to modify TSs included in any license issued before August 18, 1995. In fact, when the rule was amended in and became effective in 1995, 10 CFR 50.36(c)(2) and (c)(3) were specifically amended to add the four criteria identified in (c)(2). The final rule was clear in stating that any new TS provision that the NRC wishes to consider adding to a current licensees TS must be justified in accordance with the backfit rule. Therefore, the issuance of 10 CFR 50.36 did not impose new TSs on Oconee or any other OL.

Very Low Safety Significance Issue Resolution (VLSSIR) and Technical Assistance Request (TAR) Processes In view of the Panels assessment of the safety significance of this issue, and in the context of the new processes being put in place in NRR today (i.e., VLSSIR4, the ongoing revision to NRR Office Instruction COM-1065, Control of Task Interface Agreements, (projected for June 2020),

1 The NRC issued the Construction Permits to Duke Energy Corporation for Oconee Nuclear Station, Units 1, 2, and 3 on November 3, 1967. Duke Energy Corporation converted to Duke Power Company LLC on April 3, 2006 and was re-named Duke Energy Carolinas, LLC as of October 1, 2006. Duke Energy Carolinas, LLC is the owner and operator of Oconee Nuclear Station, Units 1, 2, and 3.

2 The NRC issued the Operating Licenses to Duke Energy Carolinas, LLC for Oconee Nuclear Station, Units 1, 2, and 3 on February 6, 1973, October 6, 1973, and July 19, 1974, respectively.

3 These events took place in July 1976 at Millstone Nuclear Power Station and in 1979 at Arkansas Nuclear One.

4 Addressing Issues of Very Low Safety Significance, ADAMS Accession No. ML19260G224.

5 The TIA working group is working on a major overhaul of the TIA/TAR program contained in the NRR guidance, COM-106, Control of Task Interface Agreements, ADAMS Accession No. ML15219A174.

and the Commission revised policy and guidance on backfitting), I would like to give my thoughts on how we should be evaluating safety significance prior to the expenditure of significant resources in evaluating an issue.

First, as you may be aware, the agency is currently undergoing an effort to update and improve its TAR (formerly TIA) process. While I expect this effort will improve the TAR process in a number of ways, the current path forward on this improvement and the VLSSIR process would result in the agency taking a different approach.

Both the implementation of the VLSSIR and the ongoing revisions to the TAR processes will help us maintain a clear focus on the most safety important issues. In light of the Panels conclusion, it is my view that if these processes had been in place and used, it would have resulted in the low safety significance issue being dispositioned at an earlier stage and with less resources expended6.

Backfit considerations When I consider this issue in the context of a potential backfit, I would now use the recently issued Management Directive (MD) 8.4, Management of Facility-Specific Backfitting and Information Collection guidance. The key driver for backfitting is safety significance.

Specifically, MD 8.4 discusses three principal justifications for the agency to impose a backfit:

adequate protection, compliance, and cost justified substantial increase in protection. MD 8.4, Step I.A.7 states that the, NRC must first consider whether regulatory action is necessary to ensure adequate protection of public health and safety, and if so whether there is an imminent threat to public health and safety.

So, in view of the Panels conclusion of the safety significance of this issue (i.e., the Panel results yielded mean delta core damage frequency values ranging from 5E-10/year to 9E-7/year, or approximately two to five orders of magnitude less than the baseline operational risk), it is clear to me that this issue is far below a threshold of safety significance (and note I recognize that a more detailed effort would be a fully risk-informed determination) to be considered to present either an undue risk condition to the public, or even a substantial level of risk such that a traditional backfit analysis could be pursued. In other words, it does not appear to be viable to impose new requirements on this licensee and meet either the adequate protection exception criteria in 10 CFR 50.109(a)(4), or to satisfy the substantial additional overall protection standard in 10 CFR 50.109(a)(3). As should be apparent, this also means there is no imminent threat and as such no need for immediate action as a direct result.

This leaves only compliance as a possible path forward. Here, if I look at what was done in 1990 when the staff issued a SE on this matter, it is my view that SE showed a complete and full understanding of the applicable BTP. I conclude that was a thoughtful SE that reached the proper conclusion. In terms of whether this approval could be viewed as an error and therefore subject to a potential compliance backfit, I conclude that there was no error in that approval.

In summary, I found that that there is no adequate protection, compliance, or cost-justified substantial increase in protection basis for modifying the current Oconee DVR configuration.

Based on the above, I conclude that we could not (today) impose new requirements on this 6

This discussion assumes that the other existing constraints for implementing the VLISSR process would be met.

licensee for this issue, nor could we impose additional TS requirements in view of the 1995 amendment to 10 CFR 50.36.

I appreciate the Panels thoughtful assessment of the concerns raised in the DPO. My responses to specific Panel recommendations are provided below.

Response to Recommendation 1 (Panel Recommendation 1) while a verbal meeting was held with the DPO submitter in October 2018 to disposition the NRR Electrical Branchs comments to the draft TIA response, a more formal disposition and addressing of the comments in written form in the final TIA response would have been beneficial from the standpoint of the Principles of Good Regulation (i.e.,

Openness and Transparency) for internal staff and in this case, the DPO submitter. Including a written disposition of the comments in the TIA response could have, in fact, eliminated the need for this DPO Panel resulting in an overall saving of agency resources I agree with the Panel that documenting the disposition of the submitters comments to the TIA 2014-04 response would have been beneficial from the standpoint of the NRCs Principles of Good Regulation (i.e., Openness and Transparency). However, it is apparent that the decisionmaking process would have benefited from better communication with the Region and internally within NRR. NRR is a learning organization and is receptive to ideas for process improvements to enhance our ability to carry out our mission efficiently and effectively.

After evaluating this issue in the NRCs broader safety and security mission and holistically considering all information available to me, I found that the ongoing revision to COM-106 provides a clear opportunity to resolve comments from the requesting office, as well as comments raised during the development of the TAR response by NRR staff. While I recognize the important role of documenting the disposition of the staffs comments in ensuring high-quality clear documentation of regulatory decisions, my assessment is that the ongoing revision to COM-106 sufficiently addresses this subject.

Response to Recommendation 2 (Panel Recommendation 2) a review of the process, as applied to the response to TIA 2014-04, should be considered to ascertain whether there were any missed opportunities to have researched Oconees DVR configuration to the same depth as that performed by the DPO Panel. Specifically, the Panel reviewed and evaluated specific licensee procedures and drawings to verify that Oconees DVR configuration (i.e., the ABB CV-7, 27N and 27E, undervoltage relays on the 4.16 kV MFBs) meets regulatory requirements. Having evaluated the electrical distribution system design configuration to the same depth during development of the TIA response may have eliminated the need for this DPO Panel resulting in an overall saving of agency resources The Panel suggests that a review of the TAR process be considered to ascertain whether there were missed opportunities to have researched the Oconee DVR configuration at a greater depth, and thereby, eliminate what occurred in this situation (i.e., a DPO and the subsequent need for the panel to do this work). I have a different perspective.

Both the implementation of the VLSSIR and the ongoing revisions to the TAR processes are intended in part, to establish a better means for promptly assessing and resolving low safety significant issues within existing regulatory processes and thereby focus those resources on

issues of greater safety significance. The Panel concluded that the issue involved for Oconee was of very low safety significance. It is my view that if these processes had been in place and used, it would have resulted in the very low safety significance issue being dispositioned, at an earlier stage, and with less resources expended. Therefore, I find it reasonable to conclude that the implementation of the new VLSSIR process, and if applicable, the revised TAR process (i.e.,

if the issue is not clearly determined to be very low safety significance and enters the TAR process) would be a better means to address future issues similar to Oconee, rather than to revise the TAR process. As regulators, it is my conclusion that these processes enable us to better serve public health and safety.

Response to Recommendation 3 (Panel Recommendation 3) more dialogue in Regulatory Information Summary (RIS) 2011-12, Adequacy of Station Electric Distribution System Voltages on pre-GDC plants, such as a discussion of the 10 CFR 50.36(c)(2)(iii) exemption and 50.55a(h)(2), would have led to an increased understanding of the licensing basis associated with plants that were issued construction and operating licenses before GDC 17 came into effect. Such additional research and documentation in 2011 could have addressed at least some of the DPO submitters concerns. Supplementing RIS 2011-012 regarding pre-GDC plants should be considered as a knowledge transfer tool to future regulators.

While I recognize the value in clarifying the application of GDCs to this issue as should be evident from the discussion above, I believe that a more effective path forward is to address this issue as part the follow-on backfitting training that will support the final issuance of the new backfitting guidance (i.e., NUREG-1409, Backfitting Guidelines, is currently undergoing a revision to align with and implement the Commissions newly issued and revised MD 8.4). I do not see the value of expending resources in supplementing Regulatory Information Summary 2011-12 to address the specific issue of DVR scheme. Also, I do not expect that at a significant number of additional DVR issues to arise for the operating fleet (given the history and evolution of the issue) to warrant expenditure of those resources. My assessment is that when issues do arise for this issue or others, I conclude that the new backfitting policy, with the new revised guidance (under development) and the supporting training for the staff sufficiently addresses the subject of ensuring that these issues and others that are similar, are properly addressed.

Concluding Remarks I found that your DPO positions were of notable technical merit and well documented in your submittal. Based on the multiple evaluations that have confirmed the very low safety-significance of the issue and the overall adequacy of the staffs evaluation of the TIA response, I have concluded that Oconee meets its licensing basis. Your submittal also highlighted the importance of intra and inter-office communications and collaboration to improve the quality of our decisionmaking consistent with the NRCs Principles of Good Regulation and the NRC values.

A summary of the DPO will be included in the Weekly Information Report (when the case is closed) to advise employees of the outcome.

Thank you for raising your DPO and for your active participation in this process. I commend you for your commitment and dedication to the NRC mission. An open and thorough exploration of how we carry out our regulatory processes is essential to keeping these programs effective.

Your willingness to raise concerns with your colleagues and managers will ensure that your

concerns are heard and understood is admirable and vital to ensuring a healthy safety culture within the Agency.

References

1. Oconee Nuclear Station - NRC Component Design Basis Inspection Report 05000269/2014007, 05000270/20140007, and 05000287/2014007, ADAMS Accession No. ML14178A535, June 27, 2014.

2. Request for Technical Assistance Regarding the Adequacy of The Oconee Station Design and Licensing Bases for the Degraded Voltage Relay Protection Design (TIA 2014-04), ADAMS Accession No. ML14311A862, November 7, 2014.

3. Oconee, Units 1, 2, and 3 - TIA 2014-04, Request for Technical Assistance Regarding the Adequacy of the Station Design and Licensing Bases for the Degraded Voltage Relay, ADAMS Accession No, ML15154A490, May 22, 2015.

4. Oconee Nuclear Station, Units 1, 2, and 3 - DVR, ADAMS Accession No.,

ML18211A217, June 27, 2018.

5. Oconee Nuclear Station, Units 1, 2, and 3 - Response to Task Interface Agreement 2014-04, Adequacy of The Oconee Nuclear Station Design and Licensing Bases for Degraded Voltage Protection (TAC NOS. MF4622, MF4623, AND MF4624; EPID L-2014-LRA-003), ADAMS Accession No. ML18226A215, January 22, 2019.

6. Oconee Task Interface Agreement 2014 NRC Staffs Response Concerning Degraded Voltage Protection, ADAMS Accession No. ML19136A282, May 8, 2019.

7. DPO-2019-001, Memo Establishing DPO Panel, ADAMS Accession No. ML19140A434, May 21, 2019.

8. Differing Professional Opinion Panel Report on the Oconee Task Interface Agreement 2014-04, NRC Staff's Response Concerning Degraded Voltage Protection (DPO-2019-001), ADAMS Accession No. ML19347B523, December 12, 2019.

Document 5: DPO Appeal Submittal

Attachment - DPO-2019-01 Perceived Flaws in the DPO Decision The DPO Panel and the Office Directors evaluation erroneously concluded that the Oconee DVR configuration is in compliance with its licensing basis. Specifically, Oconee is in compliance with the associated TS, meets the intent of the June 3, 1977, Multi-plant Action Letter, and is acceptable in view of Branch Technical Position (BTP) PSB-1, Adequacy of Station Electric Distribution System Voltages, Revision 0. This statement and conclusions are inconsistent with NRC staffs safety evaluation and the UFSAR design basis as discussed in my DPO. My review indicated that Oconee Units 1, 2, and 3 do not meet the regulatory requirements and licensing basis pertaining to the degraded voltage protection requirements for the electric power system and currently all Oconee units are operating with inadequate protection from degraded voltage conditions. The concern raised in my DPO is not satisfactorily addressed because the response contains several flaws in the technical and regulatory evaluations.

1. The DPO Panel made the following conclusions and recommendation:

• Oconee meets the regulatory requirements under which they were licensed (i.e., their license basis).

• The DPO Panel did not find a non-compliance associated with the licensing basis or the degraded voltage protection scheme at Oconee.

• Oconee has inverse-time characteristic, safety-related undervoltage relays physically attached to the 4.16 kilovolt (kV) alternating current Main Feeder Busses (to which the engineered safeguard (ES) busses are connected). These relays will automatically actuate to seek a reliable source of power in the event of a design basis accident or degraded voltage event. No manual actions are required. Furthermore, Oconees electrical system is unique in its use of hydroelectric and gas turbine units to provide redundant, independent sources of emergency and offsite power. Coupled with the undervoltage protection schemes on the 230 kV and Main Feeder Buses (MFBs), the ES buses have adequate sources of emergency power under all modes of plant operation and analyzed conditions.

• Normally, a nuclear plant would be required to have the degraded voltage relay (DVR) setpoints defined in the plants Technical Specifications (TSs) in accordance with 50.36(c)(1)(ii)(A) since these setpoints are associated with a limiting safety system setting (LSSS). However, 10 CFR 50.36(c)(2)(iii) states that a licensee is not required to propose to modify TSs that are included in any licensee issued before August 18, 1995.

Since Oconees operating License and TSs were issued prior to 1995 in the early 1970s, the licensee is not required to include DVR setpoints in TS.

• Recommendation 3 - More dialogue in Regulatory Information Summary (RIS) 2011-12, Adequacy of Station Electric Distribution System Voltages on pre-GDC plants, such as a discussion of the 10 CFR 50.36(c)(2)(iii) exemption and 50.55a(h)(2), would have led to an increased understanding of the licensing basis associated with plants that were issued construction and operating licenses before GDC 17 came into effect. Such additional research and documentation in 2011 could have addressed at least some of the DPO submitters concerns. Supplementing RIS 2011-012 regarding pre-GDC plants should be considered as a knowledge transfer tool to future regulators.

The following key points are provided below for my evaluations to conclude that the panel decision is flawed:

(i) Oconee does not have a safety related (Class 1E) degraded voltage protection scheme at the 4.16 kV engineered safeguard (ES) buses (1) (2) (3) TC, TD, and TE or standby safety related buses to transfer the bus to the onsite power system upon a degraded voltage condition at the 230 KV offsite power system. The 230 KV degraded voltage protection and actuation system (second level DVR protection) were installed on the 230 kV in the 1987- 1990 time frame to address the design deficiencies identified that were not adequately evaluated when responding to 1977 Multi-plant Action generic issue and Generic Letter, "Adequacy of Station Electric Distribution System Voltages," August 8, 1979. The licensee made a determination (1970s and 1980s) that concluded that the undervoltage relays connected to the 4.16 kV main feeder busses were sufficient to address the NRC requirements for additional second level DVR protection for all operating power plants. As stated in the DPO, the NRC staff made several errors in approving the current DVR design although the reviewers were aware that the proposed modification did not fully meet BTP PSB-1 in several areas (as stated in several NRC safety evaluations) as well as not protecting the safety related equipment from the consequences of degraded voltages. The logic used to approve this design has no regulatory and technical bases. The DPO Panel states that the staffs decision to not mandate all the guidance specified in the BTP, relative to the robustness of the Oconee local grid was appropriate, albeit confusing and not well explained. I am concerned that the panel and the Office Directors evaluations do not make any recommendations to correct such an inadequate safety evaluation and going forward, in the future to close out a generic safety issue or issuing licensing action is a concern. My concerns are detailed in the DPO and not restated here.

In addition, the Panel report states the panel found that the DVR relays are within the safety-related Class 1E boundary (see Oconee drawing O-702-A, Oconee Nuclear Station Units 1-3, One-Line Diagram, 6900 & 4160 Auxiliary System, Revision 38. Drawing O-702-A is a QA Condition 1 drawing and is safety-related (see grid G-3). This drawing shows the safety-related, CV-7, 4160 undervoltage relays physically connected to the MFBs. In turn, the MFBs are electrically connected to the ES busses through normally closed breakers. Each of the two MFBs can be connected to each of the three ES buses through redundant circuit breakers, ensuring the ES buses have a continuous source of reliable power. (See drawings O-0702 for unit 1; O-1702 for unit 2, and O-2702 for unit 3). These ABB CV-7 type, (identified by the licensee as 27N and 27E), undervoltage relays have an inverse-time characteristic, are part of the safety-related EPSL system and will automatically actuate to seek a reliable source of power in the event of a design basis accident or degraded voltage event. See attached Figures - My review indicated that the above relays 27N and 27E were originally installed at the time of initial licensing of Oconee Units and these relays are part of undervoltage monitoring scheme for

Reactor Coolant Pump 6.9 kV buses 1TA and 1TB buses. These buses are fed from Auxiliary Transformer (1) (2) (3) T (main generator source) 6.9 kV winding, whereas a separate 4.16 kV winding of (1) (2) (3) T transformer feeds the ES buses. The staffs safety evaluation dated November 14, 1990 states undervoltage relays (1 per phase with 2 out-of-three logic) on the secondary side of each unit's auxiliary transformer open the unit's N breakers. Similarly, undervoltage relays on the secondary side of each unit's startup transformer open the unit's E breakers. Upon opening of the N and E breakers, non-safety related undervoltage relays on each unit's 4 kV main feeder buses sense a loss-of-voltage condition and start the Keowee hydroelectric units. Therefore, the ES buses are not monitored by these relays which is the subject of the TIA and the DPO. As stated in the DPO, these inverse-time undervoltage relays are not installed for degraded voltage protection, but to transfer the ES buses to the onsite power system on a loss of voltage condition. These relays will automatically disconnect buses for loss of voltage scenarios ( voltages below 88% at the ES buses) and as discussed above, these were part of first level undervoltage protection scheme before the second level under voltage protection schemes were required by NRC part of 1977 Multi-plant Action generic issue resolution. Therefore, the licensee never installed a second level undervoltage protection scheme to comply with the 1977 Multi-plant Action generic issue resolution. It appears that the licensees correspondences in the 1970s misled the staff that it had safety related relays performing the same functions and requirements as stated in the compliance letter issued to the licensees on June 3, 1977. In addition, I noted that the only design basis information provided in the Oconees UFSAR is regarding the 230 kV Switching Station Degraded Grid Protection and the 100 kV Switching Station (there is no discussion of main feeder bus or startup bus 4.16 kV undervoltage protection).

Also, my review indicated that the 230 kV DVR protection system is not single failure proof, non-safety related, and does not meet the regulatory requirements for Oconee electric power system (AEC GDC 39 (additional requirements added to satisfy the DVR concerns), 50.55a(h)(2) (IEEE 279 requirements for safety related system), and 50.36 concerning addition of trip setpoints for DVR and LOV relays in TS part of LSSS requirements. I noted that the licensee states the startup transformers and associated degraded voltage protection systems on the 230 kV system as safety-related. Please note that the NRC has previously clarified, in response to another TIA response, that QA-1 category is not the same as Class 1E or safety related since they do not meet the single failure criteria and protection requirements for natural phenomena and are susceptible to common-cause failures. The Oconee units normally operate with ES buses aligned to the main generator power with loss of voltage protection from main feeder buses and the DVR protection at 230 kV system.

As stated above, the 230 kV degraded voltage protection and actuation system (second level DVR protection for offsite power source) was installed in the 1990s to address the design deficiencies identified in previous licensee submittals. I noted that the licensee had never withdrew or corrected any of the earlier submittals (1970s and 1980s) regarding DVRs when it submitted the amendment requests to address the design deficiencies identified via LERs. Also, I noted that the degraded voltage settings specified in TS for the 230 kV system is 98 -99.5%,

while the loss of voltage setting at the 4.16 kV main feeder bus is 88% based on licensing submittals (not in the current TS). This shows that the relay setting is meant for loss of voltage protection (less than 98% Nominal voltage) and not for degraded voltage protection of equipment. This is further evidenced in the design basis information provided in the current UFSAR section 8.2.1.3 states and is also specified in my DPO:

Voltage analyses indicate that several 208V and 600V MOV and continuous-duty motor terminal voltages are below the acceptance criteria during the worst-case accident with degraded grid conditions. The analyses conclude that (a) several MOV's could stall due to the low supply voltage and (b) 4160V bus undervoltage relays could trip, thereby disconnecting the EDS from the transmission grid and repowering it from the standby on-site emergency power source (i.e. a Keowee Hydro Unit). As an operating option, by load shedding several large non-safety related 4160V loads, safety related equipment performance can be improved during an accident with degraded grid conditions.

Normally, the Oconee 230 kV switchyard operates satisfactorily at rated voltage when one or more Oconee Units are on-line. If all three units are off-line (including a single on-line Unit that trips), a minimum switchyard voltage is not guaranteed.

In the event of a design basis accident, the accident Unit trips off-line. This reduces switchyard voltage due to the lost generation. As an operating preference, by tripping several large non-safety related loads, the available margin can be maintained above an acceptable level. If the load shed circuitry is unavailable or fails to operate, the Keowee Units will start and re-power the safety related EDS as designed.

Therefore, based on the above discussions, I conclude that the licensee has not adequately addressed the safety-related second level DVR protection requirements for Oconee units 1, 2, and 3 and the licensee is not in compliance with NRC requirements specified in the DPO.

ii. DPO panel response and Office Directors letter clarified the §50.36 requirements pertaining to LCOs, but the TIA question and the DPO is referring to the LSSS requirements in § 50.36 -

not LCO requirements. The regulation is clear about the exemption for LCO requirements for Oconee because it was initially licensed before August 18,1995. The panel response and the TIA response are in error because it is referring to the wrong requirement in 50.36. Therefore, the panels review did not correctly address the DPO concern.

The following information was provided in the DPO The Region II staffs concern was based on the licensee not providing the LOP relay setpoints and associated time delays not included in the plant TSs for setpoints and time delays. Please note that the applicable requirement is specified in 10 CFR 50.36 (c)(3) and not 10 CFR 50.36(c)(2)(ii)(C), Criterion 3. The regulation at 10 CFR 50.36(c)(3) requires TSs to include items in the category of surveillance requirements, which are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the LCOs will be met. The SRs for emergency power system is discussed in TS 3.3.17 thru 3.3.23. However, SR associated with LCO 3.3.17 only require the performance of a channel functional test and do not include a requirement to perform a channel calibration. My review determined that this testing appears to be insufficient to verify operability of an EPSL Automatic Transfer Function channel and the licensee is not meeting 10 CFR 50.36(c)(3) requirements. In addition, the TIA response referring to requirements of LCO (i.e.,

10 CFR 50.36(c)(2)(iii)) does not to apply to 10 CFR 50.36(c)(3)). Therefore, the licensee is required to identify LOP relay setpoints and associated time delays in TS as required by 10 CFR 50.36(c)(3)) and staff positions provided in NRC compliance letter dated June 3, 1977 and BTP PSB-1.

iii. The risk evaluation performed for the degraded voltage protection issue has never been modeled by the NRC. Therefore, the uncertainties and assumptions made in the evaluation

cannot be validated. It should be noted that the degraded voltage protection issue was a generic safety issue because it impacts both redundant safety related buses and both redundant trains of ECCS equipment. This is particularly true for Oconee because ES buses are powered by the same offsite or auxiliary power. This is one of the reasons why NRC took generic action to resolve this issue - common cause failure concerns.

The risk assessment states that with no established methodology for this type of risk assessment, it was performed outside of normal NRC processes. Both the Office Directors evaluation and DPO panel report characterized this issue as low safety significance which are incorrect and inconsistent with the NRCs prior evaluations which resulted in NRC taking actions via generic safety resolution process (NRC Multi-plant Generic Action B-23 resolution. I am concerned that an unsupported risk assessment was used to screen a generic safety issue as low safety significance. This is contrary to the NRCs mission of maintaining safety of nuclear power plants.

Several precedence exists where NRC inspectors have identified non-compliance with DVR requirements for plants such as Millstone, ANO, Peach Bottom, Limerick, Palo Verde, Hatch, Farley, Ginna, Fermi, Watts Bar, Sequoya, Nine Mile, and DC Cook. The licensees for these plants have addressed the DVR issues satisfactorily. The non-compliance with Oconee Units 1,2, and 3 must be resolved similarly.

I note that a risk-informed process cannot disregard the current NRC requirements unless the licensee requests exemption and reliefs from meeting applicable requirements. Also, it is important to note that a risk-informed framework should be used in a manner that complements the NRCs deterministic approach (design functional requirements) and supports the NRCs traditional defense-in-depth philosophy.

My conclusion is that the Oconee DVR configuration is still not in compliance with AEC Criterion 39, 10 CFR 50.36, and 50.55a(h)(2), a requirements that are imposed on all licensees since the original licensing of Oconee.

iv. I reviewed Recommendation 3 which states pre-GDC plants, such as a discussion of the 10 CFR 50.36(c)(2)(iii) exemption and 50.55a(h)(2), would have led to an increased understanding of the licensing basis associated with plants that were issued construction and operating licenses before GDC 17 came into effect. This statement is incorrect because there is no difference in the DVR protection requirements and requirements to be added in the TS for a pre-GDC vs. a GDC plant. As stated earlier, the requirements to be added in the TS is a LSSS setpoints and time delays for DVR or LOV relays are a requirement in the TS in accordance with 10 CFR 50.36 (c)(3). There is no exemption provision specified in this regulation. These additional requirement was imposed on all licensees irrespective of what criteria to the plants were licensed to resolve the common cause failure concerns in the electric power system.

Therefore, I find no issue with the RIS 2011-12 staff positions and restatement of regulatory bases and staff positions for DVR protection requirements.

Document 6: Statement of Views UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 March 30, 2020 MEMORANDUM TO: Margaret M. Doane Executive Director for Operations FROM: Ho K. Nieh, Director /RA/

Office of Nuclear Reactor Regulation

SUBJECT:

STATEMENT OF VIEWS REGARDING APPEAL OF DIFFERING PROFESSIONAL OPINION CONCERNING DPO-2019-001 The purpose of this memorandum is to provide my statement of views on the appeal of differing professional opinion (DPO)-2019-001 1, concerning the U.S. Nuclear Regulatory Commission (NRC) staffs response to Oconee Task Interface Agreement (TIA) 2014-04 associated with degraded voltage protection.

On March 5, 2020, the DPO submitter sent an appeal to you regarding the DPO response decision because the DPO response contained inaccurate technical and regulatory bases to conclude that Oconee meets its licensing basis. In addition, the appeal states that there are flaws in the DPO decision and I do not agree with the panel and the Office Directors evaluation that supports the panels conclusion and recommendations I have reviewed the associated documents for this DPO, the DPO appeal, and met with the appealer on March 23, 2020, to deepen my understanding of the issues raised over this activity.

My views on the appeal The appealer asserted that the DPO Ad Hoc Review Panel (the Panel) Report and my Decision contained inaccurate technical and regulatory bases. Specifically, the appealer asserted that the DPO Decision is in error and Oconee Nuclear Station, Units 1, 2, and 3 (Oconee) does not meet its licensing basis. I disagree with this assertion because the facts that were presented by the Panel were soundly established through a comprehensive review of the technical and regulatory dimensions of the matter at hand.

CONTACT: Luis Betancourt, NRR 301-415-6146 1 On May 8, 2019, a Senior Electrical Engineer from NRR submitted a DPO regarding the staffs response to Oconee TIA 2014-04 associated with degraded voltage protection (Agencywide Documents Access and Management System (ADAMS) Accession No. ML19136A282). On December 12, 2019, the Panel issued their report to the NRR Office Director (ADAMS Accession No. ML19347B523). On February 7, 2020, the NRR Office Director issued a Directors Decision to the DPO submitter (ADAMS Accession No. ML20027C726).

The Oconee degraded voltage relay (DVR) scheme meets the regulatory requirements under which it was licensed 2 (i.e., the licensing basis). None of the regulatory requirements and actions identified by the appealer required the installation of a degraded voltage protection scheme at Oconee.

The licensing basis for degraded voltage protection was established by the NRCs approval of the licensees responses to the 1977 and 1979 Generic Letters. It was not imposed through generic or plant-specific regulatory actions. Concerning Oconee, these specific approvals involved placing a DVR scheme in the 230 kilovolts (kV) switchyard. These approvals represent the licensing basis for Oconee on this issue. The appealers reference to the other regulatory requirements and guidance, such as Branch Technical Position PSB-1, Adequacy of Station Electric Distribution System Voltages, Revision 0, are not part of the Oconee licensing basis.

The appealer specified three flaws with the DPO Decision. My views on the three flaws are as follows:

1. Oconee does not have a safety related (Class 1E) degraded voltage protection scheme at the 4.16 kV engineered safeguard (ES) buses (1) (2) (3) TC, TD, and TE or standby safety related buses to transfer the bus to the onsite power system upon a degraded voltage condition at the 230 kV offsite power system. The appealer states that his review of the drawings identified by the Panel report is part of undervoltage monitoring scheme for Reactor Coolant Pump 6.9 kV buses 1TA and 1TB buses, which are non-safety-related. After reviewing the applicable drawings, conducting internal interviews with relevant Panel members, and meeting with the appealer, I concluded that the DVR relays identified by the Panel report are connected to the 4.16 kV main feeder busses (which are electrically connected to the Engineered Safeguard Feature busses) and are within the safety-related boundary. Therefore, I do not agree with the appealer.

2. [T]he licensee is required to identify LOP [loss-of-power] relay setpoints and associated time delays in TS as required by 10 CFR 50.36(c)(3)) and staff positions provided in NRC compliance letter dated June 3, 1977 and BTP PSB-1. The appealer discusses the requirements in Title 10 of the Code of Federal Regulations (10 CFR) Part 50 Section 50.36, Technical Specifications, and refers to paragraphs (c)(2) and (c)(3). Specifically, the appealer makes reference to 10 CFR 50.36 as requiring DVR Technical Specifications (TS). The initial set of TSs for Oconee was reviewed, approved, and issued with the initial Operating License prior to the degraded voltage events3 that led the Commission to take regulatory actions to address degraded voltage conditions. All changes to the TS after the Commissions issuance of the license and supporting TSs were reviewed and approved by NRC. This represents the actual implementation of 10 CFR 50.36 and is the Oconee-specific TS. The more general requirements at 10 CFR 50.36 guide applicant proposals for TSs, but they do not override the specific Commission review and approval of TS for individual licensees.

2 Oconee received both its Construction Permit and Operating License prior to the degraded voltage events that led the Commission to take regulatory actions to address degraded voltage conditions. The operational experience from these events was information and knowledge not known and understood in 1971 (or before), when the General Design Criteria were issued in Appendix A to Title 10 of the Code of Federal Regulations Part 50.

3 These events took place in July 1976 at Millstone Nuclear Power Station and in 1979 at Arkansas Nuclear One.

3. The risk evaluation performed for the degraded voltage protection issue has never been modeled by the NRC. Therefore, the uncertainties and assumptions made in the evaluation cannot be validated. I tasked the Division of Risk Assessment to do an independent peer review 4 of the risk insights in the DPO Panel report. The results of the independent review concluded the Panel used NRC guidance to appropriately model the issue of concern. The independent peer review did not identify any issues that would impact the results of the risk assessment or my Director Decision.

Accordingly, I conclude that the appealer has not raised any additional issues that fundamentally impact the conclusions of the Panel report and my DPO Decision. After evaluating this issue in the NRCs broader safety and security mission and holistically considering all information available to me (including the risk insights in the Panel report), I concluded that the issue involved for Oconee was of very low safety significance 5.

New processes are being put in place at the NRC, such as the Very Low Safety Significance Issue Resolution process in Inspection Manual Chapter 0612, Issue Screening, the ongoing revision to NRR Office Instruction COM-106, Control of Task Interface Agreements, and the staffs guidance for implementing the Commissions direction on backfitting in SRM-SECY 0049. An underlying objective of these processes is to better serve public health and safety by focusing regulatory attention on matters of greater significance. It is my view and recommendation that you should employ a risk-informed approach, consistent with the NRCs Principles of Good Regulation, in arriving at your decision on this appeal.

4 The independent peer review report was issued on March 23, 2020 (ADAMS Accession No. ML20076C874). The independent peer review followed the process provided in ADM-504, NRR Technical Work Product Quality and Consistency.

5 The results of DPO Panel risk insights yielded mean delta core damage frequency values ranging from 5E-10/year to 9E-7/year, or approximately two to five orders of magnitude less than the baseline operational risk.

ML20086G867 *via e-mail OFFICE NRR/TA* NRR/D*

NAME LBetancourt HNieh DATE 03/26/2020 03/30/2020 Document 7: DPO Appeal Decision UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 January 28, 2021 MEMORANDUM TO: Roy K. Mathew Senior Electrical Engineer Electrical Engineering Branch Division of Engineering and External Hazards Office of Nuclear Reactor Regulation Signed by Doane, Margaret FROM: Margaret M. Doane on 01/28/21 Executive Director for Operations

SUBJECT:

DIFFERING PROFESSIONAL OPINION APPEAL CONCERNING DEGRADED VOLTAGE PROTECTION AT THE OCONEE SITE (DPO-2019-001)

The purpose of this memorandum is to inform you of my considerations and conclusions regarding the Differing Professional Opinion (DPO) appeal you submitted on February 28, 2020.

The appeal raised concerns with the decision issued by the Director of the Office of Nuclear Reactor Regulation (NRR) on February 7, 2020, concerning degraded voltage protection at the Oconee Nuclear Station for Units 1, 2, and 3 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML20027C726). I evaluated the issues you raised in the appeal using the process described in Management Directive 10.159, The U.S. Nuclear Regulatory Commission (NRC) Differing Professional Opinions Program, to ensure appropriate agency action in this matter.

After careful consideration of your appeal, I conclude the degraded voltage relay (DVR) protection scheme at the Oconee Nuclear Station for Units 1, 2, and 3 (Oconee) is consistent with the site s current licensing basis. This scheme was reviewed and approved by the NRC staff. Additionally, the current degraded voltage protection scheme at Oconee provides reasonable assurance of adequate protection of site safety. However, with respect to your issue regarding the lack of relay setpoints and time delays in the technical specifications (TS), I have determined that further review is necessary by the staff as discussed in Enclosure 2.

CONTACT: Christopher Cook, OEDO (301) 415-6397

R. Mathew 2 Your DPO appeal raised four specific issues1. A paraphrased summary of issues and my conclusions for each are as follows:

Issue 1. The licensee is required to identify loss-of-power (LOP) relay setpoints and associated time delays in TS as required by 10 CFR 50.36(c)(3) and staff positions provided in the NRC compliance letter dated June 3, 1977, and BTP PSB-1. You also assert that your original DPO was not correctly addressed because the regulatory exception in 10 CFR 50.36(c)(2)(iii) does not apply to a surveillance requirement under 10 CFR 50.36(c)(3).

Answer 1. The regulatory exception in 50.36(c)(2)(ii) applies to limiting conditions for operation (LCO) and does not apply to non-LCO technical specifications, such as surveillance requirements. Therefore, the regulatory exception does not apply to Oconee in this instance because, among other things, the proposed modification is for the addition of a surveillance requirement under 10 CFR 50.36(c)(3). I am sending this issue back to NRR to determine whether the proposed technical specification is required for DVR protection at Oconee under 10 CFR 50.36(c)(3), in accordance with the backfit rule.

Issue 2. Oconee does not have a safety-related (Class 1E) degraded voltage protection scheme at the 4.16 kV engineered safeguard (ES) buses (1) (2) (3) TC, TD, and TE or standby safety-related buses to transfer the bus to the onsite power system upon a degraded voltage condition at the 230 kV offsite power system.

Answer 2. The DVR protection scheme at the Oconee Nuclear Station for Units 1, 2, and 3 (Oconee) is consistent with the site s current licensing basis. This scheme provides reasonable assurance of adequate protection of site safety. This issue is closed.

Issue 3. (a) There is no difference in the DVR protection requirements and requirements to be added in the technical specification for a pre-General Design Criteria (GDC) versus GDC plant; (b) Requirements should be added in the TS for limiting safety system settings (LSSS) setpoints and time delays for DVR or Loss-of-Voltage (LOV) relays in accordance with 10 CFR 50.36(c)(3). There is no exemption provision in the regulations for these requirements.

Answer 3.(a). I agree with part (a) of Issue 3; (b). My response to part (b) is similar to Answer 1 above. This issue is closed.

Issue 4. The risk evaluation performed for the degraded voltage protection issue has never been modeled by the NRC. Therefore, the uncertainties and assumptions made in the evaluation cannot be validated.

Answer 4. I disagree. The DPO panel performed a risk evaluation using present-day methodologies and guidance. The evaluation was independently peer-reviewed as part of your appeal. I conclude that the degraded voltage protection issue raised in your DPO was appropriately evaluated using a suitable risk analysis. This issue is closed.

Thank you for taking the time to raise your concerns to me and for the detailed information you provided to support your position and my review. Your willingness to raise concerns through the DPO process is consistent with our organizational values of Openness and Commitment. More in-depth analysis of each of the issues you raised is provided in the pages that follow.

In accordance with MD 10.159, a summary of this appeal decision will be included in the Weekly Information Report posted on the NRC s public Web site to advise interested employees and members of the public of the outcome.

1 The appeal sequenced the four concerns in a different order. Specifically, the appeal began with Issue 2, followed by Issue 1, Issue 4, and then Issue 3.

R. Mathew 3 DEDM-LED TEAM ANALYSIS Decision Process and Background To better understand your concerns, I assigned the Deputy Executive Director for Materials, Waste, Research, State, Tribal, Compliance, Administration, and Human Capital Programs (DEDM), an Executive Technical Assistant (ETA) from my office, and an attorney from the Office of the General Counsel, to review the issues raised in your appeal. This DEDM-led team gathered information through discussions with you, the NRR Director, the DPO panel, and other knowledgeable staff who reviewed documents pertinent to your appeal. The information collected provided independent insights and perspectives for my consideration.

On May 8, 2019, you submitted a DPO with the subject Oconee Task Interface Agreement 2014-04 NRC Staff s Response Concerning Degraded Voltage Protection. The Task Interface Agreement (TIA) was submitted by Region II on November 7, 2014 (ADAMS Accession No. ML14311A862). Several years later and on July 27, 2018, the Region II Director of Reactor Safety revised the TIA request (ADAMS Accession No. ML18211A217). The revised TIA narrowed the scope of Region II s request by requesting NRR staff clarify whether the issues discussed in Region II s TIA are consistent with the Oconee licensing basis and staff positions applicable to Oconee. NRR provided its response on January 22, 2019, (ADAMS Accession No. ML18226A215) ( TIA Response ). Your DPO concerns technical details and conclusions contained in the TIA Response.

On May 21, 2019, an ad-hoc review panel was formed and tasked by the NRC Differing Views Program Manager to review your DPO (ADAMS Accession No. ML19140A434). The DPO panel subsequently issued their findings report to the Deciding Official, the Director of NRR, on December 12, 2019 (ADAMS Accession No. ML19347B523) ( DPO Panel Report ). Of note to your appeal s concerns, the DPO panel concluded that Oconee meets the regulatory requirements under which the plant was licensed, the ES buses have adequate sources of emergency power under all modes of plant operation, and that the licensee is not required to include additional setpoints and time delays in the TS.

On February 7, 2020, the Deciding Official issued his decision regarding the DPO s concerns as informed by the DPO Panel Report and his own review (ADAMS Accession No. ML20027C726).

He agreed with the DPO panel s conclusion that the Oconee DVR configuration is in compliance with 10 CFR 50.36, Technical Specifications, and 10 CFR 50.55a(h)(2) requirements and is capable of responding to design basis events. He also agreed with the panel that the issues you raised are of very low safety significance.

However, the Deciding Official did not agree with all points made by the DPO panel. Notably, he found issue with the panel s conclusions that the DPO submitter was correct in that regulations (GDC 17, as well as AEC Criterion 39 as is cited in the Oconee s license bases) require automatic degraded voltage protection as described in the 1977 Multi-plant Action Letter. The Deciding Official pointed out that Oconee received both its CP and OL2 prior to the degraded voltage events at Millstone Unit 2 and Arkansas Nuclear One (ANO) in the 1970s that led the NRC to take regulatory actions. As a direct result, design criteria for Oconee do not include a requirement for automatic degraded voltage systems. Similarly, the Institute of Electrical and Electronics Engineers (IEEE) Standard (Std.) 279-1971, Criteria for Protection Systems for 2

The Agency issued Construction Permits (CP) for Oconee Nuclear Station, Units 1, 2, and 3 on November 3, 1967.

The Agency issued the Operating Licenses (OL) for Oconee Nuclear Station, Units 1, 2, and 3 on February 6, 1973, October 6, 1973, and July 19, 1974, respectively.

R. Mathew 4 Nuclear Power Generating Stations, referenced in 10 CFR 50.55a(h)(2), could not have been understood at the time of Oconee s licensing to address the degraded voltage conditions that occurred years after the IEEE standard was issued. It was only by the NRC s regulatory actions following the degraded voltage events at Millstone and ANO that put in place subsequent DVR requirements for the existing operating fleet of reactors, including Oconee.

Response to Issue 1 With respect to Issue 1, you state that the licensee is required to identify LOP relay setpoints and associated time delays in TS as is required by 10 CFR 50.36(c)(3) and staff positions provided in NRC compliance letter dated June 3, 1977, and BTP PSB-1. You also assert that your original DPO was not correctly addressed because the regulatory exception in 10 CFR 50.36(c)(2)(iii) does not apply to a surveillance requirement under 10 CFR 50.36(c)(3). Based on my review as discussed below, I agree with your assertion and conclude that the regulatory exception does not apply here because: 1) the modification you propose is related to TS that were added to Oconee s licenses in September 1998, after the August 18, 1995, threshold specified in the regulation; and 2) the proposed modification is for the addition of a surveillance requirement under 10 CFR 50.36(c)(3), not to satisfy the criteria governing an LCO in 10 CFR 50.36(c)(2)(ii).

The regulatory exception in 10 CFR 50.36(c)(2)(iii) states: A licensee is not required to propose to modify technical specifications that are included in any license issued before August 18, 1995, to satisfy the criteria in paragraph (c)(2)(ii) of this section. In its report, the DPO panel determined that although a nuclear plant would normally be required to have DVR setpoints defined in the TS in accordance with 10 CFR 50.36(c)(1)(ii)(A) and 10 CFR 50.36(c)(3), the licensee was not required to include such TS for Oconee under the regulatory exception in 10 CFR 50.36(c)(2)(iii) because Oconee s operating license and TS were issued prior to 1995 in the early 1970s. Thus, the DPO panel concluded that Oconee s surveillance requirements associated with TS 3.3.17 and 3.3.18 are not required to include specific DVR setpoint values.

Oconee s operating licenses were originally issued for Units 1, 2, and 3 on February 6, 1973, October 6, 1973, and July 19, 1974, respectively, and included TS related to Oconee s electrical system. However, the TS for Oconee s electrical system have been modified several times since the Oconee licenses were originally issued. Notably, on September 4, 1998, the NRC approved a license amendment request that completely revise[d] the [technical specifications]

related to the electrical distribution system and incorporate[d] new requirements for system operation, limiting conditions of operation, and surveillance requirements. (ADAMS Accession No. ML15261A466). Based on my review, the relevant TS referenced by you and the DPO panel, LCO 3.3.17 and LCO 3.3.18 and their associated surveillance requirements, were added to Oconee s licenses as part of the September 1998 amendment.3 Therefore, I conclude that the regulatory exception in 10 CFR 50.36(c)(2)(iii) does not apply to TS 3.3.17 and 3.3.18 because they were added to Oconee s license after the August 18, 1995 threshold date specified in the regulation.

I also agree with your assertion that the exception in 10 CFR 50.36(c)(2)(iii) does not apply to Oconee because the proposed modification is for the addition of a surveillance requirement 3

TS 3.3.17 and 3.3.18 were originally numbered 3.7.3 and 3.7.4 in the September 1998 amendment. As part of Oconee s conversion to the improved technical specifications (ITS) in December 1998, TS 3.7.3 and 3.7.4 were relocated and renumbered as TS 3.3.17 and TS 3.3.18 but were not substantively modified (ADAMS Accession Nos.

ML012060036, ML15261A511, and ML15261A512). In this appeal, TS 3.3.17 and TS 3.3.18 are used to refer to TS 3.7.3 and 3.7.4 in the September 1998 amendment.

R. Mathew 5 under 10 CFR 50.36(c)(3), and not for the addition of an LCO meeting the criteria in 10 CFR 50.36(c)(2)(ii). Under the exception in 10 CFR 50.36(c)(2)(iii), a licensee is not required to propose to modify TS to satisfy the criteria in 10 CFR 50.36(c)(2)(ii). Section 50.36(c)(2)(ii) specifies that a technical specification LCO for a nuclear reactor must be established for each item meeting one or more of the four criteria outlined in the regulation.

I also note that subsection (c)(2) of 10 CFR 50.36 is designated specifically for LCOs; Additionally, in accordance with 10 CFR 50.36(c)(3), Surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met. The TS amendment you proposed is for the addition of a surveillance requirement for the calibration of DVR setpoints. You state that the surveillance requirements associated with LCO 3.3.17 only require the performance of a channel function test and do not include a requirement to perform a channel calibration, and the testing appears insufficient to verify operability for an Emergency Power Switching Logic (EPSL)

Automatic Transfer Function channel. In essence, your concern is that the existing surveillance requirements are deficient and do not meet the requirement in 10 CFR 50.36(c)(3) to ensure that the specified LCO in 3.3.17 is being met. As noted above, the regulatory exception applies only to LCOs that meet the criteria in 10 CFR 50.36(c)(2)(ii), not surveillance requirements covered under 10 CFR 50.36(c)(3). Therefore, I conclude that the exception in 10 CFR 50.36(c)(2)(iii) does not apply to Oconee in this instance because the proposed modification is for the addition of a surveillance requirement under 10 CFR 50.36(c)(3).

I also note that the Statements of Consideration (SOC) for the 1995 TS rule discuss applicability of the exception in 10 CFR 50.36(c)(2)(iii).4 Specifically, the SOC clarifies that a licensee would be required to modify its TS if the Commission determined that a new requirement was necessary in accordance with the backfit rule and the new requirement met one of the four criteria contained in Section 50.36(c)(2)(ii). Thus, even if the exception were to apply to surveillance requirements which are the source of your concern for this issue, it would not preclude the NRC from requiring a licensee to modify its TS notwithstanding applicability of the exception if the NRC determines that the new requirement is necessary in accordance with the backfit rule.

For the reasons described above, I agree that the regulatory exception in 10 CFR 50.36(c)(2)(iii) does not apply to the TS surveillance requirements that you state are necessary. In its report, the DPO panel concluded that [a]bsent the exemption, however, Oconee would have been required to add the MFB [main feeder bus] DVR setpoints to TSs. 5 Therefore, I am sending this issue back to NRR to determine whether the proposed technical specification is required for DVR protection at Oconee under 10 CFR 50.36(c)(3), in accordance with the backfit rule.

As part of this determination, NRR should consider the extent to which the staff relied on the TS Bases in its approval of TS 3.3.17 and 3.3.18 as part of the September 1998 amendment. The staff s safety evaluation for the September 1998 amendment (ADAMS Accession No. ML15261A468) and the TS Bases (ADAMS Accession No. ML15261A464) for TS 3.3.18 state, Actual setpoint values for the undervoltage relays for the N and E breakers are to be verified independently as a prerequisite to this SR. 6 These statements regarding verification of the 4

On July 19, 1995, NRC published the final rule in the Federal Register (60 FR 36953) 5 DPO Panel Report, transmittal memo at 2.

6 1998 safety evaluation at 29. 1998 TS Bases at B3.7-41.

R. Mathew 6 setpoints in the TS Bases were not included as part of the ITS Conversion amendment in December 1998.7 The TIA Response includes several statements suggesting that the staff considered the verification of the setpoints as described in the TS Bases to be requirements for Oconee that were removed as part of the ITS Conversion amendment.8 However, in accordance with 10 CFR 50.36(a)(1), A summary statement of the bases or reasons for such specifications, other than those covering administrative controls, shall also be included in the application, but shall not become part of the technical specifications. Thus, even if TS Bases are issued with the technical specifications as part of a license amendment as was done in the September 1998 amendment, in accordance with 10 CFR 50.36(a)(1), the TS Bases are not part of the TS and are not requirements. Accordingly, NRR should consider what, if any, weight was placed on the verification of the actual setpoint values for the undervoltage relays for the N and E breakers described in the TS Bases with respect to TS 3.3.17 and 3.3.18 as part of the staff s approval of the September 1998 amendment.

You also state that the staff positions provided in NRC letter dated June 3, 1977 (ADAMS Accession No. ML14231B281), ( June 1977 letter ), and BTP PSB-1 (ADAMS Accession No. ML052350520) require Oconee to include the LOP relays in TS. In general, staff positions are not requirements, but instead describe a method of complying with NRC requirements. Staff positions are not requirements unless a licensee commits to following the position as a method of complying with a regulation, thereby making the staff position part of the plant s licensing basis. Based on my review, the licensee did not fully commit to following the staff positions discussed in the June 1977 letter or BTP PSB-1.

As discussed more fully below in the response to Issue 2, in the June 1977 letter, the NRC staff requested that the licensee propose plant modifications to meet the staff positions described in the letter, or provide a detailed analysis demonstrating that the facility design had equivalent capabilities and protective features. In its July 21, 1977, response (ADAMS Accession No. ML16030B655) to the NRC s June 3, 1977 letter, the licensee provided an analysis concluding that the Oconee emergency power system design had equivalent capabilities and protective features. On December 20, 1978 (ADAMS Accession No. ML14231B293), the staff issued a letter stating that Oconee s existing system design affords adequate protection against degraded grid undervoltage conditions in accordance with the NRC letter of June 3, 1977, and is therefore acceptable. Similarly, as noted in the staff s November 14, 1990, Safety Evaluation (ADAMS Accession No. ML14231B303), the licensee did not fully commit to following the staff positions in BTP PSB-1, and the staff found the licensee s proposed modifications to its degraded voltage protection acceptable.

Nevertheless, for the reasons discussed above, I am sending this issue back to NRR via the OEDO ticket assignment in Enclosure 2 to determine whether the proposed technical specification surveillance requirements are required for DVR protection at Oconee under 10 CFR 50.36(c)(3) in accordance with the backfit rule.

Response to Issue 2 With respect to Issue 2, you state that Oconee does not have a safety related (Class 1E) 7 See ADAMS Accession Nos. ML012060036, ML15261A512, ML15261A511, and ML15253A343.

8 The TIA Response concludes that as part of the ITS conversion, the TS and TS Bases did not retain the requirements to independently verify actual setpoint values for the undervoltage relays for the N and E breakers as a prerequisite to the SR. TIA Response at 19. The TIA Response also states that Oconee s TS Bases were part of the TSs (i.e., Appendix A to the operating licenses) and, thus, were issued by the NRC via license amendments to the TSs. TIA Response at 6.

R. Mathew 7 degraded voltage protection scheme at the 4.16 kV engineered safeguard (ES) buses (1) (2) (3)

TC, TD, and TE or standby safety related buses to transfer the bus to the onsite power system upon a degraded voltage condition at the 230 kV offsite power system. The DPO panel agreed that Oconee Nuclear Station does not have redundant safety-related degraded voltage protective relays physically attached to the 4.16 kV ES buses (TC, TD, TE) and that one (string) division of safety-related equipment is powered from each of these buses, including 4.16 kV loads, 600V load centers and motor control centers (MCCs). 9 However, the DPO panel was able to conclude the Oconee system meets current regulatory requirements to ensure safety-related equipment has adequate power available under all postulated accident conditions 10 due to other safety-related relays and protective systems installed at the site. The DPO panel noted that these other relays and systems were reviewed and approved by the NRC staff.

As part of its decision-making process, the DEDM-led team reviewed the documents cited by you and the DPO panel, and other supporting documents discovered though the team s independent research. A list of licensee (Duke) design documents is provided in Enclosure 1.

These documents and the numerous ADAMS documents cited throughout this response are just some indicators of the complexity associated with the electrical system at this unique three reactor site co-located with hydroelectric generation facilities. Although it is difficult to distill the Oconee electrical system into a few short paragraphs, the following is provided as background for others so that they may better understand my conclusions.

During normal operation, station auxiliary loads are powered from the unit s Auxiliary Transformer.11 The 4.16 kV windings of the transformer are aligned to the MFBs through circuit breakers designated as the N breakers. The MFBs can also be connected to the unit s Startup Transformer ( E breakers), which are fed from the 230 kV switchyard system. The MFBs can also be connected to the Standby system ( S breakers), which are supplied power from either:

1) the CT4 transformer, powered by the Keowee Hydroelectric Dam; or 2) the CT5 transformer, powered by the Lee Station gas turbine generator. The MFB breakers can be tripped and realigned by undervoltage sensing circuitry (EPSL) which senses degraded or LOV at the MFBs. This protective circuitry performs similar functions for the MFB/ES bus combinations as would typical undervoltage relays structured as Degraded and LOV protective systems. The MFBs are electrically connected to the ES buses and are electrically protected with an assortment of protective relays.

MFB undervoltage protection was part of Oconee s original design. The licensee chose to provide this undervoltage protection in part by installing ABB CV-7 relays. These relays exhibit an inverse-time characteristic and automatically actuate in the event voltage levels drop below setpoint values after a set time delay; the lower the voltage level from the nominal, the faster the relays will trip. An inherent aspect of the inverse-time characteristic is that these relays provide degraded voltage protection as well as LOV protection. Key engineering factors that set the protection levels are the relay s setpoints and time delay settings, which are the subject of Issue 1 above.

In reviewing your concern, the DPO panel stated [s]ince Oconee s DVR relays are designated as safety-related, Class 1E, and operate on a two-out-of-three coincident logic, they also meet the single failure requirements of IEEE Std. 603-1991. 12 The DEDM-led review team confirmed the validity of this statement by reviewing licensee submittals and drawings listed in Enclosure 1 9

DPO Panel Report at 22.

10 Ibid.

11 See DPO Panel Report, Appendix C, Figure 1 for an electrical distribution diagram of Oconee.

12 DPO Panel Report at 33.

R. Mathew 8 and though discussions with the DPO panel to understand their review process. The DEDM-led team confirmed that the MFB relays are ABB type CV-7 and that they are indeed physically connected to the MFBs and not directly on the ES buses. However, the MFBs are electrically connected to the ES buses and at the same 4.16 kV electric potential. Each of the two MFBs can be connected to each of the three ES buses through redundant circuit breakers, ensuring the ES buses have a continuous source of reliable power.13 Based on my team s review of the licensee s documents and the team s discussions with DPO panel members, the DEDM-led review team agreed with the DPO panel that these relays are considered safety-related Class 1E.

Emergency power use of the Standby Buses is described in Duke Energy s Document OSS-0254.00-00-2000, 4KVA Essential Auxiliary Power System. Use of the Standby Buses is governed by the EPSL system which, in part, is responsible for sensing and control of MFB voltages. The EPSL is within the 4 kV essential auxiliary power system and is classified as QA-1 level.14 The EPSL is designed to automatically select an emergency source from either the Startup Transformer or the Standby Bus in the event of loss or degradation of Normal power. In support of this function, the Keowee Emergency Start logic is designed to automatically start both Keowee units to supply emergency power if this source is required. The EPSL circuitry is designed to ensure that a reliable source of power is available to the 4.16 kV MFBs under all modes of operation, including a degraded voltage condition at the 230 kV switchyard bus.

These circuits are designed to further ensure that during or after a postulated accident, a continuous supply of power is available to bring the reactor to a safe shutdown condition. The EPSL ensures quality power is supplied to the MFB by monitoring available sources of power and closing or tripping the appropriate 4.16 kV circuit breakers. The EPSL contains undervoltage monitoring circuits that monitor each phase of the 4.16 kV outputs of the unit auxiliary (Normal source), the Startup transformers powered from the 230 kV switchyard Yellow bus, and each phase of the two Standby Buses. A load-shed circuit is provided that is designed to automatically shed (trip) non-essential loads before a transfer to a Standby Bus occurs. A transfer to a Standby Bus and retransfer to the Startup transformers is designed to, in a power-seeking configuration, automatically select the most readily available power source to supply the unit's MFB and hence the 4.16 kV ES buses. These arrangements were approved by staff as documented in the NRC safety evaluation report dated November 22, 1982 (ADAMS Accession No. ML15112B085).

Present-day requirements for degraded voltage protection are different from requirements in place at the time of Oconee s original design. The evolution of NRC s degraded grid voltage requirements came about from operating experience. Events at Millstone Unit 2 in July 1976 and ANO in September 1978 revealed a generic fleet-wide safety issue with regard to degraded voltage protection. Specifically, the NRC determined that existing electrical distribution system designs may not provide adequate protection against degraded voltage impacts on engineered safety equipment and required a second level of undervoltage protection15 be added to safety-related electrical buses. Because of the potentially serious consequences of such a failure, all operating nuclear power plants were reviewed to establish the adequacy of the design and plant operating procedures. Oconee was sent its letter on June 3, 1977 (ADAMS Accession No.

13 See Duke Drawing O-0702-A for unit 1; similar for units 2 and 3 14 OSS-0254.00-00-2000 15 IEEE Standard 741-2007, Standard Criteria for the Protection of Class 1E Power Systems and Equipment in Nuclear Power Generating Stations , Annex A, Section A.2 states that The first level of undervoltage protection is provided by the loss of voltage relays whose function is to detect and disconnect the Class 1E buses from the preferred power supply upon a total loss of voltage. The second level of undervoltage protection is provided by the degraded voltage relays, which are set to detect a low-voltage condition.

R. Mathew 9 ML14231B281), in which the NRC staff requested the licensee compare the design of their emergency power systems to staff positions stated in Enclosure 1 to the letter, and either (1) propose plant modifications to meet the staff positions, or (2) provide a detailed analysis that showed that the facility design had equivalent capabilities and protective features.

You assert that the licensee never installed a second level undervoltage [degraded voltage]

protection scheme to comply with the 1977 Multi-plant Action generic issue resolution.

However, the licensee did respond via letters dated July 21, 1977 (ADAMS Accession No. ML16030B655), and October 7, 1977 (ADAMS Accession No. ML16030A284). While the licensee did not propose plant modifications, they did provide an analysis demonstrating that Oconee s existing design had equivalent capabilities and protective features. The staff reviewed the submitted analysis, which is documented in a letter to the licensee dated December 20, 1978 (ADAMS Accession No. ML14231B293). The letter concludes with [NRC staff has]

completed our review of the existing system design and have determined that the design affords adequate protection against degraded grid undervoltage conditions in accordance with the NRC letter of June 3, 1977, and is therefore acceptable.

Since the 1978 letter, the NRC staff has approved several modifications and amendments associated with Oconee s degraded voltage protection system. NRC staff safety evaluation reports (SERs) reviewed as part of this appeal by the DEDM-led team include the following:

ADAMS Accession Issuance Date Brief Summary No.

SER approving amendments 117, 117, November 22, 1982 114 to include digital logic channels, and ML15112B085 EPSL SER approving proposed modifications to November 14, 1990 ML14231B303 provide additional degraded grid protection SER approving complete revisions to the September 4, 1998 ML1261A468 electrical TS Although the motivation for each licensee submittal is different, the DEDM-led team noted three similarities that cut across all the documents. First, Oconee s undervoltage protection system, and the onsite electrical distribution system is very complex. Secondly, the use of Keowee Hydroelectric Dam in lieu of emergency diesel generators adds additional complexity to the site s electrical system, as do the multiple offsite sources of power available to the reactor operators via the Standby Buses. Thirdly, however, is that all SERs reach the same conclusion; namely, that Oconee s degraded voltage protection scheme provides reasonable assurance of adequate protection of site safety.

Based upon my review and following discussions with the DEDM-review team, I agree with the decision reached by the DPO panel regarding Issue 2. The existing DVR protection scheme at Oconee is consistent with the site s current licensing basis. Safety-related Class 1E relays at the ES or the standby safety-related buses are not necessary for technical staff to find reasonable assurance of adequate protection due to the existing degraded voltage protection scheme which utilizes other buses, the EPSL, and relays to these buses. The existing Oconee degraded voltage protection system ensures safety-related equipment has adequate power available under its postulated accident conditions.

Response to Issue 3

R. Mathew 10 You challenged the DPO panel s suggestion in Recommendation 3 that [m]ore dialogue in [RIS 2011-12] on pre-GDC plants, such as a discussion of the 10 CFR 50.36(c)(2)(iii) exemption and 50.55(a)(2), could lead to an increased understanding of the licensing basis associated with plants that were issued construction and operating licenses before GDC 17 came into effect.

Specifically, you state in the appeal that the report is incorrect because there is no difference in the DVR protection requirements and requirements to be added in the [technical specifications]

for a pre-GDC vs. a GDC plant. As stated earlier, the requirements to be added in the TS is a LSSS setpoints and time delays for DVR or LOV relays are a requirement in the TS in accordance with 10 CFR 50.36(c)(3).

To your point regarding the requirements in 10 CFR 50.36, it is unclear why any clarification in the RIS regarding the regulatory exception in 10 CFR 50.36(c)(2)(iii) should be limited to pre-GDC plants. To the extent the exception in 50.36(c)(2)(iii) applies, it could apply to both GDC and pre-GDC plants given that the date threshold in the exception is August 18, 1995, after the GDCs were promulgated. In any event, as I note in my discussion of Issue 1 above, the exception in 10 CFR 50.36(c)(2)(iii) does not apply to Oconee in this instance. Therefore, the DPO panel s suggestion to modify the RIS with respect to the 10 CFR 50.36(c)(2)(iii) exception appears to be moot as it relates to this issue.

Response to Issue 4 You stated that the risk evaluation performed for the degraded voltage protection issue has never been modeled by the NRC and, therefore, the uncertainties, and assumptions made in the evaluation cannot be validated.

While it is true that no numerical risk model is an exact replica of the electrical components contained at a complex nuclear reactor, a well-run and well-calibrated risk analysis model operated by a knowledgeable expert can provide insights regarding electrical engineering safety concerns. To that end, a Regional Senior Reactor Analyst developed risk models to understand potential changes in core damage frequency at Oconee due to the concerns documented in your DPO. The risk model s results were subsequently checked by an independent Regional Senior Reactor Analyst prior to being presented to the DPO panel. The DPO panel then included the risk analyst s findings in their report.

Also, while the current granularity of such risk models is not down to the specific relay level, these models do provide useful insights regarding the change in core damage frequency should various electrical systems fail to perform as intended. The DPO panel s analysis was performed with the goal of adhering to the Principles of Good regulation, particularly Clarity and Reliability.

Regulations should be coherent, logical, and practical; positions should be readily understood and easily applied. Regulations should also be based on the best available knowledge from research and operational experience. The DPO panel s modeling framework is also consistent with the Commission s policy statement on use of probabilistic risk assessment.

Following the submittal of your appeal, the NRR Director tasked NRR s Division of Risk Assessment to perform a peer review of the DPO panel s risk analysis. The subsequent peer review was independent, followed guidance provided in ADM-504, NRR Technical Work Product Quality and Consistency, and was performed by a knowledgeable Senior Reactor Analyst at NRC headquarters for independence. The peer review report was issued on March 23, 2020 (ADAMS Accession No. ML20076C874). This report concludes the DPO s risk analyst used NRC guidance to appropriately model your issue. The peer review also did not identify any issues that would impact the simulation results or the regulatory decision.

R. Mathew 11 The DEDM-led review team reviewed the DPO Panel Report and discussed the modeling results with the panel. Based upon my review of the DPO Case File and discussions with the DEDM-led review team, my conclusions are aligned with those of the NRR Director.

Specifically, I disagree with the assertions in Issue 4, and conclude that the degraded voltage protection issue raised in your DPO was appropriately evaluated using a suitable risk analysis.

Conclusion I want to thank you for bringing your concerns to my attention and for using the DPO appeal process. Our agency relies on dedicated professionals, such as yourself, who are willing to raise safety-related concerns that could impact the NRC mission.

After careful consideration of your appeal, I conclude that the regulatory exception in 50.36(c)(2)(ii) applies to LCOs. This exception does not apply to non-LCO TS, such as surveillance requirements under 10 CFR 50.36(c)(3). It is for this reason that I am sending Issue 1 back to NRR via the OEDO ticket assignment in Enclosure 2 to determine whether the proposed technical specification is required for DVR protection at Oconee under 10 CFR 50.36(c)(3), in accordance with the backfit rule.

Regarding Issue 2, I conclude that the DVR protection scheme at Oconee is consistent with the site s current licensing basis. This scheme was reviewed and approved by the NRC staff. The degraded voltage protection scheme provides reasonable assurance of adequate protection of site safety. This closes Issue 2.

Finally, and for the reasons stated above, Issues 3 and 4 are closed.

Enclosures:

1. Duke (Licensee) Documents Reviewed

2. OEDO Ticket Assignment

ML21022A048

• via email OFFICE OEDO/AO OGC DEDM EDO NAME CCook AGhosh-Naber DRoberts MDoane DATE 01/22/2021 01/25/2021 01/26/2021 1/28/21 Duke (Licensee) Documents Reviewed Drawings Number Title Rev O-702-A Units 1-3: One Line Diagram 6900V & 4160V Auxiliary Sys. 38 O-702-A1 Unit 1: One Line Diagram 6900V & 4160V Sta Auxiliary Sys 24 O-0702-A-002 Units 1-3: One Line Diagram 6900V & 4160V Station Auxiliary Sys 22 O-2702 Unit 3: One Line Diagram 6900V & 4160V Sta Auxiliary Sys 25 Design Documents Number Title Rev OSS-0254.00-00-2000 (ELECT) 4KV ESSENTIAL AUXILIARY POWER SYSTEM 24 OSC-4300 (ELEC) Protective Relay Settings 37 Enclosure 1

OEDO TICKET ASSIGNMENT REQUEST FORM 6 months following issuance of the EDO s Task Due Date: appeal decision memorandum associated with DPO-2019-001.

Assigned Office(s): NRR CC Routing:

N/A (Mark N/A if None)

Determine whether an additional technical specification identifying relay setpoints and associated time delays is required for DVR Description of Task:

protection at Oconee under 10 CFR 50.36(c)(3), in accordance with the backfit rule.

See discussion associated with Issue 1 in the Special Instructions for Assigned Office(s): EDO s appeal decision memorandum associated with DPO-2019-001.

Type of Response (memo, email, etc.) Memo NOTE: none.

Enclosure 2