ML11277A148

NUREG-0847 Supp 24 Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant, Unit 2.

ML11277A148
Person / Time
Site:	Watts Bar
Issue date:	09/30/2011
From:	Office of Nuclear Reactor Regulation
To:
Beltz, G
References
NUREG-0847 S24
Download: ML11277A148 (229)

Text

NUREG-0847 Supplement 24 Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant, Unit 2 Docket Number 50-391 Tennessee Valley Authority Office of Nuclear Reactor Regulation

AVAILABILITY OF REFERENCE MATERIALS IN NRC PUBLICATIONS NRC Reference Material Non-NRC Reference Material As of November 1999, you may electronically access Documents available from public and special technical NUREG-series publications and other NRC records at libraries include all open literature items, such as NRC=s Public Electronic Reading Room at books, journal articles, and transactions, Federal http://www.nrc.gov/reading-rm.html. Register notices, Federal and State legislation, and Publicly released records include, to name a few, congressional reports. Such documents as theses, NUREG-series publications; Federal Register notices; dissertations, foreign reports and translations, and applicant, licensee, and vendor documents and non-NRC conference proceedings may be purchased correspondence; NRC correspondence and internal from their sponsoring organization.

memoranda; bulletins and information notices; inspection and investigative reports; licensee event reports; and Commission papers and their Copies of industry codes and standards used in a attachments. substantive manner in the NRC regulatory process are maintained atC NRC publications in the NUREG series, NRC The NRC Technical Library regulations, and Title 10, Energy, in the Code of Two White Flint North Federal Regulations may also be purchased from one 11545 Rockville Pike of these two sources. Rockville, MD 20852B2738

1. The Superintendent of Documents U.S. Government Printing Office Mail Stop SSOP These standards are available in the library for Washington, DC 20402B0001 reference use by the public. Codes and standards are Internet: bookstore.gpo.gov usually copyrighted and may be purchased from the Telephone: 202-512-1800 originating organization or, if they are American Fax: 202-512-2250 National Standards, fromC

2. The National Technical Information Service American National Standards Institute nd Springfield, VA 22161B0002 11 West 42 Street www.ntis.gov New York, NY 10036B8002 1B800B553B6847 or, locally, 703B605B6000 www.ansi.org 212B642B4900 A single copy of each NRC draft report for comment is available free, to the extent of supply, upon written request as follows: Legally binding regulatory requirements are stated only Address: U.S. Nuclear Regulatory Commission in laws; NRC regulations; licenses, including technical Office of Administration specifications; or orders, not in Publications Branch NUREG-series publications. The views expressed in Washington, DC 20555-0001 contractor-prepared publications in this series are not E-mail: DISTRIBUTION.SERVICES@NRC.GOV necessarily those of the NRC.

Facsimile: 301B415B2289 The NUREG series comprises (1) technical and Some publications in the NUREG series that are administrative reports and books prepared by the staff posted at NRC=s Web site address (NUREGBXXXX) or agency contractors http://www.nrc.gov/reading-rm/doc-collections/nuregs (NUREG/CRBXXXX), (2) proceedings of conferences are updated periodically and may differ from the last (NUREG/CPBXXXX), (3) reports resulting from printed version. Although references to material found international agreements (NUREG/IABXXXX), (4) on a Web site bear the date the material was brochures (NUREG/BRBXXXX), and (5) compilations accessed, the material available on the date cited may of legal decisions and orders of the Commission and subsequently be removed from the site. Atomic and Safety Licensing Boards and of Directors=

decisions under Section 2.206 of NRC=s regulations (NUREGB0750).

NUREG-0847 Supplement 24 Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant, Unit 2 Docket Number 50-391 Tennessee Valley Authority Manuscript Completed: August 2011 Date Published: September 2011 Office of Nuclear Reactor Regulation

ABSTRACT This report supplements the safety evaluation report (SER), NUREG-0847 (June 1982),

Supplement No. 23 (July 2011, Agencywide Documents Access and Management System (ADAMS) Accession No. ML11206A499), with respect to the application filed by the Tennessee Valley Authority (TVA), as applicant and owner, for a license to operate Watts Bar Nuclear Plant (WBN) Unit 2 (Docket No 50-391).

In its SER and Supplemental SER (SSER) Nos. 1 through 20 issued by the Office of Nuclear Reactor Regulation (NRR) of the U.S. Nuclear Regulatory Commission (NRC or the staff), the staff documented its safety evaluation and determination that WBN Unit 1 met all applicable regulations and regulatory guidance. Based on satisfactory findings from all applicable inspections, on February 7, 1996, the NRC issued a full-power operating license (OL) to WBN Unit 1, authorizing operation up to 100-percent power.

In SSER 21, the staff addressed TVAs application for a license to operate WBN Unit 2, and provided information regarding the status of the items remaining to be resolved, which were outstanding at the time that TVA deferred construction of WBN Unit 2, and were not evaluated and resolved as part of the licensing of WBN Unit 1. Beginning with SSER 22, the staff documented its ongoing evaluation and closure of open items in support of TVAs application for a license to operate WBN Unit 2.

In this and future SSERs, the staff continues its documentation of its review of open items in support of TVAs application for an operating license for WBN Unit 2.

iii

TABLE OF CONTENTS Page ABSTRACT .... iii ABBREVIATIONS .. ix 1 INTRODUCTION AND DISCUSSION.... 1-1 1.1 Introduction..... 1-1 1.7 Summary of Outstanding Issues..... 1-2 1.8 Confirmatory Issues...... 1-25 1.9 License Conditions................................................................................... 1-25 1.10 Unresolved Safety Issues......................................................................... 1-26 1.13 Implementation of Corrective Action Programs and Special Programs.... 1-26 1.13.1 Corrective Action Programs.......................................................... 1-27 1.13.2 Special Programs......................................................................... 1-28 1.14 Implementation of Applicable Bulletin and Generic Letter Requirements. 1-29 2 SITE CHARACTERISTICS..................................................................................... 2-1 2.4 Hydrologic Engineering............................................................................ 2-1 2.4.10 Flooding Protection Requirements............................................... 2-1 2.5 Geology and Seismology.......................................................................... 2-7 3 DESIGN CRITERIA - STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS............................................................................................................... 3-1 3.6 Protection Against the Dynamic Effects Associated with the Postulated Rupture of Piping...................................................................................... 3-1 3.6.3 Leak-Before-Break Evaluation Procedures..................................... 3-1 4 REACTOR............................................................................................................... 4-1 4.4.10 Accident Conditions.................................................................................. 4-1 5 REACTOR COOLANT SYSTEM AND CONNECTED SYSTEMS..... 5-1 5.2 Integrity of Reactor Coolant Pressure Boundary...................................... 5-1 5.2.2 Overpressure Protection................................................................. 5-1 7 INSTRUMENTATION AND CONTROLS................................................................ 7-1 7.6 All Other Systems Required for Safety..................................................... 7-1 7.6.1 Loose Part Monitoring System 7-1 7.7 Control Systems Not Required for Safety................................................. 7-2 7.7.1 System Description......................................................................... 7-2 8 ELECTRIC POWER SYSTEMS.............................................................................. 8-1 8.1 General..................................................................................................... 8-1 v

TABLE OF CONTENTS (Continued)

Page 9 AUXILIARY SYSTEMS ... 9-1 9.1 Fuel Storage Facility................................................................................. 9-1 9.1.4 Fuel Handling System..................................................................... 9-1 9.3 Process Auxiliaries................................................................................... 9-1 9.3.2 Process and Post-Accident Sampling Systems.............................. 9-1 10 STEAM AND POWER CONVERSION SYSTEM..... 10-1 10.4 Other Features.......................................................................................... 10-1 10.4.8 Steam Generator Blowdown System............................................ 10-1 10.4.9 Auxiliary Feedwater System......................................................... 10-2 11 RADIOACTIVE WASTE PROGRAM....................................................................... 11-1 11.0 Summary Description............................................................................... 11-1 11.1 Source Terms........................................................................................... 11-2 11.2 Liquid Waste Management....................................................................... 11-2 11.3 Gaseous Waste Management.................................................................. 11-5 11.4 Solid Waste Management System............................................................ 11-12 11.5 Process and Effluent Radiological Monitoring and Sampling Systems.... 11-12 12 RADIATION PROTECTION PROGRAM................................................................. 12-1 12.1 General..................................................................................................... 12-1 12.2 Ensuring That Occupational Radiation Exposures Are As Low As Reasonably Achievable (ALARA)............................................................. 12-1 12.3 Radiation Sources.................................................................................... 12-1 12.4 Radiation Protection Design Features...................................................... 12-3 12.5 Dose Assessment..................................................................................... 12-6 12.6 Health Physics Program........................................................................... 12-7 12.7 NUREG-0737 Items.................................................................................. 12-8 12.7.1 Plant Shielding (II.B.2).................................................................. 12-8 13 CONDUCT OF OPERATIONS................................................................................ 13-1 13.6 Physical Security...................................................................................... 13-1 13.6.6 Cyber Security Plan...................................................................... 13-1 15 ACCIDENT ANALYSIS...................................................................... 15-1 15.2 Normal Operation and Anticipated Transients.......................................... 15-1 15.2.1 Loss-of-Cooling Transients........................................................... 15-1 15.2.2 Increased Cooling Transients....................................................... 15-9 15.2.3 Change in Coolant Inventory Transients...................................... 15-21 15.2.4 Reactivity and Power Distribution Anomalies............................... 15-25 15.3 Limiting Accidents..................................................................................... 15-42 vi

TABLE OF CONTENTS (Continued)

Page 15.3.1 Loss-of-Coolant Accidents............................................................ 15-42 15.3.2 Steamline Break........................................................................... 15-47 15.3.3 Feedwater System Pipe Breaks Inside and Outside Containment.................................................................................. 15-53 15.3.4/15.3.5 Reactor Coolant Pump Rotor Seizure/ Reactor Coolant Pump Shaft Break............................................................. 15-57 15.3.6 Anticipated Transients Without Scram.......................................... 15-60 15.5 NUREG-0737 Items.................................................................................. 15-64 15.5.1 Thermal-Mechanical Report (II.K.2.13)......................................... 15-64 15.5.2 Voiding in the Reactor Coolant System during Transients (II.K.2.17)...................................................................................... 15-65 15.5.4 Automatic Trip of Reactor Coolant Pumps (II.K.3.5).................... 15-66 APPENDIX A CHRONOLOGY OF RADIOLOGICAL REVIEW OF WATTS BAR NUCLEAR PLANT, UNIT 2, OPERATING LICENSE REVIEW......... A-1 APPENDIX E CONTRIBUTORS TO SSER 24............................................................... E-1 APPENDIX WATTS BAR UNIT 2 ACTION ITEMS TABLE..... HH-1 HH vii

ABBREVIATIONS AACC American Association for Contamination Control ABGTS auxiliary building gas treatment system ABI auxiliary building isolation ABSCE auxiliary building secondary containment enclosure AC or ac alternating current ACAS auxiliary control air system ACR auxiliary control room ADAMS Agencywide Documents Access and Management System AFW auxiliary feedwater AFWP auxiliary feedwater pump ALARA as low as reasonably achievable AMSAC anticipated transient without scram mitigation system actuation circuitry ANSI American National Standards Institute ANS American Nuclear Society AOO anticipated operational occurrence AOV air-operated valve APS auxiliary power system ART adjusted reference temperature ASB Auxiliary Systems Branch (of NRR)

ASME American Society of Mechanical Engineers ASTM American Society for Testing and Materials ATWS anticipated transient without scram BEACON Westinghouse Best Estimate Analyzer for Core OperationsNuclear BISI bypassed and inoperable status indication BL bulletin BMI bottom-mounted instrumentation BOL beginning of life BTP Branch Technical Position BWG Birmingham Wire Gauge BWR boiling-water reactor CAP corrective action program CAS central alarm station CCS component cooling system CCW circulating cooling water CDWE condensate demineralizer waste evaporator CECC Central Emergency Control Center (of TVA)

CERPI computer-enhanced rod position indication CET core exit thermocouple cfm cubic feet per minute CFR Code of Federal Regulations Ci curie CIV containment isolation valve COMS cold overpressure mitigation system COT channel operability test CP control processor CPU central processing unit ix

CRD control rod drive CRDM control rod drive mechanism CSST common station service transformer CST condensate storage tank CVCS chemical volume and control system CVI containment vent isolation DBA design basis accident DBT design basis threat DC or dc direct current DCN design change notice DCS distributed control system DCRDR detailed control room design review DG diesel generator DMBW dissimilar metal butt welds DNB departure from nucleate boiling DNBR departure from nucleate boiling ratio DSP digital signal processor DVR degraded voltage relay EAL emergency action level ECCS emergency core cooling system ECS environmental control system EDCR Engineering Document Construction Release EDG emergency diesel generator EDS environmental data station EFPD effective full power day EFPY effective full power year EGTS emergency gas treatment system EMI/RFI electromagnetic/radiofrequency interference EOF emergency operations facility EOL end of life EOP emergency operating procedure EPA Environmental Protection Agency or electrical penetration assemblies EPIP emergency plan implementing procedure EPRI Electric Power Research Institute EPZ emergency planning zone EQ environmental qualification ERCW essential raw cooling water ERDS emergency response data system ERO emergency response organization ESF engineered safety feature ESFAS engineered safety feature actuation system ESW extremely severe weather ETA evacuation time estimate FEMA Federal Emergency Management Agency FHA fuel handling accident FLB feedwater line break FSAR final safety analysis report FW feedwater GDC general design criterion/criteria x

GI generic issue GL generic letter gpm gallons per minute HRCAR high range containment air radiation HDCI High Duty Core Index HAS hydrogen analyzer system HED human engineering deficiency HEPA high efficiency particulate air HFP hot full power HMS hydrogen mitigation system HVAC heating, ventilation, and air conditioning HZP hot zero power I&C instrumentation and control ICC inadequate core cooling ICCM inadequate core cooling monitor ICS integrated computer system IE Office of Inspection and Enforcement IEB Office of Inspection and Enforcement Bulletin IEEE Institute of Electrical and Electronics Engineers IESNA Illuminating Engineering Society of North America IFM intermediate flow mixers IFR Interim Finding Report IIS in-core instrumentation system IITA in-core instrumentation thimble assembly INEL Idaho National Engineering Laboratory IPE individual plant examination IPEEE individual plant examination of external events IST inservice testing IV&V independent verification and validation kHz kilohertz kV kilovolt kVA kilovolt ampere kW kilowatt LCC lower compartment cooler LCD liquid crystal display LCO limiting condition for operation LCV level control valve LED light emitting diode LLEA local law enforcement agency LOCA loss-of-coolant accident LOOP loss of offsite power LOV loss of voltage LPMS loose part monitoring system LPZ low-population zone LTC load tap changer LTOP low-temperature overpressure protection LWR light-water reactor MCCB molded case circuit breaker MCES main condeser evacuation system xi

MCR main control room MCRHZ main control room habitability zone MDAFWP motor-driven auxiliary feedwater pump MEB Mechanical Engineering Branch (of NRR)

MIDS moveable in-core detector system MJRERP Multi-Jurisdictional Radiological Emergency Response Plan MOU memorandum of understanding MOV motor operated valve mph miles per hour MSIV main steam isolation valve MSLB main steam line break MSS main steam system MTEB Materials Engineering Branch (of NRR)

MTP maintenance and test panel MVA megavolt-ampere MWD/MTU megawatt days per metric ton unit (or uranium)

NEC not elsewhere classified MWt megawatts thermal NCDC National Climatic Data Center NDE nondestructive examination NDL nuclear data link NEI Nuclear Energy Institute NGDC New Generation Development and Construction NIS nuclear instrumentation system NPP Nuclear Performance Plan NP-REP Nuclear Power Radiological Emergency Plan NQA nuclear quality assurance NRC Nuclear Regulatory Commission NRR Office of Nuclear Reactor Regulation NSSS nuclear steam supply system NUREG report prepared by NRC staff OBE operating basis earthquake OCA owner controlled area OE operating experience OI operating instruction OL operating license OM operator monitor OM Code ASME Code for Operation and Maintenance of Nuclear Power Plants OSC operations support center PA protected area PAD performance analysis and design PAMS postaccident monitoring system PASS postaccident sampling system pcm percent millirho PCT peak centerline temperature PEDS plant engineering data system PDMS power distribution monitoring system PLC programmable logic controller PMF probable maximum flood xii

PORC plant operations review committee PORV power-operated relief valve ppb parts per billion PRT pressurizer relief tank PSHT preservice system hydrostatic test psia pounds per square inch absolute psig pounds per square inch gauge PSP Physical Security Plan PTLR Pressure and Temperature Limits Report PTS pressurized thermal shock PWR pressurized-water reactor PWSCC primary water stress corrosion cracking QA quality assurance RAD radiation absorbed dose RAI request for additional information RBPVS reactor building purge ventilation system RCCA rod cluster control assembly RCP reactor coolant pump RCPB reactor coolant pressure boundary RCS reactor coolant system RG Regulatory Guide RHR residual heat removal RIS regulatory issue summary RPIS rod position indication system RPS reactor protection system RPV reactor pressure vessel RSB Reactor Systems Branch (of NRR)

RTDP Revised Thermal Design Procedure RV reactor vessel RVI reactor vessel internal RWST refueling water storage tank SAFDL specified acceptable fuel design limit SAL safety analysis limit SAS secondary alarm station SAT system approach to training SBO station blackout SCC stress corrosion cracking SCP Safeguards Contingency Plan SDD software design description SDS satellite display station SE safety evaluation SEC serial-to-Ethernet controller SER safety evaluation report, NUREG-0847, dated June 1982 SG steam generator SGBS steam generator blowdown system SI safety injection SNB subcooled nucleate boiling SPND self powered neutron detector SP special program xiii

SPDS safety parameter display system SPS signal processing system SQN Sequoyah Nuclear Plant SR surveillance requirement SRM Staff Requirements Memorandum SRP Standard Review Plan, NUREG-0800 SRS software requirements specification SSC structures, systems, and components SSE safe shutdown earthquake SSER Supplemental SER SSPS solid state protection system Std Standard SV safety valve SVVR software verification and validation report SW severe weather SWCCF software common cause failure Tavg average reactor core temperature TPBAR tritium-producing burnable absorber bar TDAFW turbine-driven auxiliary feedwater TDAFWP turbine-driven auxiliary feedwater pump TGSS turbine gland sealing system TI technical or temporary instruction TID total integrated dose TIPTOP Turbine Integrity Program with Turbine Overspeed Protection TMI Three Mile Island TPBAR tritium production burnable absorber rod T&QP Training and Qualification Plan TR topical report TRM Technical Requirements Manual TS technical specification TSC Technical Support Center TSR technical surveillance requirement TSTF Technical Specification Task Force TVA Tennessee Valley Authority UHS ultimate heat sink UPS uninterruptible power supply USE upper shelf energy USI unresolved safety issue UT ultrasonic test VCT volume control tank VCTLCS volume control tank level control system V&V verification and validation WBN Watts Bar Nuclear Plant WBN REP Watts Bar Nuclear Plant Radiological Emergency Plan WBNPP Watts Bar Nuclear Performance Plan WCAP Westinghouse Commercial Atomic Power (report)

WINCISE Westinghouse INCore Information, Surveillance, and Engineering system xiv

1 INTRODUCTION AND DISCUSSION 1.1 Introduction The Watts Bar Nuclear Plant (WBN or Watts Bar) is owned by the Tennessee Valley Authority (TVA) and is located in southeastern Tennessee approximately 50 miles northeast of Chattanooga. The facility consists of two Westinghouse-designed four-loop pressurized-water reactors (PWRs) within ice condenser containments.

In June 1982, the Nuclear Regulatory Commission staff (NRC staff or staff) issued safety evaluation report (SER), NUREG-0847, Safety Evaluation Report related to the operation of Watts Bar Nuclear Plant Units 1 and 2, regarding TVAs application for licenses to operate WBN Units 1 and 2. In SER Supplements (SSERs) 1 through 20, the NRC staff concluded that WBN Unit 1 met all applicable regulations and regulatory guidance and on February 7, 1996, the NRC issued an operating license (OL) to Unit 1. TVA did not complete WBN Unit 2, and the NRC did not make conclusions regarding it.

On March 4, 2009, TVA submitted an updated application in support of its request for an OL for WBN Unit 2, pursuant to Title 10 of the Code of Federal Regulations (10 CFR), Part 50, Domestic Licensing of Production and Utilization Facilities.

In SSER 21, the staff provided information regarding the status of the WBN Unit 2 items that remain to be resolved, which were outstanding at the time that TVA deferred construction of Unit 2, and which were not evaluated and resolved as part of the licensing of WBN Unit 1. In SSER 22, the staff began the documentation of its evaluation and closure of open items in support of TVAs application for a license to operate WBN Unit 2.

In this and future SSERs, the staff will continue the documentation of its evaluation and closure of open items in support of TVAs application.

The format of this document is consistent with the format and scope outlined in the Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR

[Light-Water Reactor] Edition (NUREG-0800), dated July 1981 (SRP, NUREG-0800). The staff added additional chapters to address the overall assessment of the facility, Nuclear Performance Plan issues, and other generic regulatory topics.

Each of the sections and appendices of this supplement is numbered the same as the SER section that is being updated, and the discussions are supplementary to, and not in lieu of, the discussion in the SER, unless otherwise noted. For example, Appendix E continues to list the principal contributors to the SSER. However, the chronology of the safety review correspondence previously provided in Appendix A has been discontinued, and a reference is provided instead to the NRCs Agencywide Documents Access and Management System (ADAMS) or the Public Document Room (PDR). Public correspondence exchanged between the NRC and TVA is available through ADAMS or the PDR. Appendix HH includes an Action Items Table. This table provides a status of all the open items, confirmatory issues, and proposed license conditions that must be resolved prior to completion of an NRC finding of reasonable assurance on the OL application for WBN Unit 2. The staff will maintain the Action Items Table and revise Appendix HH in future SSERs, and add new appendices, as necessary.

References listed as not publicly available in the SSER contain proprietary information and have been withheld from public disclosure in accordance with 10 CFR 2.390.

1-1

The NRC's Agencywide Documents Access and Management System (ADAMS) is the agencys official recordkeeping system.

ADAMS has the full text of regulatory and technical documents and reports written by NRC, NRC contractors, or NRC licensees. Documents include NRC regulatory guides, NUREG-series reports, correspondence, inspection reports, and others, are assigned accession numbers. They are searchable and accessible from ADAMS. Documents are released periodically during the day in the ADAMS PUBLIC/Legacy Interface Combined (ADAMS PUBLIC) and Web-based ADAMS (WBA) interfaces; they are released once a day in Web-based Publicly Available Records System (PARS). These documents in full text can be searched using ADAMS accession numbers or specific fields and parameters such as docket number and documents dates.

More information regarding ADAMS and help for accessing documents may be obtained on the NRC Public Web site at http://www.nrc.gov/reading-rm/adams/faq.html#1.

All WBN documents may be accessed using WBN docket numbers 05000390 and 05000391 for Units 1 and 2, respectively.

The WBN Unit 2 Project Manager is Patrick D. Milano, who may be contacted by calling (301) 415-1457, by e-mail to Patrick.Milano@nrc.gov, or by writing to the following address:

Mr. Patrick D. Milano U.S. Nuclear Regulatory Commission Mail Stop O-8H4 Washington, D.C. 20555 1.7 Summary of Outstanding Issues The staff documented its previous review and conclusions regarding the OL application for WBN Unit 1 in the SER (NUREG-847) and its supplements 1 through 20. Based on these reviews, the staff issued an OL for WBN Unit 1 in 1996. In the SER and SSERs 1 through 20, the staff also reviewed and approved certain topics for WBN Unit 2, though no final conclusions were made regarding an OL for WBN Unit 2. To establish the remaining scope and the regulatory framework for the staffs review of an OL for WBN Unit 2, the staff reviewed the SER and SSERs 1 thorough 20. Based on this review, the staff identified resolved topics (i.e., out of scope for review) and open topics (i.e., in scope for staff review) for WBN Unit 2. Where it was not clear whether the SER topic applied to Unit 2 or not, the staff conservatively identified it as open pending further evaluation. It should be noted that these were not technical evaluations of each topic; rather, it was a status review to determine whether the topic was open or resolved. The staff documented this evaluation in SSER 21 as the baseline for resumption of the review of the OL application for Unit 2. Thus, SSER 21 reflects the status of the staffs review of WBN Unit 2 up to 1995. The staff notes that a subsequent, more detailed assessment may find some topics conservatively identified in the initial assessment as open that should be redefined as closed. Conversely, the NRC staff notes that there may be circumstances that could result in the need to reopen some previously closed topic areas that may have been adequately documented and that are considered closed in SSER 21. Such cases will be identified by a foot note in future SSERs to document that previous open topics have been re-categorized as closed without requiring further review, or vice versa.

1-2

The SER and SSERs 1 through 20 evaluated the changes to the final safety analysis report (FSAR) until Amendment 91. FSAR Amendment 91 was the initial licensing basis for WBN Unit 1. At this time, the FSAR was applicable to both Units 1 and 2. As part of its updated OL application for WBN Unit 2, TVA split the FSAR Amendment 91 into two separate FSARs for WBN Units 1 and 2. TVA has submitted WBN Unit 2 FSAR Amendments 92 through 102 to address the open topics in support of its OL application for WBN Unit 2. These FSAR amendments reflect changes that have occurred since 1995. These FSAR amendments are currently under staff review. The staffs review of these FSAR changes is documented in SSER 22 and subsequent supplements.

Additional general topics (e.g., financial qualifications that were not included in SSER 21, but that should be resolved prior to issuance of an OL) are also identified in SSER 22 and subsequent supplements.

SSER 21 initially provided the table below documenting the status of each SER topic. The relevant document in which the topic was last addressed is shown in parenthesis. This table will be maintained in this and future supplements to reflect the updated status of review for each topic.

ISSUE STATUS TABLE Issue Status Section Note (1) Site Envelope 2 (2) Geography and Demography Resolved (SSER 22) 2.1 (3) Site Location and Description Resolved (SER) 2.1.1 3 (SSER 22)

(4) Exclusion Area Authority and Resolved (SER) 2.1.2 3 Control (SSER 22)

(5) Population Distribution Resolved (SER) 2.1.3 (SSER 22)

(6) Conclusions Resolved (SER) 2.1.4 (SSER 22)

(7) Nearby Industrial, Transportation, Resolved (SSER 22) 2.2 and Military Facilities (8) Transportation Routes Resolved (SER) 2.2.1 (SSER 22)

(9) Nearby Facilities Resolved (SER) 2.2.2 (SSER 22)

(10) Conclusions Resolved (SER) 2.2.3 (SSER 22)

(11) Meteorology (SER) 2.3 (SSER 22)

(12) Regional Climatology Resolved (SER) 2.3.1 (SSER 22)

(13) Local Meteorology Resolved (SER) 2.3.2 (SSER 22)

(14) Onsite Meteorological Resolved (SER) 2.3.3 Measurements Program (SSER 22) 1-3

Issue Status Section Note (15) Short-Term (Accident) Atmospheric Resolved (SER) 2.3.4 Diffusion Estimates (SSER 14)

(SSER 22)

(16) Long-Term (Routine) Diffusion Resolved (SER) 2.3.5 Estimates (SSER 14)

(SSER 22)

(17) Hydrologic Engineering 2.4 (18) Introduction Resolved (SER) 2.4.1 (19) Hydrologic Description Resolved (SER) 2.4.2 (20) Flood Potential Resolved (SER) 2.4.3 (21) Local Intense Precipitation in Plant Resolved (SER) 2.4.4 1 Area (22) Roof Drainage Resolved (SER) 2.4.5 1 (23) Ultimate Heat Sink Resolved (SER) 2.4.6 (24) Groundwater Resolved (SER) 2.4.7 1 (25) Design Basis for Subsurface Resolved (SER) 2.4.8 Hydrostatic Loading (SSER 3)

(26) Transport of Liquid Releases Resolved (SER) 2.4.9 2 (SSER 22)

(27) Flooding Protection Requirements Open (SER) 2.4.10 (Inspection) (SSER 24)

(28) Geological, Seismological, and Resolved (SER) 2.5 Geotechnical Engineering (SSER 24)

(29) Geology Resolved (SER) 2.5.1 (30) Seismology Resolved (SER) 2.5.2 (31) Surface Faulting Resolved (SER) 2.5.3 (32) Stability of Subsurface Materials Resolved (SER) 2.5.4 and Foundations (SSER 3)

(SSER 9)

(SSER 11)

(33) Stability of Slopes Resolved (SER) 2.5.5 (34) Embankments and Dams Resolved (SER) 2.5.6 (SSER 22)

(35) References (SER) 2.6 (SSER 22)

(36) Design Criteria - Structures, 3 Components, Equipment, and Systems (37) Introduction 3.1 (38) Conformance With General Design Resolved (SER) 3.1.1 Criteria (39) Conformance With Industry Codes Resolved (SER) 3.1.2 and Standards (40) Classification of Structures, Resolved (SSER 14) 3.2 Systems and Components (SSER 22) 1-4

Issue Status Section Note (41) Seismic Classifications Resolved (SER) 3.2.1 (SSER 3)

(SSER 5)

(SSER 6)

(SSER 8)

(42) System Quality Group Classification Open (NRR) (SER) 3.2.2 (SSER 3)

(SSER 6)

(SSER 7)

(SSER 9)

(SSER 22)

(43) Wind and Tornado Loadings 3.3 (44) Wind Loading Resolved (SER) 3.3.1 (45) Tornado Loading Resolved (SER) 3.3.2 (46) Flood Level (Flood) Design 3.4 (47) Flood Protection Resolved (SER) 3.4.1 (48) Missile Protection 3.5 (49) Missile Selection and Description Resolved (SER) 3.5.1 (SSER 9)

(SSER 14)

(SSER 22)

(50) Structures, Systems, and Resolved (SER) 3.5.2 Components to be Protected from (SSER 2)

Externally Generated Missiles (SSER 22)

(51) Barrier Design Procedures Resolved (SER) 3.5.3 (52) Protection Against the Dynamic Open (NRR) (SER) 3.6 Effects Associated with the (SSER 6)

Postulated Rupture of Piping (SSER 11)

(53) Plant Design for Protection Against Resolved (SER) 3.6.1 Postulated Piping Failures in Fluid (SSER 14)

System Outside Containment (SSER 22)

(54) Determination of Break Locations Resolved (SER) 3.6.2 3 and Dynamic Effects Associated (SSER 14) with the Postulated Rupture of (SSER 22)

Piping (55) Leak-Before-Break Evaluation Resolved (SSER 5) 3.6.3 Procedures (SSER 12)

(SSER 22)

(SSER 24)

(56) Seismic Design Resolved (SER) 3.7 2 (SSER 6)

(57) Seismic Input Resolved (SER) 3.7.1 2 (SSER 6)

(SSER 9)

(SSER 16) 1-5

Issue Status Section Note (58) Seismic Analysis Resolved (SER) 3.7.2 2 (SSER 6)

(SSER 8)

(SSER 11)

(SSER 16)

(59) Seismic Subsystem Analysis Resolved (SER) 3.7.3 (SSER 6)

(SSER 7)

(SSER 8)

(SSER 9)

(SSER 12)

(SSER 22)

(60) Seismic Instrumentation Resolved (SER) 3.7.4 1 (61) Design of Seismic Category I Resolved (SER) 3.8 2 Structures (SSER 9)

(62) Steel Containment Resolved (SER) 3.8.1 (SSER 3)

(63) Concrete and Structural Steel Resolved (SER) 3.8.2 Internal Structures (SSER 7)

(64) Other Seismic Category I Structures Open (NRR) (SER) 3.8.3 (SSER 14)

(SSER 16)

(65) Foundations Resolved (SER) 3.8.4 (66) Mechanical Systems and Resolved (SER) 3.9 Components (67) Special Topics for Mechanical Resolved (SER) 3.9.1 Components (SSER 6)

(SSER 13)

(SSER 22)

(68) Dynamic Testing and Analysis of Resolved (SER) 3.9.2 Systems, Components, and (SSER 14)

Equipment (SSER 22)

(69) ASME Code Class 1, 2, and 3 Resolved (SER) 3.9.3 Components, Component (SSER 3)

Structures, and Core Support (SSER 4)

Structures (SSER 6)

(SSER 7)

(SSER 8)

(SSER 15)

(SSER 22)

(70) Control Rod Drive Systems Resolved (SER) 3.9.4 (71) Reactor Pressure Vessel Internals Open (SER) 3.9.5 (SSER 23) 1-6

Issue Status Section Note (72) Inservice Testing of Pumps and Open (NRR) (SER) 3.9.6 Valves (SSER 5)

(SSER 12)

(SSER 14)

(SSER 18)

(SSER 20)

(SSER 22)

(73) Seismic and Dynamic Qualification Resolved (SER) 3.10 of Seismic Category I Mechanical (SSER 1) and Electrical Equipment (SSER 3)

(SSER 4)

(SSER 5)

(SSER 6)

(SSER 8)

(SSER 9)

(SSER 23)

(74) Environmental Qualification of Open (NRR) (SSER 15) 3.11 Mechanical and Electrical (SSER 22)

Equipment (75) Threaded Fasteners ASME Code Resolved (SSER 22) 3.13 Class 1, 2, and 3 (76) Reactor 4 (77) Introduction (SER) 4.1 (SSER 23)

(78) Fuel System Design (SSER 23) 4.2 (79) Description Resolved (SER) 4.2.1 (SSER 13)

(SSER 23)

(80) Thermal Performance Open (NRR) (SER) 4.2.2 (SSER 2)

(SSER 23)

(81) Mechanical Performance Resolved (SER) 4.2.3 (SSER 2)

(SSER 10)

(SSER 13)

(SSER 23)

(82) Surveillance (SER) 4.2.4 (83) Fuel Design Considerations Resolved (SER) 4.2.5 (SSER 23)

(84) Nuclear Design (SSER 23) 4.3 (85) Design Basis Resolved (SER) 4.3.1 (SSER 13)

(SSER 23)

(86) Design Description Resolved (SER) 4.3.2 (SSER 13)

(SSER 15)

(SSER 23)

(87) Analytical Methods Resolved (SER) 4.3.3 (SSER 23) 1-7

Issue Status Section Note (88) Summary of Evaluation Findings Resolved (SER) 4.3.4 (SSER 23)

(89) Thermal-Hydraulic Design (SSER 23) 4.4 (90) Performance in Safety Criteria Resolved (SER) 4.4.1 (SSER 23)

(91) Design Bases Resolved (SER) 4.4.2 (SSER 12)

(SSER 23)

(92) Thermal-Hydraulic Design Resolved (SER) 4.4.3 Methodology (SSER 6)

(SSER 8)

(SSER 12)

(SSER 13)

(SSER 16)

SE dated 6/13/89 (SSER 23)

(93) Operating Abnormalities Resolved (SER) 4.4.4 (SSER 13)

(SSER 23)

(94) Loose Parts Monitoring System Resolved (SER) 4.4.5 (SSER 3)

(SSER 5)

(SSER 16)

(SSER 23)

(95) Thermal-Hydraulic Comparison Resolved (SER) 4.4.6 (SSER 23)

(96) N-1 Loop Operation Resolved (SER) 4.4.7 (SSER 23)

(97) Instrumentation for Inadequate Core Open (NRR) (SER) 4.4.8 Cooling Detection (TMI Action Item (SSER 10)

II.F.2) (SSER 23)

(98) Summary and Conclusion Open (NRR) (SER) 4.4.9 (SSER 23)

(99) Reactor Materials 4.5 (100) Control Rod Drive Structural Resolved (SER) 4.5.1 1 Materials (101) Reactor Internals and Core Support Resolved (SER) 4.5.2 Materials (102) Functional Design of Reactivity Resolved (SER) 4.6 Control Systems (SSER 23)

(103) Reactor Coolant System and 5 Connected Systems (104) Summary Description Resolved (SER) 5.1 2 (SSER 5)

(SSER 6)

(105) Integrity of Reactor Coolant 5.2 Pressure Boundary 1-8

Issue Status Section Note (106) Compliance with Codes and Code Resolved (SER) 5.2.1 Cases (SSER 22)

(107) Overpressurization Protection Resolved (SER) 5.2.2 (SSER 2)

(SSER 15)

(SSER 24)

(108) Reactor Coolant Pressure Boundary Resolved (SER) 5.2.3 Materials (SSER 22)

(109) Reactor Coolant System Pressure Open (NRR) (SER) 5.2.4 Boundary Inservice Inspection and (SSER 10)

Testing (SSER 12)

(SSER 15)

(SSER 16)

(SSER 23)

(110) Reactor Coolant Pressure Boundary Resolved (SER) 5.2.5 Leakage Detection (SSER 9)

(SSER 11)

(SSER 12)

(SSER 22)

(111) Reactor Vessel and Internals 5.2.6 Modeling (112) Reactor Vessel 5.3 (113) Reactor Vessel Materials Open (NRR) (SER) 5.3.1 (SSER 11)

(SSER 14)

(SSER 22)

(114) Pressure-Temperature Limits Open (NRR) (SER) 5.3.2 (SSER 16)

(SSER 22)

(115) Reactor Vessel Integrity Open (NRR) (SER) 5.3.3 (SSER 22)

(116) Component and Subsystem Design 5.4 (117) Reactor Coolant Pumps Resolved (SER) 5.4.1 2 (SSER 22)

(118) Steam Generators Resolved (SER) 5.4.2 (SSER 1)

(SSER 4)

(SSER 22)

(119) Residual Heat Removal System Resolved (SER) 5.4.3 (SSER 2)

(SSER 5)

(SSER 10)

(SSER 11)

(SSER 23)

(120) Pressurizer Relief Tank Resolved (SER) 5.4.4 (SSER 22) 1-9

Issue Status Section Note (121) Reactor Coolant System Vents Open (SER) 5.4.5 (TMI Action Item II.B.1) (Inspection) (SSER 2)

(SSER 5)

(SSER 12)

(SSER 23)

(122) Engineered Safety Features 6 (123) Engineered Safety Feature 6.1 Materials (124) Metallic Materials Open (NRR) (SER) 6.1.1 (SSER 23)

(125) Organic Materials Resolved (SER) 6.1.2 (SSER 22)

(126) Postaccident Emergency Cooling Resolved (SER) 6.1.3 Water Chemistry (SSER 22)

(127) Containment Systems 6.2 (128) Containment Functional Design Resolved (SER) 6.2.1 (SSER 3)

(SSER 5)

(SSER 7)

(SSER 12)

(SSER 14)

(SSER 15)

(SSER 22)

(129) Containment Heat Removal Resolved (SER) 6.2.2 Systems (SSER 7)

(SSER 22)

(130) Secondary Containment Functional Resolved (SER) 6.2.3 Design (SSER 18)

(SSER 22)

(131) Containment Isolation Systems Resolved (SER) 6.2.4 (SSER 3)

(SSER 5)

(SSER 7)

(SSER 12)

(SSER 22)

(132) Combustible Gas Control Systems Resolved (SER) 6.2.5 (SSER 4)

(SSER 5)

(SSER 8)

(SSER 22)

(133) Containment Leakage Testing Open (NRR) (SER) 6.2.6 (SSER 4)

(SSER 5)

(SSER 19)

(SSER 22)

(134) Fracture Prevention of Containment Resolved (SER) 6.2.7 1 Pressure Boundary (SSER 4)

(SSER 23)

(135) Emergency Core Cooling System Resolved (SER) 6.3 1 1-10

Issue Status Section Note (136) System Design Open (NRR) (SER) 6.3.1 (SSER 6)

(SSER 7)

(SSER 11)

(137) Evaluation Resolved (SER) 6.3.2 1 (SSER 5)

(138) Testing Open (NRR) (SER) 6.3.3 (SSER 2)

(SSER 9)

(139) Performance Evaluation Resolved (SER) 6.3.4 (140) Conclusions Open (NRR) (SER) 6.3.5 (141) Control Room Habitability Resolved (SER) 6.4 (SSER 5)

(SSER 11)

(SSER 16)

(SSER 18 (SSER 22)

(142) Engineered Safety Feature (ESF) 6.5 Filter Systems (143) ESF Atmosphere Cleanup System Resolved (SER) 6.5.1 (SSER 5)

(SSER 22)

(144) Fission Product Cleanup System Resolved (SER) 6.5.2 1 (145) Fission Product Control System Open (NRR) (SER) 6.5.3 (SSER 22)

(146) Ice Condenser as a Fission Product Resolved (SER) 6.5.4 1 Cleanup System (147) Inservice Inspection of Class 2 and Open (NRR) (SER) 6.6 3 Components (SSER 10)

(SSER 12)

(SSER 15)

(SSER 23)

(148) Instrumentation and Controls 7 (149) Introduction 7.1 (150) General Resolved (SER) 7.1.1 (SSER 13)

(SSER 16)

(SSER 23)

(151) Comparison with Other Plants Resolved (SER) 7.1.2 1 (SSER 23)

(152) Design Criteria Resolved (SER) 7.1.3 (SSER 4)

(SSER 15)

(SSER 23)

(153) Reactor Trip System Resolved (SER) 7.2 (154) System Description Open (NRR) (SER) 7.2.1 (SSER 13)

(SSER 15)

(SSER 23) 1-11

Issue Status Section Note (155) Manual Trip Switches Resolved (SER) 7.2.2 1 (SSER 23)

(156) Testing of Reactor Trip Breaker Resolved (SER) 7.2.3 1 Shunt Coils (SSER 23)

(157) Anticipatory Trips Resolved (SER) 7.2.4 (SSER 23)

(158) Steam Generator Water Level Trip Resolved (SER) 7.2.5 (SSER 2)

(SSER 14)

(SSER 23)

(159) Conclusions Resolved (SER) 7.2.6 (SSER 13)

(SSER 23)

(160) Engineered Safety Features System Open (NRR) (SER) 7.3 (SSER 13)

(161) System Description Resolved (SER) 7.3.1 (SSER 13)

(SSER 14)

(SSER 23)

(162) Containment Sump Level Resolved (SER) 7.3.2 Measurement (SSER 2)

(SSER 23)

(163) Auxiliary Feedwater Initiation and Resolved (SER) 7.3.3 1 Control (SSER 23)

(164) Failure Modes and Effects Analysis Resolved (SER) 7.3.4 (SSER 23)

(165) IE Bulletin 80-06 Resolved (SER) 7.3.5 (SSER 3)

(SSER 23)

(166) Conclusions Resolved (SER) 7.3.6 (SSER 13)

(SSER 23)

(167) Systems Required for Safe 7.4 Shutdown (168) System Description Resolved (SER) 7.4.1 (SSER 23)

(169) Safe Shutdown from Auxiliary Resolved (SER) 7.4.2 Control Room (SSER 7)

(SSER 23)

(170) Conclusions Resolved (SER) 7.4.3 (SSER 23)

(171) Safety-Related Display 7.5 Instrumentation (172) Display Systems Resolved (SER) 7.5.1 (SSER 23) 1-12

Issue Status Section Note (173) Postaccident Monitoring System Open (SER) 7.5.2 (Inspection) (SSER 7)

(SSER 9)

(SSER 14)

(SSER 15)

(SSER 23)

(174) IE Bulletin 79-27 Open (SER) 7.5.3 (Inspection) (SSER 23)

(175) Conclusions Open (SER) 7.5.4 (Inspection)

(176) All Other Systems Required for 7.6 Safety (177) Loose Part Monitoring System Resolved (SER) 7.6.1 (SSER 23)

(SSER 24)

(178) Residual Heat Removal System Resolved (SER) 7.6.2 Bypass Valves (SSER 23)

(179) Upper Head Injection Manual Resolved (SER) 7.6.3 Control (SSER 23)

(180) Protection Against Spurious Resolved (SER) 7.6.4 Actuation of Motor-Operated Valves (SSER 23)

(181) Overpressure Protection during Low Resolved (SER) 7.6.5 Temperature Operation (SSER 4)

(SSER 23)

(182) Valve Power Lockout Resolved (SER) 7.6.6 (SSER 23)

(183) Cold Leg Accumulator Valve Resolved (SER) 7.6.7 Interlocks and Position Indication (SSER 23)

(184) Automatic Switchover From Resolved (SER) 7.6.8 Injection to Recirculation Mode (SSER 23)

(185) Conclusions Resolved (SER) 7.6.9 (SSER 4)

(186) Control Systems Not Required for 7.7 Safety (187) System Description Open (NRR) (SER) 7.7.1 (SSER 23)

(SSER 24)

(188) Safety System Status Monitoring Resolved (SER) 7.7.2 System (SSER 7)

(SSER 13)

(SSER 23)

(189) Volume Control Tank Level Control Resolved (SER) 7.7.3 System (SSER 23)

(190) Pressurizer and Steam Generator Resolved (SER) 7.7.4 Overfill (SSER 23)

(191) IE Information Notice 79-22 Resolved (SER) 7.7.5 (SSER 23)

(192) Multiple Control System Failures Resolved (SER) 7.7.6 (SSER 23) 1-13

Issue Status Section Note (193) Conclusions Resolved (SER) 7.7.7 (194) Anticipated Transient Without Resolved (SSER 9) 7.7.8 Scram Mitigation System Actuation (SSER 14)

Circuitry (AMSAC) (SSER 23)

(195) NUREG-0737 Items Resolved (SER) 7.8 (SSER 23)

(196) Relief and Safety Valve Position Open (SER) 7.8.1 Indication (TMI Action Item II.D.3) (Inspection) (SSER 5)

(SSER 14)

(SSER 23)

(197) Auxiliary Feedwater System Open (SER) 7.8.2 Initiation and Flow Indication (TMI (Inspection) (SSER 23)

Action Item II.E.1.2)

(198) Proportional Integral Derivative Open (SER) 7.8.3 Control Modification (TMI Action (Inspection) (SSER 23)

Item II.K.3.9)

(199) Proposed Anticipatory Trip Resolved (SER) 7.8.4 Modification (TMI Action Item (SSER 4)

II.K.3.10) (SSER 23)

(200) Confirm Existence of Anticipatory Resolved (SER) 7.8.5 Reactor Trip Upon Turbine Trip (TMI (SSER 23)

Action Item II.K.3.12)

(201) Data Communication Systems (SSER 23) 7.9 (202) Electric Power Systems 8 (203) General Open (NRR) (SER) 8.1 (SSER 22)

(SSER 24)

(204) Offsite Power System (SER) 8.2 (SSER 22)

(205) Compliance with GDC 5 Open (NRR) (SER) 8.2.1 (SSER 13)

(SSER 22)

(206) Compliance with GDC 17 Open (NRR) (SER) 8.2.2 (SSER 2)

(SSER 3)

(SSER 13)

(SSER 14)

(SSER 15 (SSER 22)

(207) Compliance with GDC 18 Resolved (SER) 8.2.3 (SSER 22)

(208) Evaluation Findings Open (NRR) (SER) 8.2.4 (SSER 22)

(209) Onsite Power Systems Resolved (SER) 8.3 (SSER 10)

(SSER 19)

(SSER 22) 1-14

Issue Status Section Note (210) Onsite AC Power System Open (NRR) (SER) 8.3.1 Compliance with GDC 17 (SSER 2)

(SSER 7)

(SSER 9)

(SSER 10)

(SSER 13)

(SSER 14)

(SSER 18)

(SSER 20)

(SSER 22)

(211) Onsite DC System Compliance with Open (NRR) (SER) 8.3.2 GDC 17 (SSER 2)

(SSER 3)

(SSER 13)

(SSER 14)

(SSER 22)

(212) Common Electrical Features and Resolved (SER) 8.3.3 Requirements (SSER 2)

(SSER 3)

(SSER 7)

(SSER 13)

(SSER 14)

(SSER 15)

(SSER 16)

(SSER 22)

(213) Evaluation Findings Open (NRR) (SER) 8.3.4 (SSER 2)

(SSER 3)

(SSER 7)

(SSER 13)

(SSER 14)

(SSER 15)

(SSER 16)

(SSER 22)

(214) Station Blackout Open (NRR) (SSER 22) 8.4 (215) Auxiliary Systems Resolved (SER) 9 (SSER 10)

(216) Fuel Storage Facility 9.1 (217) New-Fuel Storage Resolved (SER) 9.1.1 1 (218) Spent-Fuel Storage Resolved (SER) 9.1.2 (SSER 5)

(SSER 15)

(SSER 16)

(SSER 22)

(219) Spent Fuel Pool Cooling and Open (NRR) (SER) 9.1.3 Cleanup System (SSER 11)

(SSER 15)

(SSER 23) 1-15

Issue Status Section Note (220) Fuel-Handling System Resolved (SER) 9.1.4 (SSER 3)

(SSER 13)

(SSER 22)

(SSER 24)

(221) Water Systems 9.2 (222) Essential Raw Cooling Water and Open (NRR) (SER) 9.2.1 Raw Cooling Water System (SSER 9)

(SSER 10)

(SSER 18)

(SSER 23)

(223) Component Cooling System Open (NRR) (SER) 9.2.2 (Reactor Auxiliaries Cooling Water (SSER 5)

System) (SSER 23)

(224) Demineralized Water Makeup Resolved (SER) 9.2.3 System (SSER 22)

(225) Potable and Sanitary Water Resolved (SER) 9.2.4 Systems (SSER 9)

(SSER 22)

(226) Ultimate Heat Sink Open (NRR) (SER) 9.2.5 (SSER 23)

(227) Condensate Storage Facilities Resolved (SER) 9.2.6 (SSER 12)

(SSER 22)

(228) Process Auxiliaries 9.3 (229) Compressed Air System Resolved (SER) 9.3.1 1 (SSER 22)

(230) Process Sampling System Resolved (SER) 9.3.2 (SSER 3)

(SSER 5)

(SSER 14)

(SSER 16)

(SSER 24)

(231) Equipment and Floor Drainage Resolved (SER) 9.3.3 3 System (SSER 22)

(232) Chemical and Volume Control Resolved (SER) 9.3.4 3 System (SSER 22)

(233) Heat Tracing (SSER 22) 9.3.8 (234) Heating, Ventilation, and Air 9.4 Conditioning Systems (235) Control Room Area Ventilation Resolved (SER) 9.4.1 System (SSER 9)

(SSER 22)

(236) Fuel-Handling Area Ventilation Resolved (SER) 9.4.2 System (SSER 22)

(237) Auxiliary Building and Radwaste Resolved (SER) 9.4.3 Area Ventilation System (SSER 22)

(238) Turbine Building Area Ventilation Resolved (SER) 9.4.4 System (SSER 22) 1-16

Issue Status Section Note (239) Engineered Safety Features Resolved (SER) 9.4.5 Ventilation System (SSER 9)

(SSER 10)

(SSER 11)

(SSER 14)

(SSER 16)

(SSER 19)

(SSER 22)

(240) Reactor Building Purge Ventilation (SSER 22) 9.4.6 System (241) Containment Air Cooling System (SSER 22) 9.4.7 (242) Condensate Demineralizer Waste (SSER 22) 9.4.8 Evaporator Building Environmental Control System (243) Other Auxiliary Systems 9.5 (244) Fire Protection Resolved (SER) 9.5.1 (SSER 10)

(SSER 18)

(SSER 19)

(245) Communications System Resolved (SER) 9.5.2 1 (SSER 5)

(246) Lighting System Resolved (SER) 9.5.3 (SSER 22)

(247) Emergency Diesel Engine Fuel Oil Resolved (SER) 9.5.4 2 Storage and Transfer System (SSER 5)

(SSER 9)

(SSER 10)

(SSER 11)

(SSER 12)

(SSER 22)

(248) Emergency Diesel Engine Cooling Resolved (SER) 9.5.5 1 Water System (SSER 5)

(SSER 11)

(249) Emergency Diesel Engine Starting Resolved (SER) 9.5.6 2 Systems (SSER 5)

(SSER 10)

(SSER 22)

(250) Emergency Diesel Engine Resolved (SER) 9.5.7 2 Lubricating Oil System (SSER 3)

(SSER 5)

(SSER 10)

(SSER 22)

(251) Emergency Diesel Engine Resolved (SER) 9.5.8 2 Combustion Air Intake and Exhaust (SSER 5)

System (SSER 10)

(SSER 22)

(252) Steam and Power Conversion 10 System (253) Summary Description Resolved (SER) 10.1 1-17

Issue Status Section Note (254) Turbine Generator Open (NRR) (SER) 10.2 (SSER 5)

(255) Turbine Generator Design Resolved (SER) 10.2.1 (SSER 12)

(SSER 22)

(256) Turbine Disc Integrity Resolved (SER) 10.2.2 (SSER 23)

(257) Main Steam Supply System Resolved (SER) 10.3 (258) Main Steam Supply System (Up to Resolved (SER) 10.3.1 and Including the Main Steam (SSER 19)

Isolation Valves) (SSER 22)

(259) Main Steam Supply System Resolved (SER) 10.3.2 2 (SSER 22)

(260) Steam and Feedwater System Resolved (SER) 10.3.3 Materials (SSER 22)

(261) Secondary Water Chemistry Resolved (SER) 10.3.4 (SSER 5)

(SSER 22)

(262) Other Features 10.4 (263) Main Condenser Resolved (SER) 10.4.1 (SSER 9)

(SSER 22)

(264) Main Condenser Evacuation System Resolved (SER) 10.4.2 (SSER 22)

(265) Turbine Gland Sealing System Resolved (SER) 10.4.3 (SSER 22)

(266) Turbine Bypass System Resolved (SER) 10.4.4 (SSER 5)

(SSER 22)

(267) Condenser Circulating Water Resolved (SER) 10.4.5 System (SSER 22)

(268) Condensate Cleanup System Open (NRR) (SER) 10.4.6 (SSER 22)

(269) Condensate and Feedwater Resolved (SER) 10.4.7 Systems (SSER 14)

(SSER 22)

(270) Steam Generator Blowdown System Resolved (SER) 10.4.8 (SSER 22)

(SSER 24)

(271) Auxiliary Feedwater System Resolved (SER) 10.4.9 (SSER 14)

(SSER 23)

(SSER 24)

(272) Heater Drains and Vents (SSER 22) 10.4.10 (273) Steam Generator Wet Layup (SSER 22) 10.4.11 System (274) Radioactive Waste Management 11 1-18

Issue Status Section Note (275) Summary Description Resolved (SER) 11.1 2 (SSER 16)

(SSER 24)

(276) Liquid Waste Management Resolved (SER) 11.2 (SSER 4)

(SSER 16)

(SSER 24)

(277) Gaseous Waste Management Open (NRR) (SER) 11.3 (SSER 8)

(SSER 16)

(SSER 24)

(278) Solid Waste Management System Resolved (SER) 11.4 (SSER 16)

(SSER 24)

(279) Process and Effluent Radiological Resolved (SER) 11.5 Monitoring and Sampling Systems (SSER 16)

(SSER 20)

(SSER 24)

(280) Evaluation Findings Resolved (SER) 11.6 (SSER 8)

(SSER 16)

(281) NUREG-0737 Items Open (NRR) (SER) 11.7 (282) Wide-Range Noble Gas, Iodine, and Open (SER) 11.7.1 Particulate Effluent Monitors (TMI (Inspection) (SSER 5)

Action Items II.F.1(1) and II.F.1(2)) (SSER 6)

(283) Primary Coolant Outside Open (NRR) (SER) 11.7.2 Containment (TMI Action item (SSER 5)

III.D.1.1) (SSER 6)

(SSER 10)

(SSER 16)

(284) Radiation Protection 12 (285) General Resolved (SER) 12.1 (SSER 10)

(SSER 14)

(SSER 24)

(286) Ensuring that Occupational Resolved (SER) 12.2 2 Radiation Doses Are As Low As (SSER 14)

Reasonably Achievable (ALARA) (SSER 24)

(287) Radiation Sources Resolved (SER) 12.3 (SSER 14)

(SSER 24)

(288) Radiation Protection Design Open (NRR) (SER) 12.4 Features (SSER 10)

(SSER 14)

(SSER 18)

(SSER 24)

(289) Dose Assessment Open (NRR) (SER) 12.5 (SSER 14)

(SSER 24) 1-19

Issue Status Section Note (290) Health Physics Program Open (NRR) (SER) 12.6 (SSER 10)

(SSER 14)

(SSER 24)

(291) NUREG-0737 Items 12.7 (292) Plant Shielding Open (NRR) (SER) 12.7.1 (TMI Action Item II.B.2) (SSER 14)

(SSER 16)

(SSER 24)

(293) High Range In-Containment Monitor Open (NRR) (SER) 12.7.2 (TMI Action Item II.F.1.(3)) (SSER 5)

(294) In-Plant Radioiodine Monitor (TMI Open (NRR) (SER) 12.7.3 Action Item II.D.3.3) (SSER 16)

(295) Conduct of Operations 13 (296) Organization Structure of the Resolved (SER) 13.1 Applicant (SSER 16)

(SSER 22)

(297) Management and Technical Resolved (SER) 13.1.1 Organization (298) Corporate Organization and Resolved (SER) 13.1.2 Technical Support (299) Plant Staff Organization Open (NRR) (SER) 13.1.3 (SSER 8)

(SSER 22)

(300) Training 13.2 (301) Licensed Operator Training Resolved (SER) 13.2.1 Program (SSER 9)

(SSER 10)

(SSER 22)

(302) Training for Non-licensed Personnel Resolved (SER) 13.2.2 (303) Emergency Preparedness 13.3 Evaluation (304) Introduction Open (NRR) (SER) 13.3.1 (SSER 13)

(SSER 20)

(305) Evaluation of the Emergency Plan Open (NRR) (SER) 13.3.2 (SSER 13)

(SSER 20)

(SSER 22)

(306) Conclusions Open (NRR) (SER) 13.3.3 (SSER 13)

(SSER 20)

(SSER 22)

(307) Review and Audit Resolved (SER) 13.4 (SSER 8)

(SSER 22)

(308) Plant Procedures Resolved (SER) 13.5 (SSER 22) 1-20

Issue Status Section Note (309) Administrative Procedures Resolved (SER) 13.5.1 (SSER 22)

(310) Operating and Maintenance Resolved (SER) 13.5.2 Procedures (SSER 9)

(SSER 10)

(SSER 22)

(311) NUREG-0737 Items Resolved (SER) 13.5.3 (SSER 3)

(SSER 16)

(SSER 22)

(312) Physical Security Plan Resolved (SER) 13.6 (SSER 1)

(SSER 10)

(SSER 15)

(SSER 20)

(SSER 22)

(313) Introduction (SSER 22) 13.6.1 (314) Summary of Application (SSER 22) 13.6.2 (315) Regulatory Basis (SSER 22) 13.6.3 (316) Technical Evaluation (SSER 22) 13.6.4 (317) Conclusions (SSER 22) 13.6.5 (317a) Cyber Security Plan Resolved (SSER 24) 13.6.6 (318) Initial Test Program Resolved (SER) 14 (SSER 3)

(SSER 5)

(SSER 7)

(SSER 9)

(SSER 10)

(SSER 12)

(SSER 14)

(SSER 16)

(SSER 18)

(SSER 19)

(SSER 23)

(319) Accident Analyses 15 (320) General Discussion Resolved (SER) 15.1 (321) Normal Operation and Anticipated Open (NRR) (SER) 15.2 Transients (322) Loss-of-Cooling Transients Resolved (SER) 15.2.1 (SSER 13)

(SSER 14)

(SSER 24)

(323) Increased Cooling Inventory Resolved (SER) 15.2.2 Transients (SSER 24)

(324) Change in Inventory Transients Resolved (SER) 15.2.3 (SSER 18)

(SSER 24) 1-21

Issue Status Section Note (325) Reactivity and Power Distribution Open (NRR) (SER) 15.2.4 Anomalies (SSER 4)

(SSER 7)

(SSER 13)

(SSER 14)

(SSER 24)

(326) Conclusions Resolved (SER) 15.2.5 (SSER 4)

(327) Limiting Accidents Resolved (SER) 15.3 (328) Loss-of-Coolant Accident (LOCA) Resolved (SER) 15.3.1 (SSER 12)

(SSER 15)

(SSER 24)

(329) Steamline Break Resolved (SER) 15.3.2 (SSER 3)

(SSER 14)

(SSER 24)

(330) Feedwater System Pipe Break Resolved (SER) 15.3.3 (SSER 14)

(SSER 24)

(331) Reactor Coolant Pump Rotor Resolved (SER) 15.3.4 Seizure (SSER 14)

(SSER 24)

(332) Reactor Coolant Pump Shaft Break Resolved (SER) 15.3.5 (SSER 14)

(SSER 24)

(333) Anticipated Transients Without Resolved (SER) 15.3.6 Scram (SSER 3)

(SSER 5)

(SSER 6)

(SSER 10)

(SSER 11)

(SSER 12)

(SSER 24)

(334) Conclusions Resolved (SER) 15.3.7 (335) Radiological Consequences of Resolved (SER) 15.4 Accidents (SSER 15)

(336) Loss-of-Coolant Accident Open (NRR) (SER) 15.4.1 (SSER 5)

(SSER 9)

(SSER 18)

(337) Main Steamline Break Outside of Open (NRR) (SER) 15.4.2 Containment (SSER 15)

(338) Steam Generator Tube Rupture Open (NRR) (SER) 15.4.3 (SSER 2)

(SSER 5)

(SSER 12)

(SSER 14)

(SSER 15) 1-22

Issue Status Section Note (339) Control Rod Ejection Accident Open (NRR) (SER) 15.4.4 (SSER 15)

(340) Fuel-Handling Accident Open (NRR) (SER) 15.4.5 (SSER 4)

(SSER 15)

(341) Failure of Small Line Carrying Open (NRR) (SER) 15.4.6 Coolant Outside Containment (342) Postulated Radioactive Releases as Open (NRR) (SER) 15.4.7 a Result of Liquid Tank Failures (343) NUREG-0737 Items 15.5 (344) Thermal Mechanical Report (TMI Resolved (SER) 15.5.1 Action Item II.K.2.13) (SSER 4)

(SSER 24)

(345) Voiding in the Reactor Coolant Resolved (SER) 15.5.2 System during Transients (TMI (SSER 4)

Action Item II.K.2.17) (SSER 24)

(346) Installation and Testing of Automatic Resolved (SER) 15.5.3 Power-Operated Relief Valve (SSER 5)

Isolation System (TMI Action Item II.K.3.1) Report on Overall Safety Effect of Power-Operated Relief Valve Isolation System (TMI Action Item II.K.3.2)

(347) Automatic Trip of Reactor Coolant Resolved (SER) 15.5.4 Pumps (TMI Action Item II.K.3.5) (SSER 4)

(SSER 16)

(SSER 24)

(348) Small-Break LOCA Methods Open (SER) 15.5.5 (II.K.3.30) and Plant-Specific (Inspection) (SSER 4)

Calculations (II.K.3.31) (SSER 5)

(SSER 16)

(349) Relative Risk of Low-Power Resolved (SER) 15.6 Operation (350) Technical Specification Open (NRR) 16 (351) Quality Assurance 17 (352) General Resolved (SER) 17.1 (353) Organization Resolved (SER) 17.2 (354) Quality Assurance Program Resolved (SER) 17.3 (SSER 2)

(SSER 5)

(SSER 10)

(SSER 13)

(SSER 15)

(SSER 22)

(355) Conclusions Resolved (SER) 17.4 (356) Maintenance Rule 17.6 (357) Control Room Design Review 18 1-23

Issue Status Section Note (358) General Resolved (SER) 18.1 (SSER 5)

(SSER 6)

(SSER 15)

(SSER 16)

(SSER 22)

(359) Conclusions Resolved (SER) 18.2 (SSER 16)

(SSER 22)

(360) Report of the Advisory Committee (SER) 19 on Reactor Safeguards (361) Common Defense and Security (SER) 20 (362) Financial Qualifications (SER) 21 (363) TVA Financial Qualifications for (SSER 22) 21.1 WBN Unit 2 (SSER 23)

(364) Foreign Ownership, Control, or (SSER 22) 21.2 Domination (365) Financial Protection and Indemnity 22 Requirements (366) General (SER) 22.1 (367) Preoperational Storage of Nuclear (SER) 22.2 Fuel (368) Operating Licenses Open (NRR) (SSER 22) 22.3 (369) Quality of Construction, Operational 25 Readiness, and Quality Assurance Effectiveness (370) Program for Maintenance and Open (NRR) (SSER 22) 25.9 Preservation of the Licensing Basis for Units 1 and 2 Notes:

1. In the process of further validating the information in the WBN Unit 2 FSAR, TVA identified minor administrative/typographical changes to sections previously considered Resolved. TVA addressed these changes to the applicable sections in their submittals and clearly indicated them to the staff. The staff has reviewed and confirmed that the changes made are administrative/typographical and do not impact the staffs conclusions as stated in previous SSERs. Based on this review, no additional review is necessary and this section remains Resolved.

2. During the assessment of the regulatory framework for completion of the project, the staff characterized certain topics as Open pending TVAs validation of the information contained in the section. TVA has determined that the information presented in the FSAR remained valid and only identified minor administrative or typographical changes to the section. TVA addressed the changes in their submittals and clearly indicated the changes. The staff reviewed and confirmed that the changes made to the section are administrative/typographical and do not impact its conclusions as stated in previous SSERs. Therefore, no additional review is necessary and the staff considers this section Resolved.

1-24

3. In SSER 21, this issue was identified as Resolved. However, TVA made changes to the Unit 2 FSAR affecting the previous staff conclusions. The staff evaluated the changes and the results are documented in this SSER.

1.8 Confirmatory Issues At this point in the review, there are some items that have essentially been resolved to the staff's satisfaction, but for which certain confirmatory information has not yet been provided by the applicant. In these instances, the applicant has committed to provide the confirmatory information in the near future. If staff review of this information does not confirm preliminary conclusions on an item, that item will be treated as open, and the NRC staff will report on its resolution in a supplement to this report.

The confirmatory items, with appropriate references to subsections of this report, are noted in Appendix HH.

1.9 License Conditions The NRC staff proposes two license conditions discussed in Section 2.4.10 of this SSER.

Flooding Protection Proposed License Condition No. 1:

TVA will submit to the NRC staff by August 31, 2012, for review and approval, a summary of the results of the finite element analysis, which demonstrates that the Cherokee and Douglas dams are fully stable under design basis probable maximum flood loading conditions for the long-term stability analysis, including how the preestablished acceptance criteria were met.

Flooding Protection Proposed License Condition No. 2:

TVA will submit to the NRC staff, before completion of the first operating cycle, its long-term modification plan to raise the height of the embankments associated with the Cherokee, Fort Loudoun, Tellico, and Watts Bar dams. The submittal shall include analyses to demonstrate that, when the modifications are complete, the embankments will meet the applicable structural loading conditions, stability requirements, and functionality considerations to ensure that the design basis probable maximum flood limits are not exceeded at the Watts Bar Nuclear Plant. All modifications to raise the height of the embankments shall be completed within 3 years from the date of issuance of the operating license.

The NRC staff proposes two license conditions discussed in Section 13.6.6.3.22 of this SSER.

Cyber Security Proposed License Condition 1:

The licensee shall implement the requirements of 10 CFR 73.54(a)(1)(ii) as they relate to the security computer. Completion of these actions will occur consistent with the full implementation date of September 30, 2014, as established in the licensees letter dated April 7, 2011, Response to Request for Additional Information Regarding Watts Bar 1-25

Nuclear Plant Cyber Security Plan License Amendment Request, Cyber Security Plan Implementation Schedule - Watts Bar Nuclear Plant Unit 1.

Cyber Security Proposed License Condition 2:

The licensee shall implement the requirements of 10 CFR 73.54(a)(1)(iii) as they relate to the corporate based systems that support emergency preparedness. Completion of these actions will occur consistent with the Watts Bar Nuclear Plant Unit 1 implementation schedule established in the licensees letter dated April 7, 2011, Response to Request for Additional Information Regarding Watts Bar Nuclear Plant Cyber Security Plan License Amendment Request, Cyber Security Plan Implementation Schedule - Watts Bar Nuclear Plant Unit 1.

1.10 Unresolved Safety Issues Section 210 of the Energy Reorganization Act of 1974, as amended, states, in part, The Commission shall develop a plan for providing for specification and analysis of unresolved safety issues relating to nuclear reactors and shall take such action as may be necessary to implement corrective measures with respect to such issues.

The NRC staff continuously evaluates the safety requirements used in its review against new information as it becomes available. In some cases, the staff takes immediate action or interim measures to ensure safety. In most cases, however, the initial assessment indicates that immediate licensing actions or changes in licensing criteria are not necessary. In any event, further study may be deemed appropriate to make judgments as to whether existing requirements should be modified. The issues being studied are sometimes called generic safety issues because they are related to a particular class or type of nuclear facility.

The NRC staff documented its original review of Unresolved Safety Issues for Watts Bar Nuclear Plant (WBN), Units 1 and 2, in Appendix C to the safety evaluation report (SER; NUREG-0847, June 1982). A discussion of the status of resolution of these generic issues for TVAs application for an operating license for WBN Unit 2 is provided in Appendix C to SSER 23, dated July 2011.

1.13 Implementation of Corrective Action Programs and Special Programs In 1985, TVA developed a corporate Nuclear Performance Plan (NPP) that identified and proposed corrections to problems concerning the overall management of its nuclear program and a site-specific plan for Watts Bar entitled, Watts Bar Nuclear Performance Plan (WBNPP).

TVA established 18 corrective action programs (CAPs) and 11 special programs (SPs) to address these concerns.

SSER 21, Table 1.13.1 documented the status of staff review of the CAPs and SPs. This SSER and future supplements to the SER, the staff will document its evaluation and closure of open NPP items.

1-26

1.13.1 Corrective Action Programs No. Title Program Review Status (1) Cable Issues Resolved

a. Silicon Rubber Insulated Cable (See Appendix HH)

b. Cable Jamming

c. Cable Support in Vertical Conduit

d. Cable Support in Vertical Trays

e. Cable Proximity to Hot Pipes

f. Cable Pull-Bys

g. Cable Bend Radius

h. Cable Splices

i. Cable Sidewall Bearing Pressure

j. Pulling Cables Through 90° Condulet and Flexible Conduit

k. Computer Cable Routing System Software and Database Verification and Validation (2) Cable Tray and Tray Supports Resolved (3) Design Baseline and Verification Program Resolved (4) Electrical Conduit and Conduit Support Resolved (5) Electrical Issues

a. Flexible Conduit Installations Resolved

b. Physical Cable Separation and Electrical Isolation (See Appendix HH)

c. Contact and Coil Rating of Electrical Devices

d. Torque Switch and Overload Relay Bypass Capability for Active Safety-Related Valves

e. Adhesive-Backed Cable Support Mount (6) Equipment Seismic Qualification Resolved (7) Fire protection Resolved (8) Hanger and Analysis Update Program Resolved (9) Heat Code Traceability Resolved (10) Heating, Ventilation, and Air-Conditioning Duct and Resolved Duct Supports (11) Instrument Lines Resolved (12) Prestart Test Program Plan Resolved (13) Quality Assurance (QA) Records Resolved (14) Quality-List (Q-List) Resolved 1-27

No. Title Program Review Status (15) Replacement Items Program (Piece Parts) Resolved (16) Seismic Analysis Resolved (17) Vendor Information Program Resolved (18) Welding Resolved 1.13.2 Special Programs No. Title Program Review Status (1) Concrete Quality Program Resolved (2) Containment Cooling Resolved (3) Detailed Control Room Design Review Resolved (4) Environmental Qualifications Program Resolved (5) Master Fuse List Resolved (6) Mechanical Equipment Qualification Resolved (7) Microbiologically Induced Corrosion Resolved (8) Moderate Energy Line Break Flooding Resolved (9) Radiation Monitoring System Resolved (11) Use-As-Is Condition Adverse to Quality Resolved 1-28

1.14 Implementation of Applicable Bulletin and Generic Letter Requirements From time to time, the NRC staff issues generic requirements or recommendations in the form of orders, bulletins (BLs), generic letters (GLs), regulatory issue summaries, and other documents to address certain safety and regulatory issues. These are generally termed generic communications.

The table below outlines the status of the resolution of the generic communications identified in SSER 21. It should be noted that, although many of the generic communications have been documented or otherwise resolved, the NRC staff has determined that there may be circumstances that could result in the need to reopen a previously closed topic.

Correspondence No. Title (1) GL 1980-14 Light-Water Reactor Primary Coolant System Pressure Isolation Valves TVA Action: Submit Technical Specifications (TSs) for NRC Review.

NRC Action: To be reviewed during validation of TS 3.4.14 submitted February 2, 2010.

(2) GL 1980-77 Refueling Water Level - Technical Specifications Changes TVA Action: Submit Technical Specifications for NRC Review.

NRC Action: To be reviewed during validation of TS 3.9.5 -TS 3.9.7 submitted February 2, 2010.

(3) GL 1982-28 Inadequate Core Cooling Instrumentation System TVA Action: Closed.

NRC Action: Closed. Subsumed as part of NRC staff review of Instrumentation and Controls submitted April 8, 2010.

(4) GL 1983-28 Required Actions Based on Generic Implications of Salem Anticipated Transient without Scram Events (Screened into the Items 4 through 7)

(4.a) GL 1983-28 (item Post-Maintenance Testing (reactor trip system components) 3.1)

Submit Technical Specifications for NRC Review.

TVA Action:

To be reviewed during validation of TS Bases 3.0.1 submitted NRC Action: March 4, 2009.

1-29

Correspondence No. Title (4.b) GL 1983-28 (3.2) Post-Maintenance Testing (All Surveillance Requirement Components)

TVA Action Submit Technical Specifications and NRC Review.

NRC Action To be reviewed during validation of TS Bases 3.0.1 submitted March 4, 2009.

(4.c) GL 1983-28 (4.2) Reactor Trip System Reliability (Preventive Maintenance and Surveillance Program for Reactor Trip Breakers)

TVA Action Submit Technical Specifications and NRC Review.

NRC Action To be reviewed during staff evaluation of Item 17 of TS Table 3.3.1-1 submitted February 2, 2010.

(4.d) GL 1983-28 (4.5) Reactor Trip System Reliability (Automatic Actuation of Shunt Trip Attachment)

TVA Action Submit Technical Specifications and NRC Review.

NRC Action To be reviewed during staff evaluation of Item 18 of TS Table 3.3.1-1 submitted February 2, 2010.

(8) GL 1986-09 Technical Resolution of Generic Issue B-59, (N-1) Loop Operation in BWRs and PWRs TVA Action Submit Technical Specifications for NRC Review.

NRC Action To be reviewed during validation of TS 3.4.4 - TS 3.4.8 submitted February 2, 2010.

(9) GL 1988-20 Individual Plant Examination for Severe Accident Vulnerability TVA Action Closed.

NRC Action Closed. NRC letter dated August 12, 2011 (ADAMS Accession No. ML111960228).

(10) GL 1988-20,s1 Initiation of the Individual Plant Examination for Severe Accident Vulnerabilities 10 CFR 50.54 TVA Action Closed.

NRC Action Closed. NRC letter dated August 12, 2011 (ADAMS Accession No. ML111960228).

1-30

Correspondence No. Title (11) GL 1988-20s2 Individual Plant Examination for Severe Accident Vulnerability.

Accident Management Strategies for Consideration in the Individual Plant Examination Process TVA Action Closed.

NRC Action Closed. NRC letter dated August 12, 2011 (ADAMS Accession No. ML111960228).

(12) GL 1988-20s3 Individual Plant Examination for Severe Accident Vulnerability.

Completion of Containment Performance Improvement Program and Forwarding of Insights for Use in the IPE for Severe Accident Vulnerabilities TVA Action Closed.

NRC Action Closed. NRC letter dated August 12, 2011 (ADAMS Accession No. ML111960228).

(13) GL 1988-20s4 Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities TVA Action Closed.

NRC Action Open pending completion of staff review of IPEEE submitted April 30, 2010.

(14) GL 1988-20s5 Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f)

TVA Action Closed.

NRC Action Open pending completion of staff review of IPEEE submitted April 30, 2010.

(15) GL 1989-04 Guidelines on Developing Acceptable Inservice Testing Programs TVA Action The proposed approach has been approved for WBN Unit 1; the same approach will be proposed for use on WBN Unit 2 without change.

NRC Action Open.

1-31

Correspondence No. Title (16) GL 1989-21 Request for Information Concerning Status of Implementation of Unresolved Safety Issue Requirements TVA Action TVA provided an updated status of unresolved safety issues on September 26, 2008, as supplemented on December 2, 2010, and January 25, 2011.

NRC Action Closed. See Appendix C of SSER 23.

(17) GL 1990-06 Resolution of Generic Issues 70, "PORV [power-operated relief valve] and Block Valve Reliability," and 94, "Additional LTOP [low-temperature overpressure] Protection for PWRs" TVA Action Submit Technical Specifications for NRC Review.

NRC Action To be reviewed during validation of TS 3.4.11 - TS 3.4.12 submitted February 2, 2010.

(18) GL 1992-08 Thermo-Lag 330-1 Fire Barriers TVA Action The proposed approach has been approved for WBN Unit 1; the same approach will be proposed for use on WBN Unit 2 without change.

NRC Action Open. Pending NRC staff inspection verification.

(19) GL 1995-03 Circumferential cracking of Steam Generator (SG) Tubes TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated January 21, 2010 (ADAMS Accession No. ML093631061).

(20) GL 1995-05 Voltage -Based Repair Criteria for Westinghouse Steam Generator Tubes affected by Outside Diameter Stress Corrosion Cracking TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated January 21, 2010 (ADAMS Accession No. ML093631061).

1-32

Correspondence No. Title (21) GL 1996-06 Assurance of Equipment Operability and Containment Integrity During Design-Basis Accident Conditions TVA Action The proposed approach has been approved for WBN Unit 1; the same approach will be proposed for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated January 21, 2010 (ADAMS Accession No. ML100130227).

(22) GL 1995-07 Pressure Locking and Thermal Binding of Safety- Related Power-Operated Gate Valves (Not identified in SSER 21 as Open)

TVA Action The proposed approach has been approved for WBN Unit 1; the same approach will be proposed for use on WBN Unit 2 without change.

NRC Action Closed. NRC letter dated August 12, 2010 (ADAMS Accession No. ML100190443).

(23) GL 1997-01 Degradation of Control Rod Drive Mechanism Nozzle and Other Vessel Closure Head Penetrations TVA Action The proposed approach has been approved for WBN Unit 1; the same approach will be proposed for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated June 30, 2010 (ADAMS Accession No. ML100539515).

(24) GL 1997-04 Assurance of Sufficient Net Positive Suction Head for Emergency Core Cooling and Containment Heat Removal Pumps Integrity During Design-Basis Accident Conditions TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated February 18, 2010 (ADAMS Accession No. ML100200375).

1-33

Correspondence No. Title (25) GL 1997-05 SG Tube Inspection Techniques TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated January 21, 2010 (ADAMS Accession No. ML093631061).

(26) GL 1997-06 Degradation of SG Internals TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated January 21, 2010 (ADAMS Accession No. ML093631061).

(27) GL 1998-02 Loss of Reactor Coolant Inventory and Associated Potential for Loss of Emergency Mitigation Functions While in a Shutdown Condition TVA Action The proposed approach has been approved for WBN Unit 1; the same approach will be proposed for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated May 11, 2010 (ADAMS Accession No. ML101200155).

(28) GL 1998-04 Potential for Degradation of the ECCS and the Containment Spray System after a LOCA because of Construction and Protective Coating Deficiencies and Foreign Material in Containment TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated February 1, 2010 (ADAMS Accession No. ML100260594).

1-34

Correspondence No. Title (29) GL 2003-01 Control Room Habitability TVA Action No action or documentation is provided to show the staff has reviewed the item for WBN Unit 2, and the resolution is through submittal of a technical specification.

NRC Action Closed. NRC Letter dated February 1, 2010 (ADAMS Accession No. ML100270076).

(30) GL 2004-01 Requirements for SG Tube Inspection TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated January 21, 2010 (ADAMS Accession No. ML093631061).

(31) GL 2004-02 Potential Impact of Debris Blockage on Emergency Recirculation during Design-Basis Accidents at PWRs TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Open.

(32) GL 2006-01 SG Tube Integrity and Associated Technical Specifications TVA Action No action or documentation is provided to show the staff has reviewed the item for WBN Unit 2, and the resolution is through submittal of a technical specification.

NRC Action Closed. NRC Letter dated January 21, 2010 (ADAMS Accession No. ML093631061) (See Appendix HH).

(33) GL 2006-02 Grid Reliability and the Impact on Plant Risk and the Operability of Offsite Power TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated January 21, 2010 (ADAMS Accession No. ML093631061) (See Appendix HH).

1-35

Correspondence No. Title (34) GL 2006-03 Potentially Nonconforming Hemyc and MT Fire Barrier Configurations TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter February 25, 2010 (ADAMS Accession No. ML100470398).

(35) GL 2007-01 Inaccessible or Underground Power Cable Failures that Disable Accident Mitigation Systems or Cause Plant Transients TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated January 26, 2010 (ADAMS Accession No. ML100120052).

(36) GL 2008-01 Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems TVA Action TVA submitted the information requested by the GL.

NRC Action Closed. NRC letter dated August 23, 2011 (ADAMS Accession No. ML112232205).

(37) BL 1992-01 and Failure of Thermo-Lag 330 Fire Barrier System to Perform its Supplement 1 Specified Fire Endurance Function TVA Action The proposed approach has been approved for WBN Unit 1; the same approach will be proposed for use on WBN Unit 2 without change.

NRC Action Open. Pending NRC staff inspection verification.

(38) BL 1996-01 Control Rod Insertion Problems (PWR)

TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC letter dated May 3, 2010 (ADAMS Accession No. ML101200035) required Confirmatory Action (See Appendix HH).

1-36

Correspondence No. Title (39) BL 1996-02 Movement of Heavy Loads Over Spent Fuel, Over Fuel In the Reactor Core, or Over Safety-Related Equipment The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change Closed. NRC Letter dated March 4, 2010 (ADAMS Accession No. ML100480062).

(40) BL 2001-01 Circumferential Cracking of Reactor Pressure Vessel (RPV)

Head Penetration Nozzles TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. See NRC Letter dated June 30, 2010 (ADAMS Accession No. ML100539515).

(41) BL 2002-01 RPV Head Degradation and Reactor Coolant Pressure Boundary Integrity TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. See NRC Letter dated June 30, 2010 (ADAMS Accession No. ML100539515).

(42) BL 2002-02 RPV Head and Vessel Head Penetration Nozzle Inspection Program TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. See NRC Letter dated June 30, 2010 (ADAMS Accession No. ML100539515).

1-37

Correspondence No. Title (43) BL 2003-02 Leakage from RPV Lower Head Penetrations and Reactor Coolant Pressure Boundary Integrity TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC Letter dated January 21, 2010 (ADAMS Accession No. ML093631061).

(44) BL 2004-01 Inspection of Alloy 82/182/600 Materials Used in the Fabrication of Pressurizer Penetrations and Steam Space Piping Connections at PWRs TVA Action The proposed approach has been approved for WBN Unit 1; the same approach was submitted for use on WBN Unit 2 without change.

NRC Action Closed. NRC letter dated August 4, 2010 (ADAMS Accession No. ML102080017).

(45) BL 2007-01 Security Officer Attentiveness TVA Action The proposed approach has been approved for WBN Unit 1; the same approach will be proposed for use on WBN Unit 2 without change.

NRC Action Closed. NRC letter dated March 25, 2010 (ADAMS Accession No. ML100770549).

NUREG-0737, TMI Action Items (TVA letter dated September 14, 1981, applies to all of the following NUREG-0737 issues)

(46) NUREG-0737 Independent Safety Engineering Group Item I.B.1.2 TVA Action The proposed approach has been approved for WBN Unit 1; the same approach will be proposed for use on WBN Unit 2 without change.

NRC Action Open.

1-38

Correspondence No. Title (47) NUREG-0737 Control Room Design Review (CRDR)

Item I.D.1 TVA Action The proposed approach has been approved for WBN Unit 1; the same approach will be proposed for use on WBN Unit 2 without change.

NRC Action Closed in SSER 22, Section 18.2.

(48) NUREG-0737 Post-accident Sampling Item II.B.3 TVA Action No action or documentation is provided to show the staff has reviewed the item for WBN Unit 2, and the resolution is through submittal of a technical specification.

NRC Action Closed in SSER 24, Section 9.3.2.

(49) NUREG-0737 Containment Isolation Dependability Item II.E.4.2 TVA Action No action or documentation is provided to show the staff has reviewed the item for WBN Unit 2, and the resolution is through submittal of a technical specification.

NRC Action Open.

(50) NUREG-0737 Instrumentation for Detection of Inadequate Core-Cooling Item II.F.2 TVA Action Open.

NRC Action Open. See SSER 23, Section 4.4.8.

(51) NUREG-0737 Reporting SV/RV Failures/Challenges Item II.K.3.3 TVA Action No action or documentation is provided to show the staff has reviewed the item for WBN Unit 2, and the resolution is through submittal of a technical specification.

NRC Action Closed in SSER 22, Section 13.5.3.

1-39

Correspondence No. Title (52) NUREG-0737 Anticipatory Trip at High Power Item II.K.3.10 TVA Action No action or documentation is provided to show the staff has reviewed the item for WBN Unit 2, and the resolution is through submittal of a technical specification.

NRC Action Open.

(53) NUREG-0737 Primary Coolant Outside Containment Item III.D.1.1 TVA Action No action or documentation is provided to show the staff has reviewed the item for WBN Unit 2, and the resolution is through submittal of a technical specification.

NRC Action Open.

(54) NUREG-0737 Control-Room Habitability Item III.D.3.4 TVA Action The proposed approach has been approved for WBN Unit 1; the same approach will be proposed for use on WBN Unit 2 without change.

NRC Action Closed in SSER 22, Section 6.4.

(55) IEB 75-08 PWR Pressure Instrumentation TVA Action The item has been approved either for both units at WBN or explicitly for WBN Unit 2; however, a change to the original approval requires submittal of the technical specifications and staff review.

NRC Action Open.

(56) IEB 77-04 Calculation Error Affecting Performance of a System for Controlling pH of Containment Sump Water Following a LOCA The item has been approved either for both units at WBN or TVA Action explicitly for WBN Unit 2; however, a change to the original approval requires submittal of the technical specifications and staff review.

NRC Action Open.

1-40

2 SITE CHARACTERISTICS 2.4 Hydrologic Engineering 2.4.10 Flooding Protection Requirements The staff of the U.S. Nuclear Regulatory Commission (NRC) reviewed the Tennessee Valley Authoritys (TVAs) Amendments 98, 99, 103, and 104 to the Watts Bar Nuclear Plant (WBN)

Unit 2 final safety analysis report (FSAR), Section 2.4, Hydraulic Engineering.

Evaluation In FSAR Amendment 98, dated May 7, 2010, and Amendment 99, dated May 27, 2010, TVA made some changes to FSAR Sections 2.4 through 2.4.3, about hydrological issues, floods, and the probable maximum flood (PMF). TVA made the changes based on the latest available information from the U.S. Army Corps of Engineers, Hydrologic Engineering Center; the National Weather Service document, Probable Maximum and TVA Precipitation Estimates with Areal Distribution for Tennessee River Drainages Less Than 3,000 Square Miles in Area; and the U.S. Geological Survey, National Water Information System. The FSAR stated that the PMF elevation is 738.8 feet and that TVA enveloped the calculated potential dam failure analyses. TVA further stated that it had not changed the breach sizes. As a result, the PMF elevation at 738.8 feet, which exceeds the original licensed PMF elevation, ensures that margin exists to protect critical equipment. Since TVA based the changes to Section 2.4 in FSAR Amendments 98 and 99 on the latest available hydrologic information, the staff concluded that the changes were acceptable.

In FSAR Amendment 103, dated January 24, 2011, TVA provided changes to FSAR Section 2.4 to account for a new PMF analysis. The staff verified that the changes in Amendment 103 were acceptable, because they were consistent with the latest available information from the U.S. Army Corps of Engineers, Hydrologic Engineering Center; the National Weather Service document, Probable Maximum and TVA Precipitation Estimates with Areal Distribution for Tennessee River Drainages Less Than 3,000 Square Miles in Area; and the U.S. Geological Survey, National Water Information System. However, in FSAR Section 2.4.3, Probable Maximum Flood (PMF) on Streams and Rivers, the staff found no mention that the predicted PMF level is dependent on the temporary modifications currently in place. The staff requested that TVA provide additional information to complete its review.

By letter dated March 30, 2011 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML110700622), the staff requested, in question EMCB-RAI-1, that TVA describe how the WBN Unit 2 licensing basis credits the use of the sand baskets with regard to protecting WBN Unit 2. In its letter dated April 20, 2011 (ADAMS Accession No. ML11112A137), TVA stated that the WBN Unit 2 PMF analysis and the seismic dam failure analysis credit an increased height of embankment at four dams (Fort Loudoun, Tellico, Cherokee, and Watts Bar). TVA stated that the increased height prevents overtopping and failure of these embankments during a PMF event. TVA stated that, at the time of a seismic event, the reservoir headwaters will not have reached the bottom elevation of the sand baskets; therefore, a hydrodynamic loading condition does not apply. TVA further stated the following:

Stability analysis of the Fort Loudoun embankment sand baskets for the seismic load case, which is based on the simultaneous application of seismic base accelerations at the top of the embankment as shown in WBN Unit 2 FSAR 2-1

Figure 2.4-72 [Embankment Results Of Analysis For Operating Basis EarthquakeFort Loudoun Dam], showed that the sand baskets are stable and meet or exceed the acceptable stability factors of safety. To confirm this stability determination, TVA will perform either a hydrology analysis without crediting the use of the sand baskets at Fort Loudoun dam for the seismic dam failure and flood combination described above or TVA will perform a seismic test of the sand baskets. TVA will report the results of this analysis or test to the NRC by October 31, 2011.

During the review, the staff conducted a conference call on May 4, 2011, and asked that TVA indicate an effective height of the embankment on Figure 2.4-72. In FSAR Amendment 104, TVA revised Figure 2.4-72 by adding Note 3, which stated the following:

Improvements have increased the effective height of the embankment to a minimum El. 836 (see Fort Loudoun project drawing 10W222-1). Field surveys indicate a minimum height of elevation 836.9 was achieved.

In FSAR Amendment 104, dated June 3, 2011, TVA also stated that the predicted PMF level is dependent on the temporary modifications currently in place. Specifically, TVA had deployed sand baskets, approximately 4 feet in height, in the vicinity of four dams (Cherokee, Fort Loudoun, Tellico, and Watts Bar).

As described above, the staff reviewed TVAs response to EMCB-RAI-1 and the revised Figure 2.4-72 and found them acceptable. In order to confirm the stability analysis of the sand baskets used by TVA in the WBN Unit 2 licensing basis, TVA will perform either a hydrology analysis without crediting the use of the sand baskets at the Fort Loudoun dam for the seismic dam failure and flood combination, or TVA will perform a seismic test of the sand baskets, as stated in TVAs letter dated April 20, 2011. TVA will report the results of this analysis or test to the NRC by October 31, 2011. This is Open Item 133 (Appendix HH).

During a meeting between TVA and the NRC on July 2, 2010, to discuss hydrology concerns expressed by the staff related to the operating TVA units, TVA indicated that the Cherokee and Douglas dams require rigorous evaluation in the form of finite element analyses to confirm their structural adequacy and functionality for long-term operation. The NRC staff agreed with TVAs action as a confirmation of its earlier operability determination for PMF related to the operating units. TVA also indicated that the estimated completion of such analyses will likely extend beyond the projected start of operation for WBN Unit 2. By letter dated March 30, 2011 (ADAMS Accession No. ML110700622), the staff requested, in question EMCB-RAI-2, that TVA discuss how the licensing bases for WBN Unit 2 reflect the short-term operability and the long-term functionality of these dams.

By letter dated April 20, 2011 (ADAMS Accession No. ML11112A137), TVA stated the following:

The WBN Unit 2 licensing basis PMF hydrologic analysis, as described in Section 2.4 of the WBN Unit 2 FSAR, considers Cherokee and Douglas dams fully stable for the PMF loading conditions. To address short-term functionality of Cherokee and Douglas dams for new PMF loads, stability evaluations of both dams were performed by ARCADIS [consultant]. Based on these evaluations, ARCADIS recommended continued operation of Cherokee and Douglas dams until a more rigorous finite element analysis (FEA) is performed. TVA subsequently provided the ARCADIS evaluation of Cherokee Dam to the TVA 2-2

Hydro Board of Consultants (HBOC) for review. In December 2009, the HBOC concluded that The sliding factors of safety and resistance against overturning are considered adequate for the continued operation of the dam under the normal pool and new PMF loading conditions while the finite element analysis is being planned and carried out. Since the Douglas Dam is similar to Cherokee Dam, TVA concluded that the HBOC assessment of Cherokee Dam was applicable to Douglas Dam. The FEA, which is addressed in the TVA corrective action program, will be completed before the projected start of operation of WBN Unit 2. TVA will provide an update of the WBN Unit 2 FSAR to describe the long-term stability analysis methodology following the completion of the FEA by August 31, 2012.

The staff reviewed TVAs response to EMCB-RAI-2 and determined that TVA adequately addressed the short-term functionality of the Cherokee and Douglas dams for the new PMF loads, because it confirmed continued operation based on the results of the stability ARCADIS evaluations of both dams. TVA stated that it would provide an update of the WBN Unit 2 FSAR to describe the long-term stability analysis methodology following the completion of the FEA by August 31, 2012. By letter dated May 20, 2011 (ADAMS Accession No. ML11145A163), TVA stated the following:

TVA agreed during the follow-up phone call [held on May 4, 2011, to discuss TVAs letter dated April 20, 2011] that completion of the Cherokee and Douglas dams finite element analysis as discussed in RAI [request for additional information] response question 2 and the date for permanent modification resolution to address each of the sand basket installations as discussed in RAI response question 4, would be license conditions.

Therefore, the staff proposes a license condition requiring the following:

TVA will submit to the NRC staff by August 31, 2012, for review and approval, a summary of the results of the finite element analysis, which demonstrates that the Cherokee and Douglas dams are fully stable under design basis probable maximum flood loading conditions for the long-term stability analysis, including how the preestablished acceptance criteria were met.

By letter dated March 30, 2011 (ADAMS Accession No. ML110700622), the staff requested, in question EMCB-RAI-3, that TVA discuss its basis for determining the structural adequacy of the sand baskets, under either a temporary or long-term deployment scenario. Specifically, the staff requested that TVA address the ability of the sand baskets to withstand debris, erosion, and impact loading caused by a tornado, a hurricane, or large moving objects such as trucks. By letter dated April 20, 2011 (ADAMS Accession No. ML11112A137), TVA stated that it performed the stability calculations for the sand baskets under PMF conditions using vendor test data for sliding resistance. The PMF stability analysis demonstrated an acceptable factor of safety in sliding for each installation. Based on the vendors sand basket estimation of a design life of between 5 and 7 years, TVA concluded that the sand baskets can perform their intended function until decisions are made about the long-term solution for preventing embankment overflow. TVA also stated that it did not evaluate the impact loading caused by a tornado, a hurricane, or large moving objects, such as trucks, in the sand basket structural adequacy calculations. TVA stated that any impacts to the sand baskets from large moving objects (such as trucks) in flood conditions are not considered, since the flow of the driving water through the reservoirs would carry such objects to the discharge points of the reservoirs.

2-3

By letter dated May 20, 2011 (ADAMS Accession No. ML11145A163), TVA stated that the sand baskets installed on the embankments at the Cherokee, Fort Loudoun, Tellico, and Watts Bar dams are designed for loading conditions that are consistent with the loading conditions used in the design of the dam concrete structures and embankments at these facilities. TVA also stated that, for the PMF and the seismic-flood events, the sand baskets are designed for the lateral hydrostatic loads resulting from the peak headwater conditions, the uplift pressure on the base of the baskets, and the deadweight of the sand baskets. TVA stated that the sand baskets were shown to be stable against sliding by demonstrating that the frictional resistance at the basket/surface interface multiplied by the vertical forces on the base of the sand basket exceeds the applied lateral hydrostatic forces with a minimum factor of safety of 1.1, in accordance with U.S. Army Corps of Engineers document EM 1110-2-2100, Engineering and Design of Stability Analysis of Concrete Structures, for extreme conditions.

TVA stated that the sand baskets are shown to be stable against overturning by demonstrating that the resisting moment provided by the deadweight of the baskets exceeds the overturning moment associated with the lateral hydrostatic forces and the uplift pressure on the base of the sand baskets. For the seismic flood events evaluated, TVA stated that none of the sand baskets are credited, except at the Fort Loudoun dam. The Fort Loudoun dam sand baskets are designed for the top-of-embankment horizontal and vertical base accelerations for the seismic event under consideration plus deadweight. TVA stated that, should a tornado, a hurricane, or the impact of a large moving object (such as a land-based truck) cause damage to the sand baskets, inspections by TVA personnel within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after these events would detect the damage, and the appropriate repairs would be made. Further, TVA stated that any impacts to the sand basket from large moving objects (such as trucks) in flood conditions are not considered, since the flow of the driving water through the reservoirs would carry such objects to the discharge points of the reservoirs.

The staff concluded that TVAs responses to EMCB-RAI-3 were acceptable, because TVA adequately responded to the staffs concerns associated with its basis for concluding the structural adequacy of the sand baskets, under either a temporary or long-term deployment scenario, specifically, the ability of the sand baskets to withstand debris, erosion, and impact loading caused by a tornado, a hurricane, or large moving objects such as trucks.

By letter dated March 30, 2011 (ADAMS Accession No. ML110700622), the staff requested, in question EMCB-RAI-4, that TVA clarify whether the sand baskets will be replaced or modified as permanent structures after WBN Unit 2 receives its operating license. The staff also requested that TVA provide documentation of long-term usage either from the manufacturer, equivalent projects, or other appropriate supporting documentation. In addition, the staff requested that the documentation include references to the maintenance and operation plans of the systems, or replacement plans, to achieve a long-term solution. By letter dated April 20, 2011 (ADAMS Accession No. ML11112A137), TVA responded that the permanent modifications are in the conceptual design phase; therefore, the transition from the temporary modification to permanent modification has not yet been formally planned. TVA further stated that permanent modification options to address each of the sand basket installations are currently underway as part of the TVAs National Environmental Policy Act review process. TVA stated that a formal decision on the preferred alternative will be made by September 2012.

Implementation of the preferred alternative is expected to be completed by October 2015, which is before the end of the vendors projected sand basket design life of 5-7 years.

2-4

As noted above, by letter dated May 20, 2011 (ADAMS Accession No. ML11145A163), TVA stated the following:

TVA agreed during the follow-up phone call [held on May 4, 2011, to discuss TVAs letter dated April 20, 2011] that completion of the Cherokee and Douglas dams finite element analysis as discussed in RAI response question 2 and the date for permanent modification resolution to address each of the sand basket installations as discussed in RAI response question 4, would be license conditions.

Based on TVAs responses, the NRC staff proposes a license condition stating that, before completion of the first operating cycle, TVA will submit its long-term or permanent modification plan to raise the height of the embankments associated with the Cherokee, Fort Loudoun, Tellico, and Watts Bar dams. The plan shall be supported by analyses to demonstrate that, when the modifications are complete, the embankments will meet the applicable structural loading conditions, stability requirements, and functionality considerations to ensure that the design-basis probable maximum flood limits are not exceeded at WBN. Considering that the service life of the sand baskets is 5-7 years and that WBN Unit 2 is expected to begin operation in 2012, the final modification shall be completed within 3 years from the date of issuance of the operating license.

By letter dated March 30, 2011 (ADAMS Accession No. ML110700622), the staff requested, in question EMCB-RAI-5, that TVA identify all current operability determinations that it has made related to WBN Unit 1 that are relevant to WBN Unit 2, where the licensing bases for Unit 1 about hydrology and the PMF level are not fully met. In addition, the staff asked TVA to discuss how it intends to address, in its licensing basis for WBN Unit 2, each incident for which TVA is relying on an operability determination for continued operation at Unit 1 until full compliance with the licensing basis is reached. By letter dated April 20, 2011 (ADAMS Accession No. ML11112A137), TVA responded that, during the reverification of the design-basis flood levels for WBN Unit 2, it identified inconsistencies and erroneous input assumptions in the existing design-basis hydrologic analysis for WBN Unit 1. As TVA identified these issues, it wrote corrective action documents and performed evaluations to assess the estimated impact of the issues on the WBN Unit 1 design bases. After TVA reviewed each issue or group of issues for impact on WBN Unit 1 operability and design bases, it closed the corrective action documents to a single corrective action document, WBN Problem Evaluation Report (PER) 154477, which tracks resolution of the final design-basis flood hydrologic analyses and update of the WBN Unit 1 FSAR licensing basis.

TVA also stated that it has completed the reverification of the design-basis flood levels for WBN Units 1 and 2. As a result of the issues associated with the WBN Unit 1 design-basis flood hydrologic analysis, the maximum PMF elevation at the WBN site increased from elevation 734.9 to 738.8 feet. TVA indicated that the evaluation performed for the impact of the revised PMF elevation of 738.8 feet did not identify any operability concerns for Unit 1. However, an update of the WBN Unit 1 FSAR for the revised hydrologic analysis and the increased design-basis flood elevation is required and is scheduled, as described in TVAs Corrective Action Program. TVA further stated that it revised the WBN Unit 2 design-basis flood licensing bases. TVA indicated that the hydrological analysis performed in support of the WBN Unit 2 design-basis flood evaluation resolved the deficiencies identified in the reverification process. In WBN Unit 2 FSAR Amendment 104, TVA updated the increased height credited at the Fort Loudoun, Cherokee, Watts Bar, and Tellico dams as the current licensing basis for WBN Unit 2.

The FSAR, page 2.4-32 (in the section Multiple Failures), states the following:

2-5

Fort Loudoun, Tellico, and Watts Bar have previously been judged not to fail for the OBE [operating-basis earthquake] (0.09 g). Postulation of Tellico failure in this combination has not been evaluated but is bounded by the SSE

[safe-shutdown earthquake] failure of Norris, Cherokee, Douglas and Tellico.

TVA should provide the NRC staff with supporting technical justification for the statements in Amendment 104 of FSAR Section 2.4.4.1, Dam Failure Permutations, page 2.4-32 (in the section Multiple Failures) that, Fort Loudoun, Tellico, and Watts Bar have previously been judged not to fail for the OBE (0.09 g). Postulation of Tellico failure in this combination has not been evaluated but is bounded by the SSE failure of Norris, Cherokee, Douglas and Tellico.

This is Open Item 134 (Appendix HH).

Conclusions As discussed above, the NRC staff verified that TVAs changes in FSAR Section 2.4 are acceptable because they are consistent with the latest available information from the U.S. Army Corps of Engineers, Hydrologic Engineering Center; the National Weather Service document, Probable Maximum and TVA Precipitation Estimates with Areal Distribution for Tennessee River Drainages Less Than 3,000 Square Miles in Area, and the U.S. Geological Survey, National Water Information System.

Based on the staffs review of Amendment 104 to WBN Unit 2 FSAR Section 2.4.3 and the information provided by TVA in its letters dated April 20 and May 20, 2011, TVA adequately addressed the staffs questions regarding the dependence of the predicted PMF on the temporary modifications (sand baskets) currently in place at the dams in the vicinity of WBN. As discussed above, the staff proposes two license conditions related to the flooding protection at Watts Bar Unit 2.

Flooding Protection Proposed License Condition No. 1:

TVA will submit to the NRC staff by August 31, 2012, for review and approval, a summary of the results of the finite element analysis, which demonstrates that the Cherokee and Douglas dams are fully stable under design basis probable maximum flood loading conditions for the long-term stability analysis, including how the preestablished acceptance criteria were met.

Flooding Protection Proposed License Condition No. 2:

TVA will submit to the NRC staff, before completion of the first operating cycle, its long-term modification plan to raise the height of the embankments associated with the Cherokee, Fort Loudoun, Tellico, and Watts Bar dams. The submittal shall include analyses to demonstrate that, when the modifications are complete, the embankments will meet the applicable structural loading conditions, stability requirements, and functionality considerations to ensure that the design basis probable maximum flood limits are not exceeded at the Watts Bar Nuclear Plant. All modifications to raise the height of the embankments shall be completed within 3 years from the date of issuance of the operating license.

2-6

2.5 Geology and Seismology Introduction The NRC staff reviewed Sections 2.5 through 2.5.5 of WBN Unit 2 FSAR Amendment 95, dated November 24, 2009, pertaining to the geotechnical engineering and aspects of TVAs application for an operating license for WBN Unit 2. The staff concluded that TVA did not make any changes to FSAR Sections 2.5 through 2.5.3, or to Section 2.5.5, dealing with geological and seismological aspects of WBN Unit 2, compared to those aspects which were reviewed and approved by the NRC staff at the time of the licensing of WBN Unit 1 in 1996. However, TVA has made some additions and corrections to FSAR Section 2.5.4, Properties of Subsurface Materials and Foundations. Based on its review, the NRC staff asked a number of questions, as discussed below, which were discussed with TVA staff on March 31, 2010, at a public meeting. TVA subsequently responded to the staffs questions by letter dated June 3, 2010.

Evaluation The staff noted that WBN Unit 2 FSAR Section 2.5.4.2.2.9.4, Monitoring Program for Differential Movement, page 2.5-89, contained an addition which states that TVA had determined that differential settlement was no longer required at WBN, based on an internal TVA memo on settlement stations, dated February 6, 1984, and on TVA Calculation No. WCG-1-861, Settlement Monitoring. The staff asked TVA to provide a copy of its 1984 memo, justifying its decision to discontinue the differential settlement monitoring. The basis for the staffs question was the statement in FSAR Section 2.5.4.2.2.9.3 that discusses that the design value of 1-inch of differential settlement between the adjacent rock-supported structures was not incorporated into the design of piping and electrical components passing between the adjacent rock-supported Category I structures. The staffs request was made to verify the basis for TVAs determination to discontinue differential settlement monitoring referred to in FSAR Amendment 95.

In its letter to the staff dated June 3, 2010, TVA provided internal memos dated August 30, 1983, Settlement Monitoring Program, and February 6, 1984, Watts Bar Nuclear Plant Units 1 and 2 - Settlement Stations. The staff reviewed these internal memos and noted that, for the first eight years (ending in November 1982), the settlement of the rock-supported turbine generator foundation readings changed only +/-1/16 inch from the initial readings. The staff also noted that the waste management building was monitored for 7 years (as stated in the memo dated February 6, 1984) and for the last two years had only 0.05 inches of settlement. The settlement readings on the diesel generator building, the waste management building, and the turbine generators were negligible over the monitored period. Since the building settlements were monitored over a reasonable period of time based on engineering judgement and the settlements were insubstantial, the staff concluded that TVAs approach was acceptable.

In Amendment 95, TVA made some corrections on FSAR pages (pp) 2.5-150 through 2.5-251 to correct previous entries, e.g., pp 2.5-165 through 168 include corrections to formulas for dynamic soil properties. The staff asked TVA to describe the effects of these corrections, with special attention given to the effect of the corrections related to the dynamic soil properties previously used in the soil-structure analysis/design.

In its response to the staff by letter dated June 3, 2010, TVA stated that the revision in Amendment 95 was to correct typographical errors in the Unit 2 FSAR, in order to make it the same as the Unit 1 FSAR. TVA stated that the Unit 1 version is correct and the Unit 2 version 2-7

was intended to be the same; however, the Unit 2 version was inadvertently changed due to the electronic document conversion process. TVA also stated that the pages listed provide Tables 2.5-17A, 2.5-17B, 2.5-17C, and 2.5-7D. The amendment of all four pages was "WBNP-63" in the version of the pages issued by FSAR Amendment 92, and remained as such through Amendment 98. TVA further stated that the changes corrected typographical errors that occurred during the change from one electronic format to another; this happened in the version of the pages issued by Amendment 95, and the amendment remains the same. The staff concluded that TVAs responses were acceptable, because the typographical errors that occurred during the change from one electronic format to another were corrected by FSAR Amendment 98.

The staff also asked TVA to discuss the effects of corrections and additions made to the laboratory test data pertaining to the Essential Raw Cooling Water (ERCW) supply pipelines, since these soil investigations pertain to the issue of liquefaction of soils supporting these pipelines, which was an important topic discussed between the NRC and TVA at the time WBN Unit 1 was licensed.

In its response by letter dated June 3, 2010, TVA stated that no test data were affected. As discussed above, the changes corrected errors that occurred during the change from one electronic format to another. The staff concluded that TVAs response was acceptable, since the typographical errors that occurred during the change from one electronic format to another were corrected by FSAR Amendment 98.

The staff noted that FSAR pp 2.5-179, 180, and 181, denoted as Amendment 40, contained some apparent changes in Amendment 95. The staff asked TVA,

• to indicate if the changes pertain to Amendment 40 or to Amendment 95.

• if the entries pertain to Amendment 40, then to confirm that these were previously reviewed and approved by the NRC staff. If the entries were added in Amendment 95, TVA was asked to correct the amendment number and discuss the effect of the changes.

In its letter dated June 3, 2010, TVA stated that, as discussed above, the indicated changes corrected errors that occurred during the change from one electronic format to another. Thus, no change bars are required, and the amendment remains the same. In Amendment 98, these three pages are now on the following two pages: p. 2.5-177 is Table 2.5-24 (sheet 2 of 3), and

p. 2.5-179 is Table 2.5-24 (sheet 3 of 3). The staff concluded that TVAs response was acceptable, because the typographical errors that occurred during the change from one electronic format to another were corrected by Amendment 98.

Similarly, FSAR pp 2.5-203 and 204, denoted as Amendment 63, contained some apparent changes in Amendment 95. The staff asked TVA,

• to indicate if these changes pertain to Amendment 63 or to Amendment 95.

• if the entries pertain to Amendment 63, confirm that these were previously reviewed and approved by the NRC staff. If the entries were added in Amendment 95, TVA was asked to correct the amendment number and discuss the effect of the changes.

2-8

In its letter dated June 3, 2010, TVA stated that the indicated changes correct errors that occurred during the change from one electronic format to another. TVA also stated that in Amendment 98, sheets 2 and 3 of Table 2.5-24 are now on the following pages: p. 2.5-201 is Table 2.5-43 (sheet 1 of 3), and p. 2.5-202 is Table 2.5-43 (sheet 2 of 3). The staff concluded that TVAs response was acceptable, because the typographical errors that occurred during the change from one electronic format to another were corrected by Amendment 98.

Summary and Conclusion The NRC staff reviewed Amendment 95 of WBN Unit 2 FSAR Section 2.5.4, Properties of Subsurface Materials and Foundations, and noted some changes that required clarification.

Based on its review of TVAs responses, the staff concluded that TVAs responses were acceptable, because the typographical errors that occurred during the change from one electronic format to another were corrected by Amendment 98. Since there are no substantive changes to WBN Unit 2 FSAR Sections 2.5 through 2.5.5 since the NRC staff approved the sections during the licensing for WBN Unit 1, the sections are acceptable.

2-9

3 DESIGN CRITERIA 3.6 Protection Against the Dynamic Effects Associated with the Postulated Rupture of Piping 3.6.3 Leak-Before-Break Evaluation Procedures In SSER 22, dated February 2011, the NRC staffs Open Item 15 (Appendix HH) stated TVA should confirm to the NRC staff the completion of Primary Stress Corrosion Cracking (PWSCC) mitigation activities on the Alloy 600 dissimilar metal butt welds (DMBWs) in the primary loop piping.

In Enclosure 1 (item number 15) of its letter to the NRC dated April 6, 2011 (ADAMS Accession No. ML110980637), TVA stated that Unit 2 has completed the Mechanical Stress Improvement Process (MSIP).

Amendment 103 to the Unit 2 FSAR added five new paragraphs to the end of Section 5.5.3.3.1 (Material Corrosion/Erosion Evaluation) to describe this process.

TVA stated, in part, in Section 5.5.3.3.1 of WBN Unit 2 FSAR Amendment 103, dated March 15, 2011, that Pressurizer and reactor vessel nozzle dissimilar metal (i.e., Inconel Alloy 82/182) are susceptible to stress corrosion cracking. Under sustained tensile stresses, dissimilar metal (DM) nozzle buttering and nozzle to safe end butt welds can develop cracks through corrosive action of the primary water. However, stress corrosion cracking does not occur in materials that are in a compressive state of stress. Therefore, TVA has committed to industry guidance document, Nuclear Energy Institute, (NEI) 03-08, Guideline for the Management of Materials Issues, to address these materials issues. NEI 03-08 endorses MRP-139, Revision 1, Material Reliability Program: Primary System Piping Butt Weld Inspection and Evaluation Guideline.

Under this program, TVA has used Mechanical Stress Improvement Process (MSIP), a proprietary mechanical process, which mitigates and prevents the initiation of stress corrosion cracking at dissimilar metal (DM) weld locations in components and piping...

Since TVA confirmed that it has committed to Electric Power Research Institute (EPRI) Material Reliability Program (MRP)-139, Revision 1, December 2008, and used the MSIP process, as documented in WBN Unit 2 FSAR Section 5.5.3.3.1, the NRC staff concludes that TVA has completed reasonable PWSCC mitigation activities on the Alloy 600 DMBWs in the primary loop piping. Therefore, Open Item 15 is closed.

3-1

4 REACTOR 4.4.10 Accident Conditions Grouping postulated accidents by their event frequency is a standard approach used by the U.S. Department of Energy, the NRC, and the nuclear industry. Accidents are defined as Condition I, II, III, IV, or beyond design basis. As stated in WBN Unit 2 FSAR Section 15.0, Accident Analyses, TVA uses the American Nuclear Society (ANS) classification system, which divides plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public. See American Nuclear Society (ANS) 51.1, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants (replaces American National Standards Institute (ANSI) N18.2), issued 1983).

Section 4.3.1 of the WBN Unit 2 FSAR also describes the categorization of plant conditions used by TVA, which are provided as follows for information:

The full spectrum of plant conditions is divided into four categories, in accordance with the anticipated frequency of occurrence and risk to the public:

(1) Condition INormal Operation and Operational Transients (2) Condition IIFaults of Moderate Frequency (3) Condition IIIInfrequent Faults (4) Condition IVLimiting Faults In general the Condition I occurrences are accommodated with margin between any plant parameter and the value of that parameter which would require either automatic or manual protective action. Condition II incidents are accommodated with, at most, a shutdown of the reactor with the plant capable of returning to operation after corrective action. Fuel damage, defined as penetration of the fission product barrier, i.e., the fuel rod clad, is not expected during Condition I and Condition II events. It is not possible to preclude a very small number of rod failures for these events; however, the resulting fission product activity that would potentially result is within the design capability of the Chemical and Volume Control System (CVCS) and is consistent with the plant design bases.

Condition III incidents do not cause more than a small fraction of the fuel elements in the reactor to be damaged, although sufficient fuel element damage might occur to preclude immediate resumption of operation. The release of radioactive material due to Condition III incidents is not sufficient to interrupt or restrict public use of these areas beyond the exclusion radius. Furthermore, a Condition III incident does not, by itself, generate a Condition IV fault or result in a consequential loss of function of the reactor coolant or reactor containment barriers.

Condition IV occurrences are faults that are not expected to occur but are defined as limiting faults which must be designed against. Condition IV faults shall not cause a release of radioactive material that exceeds the limits of 10 CFR [Part] 100.

The core design power distribution limits related to fuel integrity are met for Condition I occurrences through conservative design and maintained by the 4-1

action of the control system. The requirements for Condition II occurrences are met by providing an adequate protection system which monitors reactor parameters. The Control and Protection Systems are described in Chapter 7 [of the FSAR] and the consequences of Condition II, III and IV occurrences are given in Chapter 15 [of the FSAR].

4-2

5 REACTOR COOLANT SYSTEM AND CONNECTED SYSTEMS 5.2 Integrity of Reactor Coolant Pressure Boundary 5.2.2 Overpressure Protection The Tennessee Valley Authority (TVA) described overpressure protection for the reactor coolant pressure boundary (RCPB) during power operation at Watts Bar Nuclear Plant (WBN) Unit 2 in Section 5.2.2, Overpressurization Protection, of the WBN Unit 2 final safety analysis report (FSAR). Three pressurizer safety valves and two power-operated relief valves (PORVs), which all discharge through a common header to the pressurizer relief tank, provide overpressure protection for the RPCB during power operation. Each of the PORVs has the capacity to relieve 210,000 pounds mass per hour of saturated steam at 2,350 pounds per square inch gauge (psig). The PORVs are designed to limit pressurizer pressure to a value below the high pressure reactor trip setpoint for a 10-percent step load decrease and to prevent unnecessary safety valve action. Remotely operated stop valves can individually isolate each PORV in the event of excessive leakage.

Regulatory Evaluation Relief and safety valves and the reactor protection system provide overpressure protection for the RCPB during power operation. The staff of the U.S. Nuclear Regulatory Commission (NRC) reviewed the pressurizer PORVs and safety valves, as well as the piping from these valves to the quench tank and the reactor coolant system (RCS) relief and safety valves. In its review, the NRC staff referred to the guidance in Section 5.2.2, Revision 3, Overpressure Protection, of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, issued July 1981 (hereafter referred to as the SRP). The NRCs acceptance criteria are based, in part, on the following regulatory requirements:

• Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities, Appendix A, General Design Criteria for Nuclear Power Plants, General Design Criterion (GDC) 15, Reactor Coolant System Design, which requires that the RCS and its associated auxiliary systems be designed with sufficient margin to ensure that the design conditions of the RCPB are not exceeded during any condition of normal operation

• GDC 31, Fracture Prevention of Reactor Coolant Pressure Boundary, which requires that the RCPB be designed with sufficient margin to ensure that it behaves in a nonbrittle manner and that the probability of rapidly propagating fracture is minimized SRP Section 5.2.2 contains specific review and acceptance criteria.

Technical Evaluation In the event of a complete loss of heat sink (e.g., when steamflow to the turbine is ended), the pressurizer safety valves protect the RCPB against overpressure, and the steam generator safety valves protect the main steam system against overpressure. The following reactor trip functions are also available for overpressure protection:

(1) reactor trip upon turbine trip (if the turbine is tripped)

(2) high pressurizer pressure reactor trip 5-1

(3) overtemperature change in reactor coolant temperature (T) reactor trip (4) low-low steam generator water level reactor trip As noted in the acceptance criteria of SRP Section 5.2.2, pressure in the reactor coolant and main steam systems should be maintained below 110 percent of the design values, in accordance with the American Society of Mechanical Engineers Boiler and Pressure Vessel Code (ASME Code), Article NB-7000. For WBN Unit 2, the ASME Code pressure limit for the RCPB is 110 percent of its 2,485 psig design pressure (or 2,750 pressure per square inch absolute (psia)).

The upper limit of overpressure protection is based on the positive surge of the reactor coolant produced as a result of a turbine trip under full load (i.e., a 100-percent load mismatch, assuming that the core continues to produce full power). The self-actuated safety valves are sized on the basis of steamflow from the pressurizer to accommodate this surge at a setpoint of 2,500 psia and a total accumulation of 3 percent. The actual installed capacity of the safety valves should be greater than the required capacity, as calculated from the sizing analysis. This is indicated by the ratio of safety valve flow to peak surge rate (greater than 1.0). TVA took no credit for the relief capability provided by the pressurizer PORVs during this surge.

In addition, the guidelines of SRP Section 5.2.2 specify that no credit is to be taken for the first safety-grade reactor trip signal. In a loss of load transient (e.g., a turbine trip under full load),

the first reactor trip signal is expected to be generated by the turbine trip. However, the direct reactor trip upon turbine trip is not credited as a qualified signal, since it originates from the turbine building, which is not seismically qualified. The first safety-grade reactor trip signal would be a signal that is generated by the reactor protection system (i.e., trip signal 2, 3, or 4, listed above). Often, the most direct reactor trip signal (from a high pressurizer pressure condition) is generated first. According to SRP Section 5.2.2, the accident analysis should not credit this signal. The reactor trip should be delayed until the second reactor trip signal (e.g., from overtemperature T) is generated.

To show that WBN Unit 2 is adequately protected against overpressure, TVA referred to (1) the RCS pressure case analysis reported in WBN Unit 2 FSAR, Section 15.2.7, Loss of External Electrical Load and/or Turbine Trip, and (2) Westinghouses final overpressure protection report for WBN Unit 2, Overpressure Protection Report for Watts Bar Nuclear Power Plant Unit 2 as Required by ASME Boiler and Pressure Vessel Code, Section III, Article NB-7300, issued March 2010. The latter report was prepared in accordance with the method described in Westinghouses topical report on overpressure protection, WCAP-7769, Revision 1, Overpressure Protection for Westinghouse Pressurized Water Reactors, issued June 1972.

The analyses in both reports were performed using the LOFTRAN code (see WCAP-7907-P-A (proprietary) and WCAP-7907-A (nonproprietary), LOFTRAN Code Description, issued April 1984), a digital simulation that includes point neutron kinetics, the RCS (including the reactor vessel), the hot leg, the primary side of the steam generator and cold leg, the secondary side of the steam generator, the pressurizer, the pressurizer PORVs and safety valves, and the pressurizer surge line. TVA analyzed this event with no credit taken for operation of the pressurizer PORVs, steamline relief valves, steam dump system, pressurizer level control system, or pressurizer spray. The NRC staff has approved the LOFTRAN code.

TVA performed the analyses in both reports assuming that the reactor would trip on the first safety-grade reactor trip signal (from a high pressurizer pressure condition). However, the review guidelines in SRP Section 5.2.2 specify an analysis of the worst RCS pressure transient 5-2

in which the reactor trip is delayed until the second safety-grade primary system trip signal is generated (e.g., from an overtemperature T condition). Accordingly, the NRC staff requested that TVA provide an analysis that is based on a reactor trip from the second safety-grade primary system trip signal.

In its response to the NRC in Enclosure 1 of its letter dated February 11, 2011, TVA described that such an analysis is a valve sizing calculation, performed before plant construction, to show that the safety valves can provide adequate overpressure protection. Therefore, the FSAR analysis should be sufficient to show that the WBN Unit 2 design includes adequate overpressure protection.

The WBN Unit 2 valve sizing calculation, described in Westinghouses final overpressure protection report, is based on an analysis that credits a reactor trip from the first safety-grade trip signal and not the second safety-grade trip signal. Westinghouses final overpressure protection report is not consistent with SRP Section 5.2.2 guidelines.

The FSAR analysis predicts that the peak primary cooling system pressure will reach 2,691.8 psia, and thus will not exceed 110 percent of the design pressure (or 2,750 psia). TVA provided the requested analysis in Enclosure 4 of its letter dated April 1, 2011, which does not credit the first safety-grade reactor trip signal. As expected, its results indicate that the peak primary pressure will be higher, but not high enough to exceed 110 percent of the design pressure. The following table compares the two analyses.

Table 5.2.2-1 Reactor Trip on Safety-Grade Trip Signals Rx Trips on First Rx Trips on Second Safety-Grade Trip Safety-Grade Trip Signal Signal Loss of load occurs 0.00 sec 0.00 sec High pressurizer pressure setpoint is reached 4.76 sec 4.76 sec Overtemperature T setpoint is reached n/a 9.79 sec Rod motion starts 6.76 sec 11.29 sec Peak primary system pressure is reached 8.50 sec 11.10 sec (2,691.8 psia) (2,714.7 psia)

Secondary safety valves open 9.58 sec 9.57 sec Peak pressurizer water volume is reached 11.60 sec 15.60 sec (1,475.2 ft3) (1,677.7 ft3)

In both transients, the secondary system safety valves open at about the same time. When the reactor trip signal is delayed (because of the occurrence of the second trip signal), the peak primary system pressure is reached before the time of reactor trip. This results from the reduction in the mismatch between heat generation and heat removal caused by the opening of the secondary system safety valves.

The peak pressurizer water volume does not reach the pressurizer capacity (1,800 cubic feet) in either of the analyses. If the pressurizer does not fill, then there would be no water relief through the pressurizer relief or safety valves and no potential for sticking open one or more of these valves. Such a scenario would violate the Condition II event (a fault of moderate 5-3

frequency or anticipated operational occurrence) 1 acceptance criterion that prohibits the development of a more serious event (e.g., a small-break loss-of-coolant accident) from a less serious event (e.g., this loss of load event).

Based on its review of TVAs analysis, the NRC staff concludes that the overpressure protection provided for WBN Unit 2, at power operating conditions, is consistent with the guidelines of SRP Section 5.2.2, and therefore complies with the requirements of GDC 15 and 31.

Conclusion The NRC staff reviewed TVAs analyses related to the overpressure protection capability of the WBN Unit 2 during power operation. The NRC staff concludes that TVA has (1) adequately accounted for the pressurization events and the plant overpressure protection features and (2) demonstrated that the plant will have sufficient pressure relief capacity to ensure that pressure limits are not exceeded. Based on this, the NRC staff concludes that the overpressure protection features will provide adequate protection to meet the requirements of GDC 15 and

31. Therefore, the NRC staff finds the overpressure protection features acceptable with respect to overpressure protection during power operation.

References for SSER Section 5.2.2

1. Smith, M.C., Overpressure Protection Report for Watts Bar Nuclear Power Plant Unit 2 as Required by ASME Boiler and Pressure Vessel Code, Section III, Article NB-7300, March 2010.

2. WCAP-7769, Cooper, K., Miselis, V., Starek, R.M., et al., Overpressure Protection for Westinghouse Pressurized Water Reactors, Revision 1, June 1972.

3. WCAP-7907-P-A (proprietary) and WCAP-7907-A (nonproprietary), Burnett, T.W.T., et al., LOFTRAN Code Description, April 1984.

1 See Supplemental Safety Evaluation Report (SSER) 24, Section 4.4.10, for a description of accident condition classification, or see American Nuclear Society (ANS) 51.1, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants (replaces American National Standards Institute (ANSI) N18.2), issued 1983.

5-4

7 INSTRUMENTATION AND CONTROLS 7.6 All Other Systems Required for Safety 7.6.1 Loose Part Monitoring System 7.6.1.4 Technical Evaluation 7.6.1.4.5 Regulatory Guide 1.133, Revision 1 Regulatory Guide (RG) 1.133, Revision 1, Loose-Part Detection Program for the Primary System of Light-Water-Cooled Reactors, issued April 1977, describes a method acceptable to the staff of the U.S. Nuclear Regulatory Commission (NRC) for detecting a potentially safety-related loose part in light-water-cooled reactors during normal operation. As documented in Supplemental Safety Evaluation Report (SSER) 23, issued July 2011, the Tennessee Valley Authority (TVA) described how the Watts Bar Nuclear Plant (WBN) Unit 2 loose part monitoring system (LPMS) complied with the recommendations of RG 1.133, Revision 1. The staff evaluated this information along with TVAs responses to staff questions about the system and had the following open item in SSER 23 about the LPMS operability for seismic and environmental conditions:

Open Item 82 (Appendix HH): The staff concluded that the information provided by TVA pertaining to the in-containment LPMS equipment qualification for vibration was incomplete. TVA should provide (item number 362 of ADAMS Accession No. ML111050009) documentation that demonstrates the LPMS in-containment equipment has been qualified to remain functional in its normal operating vibration environment, per RG 1.133, Revision 1.

In its letter dated May 6, 2011 (item 362 of Agencywide Documents Access and Management System (ADAMS) Accession No. ML11129A205), TVA stated the following:

The Remote Charge Preamplifiers are mounted in junction boxes inside containment. The junction boxes are hard mounted either to the crane wall or to a fan room wall. The crane wall and fan room walls are not subject to any significant vibration during normal operation.

The rest of the LPMS equipment is installed in a mild environment. In its letter dated June 10, 2011 (item 362 of, and Attachment 1 to, ADAMS Accession No. ML11167A110), TVA provided Westinghouse Electric Company document EQ-QR-79, Revision 0, Summary Test Report Vibration Testing of the Westinghouse Digital Metal Impact Monitoring System (DMIMS-DX) In-Containment Sensor and Integral Hardline Cable 5357C52G01, issued May 2011. The test report demonstrates that the DMIMS-DX in-containment sensor and integral hardline cable has been qualified to remain functional in its normal operating vibration environment, which meets the criteria of RG 1.133, Revision 1. Based on its review of the information provided by TVA in letters dated May 6 and June 10, 2011, the NRC staff concludes that the LPMS meets the guidelines of RG 1.133, Revision 1. Therefore, Open Item 82 is closed.

7-1

7.7 Control Systems Not Required for Safety 7.7.1 System Description 7.7.1.9 In-Core Instrumentation System Section 7.7.1.9, Incore Instrumentation System, of the WBN Unit 2 final safety analysis report (FSAR), Amendment 102, describes the in-core instrumentation system (IIS). This section, in part, states the following:

The incore instrumentation system consists of Chromel-Alumel thermocouples and fixed incore neutron detectors contained within Incore Instrumentation Thimble Assemblies, which are inserted into the fuel assemblies through the Bottom-Mounted Instrumentation (BMI) guide tubes and into the fuel assemblies served by the BMI guide tubes. The fixed incore neutron detectors reside in the core during reactor operation and provide digitized flux signals to the Power Distribution Monitoring System for development of core flux maps.

7.7.1.9.1 Introduction The IIS to be installed in WBN Unit 2 differs from that previously approved for WBN Units 1 and 2, as documented in Section 7.7.1 of NUREG-0847, Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant, Units 1 and 2 (SER), issued June 1982. By application dated July 9, 2009 (ADAMS Accession No. ML091940191), TVA requested changes to the WBN Unit 1 technical specifications (TS) to allow use of a dedicated online core power distribution monitoring system (PDMS) to enhance surveillance of core thermal limits. The PDMS proposed by TVA for WBN was the NRC-approved Westinghouse proprietary computer code, Best Estimate Analyzer for Core OperationsNuclear (BEACON'), using the moveable in-core detector system (MIDS). In License Amendment No. 82 for WBN Unit 1 (ADAMS Accession No. ML092710381), the NRC approved the change.

The IIS for WBN Unit 2 is a new system. For WBN Unit 2, TVA will install an IIS consisting of one chromel-alumel thermocouple and five fixed in-core neutron detectors contained within in-core instrumentation thimble assemblies (IITAs), which are inserted into the fuel assemblies through the bottom-mounted instrumentation (BMI) guide tubes and into the fuel assemblies served by the BMI guide tubes. This system will replace all of the functionality provided by the MIDS used at WBN Unit 1. The IIS to be used at WBN Unit 2 is a Westinghouse INCore Information, Surveillance, and Engineering (WINCISE') system using the BEACON PDMS.

The WINCISE system continuously measures the three-dimensional core power distribution.

The self-powered neutron flux detectors (SPNDs) are distributed both axially and radially within the reactor core to provide continuous measurements of signals directly proportional to the neutron flux present around each SPND element.

Westinghouse developed the BEACON system to improve the monitoring support for Westinghouse-designed pressurized-water reactors, such as WBN Unit 1. The BEACON PDMS is a core monitoring and support package, which uses Westinghouse standard instrumentation in conjunction with an analytical methodology for online generation of three-dimensional power distributions to provide core monitoring, core measurement reduction, core analysis, and core predictions.

7-2

The Westinghouse topical report WCAP-12472-P, BEACON: Core Monitoring and Operations Support System, describes the BEACON system. In its letter dated February 16, 1994, the NRC approved this report as WCAP-12472-P-A for Westinghouse reactors. WCAP-12472-P-A (ADAMS Accession No. ML092050097; not publicly available) contains the NRC approval letter.

The generic NRC SERs provided with WCAP-12472-P-A, Addendum 2, document the BEACON system performing the core power distribution measurement function using the WBN Unit 2 WINCISE-style IIS. In its letter dated February 1, 2002 (ADAMS Accession No. ML020240416),

the NRC staff approved this addendum for Westinghouse reactors. Addendum 2 extends the previously licensed BEACON power distribution monitoring methodology to plants containing platinum self-powered fixed in-core detectors and vanadium self-powered fixed in-core detectors.

For WBN Unit 2, the IIS does not perform any direct Class 1E function. However, the WINCISE neutron flux detectors and wiring are collocated within the same detector and cable assemblies as Class 1E core exit thermocouples (CETs) used in the postaccident monitoring systems (PAMS).

Section 7.7, Control Systems, Revision 5, issued March 2007, of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP), contains the NRC staffs review guidance for the evaluation of the IIS. The objective of this review is to confirm that the IIS conforms to the acceptance criteria and guidelines, the controlled variables can be maintained within prescribed operating ranges (as applicable), and the effects of operation or failure of the system are bounded by any accident analyses in Chapter 15 of the FSAR.

7.7.1.9.2 System Description The IIS is designed to monitor neutron flux distribution and fuel assembly coolant outlet temperatures at selected locations within the reactor core. Two subsystems comprise the IIS:

the in-core thermocouple subsystem (ITS) and the in-core flux mapping subsystem (IFMS). The ITS is designed to perform a primary safety function during normal and postaccident operating modes by providing fuel assembly coolant temperature signals to the PAMS. The IFMS is designed to continuously measure the reactor core power distribution using the BEACON PDMS.

Attachments 4 and 5 to TVAs letter dated April 15, 2011 (ADAMS Accession No. ML11136A053), describe the system hardware and software design. The IIS, as previously stated, uses 58 lITAs. Each IITA consists of five vanadium SPNDs, one Type-K (chromel-alumel) thermocouple used by the Westinghouse common qualified (Common Q) PAMS, and a pressure seal. The assembly is enclosed in a protective sheath, with the detectors and thermocouple passing through a Swagelok mechanical connector fitting and terminated with an electric connector at one end. The Swagelok mechanical connector fitting is a primary pressure boundary through which the detector and thermocouple exits the reactor vessel environment to the containment structure for bottom entry IITA. The IITAs are pushed into the thimble seal table through the concrete shield area and through the bottom of the reactor vessel and into the fuel assembly instrumentation thimble tubes. For all IITAs, the ex-vessel portions of the detectors are to be contained in a metal, hermetic conduit, which extends from the Swagelok mechanical connector fitting assembly to the weldable electrical connector.

7-3

A 316L stainless steel outer sheath tube protects the detectors and thermocouple from contact with the reactor coolant and is part of the reactor coolant pressure boundary. It also withstands the axial forces present during insertion and withdrawal of the IITA before and after refueling operations.

The IITA assemblies are terminated at the far end at a seal table, where the IITA connector mates with a mineral insulated (MI) cable assembly. In Attachment 8 to TVAs May 8, 2011, letter (ADAMS Accession No. ML11129A205), Westinghouse explained that the MI cable comprises three cable sections. The first cable section is the 1-to-2 transition cable assembly, which consists of a multipin electrical connector at one end that mates to the WINCISE in-core detector and carries the signals from five vanadium self-powered detectors signals and one CET signal. This cable section then separates the vanadium self-powered detector signals and CET signals into two separate cables. The vanadium self-powered detector signals are routed to the nonsafety-related signal processing system (SPS) cabinet, and the CET signals are routed to the next MI cable section and, ultimately, through containment penetrations and to the safety-related PAMS. One of these cable sections is available for each in-core detector.

The second cable section, a 6-to-1 transition cable assembly, gathers CET signals from up to six 1-to-2 transition cable assemblies into a single, multipin electrical connector. TVA will install this entire cable section completely in the instrument room at WBN Unit 2.

The third cable section, the containment feedthrough cable assembly, is a combination MI cable and containment penetration assembly (CPA) feedthrough module. This cable section carries up to six CET signals from the 6-to-1 transition cable assembly through the CPA. At the ex-containment interface, the cable section pigtail conductors will be spliced into the existing plant cabling and enclosed in Raychem-style heat shrink tubing hardware. The CETs are connected directly to the PAMS cabinet. The breakout feature of the 1-to-2 transition cable assemblies allows the safety-related CET signals to be parted from the nonsafety-related vanadium self-powered detector signals so that each set of signals can be routed independently to meet TVA-specific cable training and separation requirements.

In-Core Thermocouple Subsystem The WBN Unit 2 ITS consists of 58 Type K chromel-alumel CETs, integral reference junction resistance temperature detectors, and all associated cabling and connectors. As described above, the CET signals are used in the Common Q PAMS. For the WBN Unit 2 WINCISE, the top-mounted CETS and CET columns and conduits were removed. For WBN Unit 2, the thermocouple sensing tip is located within the fuel assembly instrument tube, at the top of the assembly instrument thimble.

The CET signals are separated by their PAMS channel designation. In its letter dated April 15, 2011 (ADAMS Accession No. ML11136A053), TVA notes that all PAM 1 (train A) CETs are routed to penetration 33, and PAM 2 (train B) CETS are routed to penetration 18 through a series of MI cables in the reactor building. WNA-LI-00058-WBT-NP, Revision 3, Post-Accident Monitoring System (PAMS) Licensing Technical Report (ADAMS Accession No. ML110950333 (public version)), describes the WBN 2 PAMS. Section 7.5.2.2 of SSER 23, issued July 2011, also describes the PAMS.

7-4

In-Core Flux Mapping Subsystem The WBN Unit 2 IFMS is a quality-related system. The portions of the system that interface with the reactor coolant system (RCS) pressure boundary and the CETs are safety related. The IFMS consists of the WINCISE system and the BEACON PDMS.

The WINCISE system uses Optimized Proportional Axis Region Signal Separation Extended Life (OPARSSEL') IITAs, containing five vanadium SPNDs and one CET. The individual vanadium emitter generates a signal proportional to the neutron flux activation at its specific location. Within an IITA, each vanadium emitter has a different length to allow the IITA to measure the axial power distribution in five segments (i.e., each segment of detector has a different length that permits measurement of a different axial core segment). If an individual SPND were to fail, the BEACON system will continue to perform, but with a decreased axial resolution of the core power measurement within the assembly. The other vanadium detectors within the IITA would still be deemed operable. TVA should provide to the NRC staff a description of how the other vanadium detectors within the IITA would be operable following the failure of an SPND. This is Open Item 118 (Appendix HH). The extension member for each detector within the IITA ensures that all five vanadium detectors and the CET have an appropriate length to correctly locate them within the IITA.

The IIS provides a signal processing capability that digitizes the analog self-powered detector signals and transmits the data to the PDMS workstation over the plant data highway. The 58 SPNDs are equally divided between the two independent WINCISE (SPS cabinets. Each cabinet contains the signal processing electronics needed to process the analog signals from the SPNDs and transmit the digitized data to the application servers located in the computer room. The digitized self-powered detector signals are transmitted to the BEACON workstation over the plant data highway. In addition to the SPND signals, the SPS sends status information, such as power supply status, cabinet door open, and analog high temperature signal, to the application server to confirm proper operation of the SPS. For example, if the SPS cabinet were to reach a temperature of 130 degrees Fahrenheit (F), the SPS cabinet will shut down to prevent potential equipment damage.

The measured SPND signals are processed to be suitable for use by the BEACON PDMS to generate continuous three-dimensional measurements of the reactor core power distribution.

The BEACON PDMS utilizes existing core instrumentation data and an online neutronics code to provide surveillance of core thermal limits. The PDMS assimilates the fixed in-core detector signals into its nodal code to generate a fine-mesh, three-dimensional power distribution which, similar to WBN Unit 1, is used as a method for verifying the position of the control rod. In its letter dated April 15, 2011 (ADAMS Accession No. ML11136A053), TVA noted that, among other uses, this information is used for the following purposes:

• Determine if reactor power distribution is within operating limits identified in TS (Surveillance Requirement (SR) 3.2).

• Assist in calibrating ex-core channels to the in-core channels to verify input to the overtemperature T (change in reactor coolant temperature) function (SR 3.3.1.3).

• Verify rod position in the event of rod inoperable position indicators (SR 3.1.8).

• Detect improperly loaded fuel (SR 3.1.8).

7-5

Since the fixed IIS detectors reside in the core during all modes of operation, power distribution information is always available from the PDMS workstation as needed.

The Westinghouse BEACON system has several applications. In its letter dated June 23, 2011 (ADAMS Accession No. ML11187A352), TVA stated that, for WBN Unit 2, TVA is only using the BEACON-Tech Spec Monitor (TSM) application of the PDMS for conformance to the WBN existing limits. The BEACON-TSM system level was developed to provide licensees with the functionality needed to integrate BEACON into the plant TS for monitoring of current TS thermal power limits, such as peak linear power density and peak enthalpy rise.

In its April 15 and May 6, 2011, letters (ADAMS Accession Nos. ML11136A053 and ML11129A205, respectively), TVA provided a Westinghouse explanation stating that the BEACON PDMS will be the primary method for performing core power distribution measurements and surveillances when thermal power is greater than 25 percent of the rated thermal power (percent RTP). The fixed in-core detector system will be used for periodic calibration of the PDMS when thermal power is greater than 25 percent RTP. Additionally, the fixed in-core detector system will be used whenever the PDMS is inoperable or whenever a power distribution measurement is obtained with thermal power less than or equal to 25 percent RTP. A valid power distribution surveillance requires that at least 50 percent of all SPND elements be available in each operating cycle, and WINCISE does not require input from more than 75 percent of all SPND elements for the initial core power distribution measurement in each operating cycle.

7.7.1.9.3 Watts Bar Nuclear Plant, Units 1 and 2, System Differences In its April 15, 2011, TVA letter (ADAMS Accession No. ML11136A053), TVA described a fundamental difference between WBN Units 1 and 2. Unit 1 uses the MIDS, and Unit 2 uses the fixed in-core detector WINCISE system.

The MIDS instrumentation used in WBN Unit 1 provides the capability to monitor core parameters at frequent intervals using moveable in-core detectors. The PDMS combines inputs from currently installed plant instrumentation and design data for each fuel cycle. The MIDS is able to directly verify the position of a control rod with an inoperable rod position indication by comparing the profile of a 61-point axial trace associated with that control rod against the profile of an axial trace associated with a symmetric control rod with an operable rod position indication. The MIDS collects 61 axial points from top to bottom of the core, each point representing about 2.4 inches or 3.8 control rod steps.

In its April 15, 2011, letter (ADAMS Accession No. ML11136A053), TVA explained that the WINCISE provides a means to monitor continuously (at least once per minute) the power distribution limits, including limiting peaking factors and quadrant power tilt ratio. WINCISE has fixed in-core detectors. The WBN Unit 2 IIS includes the fixed in-core detectors, CETs, IITAs, and WINCISE signal processing hardware and software. The fixed in-core detectors have only five axial nodes of about 28.8 inches each or 46 control rod steps. The WINCISE PDMS cannot directly confirm control rod position using the WINCISE system. Therefore, an indirect PDMS method will be used to verify rod position, in which the PDMS assimilates the fixed in-core detector signals into its nodal code to generate a fine-mesh, three-dimensional power distribution which is used in the same manner as on WBN Unit 1 to verify the position of the control rod.

7-6

In its May 6, 2011, letter (ADAMS Accession No. ML11129A205), TVA stated that periodic flux mapping using the moveable in-core detectors (WBN Unit 1) has been replaced by continuous analysis of the permanently installed fixed in-core detectors (WBN Unit 2). Data from these fixed in-core detectors will periodically be used to generate a set of calibration factors for the BEACON PDMS.

In its April 15, 2011, letter (ADAMS Accession No. ML11136A053), TVA described that, as part of the WINCISE installation, the CETs have been relocated to the top of the IITAs, reducing the number of thermocouples from 65 on WBN Unit 1 to 58 on WBN Unit 2. The CETs for WBN Unit 2 are housed inside the IITA outer sheath. In WBN Unit 1 they are directly exposed to the primary coolant. Westinghouse LTR-NO-10-94, Revision 3, IITA Technical/Instruction Manual, which the NRC staff reviewed during audits conducted on June 28-29 and July 15, 2011, at the Westinghouse Electric Corporations office in Rockville, MD (audit report at ADAMS Accession No. ML112092667; not publicly available), also explains this. As a result, the WBN Unit 1 CETs will respond faster than the WBN Unit 2 CETs. In addition, the CET locations for installation differ. In WBN Unit 2, the CETs are installed at the end of each IITA, within the designated fuel assembly locations. Because of this, the CET measurements from WBN Unit 2 can differ from up to 15 degrees F from the WBN Unit 1 CET measurements, as described in TVAs letter dated May 6, 2011 (ADAMS Accession No. ML11129A205). Further, the WBN Unit 1 BEACON system relies on CET signal measurements to adjust the nodal calibration factors for radial power distribution changes from a reference calibration condition and signals from the power range detectors to make continuous axial power distribution changes. The WBN Unit 2 BEACON system performs the core power distribution predictions in exactly the same fashion, but continuously adjusts both the radial and axial nodal calibration factors using only data from the SPND signal measurements. The WBN Unit 2 CETs are not used to adjust the nodal calibration factors for radial power distribution changes. In its letter dated June 23, 2011 (ADAMS Accession No. ML11187A352), TVA discussed that the measured core power distribution in both cases results from adjustments to the predicted core power distribution made by the updated nodal calibration factors.

7.7.1.9.4 Evaluation Criteria The NRC staff evaluated the adequacy of the IIS using the review guidance contained in SRP Section 7.7, Control Systems. Acceptance criteria are based on the following regulatory requirements and guidance documents:

• In Title 10 of the Code of Federal Regulations (10 CFR) 50.55a(a)(1), the NRC requires that structures, systems, and components must be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety function to be performed

• For control systems isolated from safety systems, the applicable requirements of 10 CFR 50.55a(h) are defined in Institute of Electrical and Electronics Engineers (IEEE)

Std. 279-1971, IEEE Standard Criteria for Protection Systems for Nuclear Power Generating Stations, Clause 4.7, Control and Protection System Interaction; IEEE Std. 603-1991, Criteria for Safety Systems for Nuclear Power Generating Stations, Clause 5.6.3, Independence Between Safety Systems and Other Systems; and IEEE Std. 603-1991, Clause 6.3, Interaction Between the Sense and Command Features and Other Systems.

7-7

• In 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, Appendix A, General Design Criteria for Nuclear Power Plants, GDC 13, Instrumentation and Control, the NRC requires that instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions, as appropriate, to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems. Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges.

• RG 1.97, Revision 2, Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident, issued December 1980, provides guidance on instrumentation.

• Branch Technical Position (BTP) 7-19, Revision 5, Guidance for Evaluation of Diversity and Defense-In-Depth in Digital Computer-Based Instrumentation and Control Systems, issued March 2007, provides guidance related to instrumentation and control.

• To confirm compliance with GDC 24, Separation of Protection and Control Systems, the staffs evaluation should determine that the control systems are appropriately isolated from safety systems and would preserve the reliability, redundancy, and independence requirements of the safety system. The staffs evaluation should also determine that the isolation of these systems from safety systems satisfies the applicable requirements of 10 CFR 50.55a(h) and the requirements of GDC 24.

7.7.1.9.5 Technical Evaluation Sections 4.4.8 and 7.7.1 of the SER describe the NRC staffs previous evaluation of the IIS for WBN Units 1 and 2. The NRC staffs previous evaluation included a review of the instrumentation systems provided to monitor core power distribution measurements, ex-core detectors to monitor core power, axial offset, and aximuthal tilt. Moveable in-core detectors permit detailed power distributions to be measured. Section 7.7 of the SER describes the NRC staffs original evaluation for control systems not required for safety (i.e., those performing nonsafety protection functions) for WBN Units 1 and 2. Subsequent SSERs did not modify the staffs previous evaluation of the IIS.

The NRC staff evaluated the information about the IIS provided by TVA in FSAR Amendments 96 through 103 for WBN Unit 2. Amendment 102 modified the description of the IIS (FSAR Section 7.7.1.9). The NRC staff asked TVA to describe how the hardware and software design and implementation of the IIS for WBN Unit 2 differ from that which was originally reviewed by the NRC staff for WBN Units 1 and 2. In response, TVA submitted letters dated April 15, May 6, June 10, and June 23, 2011 (ADAMS Accession Nos. ML11136A053, ML11129A205, ML11167A110, and ML11187A352, respectively). SSER Section 7.7.1.9.3, above, summarizes these differences. As part of its evaluation, the NRC staff reviewed the design, implementation, and testing documentation produced for the IIS. The staffs technical evaluation is summarized below.

7-8

Separation/Isolation Evaluation The IIS does not interface with any safety system or communicate with any safety system.

However, as mentioned before, the IITA portion of the IIS includes both the SPND (non-Class 1E) and the CET (Class 1E). These two signals are electrically separated but physically located within the same IITA. As part of PAMS, the CETs need to meet the requirements for isolation established in RG 1.75, Revision 2, Physical Independence of Electric Systems, issued September 1978, up to and including any isolation device. RG 1.75 endorses IEEE Std. 384-1981, IEEE Standard Criteria for Independence of Class 1E Equipment and Circuits, to demonstrate independence. Further, in its letter dated June 10, 2011 (ADAMS Accession No. ML11167A110), TVA committed to comply with IEEE Std. 384-1981. The TVA evaluation described the latest revisions of IEEE Std. 384 (1992 and 2008), which were used to clarify the requirements in the 1981 version without relaxing any of the applicable requirements. The NRC staff evaluated the IIS against the independence criterion.

Section 5.6(3) of IEEE Std. 384-1992 provides general criteria for independence between safety-related and nonsafety-related circuits. The standard requires that, when minimum separation cannot be met, an analysis of nonsafety-related circuits may be performed to demonstrate that the safety-related circuits are not degraded below an acceptable level. If the analysis is successful, the nonsafety-related circuits can remain as nonsafety-related circuits, rather than be classified as safety-related or associated circuits.

In its letter dated April 15, 2011 (ADAMS Accession No. ML11136A053), TVA explained that the SPND signals become physically separated from CETs after the seal table, using the MI Y cable. Within the IITA, the active portions of the Class 1E CET elements and the non-Class 1E SPND elements are placed inside individual steel outer sheaths that share a common ground to provide electrical isolation between the CET and SPND elements. Because this arrangement does not meet the separation requirements of IEEE Std. 384-1981, Westinghouse performed an analysis to demonstrate the integrity of the MI cable and IITA, so that potential faults originating in, or by means of, the non-Class 1E SPNDs and SPS cabinet do not affect the operation of the CETs.

The SPND detector leads consist of a stainless steel outer sheath, with an alumina dielectric surrounding the vanadium emitter wire or connected signal wire, creating two ground metallic barriers within the IITA probe assemblies. These barriers avoid potential electric short circuits of the CET by the SPND emitters. Further, the design maximum emitter current is 5 microamps, restricting the energy available for a possible voltage buildup. Thus, the double barrier design, as well as the limited detector current provides overvoltage protection for the CET within the IITA assembly.

Westinghouse document WNA-DS-01811-WBT, Revision 0, WINCISE Signal Processing System Design Requirements, which the NRC staff reviewed during audits conducted on June 28-29 and July 15, 2011, at the Westinghouse Electric Corporation office in Rockville, MD (audit report at ADAMS Accession No. ML112092667; not publicly available), required a power supply of 120 volts alternating current (VAC) +/-10 percent for the SPS cabinet. Based on this requirement, Westinghouse determined the maximum overvoltage or surge voltage to be 264 VAC based on the information provided for the Quint power supplies to be installed in the SPS cabinet, as well as taking into account the maximum supply voltage of 220 VAC, even though the 120-VAC, Class 1E bus feeding the SPS cabinet is employed. The NRC staff evaluated the Westinghouse analysis performed to demonstrate how the SPS design meets the isolation 7-9

requirements. Calculation Note WNA-CN-00157-WBT, Revision 0, Watts Bar 2 Incore Instrumentation System Signal Processing System Isolation Requirements, summarizes this analysis. The NRC staff reviewed this calculation note during audits conducted on June 28-29 and July 15, 2011, at the Westinghouse Electric Corporation office in Rockville, MD (audit report at ADAMS Accession No. ML112092667; not publicly available). TVA should submit WNA-CN-00157-WBT to the NRC by letter to establish the record of the NRC staffs basis and its conclusions. This is Open Item 119 (Appendix HH).

The analysis showed that a surge voltage or overvoltage could originate from the SPS cabinet power supply, the 120-VAC, Class 1E power supply bus, ethernet communication, or cable voltage buildup. The analysis stated that the maximum overvoltage or surge voltage that could affect the system was 264 VAC, assuming that the power supply cable to the SPS cabinet is not routed with other cables greater than 264 VAC. TVA should confirm to the NRC staff that the maximum overvoltage or surge voltage that could affect the system is 264 VAC, assuming that the power supply cable to the SPS cabinet is not routed with other cables greater than 264 VAC. This is Open Item 120 (Appendix HH).

The analysis assumed that testing was performed for the IITA assembly, and the MI cable could withstand an overvoltage or surge voltage not greater than 600 volts direct current (Vdc). The analysis showed that no credible source of faulting can negatively impact the CETs or PAMS train. The NRC staff should confirm by review of WNA-CN-00157-WBT, Revision 0, that no credible source of faulting can negatively impact the CETs or PAMS train. Open Item 119 (Appendix HH) includes this issue.

As mentioned above, WNA-CN-00157-WBT, Revision 0, requires that the IITA assemblies and MI cable be tested for overvoltage and surge voltage of up to 600 Vdc. In a letter from R.W. Morris to D. Menard (LTR-ME-10-3, Watts Bar 2 Incore Instrumentation System Dielectric Characteristics of Completed MI Cable Assemblies, dated January 11, 2010), which the NRC staff reviewed during audits conducted on June 28-29 and July 15, 2011, at the Westinghouse Electric Corporation office in Rockville, MD (audit report at ADAMS Accession No. ML112092667; not publicly available), Westinghouse summarized the evaluation performed to determine whether the MI cable could withstand an overvoltage and surge voltage of up to 600 Vdc. The NRC staff reviewed LTR-ME-10-3 and confirmed that all 58 1-to-2 transition cable assemblies were subjected to and successfully passed a 600-Vdc dielectric strength test.

Since Westinghouse has only tested the MI cable, the same evaluation should be performed for the IITA assembly. This is Open Item 121 (Appendix HH), pending TVA submittal of the test results for the IITA assembly for NRC staff review.

Assuming satisfactory completion of the open items described above, the NRC staff concludes that the TVA analysis of the maximum credible overvoltage or surge voltage that can propagate from the non-Class 1E power supplies in the SPS cabinets to the SPND input signals is adequate. TVA also demonstrated that the MI cable and the IITA assembly can withstand overvoltage and surge voltage equal to 600 Vdc. Thus, the MI cable design allows for the isolation of the Class 1E CETs and non-Class 1E SPND signals. This hardware analysis requirement satisfies the requirements for testing or analysis of associated circuit interaction with Class 1E circuits contained in IEEE Std. 384-1981 for overvoltage conditions.

To further mitigate the possibility of a transient surge voltage condition in the SPS cabinets input power supply in excess of the identified maximum overvoltage value that might disable both divisions of the CET signals used by the PAMS, different divisions of safety power are supplied to the IIS SPS cabinets, with the power cables routed in separate shielded conduits.

7-10

Specifically, the power supply routed to PAMS train A is the same as that routed to SPS cabinet 1, and the power supply routed to PAMS train B is the same as that routed to SPS cabinet 2. TVA should confirm to the NRC staff that different divisions of safety power are supplied to the IIS SPS cabinets, with the power cables routed in separate shielded conduits.

This is Open Item 122 (Appendix HH).

For the Class 1E power supply bus feeding the SPS cabinet to adversely affect the associated PAMS train acting through the SPS circuitry, an overvoltage greater than 600 Vdc at the IITA and its associated cabling would be required to compromise PAMS. Calculation note WNA-CN-00157-WBT, Revision 0, shows this possibility. However, the associated PAMS could fail as a result of the overvoltage condition within the PAMS power supply. Failure of a single PAMS train is considered acceptable under such circumstances since there are two PAMS trains and the CET information would still be available to the operators. The SPS cabinets are not safety related and thus are not required to operate in a postaccident environment.

Further, after the seal table, the MI cable configuration is a Y split, and the SPND signals are routed to SPS cabinets 1 and 2. The Y split separates the Class 1E CET signal from the associated SPND cabling. The SPS cabinet digitizes the SPND signal. The system performs periodic automatic diagnostic testing to confirm SPND signal quality. One of these tests is a leakage resistance determination. If the SPND does not pass this test, the system will assign a data quality value to notify the power distribution calculation software to disregard data from this SPND. TVA should explain to the NRC staff how the system will assign a data quality value to notify the power distribution calculation software to disregard data from a failed SPND. This is Open Item 123 (Appendix HH).

The digitized SPND signal is then transferred to the WINCISE application servers, integrated computer system (ICS), and BEACON. The SPS transfers digitized SPND signals to the BEACON ovation data highway, where the BEACON datalink collects the data. The ICS provides plant conditions for the BEACON to use in calculating core power distribution. The WINCISE nonsafety-related internet protocol switches provide the main hub for traffic flow from the SPS cabinets, BEACON servers, WINCISE application servers, and the ICS. In its letter dated April 15, 2011 (ADAMS Accession No. ML11136A053), TVA explained that transmission of information from BEACON or SPS cabinets to the ICS is only done via the WINCISE application servers. While the BEACON datalink on the application server can connect to either BEACON machine, only BEACON A is used for communication. TVA should clarify to the NRC staff whether automatic switchover to the other server is permitted. This is Open Item 124 (Appendix HH).

The communication link to the ICS is nonsafety to nonsafety. To address cyber security, the WINCISE application servers can only communicate with the ICS via a firewall. Since these two systems are nonsafety systems, the NRC staff did not perform a safety evaluation of the communication between these two systems.

Based on the review of the information provided by TVA as summarized above, the NRC staff concludes that the IIS conforms to the applicable requirements of 10 CFR 50.55a(h), as defined in IEEE Std. 279-1971, Clause 4.7; IEEE Std. 603-1991, Clause 5.6.3; and IEEE Std. 603-1991, Clause 6.3. Furthermore, the SPS cabinet, IITA assembly, and MI cable meet the independence requirements for Class 1E stated in IEEE Std. 384-1981 and thus will not impact operation of the Class 1E CETs. Since the IIS conforms to the applicable requirements of 10 CFR 50.55a(h), it is acceptable to the NRC staff.

7-11

Equipment Qualification The WINICSE is a nonsafety-related system; only the IITA assembly and the MI cable are safety related. The SPND signals are considered quality related, and the CETs are safety related. Because these signals are bundled together in the IITA, as previously described, all Ml cables and IITA connectors provided are environmentally qualified and Class 1E qualified. TVA should clarify to the NRC staff the type of connector used with the MI cable in WBN Unit 2 and which environmental qualification test is applicable. This is Open Item 125 (Appendix HH). To enable the NRC staff to evaluate and review the IITA environmental qualification, TVA should also provide the summary report of the environmental qualification for the IITA. This is Open Item 126 (Appendix HH).

In Attachment 8 to its letter dated May 6, 2011 (ADAMS Accession No. ML11129A205), TVA submitted the Westinghouse report, DAR-ME-09-10, Revision 0, Qualification Summary Report for the WINCISE Cable and Connector Upgrade at Watts Bar Unit 2. This report summarizes the environmental and seismic/structural qualification of the MI cable, in accordance with IEEE Std. 323-1974, IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations, and IEEE Std. 344-1975, IEEE Recommended Practice for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations, including NUREG-0588, Revision 1, Interim Staff Position on Environmental Qualification of Safety-Related Electrical Equipment. This report identifies similarity analysis as the method of qualification. The report shows that the tested MI cable fulfilled the electrical operability acceptance criteria throughout all phases of testing and met the specified WBN Unit 2 environmental parameters and inputs. In addition, the MI cable is qualified for the Class 1E application. TVA should provide a summary to the NRC staff of the electromagnetic interference/radiofrequency interference testing for the MI cable electromagnetic compatibility (EMC) qualification test results. This is Open Item 127 (Appendix HH).

The thermocouple cables, connectors, and cables outside the containment are part of the Westinghouse Common Q PAMS cabinet qualification. Section 7.5.2.2 of SSER 23 discusses this qualification.

As previously described, the SPS cabinets are used for conditioning and processing of low-current signals from in-containment neutron flux monitors. The SPS cabinets do not perform any direct Class 1E function and are classified as non-Class 1E. However, because the SPS cabinets are being installed in the reactor building (a seismic Category I structure), the SPS must be qualified in accordance with RG 1.100, Revision 3, Seismic Qualification of Electric and Mechanical Equipment for Nuclear Power Plants, issued September 2009;, IEEE Std. 344-1975; and IEEE Std. 344-1987, IEEE Recommended Practice for Seismic Qualification of Class 1E Equipment for Nuclear Power Generating Stations. Specifically, the SPS cabinet must be able to withstand the effects of five operational basis earthquakes and one safe-shutdown earthquake without the loss of physical integrity or creation of missile hazards.

The NRC staff reviewed the summary description provided in Attachment 5 of TVAs letter dated June 10, 2011 (ADAMS Accession No. ML11167A110). TVA stated that the cabinet maintained structural integrity without any component detachment throughout the test program and thus complies with the WBN Unit 2 seismic qualification specification, WB-DC-40-31.2, Revision 8, Watts Bar Nuclear Plant Seismic Qualification of Category 1 Fluid System Components and Electrical or Mechanical Equipment, with testing performed in accordance with RG 1.100, IEEE Std. 344-1975, and IEEE Std. 344-1987. TVA should submit the seismic qualification test report procedures and results for the SPS cabinets to the NRC staff for review. This is Open Item 128 (Appendix HH).

7-12

EQ-TP-98-WBT, Revision 0, Electromagnetic Compatibility Test Plan and Procedure for Westinghouse Incore Information Surveillance & Engineering System (WINCISE) Signal Processing System Equipment Qualification Cabinet, describes the test procedures and monitoring system used during seismic qualification and electromagnetic compatibility of the SPS cabinets. The NRC staff evaluated the EQ-TP-98-WBT procedure during audits conducted on June 28-29 and July 15, 2011, at the Westinghouse Electric Corporation office in Rockville, MD (audit report at ADAMS Accession No. ML112092667; not publicly available), and determined that, because no simulated safety functions are to be monitored and verified, emission testing alone is sufficient to satisfy WBN Unit 2 requirements. Further, no mandatory immunity or surge withstand requirements exist for this cabinet, in accordance with the WBN Unit 2 application requirements, but surge testing was performed to address the requirements of IEEE Std. 384 and to demonstrate by test that the direct current (dc) voltage distributed from the cabinet system would not be not damaged during a design-basis surge event appropriate for this cabinet installation.

Specifically, WNA-CN-00157-WBT requires the analysis to demonstrate that surge events up to 4 kilovolts (kV) on the WINCISE SPS alternating current (ac) power feed into the cabinet could not propagate through the cabinet. Westinghouse performed an analysis to evaluate this fault.

WNA-CN-00157-WBT, Revision 0, summarizes the results of the Westinghouse analysis. This analysis demonstrated that no credible source of faulting of a 600-Vdc limit can negatively affect the PAMS. This analysis identified a Westinghouse open item requiring the Quint power supply (to be installed in the SPS cabinet) to undergo EMC testing of 4 kV to validate the assumptions made in the Westinghouse analysis. TVA should verify to the NRC staff resolution of the open item in WNA-CN-00157-WBT, which requires the Quint power supply (to be installed in the SPS cabinet) to undergo EMC testing of 4 kV to validate the assumptions made in the Westinghouse analysis. This is Open Item 129 (Appendix HH). For additional information about the Westinghouse analysis, refer to the evaluation of IEEE Std. 384 described above in this SSER section entitled Separation/Isolation Evaluation.

The acceptance criteria for the surge tests require that the 24-Vdc cabinet electronics do not suffer damage during surge events. As long as this requirement is maintained, any surge propagation into the cabinet will remain far less than the 600-Vdc limit. In Attachment 5 of its letter dated June 10, 2011 (ADAMS Accession No. ML11167A110), TVA provided a summary of the environmental qualification. This summary states that the SPS cabinet successfully complied with the emissions requirements of RG 1.180, Revision 1, Guidelines for Evaluating Electromagnetic and Radio-Frequency Interference in Safety-Related Instrumentation and Control Systems, issued October 2003. TVA should provide a summary to the NRC staff of the EMC qualification test results of the SPS cabinets. This is Open Item 130 (Appendix HH).

For EMC compliance, the SPS must not generate spurious electromagnetic emissions or become degraded through a common-mode failure caused by its operating environment that could directly or indirectly impact the operation of safety-related equipment. The SPS complies with EMC requirements by meeting the criteria of RG 1.180, Revision 1, and IEEE Std. 323-1983, IEEE Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations.

7-13

Effects of In-Core Instrumentation System Operation on Accidents The NRC staffs evaluation considered the effects of the IIS operation during plant design-basis accidents and anticipated operational occurrences to confirm that the safety analysis includes consideration of the effects of IIS action/inaction during these transients.

In its letter dated April 15, 2011 (ADAMS Accession No. ML11136A053), TVA stated that the IIS has no impact on any safety analysis documented in Chapter 15 of the WBN Unit 2 FSAR. For all Chapter 15 accidents analyzed by the NRC staff in the original SER, the IIS is referenced only as a monitor for inadvertent loading of a fuel assembly into an improper position. The WBN Unit 2 FSAR Chapter 15 also references use of the IIS to detect misloaded fuel before operating at power. Therefore, the NRC staff concludes that an undetected failure of the IIS would have no impact on the WBN Unit 2 accident analyses.

In Attachment 4 to its letter dated April 15, 2011 (ADAMS Accession No. ML11136A053), TVA identified modifications to WB-DC-40-64, Design Basis Events Design Criteria. These modifications make the description provided for the IIS consistent with the system being provided for WBN Unit 2. In its letter dated June 23, 2011 (ADAMS Accession No. ML11187A352), TVA provided additional information on these modifications. The NRC staff evaluated these modifications and concluded that they did not affect the WBN Unit 2 design-basis events design criteria and were therefore acceptable.

Effects of In-Core Instrumentation System Failures on Safety Functions The NRC staff reviewed TVAs evaluation of the failure modes of the IIS to verify that its failure does not cause plant conditions more severe than those described in the analysis of anticipated operational occurrences in Chapter 15 of the WBN Unit 2 FSAR. The only failures in the IIS with the potential to affect safety-related functions are those with the potential to cause problems with the MI cable and, consequently, a loss of CET signal. However, even in the event of a loss of CET signal, the availability of the instruments for RCS pressure, hot- and cold-leg RCS temperatures (Thot and Tcold), and containment pressure and temperature will enable the operators to make reactor core status evaluations that compensate for a loss of one channel of CET. Further, the CET operability requirements contained in PAMS require that the system provide valid CET measurement from two CETs in each core quadrant. Westinghouse Document No. 420A90, Revision 2, WINCISE Functional Specification for Watts Bar Unit 2, which the NRC staff reviewed during audits conducted on June 28-29 and July 15, 2011, at the Westinghouse Electric Corporation office in Rockville, MD (audit report at ADAMS Accession No. ML112092667; not publicly available), requires three CETs in each core quadrant for each division. Further, the CET signals are segregated into two Class 1E trains. The Common Q failure modes and effects analysis in WNA-AR-00180-WBT-P addresses the failure mode and effects analysis for the CETs. Section 7.5.2.2 of SSER 23 discusses this analysis.

In its letter dated April 15, 2011 (ADAMS Accession No. ML11136A053), TVA explained that the failure of SPND signals could impact operation of the BEACON system. During operation, the BEACON PDMS requires the following:

• 75 percent of all SPNDs must be available for the initial core power distribution measurement.

• After the initial core power distribution measurement, 50 percent of all SPNDs must be available, with at least five operable SPND signals associated with the top half of the 7-14

active core or at least five operable SPND signals associated with the bottom half of the active core per core quadrant.

Not meeting these conditions may result in either a power level restriction or a plant shutdown, if the failure is not corrected within 31 effective full-power days.

SRP BTP 7-19, Revision 5, provides the NRCs staff position and guidance for the diversity and defense-in-depth evaluation to address the concern about common-cause failure (CCF) vulnerabilities with regard to the use of digital, computer-based instrumentation and control systems. For operating reactors, the staffs position in BTP 7-19 specifies, in part, the following:

• The applicant/licensee should assess the diversity and defense in depth of the proposed instrumentation and control system to demonstrate that vulnerabilities to CCFs have been adequately addressed.

• In performing the assessment, the vendor or applicant/licensee should analyze each postulated CCF for each event that is evaluated in the accident analysis section of the safety analysis report (SAR) using best-estimate or SAR Chapter 15 analysis methods.

The vendor or applicant/licensee should demonstrate adequate diversity within the design for each of these events.

The acceptance criteria in BTP 7-19 state, in part, the following:

The applicant/licensee should (1) demonstrate that sufficient diversity exists to achieve these goals, (2) identify the vulnerabilities discovered and the corrective actions taken, or (3) identify the vulnerabilities discovered and provide a documented basis that justifies taking no action.

The WINCISE system has been designed and built as a redundant two-train system (hardware, software, and data communications) for system reliability enhancement. Redundancies were designed and built into the SPS to avoid impacting operation in the event of the loss of some SPND signals. The 58 core locations are divided between two independent cabinets of 29 IITAs to provide redundancy while providing coverage of the entire core. The signals are divided between the two cabinets, which are located in containment, such that all detector signals associated with Group 1 are terminated at one WINCISE SPS cabinet, and all Group 2 signals are terminated at the second SPS cabinet. In addition, Group 1 corresponds to the CET signals wired to PAMS train 1, and Group 2 corresponds to the CET signals wired to PAMS train 2.

The master signal processing rack data interface card provides the output data stream to the WINCISE application server. Each cabinet master signal processor rack contains redundant data interface cards. Loss of one data interface card will not result in a loss of data output from the cabinet.

Each SPS cabinet includes redundant communication paths to ensure that no single component failure results in data not being sent to the WINCISE application servers. Specifically, each cabinet has two single-mode fiber outputs providing the same cabinet status and neutron flux information corresponding with that cabinet. Redundancies are designed and built into the SPS to avoid impacting operation in the event of the loss of some SPND signals. Each cabinet master signal processor rack contains redundant data interface cards. Loss of one data interface card will not result in a loss of data output from the cabinet.

7-15

Based on the above information, the NRC staff concludes that the SPS cabinets and WINCISE application server is configured such that the failure of any single SPS component does not cause more than a 50-percent reduction in the maximum possible number of operable SPNDs.

Because the WINCISE system is not safety related, the NRC staff did not evaluate the effects of software CCF. Further, the WINCISE system was designed and built with redundancy to achieve system reliability goals and conformity with the single-failure criterion. Based on this, the NRC staff concludes that the design and function of the WBN Unit 2 WINCISE system meets the BTP 7-19 criteria for diversity.

WBN Unit 2 TS 3.1, 3.2, and 3.3 describe the use of the PDMS function of the IIS. In its letter dated June 23, 2011 (ADAMS Accession No. ML11187A352), TVA explained that it had incorporated modifications to TS 3.1 and the technical requirements manual (TRM) for the PDMS, which includes WINCISE and BEACON, in Revision B of the TS and TRM (ADAMS Accession No. ML100550326). TVA stated the following:

There is no BEACON operability section in either the Technical Specifications or the Technical Requirements Manual. The operability discussion is for the Power Distribution Monitoring System (PDMS) which includes the BEACON software and the WINCISE hardware. PDMS changes to Technical Specifications (TS 3.1.8, TS 3.2.1, TS 3.2.2, TS 3.2.4 and TS 3.3.1) were incorporated in Revisions B (ADAMS Accession Number ML100550326) and E (ADAMS Accession Number ML110270108). PDMS changes to the Technical Requirements Manual (TRM 3.3.3) were incorporated in Revision B (ADAMS Accession Number ML100550326).

The minimum WINCISE function requirements (50% and 75%) are included in TRM 3.3.3. The minimum CET function requirements are included in Technical Specification 3.3.3, Post Accident Monitoring Instrumentation, Table 3.3.3-1.

The modifications require the operator to use PDMS to monitor rod position, neutron flux distribution, and power distribution. Also, TS 3.2 and 3.3 have surveillance requirements to verify power distribution and to calibrate the ex-core channels using the PDMS. These modifications do not affect the ability of the WINCISE system to meet the intent of the TS. The IIS is used for reactivity analysis support, so a loss of its function is not critical to safety. The failure modes and effects analysis for the WINCISE identifies an operator action upon loss of the WINCISE system to shut down the plant, if the failure is not corrected within 31 effective full-power days.

As described above, the NRC staff evaluated the information provided by TVA associated with WINCISE operation and failure analysis. The staff concluded that TVA had appropriately identified the vulnerabilities of the IIS and satisfactorily documented the basis for concluding that the IIS meets the criteria of BTP 7-19 for diversity.

Regulatory Guide 1.97 Table 2 of RG 1.97, Revision 2, recommends that CET indication be used for the plant-specific safety function variable for monitoring core exit temperature. RG 1.97 classifies this variable as Type B, with Category 3 equipment qualification (B3). In Appendix V to SSER 9, issued June 1992, the NRC staff documented its evaluation of TVAs commitments for the WBN postaccident monitoring instrumentation in accordance with RG 1.97, Revision 2. TVA stated 7-16

that CET indication is a Type A, Category 1 variable, necessary to provide information required for control room operators to take specific, manually controlled safety actions. The CETs were added to the plant design to provide direct indication of degrading core cooling conditions following transient events similar to that experienced at Three Mile Island. Further, RG 1.97 requires redundancy and separation of these variables to prevent single failure of the CETs.

The configuration provided for the WBN Unit 1 CETs did not meet this requirement. However, the NRC staff approved a deviation from this requirement in SSER 9. Specifically, the NRC staff found that the CETs are divided between two PAMS channels, hence decreasing the possibility of all thermocouples being damaged by a single event.

Section 7.5.2.2 of SSER 23 describes the differences between how the CET signals are processed for WBN Unit 1 and WBN Unit 2.

Amendment 102 of the WBN Unit 2 FSAR, Table 7.5-2, Regulatory Guide 1.97 Post Accident Monitoring Variables Lists (Deviation and Justification for Deviations; page 19 of 41), contains a note stating that a Minimum of 16 Operable Thermocouples, 4 from each quadrant (Note 1, 9, 10), Deviation #37 are provided. Table 7.5-2 identifies this variable as a Type A, Category 1, variable (A1). Table 7.5-2, Deviation 37, states that a Type A, Category 1, variable has been provided with a minimum of two independent channels (PAM 1 and PAM 2) for monitoring core exit temperature. SSER 9 stated that, even though RG 1.97 required separation and redundancy of channels for Category 1 instruments, the number of thermocouples installed is greater than those required by RG. 1.97, thereby reducing the likelihood that all thermocouples would fail at the same time. The NRC staff found this explanation and justification acceptable.

FSAR Amendment 103 explains that these variables are provided with a minimum of two independent channels (PAM 1 and PAM 2) for monitoring core exit temperature. For those cases in which failure of a channel would present ambiguous or confusing information to the operator, potentially preventing the operator from taking action or misleading the operator, RG 1.97 recommends that an additional redundant (PAM 3) channel be provided. WBN Unit 2 does not include a third redundant channel for this variable. However, TVA explained that the availability of signals for RCS pressure, RCS temperatures Thot, and Tcold, and containment pressure and temperature will enable the operators to compensate for a loss of one channel of CET caused by this specific pipe break plus a single failure of the redundant channel. In its letter dated May 6, 2011 (ADAMS Accession No. ML11129A205), TVA explained that the WINCISE system will support two divisions of CET with a minimum of three thermocouples provided in each core quadrant for each division. This arrangement will guarantee that at least three thermocouples per division per quadrant, or a minimum of six thermocouples per quadrant, are available, which exceeds the minimum number required by RG 1.97. Therefore, the NRC staff concluded that the deviation is acceptable.

RG 1.97 identifies the necessary range of the CETs as 200 to 2,300 degrees F, which is the same range described in the WBN Unit 2 FSAR. However, as described previously, because of the new CET location and IITA configuration, the CETs in WBN Unit 2 can differ from the CETs in WBN Unit 1 by up to 15 degrees F under certain accident scenarios. In its letter dated June 23, 2011, TVA explained that, during accident conditions in which the reactor coolant pumps are operating, the water mixing and travelling through the fuel element channels in which the IITA guides (and thus the CETs) are located will cause the temperature seen by WBN Unit 2 to be lower than the temperature indicated for WBN Unit 1. The emergency operating procedure (EOP) for WBN Unit 2 should consider this difference in temperature. As a result, TVA should review the EOP action level setpoint to account for this difference between core exit temperature readings for WBN Unit 1 and Unit 2 and confirm the EOP action level setpoint to the NRC staff. This is Open Item 131 (Appendix HH).

7-17

In FSAR Amendment 103, TVA did not propose to change the functional characteristics (e.g.,

indicated parameters and range on indication) or the equipment qualification of this PAMS indication from that which was previously approved. Therefore, the NRC staff concludes that the information provided in FSAR Section 7.5.2 and Table 7.5-2, Deviation 37, continues to comply with applicable regulatory requirements, and the NRC staffs conclusions in SSER 9 remain valid.

7.7.1.9.6 Conclusion Based on the above, the NRC staff concludes that the IIS complies with the acceptance criteria of SRP Section 7.7, Revision 5; BTP 7-19, Revision 5; RG 1.97, Revision 2; and RG 1.75, Revision 2, and therefore meets the requirements of 10 CFR 50.55a(a)(1), 10 CFR 50.55a(h),

GDC 13, and GDC 24. Therefore, the WBN Unit 2 IIS is acceptable.

7.7.1.9.7 Aging Management of Materials The NRC staff reviewed TVAs Engineering Document Construction Release (EDCR) 52321 (ADAMS Accession Nos. ML11136A150 and ML11136A151) and TVAs letter to the NRC dated June 10, 2011 (ADAMS Accession No. ML11167A110) to evaluate TVAs aging management of materials used for the WINCISE system.

Regulatory Evaluation The NRC based its acceptance criteria, in part, on the following regulatory requirement:

• General Design Criterion (GDC) 10, Reactor Design, in Appendix A, General Design Criteria for Nuclear Power Plants, to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities, insofar as it requires that the reactor coolant system (RCS) be designed with appropriate margin to ensure that specified acceptable fuel design limits (SAFDLs) are not exceeded during normal operations, including anticipated operational occurrences (AOOs).

Technical Evaluation On WBN Unit 2, WINCISE replaces the movable in-core detection system (MIDS) and top-mounted core exit thermocouples (CETs) used on WBN Unit 1. As described by TVA, WINCISE uses 58 in-core instrument thimble assemblies (IITAs), each containing five vanadium self powered detectors and one CET. TVA stated that the regular maintenance activities for the IITAs are different from the current MIDS used in the previous Westinghouse RVs. The main differences are: (1) the IITA is not fully extracted unless it is being replaced, (2) a movable frame assembly will hold retracted IITAs in place, (3) eddy current testing will not be required for IITAs, (4) IITAs have lower vibration amplitude and a higher natural frequency than the MIDS, which uses the Unit 1 thimbles, (5) due to lower vibration, aging degradation from wear is eliminated and, (6) unlike the Unit 1 thimbles, any breach of the IITAs does not result in loss of the RCS pressure boundary.

The NRC staff reviewed the aging degradation mechanism of the materials used for the IITA components in WBN Unit 2, and concluded that the validity of the various attributes of the WINCISE system should be confirmed by TVA by performing routine inspections as part of its 7-18

maintenance activities. In its response to the staff by letter dated June 10, 2011, TVA stated in item 376:

TVA does not agree with this recommendation. The IITA assemblies cannot be inspected for wall thinning using internal eddy current methods that are used to inspect thimble tubes. In addition, after the IITAs are irradiated, inspection using external ultrasonic measurements that are used to detect pipe wall thinning would result in excessive personnel exposure. While visual inspection is possible, it cannot detect wall thinning and is limited to the section of the IITA that is not inserted into the reactor core.

As documented in WEC [Westinghouse Electric Corporation] to TVA letter WBT-D-3072 "WINCISE Vibration Induced Wear Calculation Conclusion," dated April 6, 2011 (Reference 8) calculation CN-PO-09-15, Westinghouse Incore Information Surveillance and Engineering (WINCISE) Incore Instrument Thimble Assembly (IITA) Vibration Analysis for Watts Bar Unit 2, M. J. Reho, September 22, 2010, demonstrates that the assemblies are not subject to vibration induced wear. Based on the above and the fact that the outer wall of the IITA is not a RCS pressure boundary, TVA does not agree to include an IITA inspection program in the plant maintenance program. The referenced proprietary letter and calculation are available for review at the WEC Rockville office.

To confirm that IITAs are not subject to vibration induced wear, the NRC staff conducted an audit on July 14, 2011, at the WEC office to evaluate the information supporting TVAs conclusion that flow-induced vibration (FIV) does not result in unacceptable mechanical degradation of the IITAs. The NRC staffs audit included a review of the background information and calculations contained in calculation CN-PO-09-15. The NRC staffs review of the vibration analysis focused on the methodology, inputs, assumptions and acceptance criteria used by TVA in determining that the vibration amplitudes of the IITAs, resulting from RCS flow across the IITAs, do not result in unacceptable degradation.

The NRC staff asked that TVA provide additional information regarding (1) the applicability of the methodology used to evaluate the effects of FIV on the IITAs, and (2) the acceptance criterion used by TVA to demonstrate that the FIV behavior of the IITAs is satisfactory. In its response to the NRC staff by letter dated July 29, 2011 (ADAMS Accession No. ML11215A132), TVA stated that the portions of the IITAs susceptible to FIV, the outer sheaths, are not pressure boundary components and, therefore, failure of the flexible portions of the IITAs would not result in a breach of the RCPB. In addition, TVA stated that administrative controls exist such that the plant would be required to take action in the event that a reduced number of IITAs were in operation, such as if FIV were to cause mechanical degradation and failure of any of the IITAs. TVA stated that the BEACON system provides the capability to detect whether the outer sheath of an IITA has been breached.

The NRC staff concludes that TVAs justification regarding the mechanical degradation due to FIV is acceptable, because administrative controls exist such that there is reasonable assurance that the safety-related functions performed by the IITAs will be preserved in the event that FIV results in a mechanical degradation of the outer sheath portions of the IITAs. This reasonable assurance is provided since TVA has procedures in place which require a minimum number of IITAs to be fully functional under normal operation. Additionally, TVA has the capability to detect whether or not an IITA is functioning properly. Therefore, while FIV may 7-19

result in mechanical degradation of the IITAs, the safety-related function of the IITAs is preserved by TVAs administrative controls.

Conclusion Based on its review of the information provided by TVA, as described above, the NRC staff concluded that TVA adequately addressed the aging degradation of the materials used in the IITAs. Since aging degradation due to wear does not occur in IITAs, and any breach of the IITAs does not result in loss of RCS pressure boundary, the NRC staff concludes that the IITAs do not require routine inspections under TVAs plant maintenance program. Therefore, the NRC staff concludes that TVA has adequately addressed the issue of aging degradation of the materials used in IITAs in the WINCISE system and meets the requirements of GDC 10.

7-20

8 ELECTRIC POWER SYSTEMS 8.1 General Disposition of Open Items (Appendix HH)

Open Item 3 In an NRC safety evaluation dated August 31, 2009 (ADAMS Accession No. ML092151155),

the staff identified an open item that required confirmation that the Tennessee Valley Authority (TVA) has submitted an update to FSAR Section 8.3.1.4.1, to require that an evaluation must be performed to demonstrate the acceptability of conduits, containing three or more cables, that exceed a maximum of 40 percent cable fill of the inside area of the conduit. The staff identified this as Open Item 3 in SSER 22, Appendix HH.

Originally, the NRC staff questioned TVAs use of higher conduit fills than identified in the WBN Unit 2 FSAR. FSAR Section 8.3.1.4.1, Cable Derating and Raceway Fill, states that (a) conduit containing only one cable is sized for a maximum of 53 percent cable fill; (b) conduit containing two cables is sized for a maximum of 31 percent cable fill; and (c) conduit containing three or more is sized for a maximum of 40 percent cable fill of the inside area of the conduit.

TVA stated that for the cases where the conduit fill limits have exceeded the WBN 2 FSAR limits, TVA will perform an engineering evaluation for acceptability. Thus, the staff recognized that TVA would need to submit an amendment to the WBN 2 FSAR to allow evaluation of the conduit fill exceeding the WBN Unit 2 FSAR conduit fill limits.

In its letter dated April 6, 2011, TVA stated that FSAR Amendment 95 was submitted to the NRC via TVA letter dated November 24, 2009, Watts Bar Nuclear Plant (WBN) - Unit 2 - Final Safety Analysis Report (FSAR), Amendment 95 (ADAMS Accession No. ML093370275).

The NRC staff verified that TVA revised WBN 2 FSAR Section 8.3.1.4.1 to require any conduit exceeding 40 percent cable fill to be evaluated and justified by TVA engineering. Based on this information, Open Item 3 is closed.

Open Item 18 Based on the extensive layup period of equipment within WBN Unit 2, the NRC staff determined that it must review, prior to fuel load, the assumptions used by TVA to re-establish a baseline for the qualified life of equipment. The purpose of the staff's review is to ensure that TVA has addressed the effects of environmental conditions on equipment during the layup period.

In its letter dated December 17, 2010 (ADAMS Accession No. ML103540560), TVA provided additional information regarding Open Item 18. The staff reviewed TVAs response and concluded that Open Item 18 remained open until the NRC could validate by inspection the assumptions used by TVA to re-establish a baseline for the qualified life of equipment at WBN Unit 2.

In NRC Inspection Report 05000391/2011604, dated June 29, 2011 (ADAMS Accession No. ML111810890), NRC Region II documented its inspection and review of Open Item 18. Based on the results documented in the inspection report, Open Item 18 is closed.

8-1

Open Item 19 Open Item 19 required the NRC staff to complete its review of TVAs environmental qualification (EQ) program procedures for WBN Unit 2 prior to fuel load.

In NRC Inspection Report 05000391/2011604, dated June 29, 2011 (ADAMS Accession No. ML111810890), NRC Region II documented its inspection and review of Open Item 19. Based on the results documented in the inspection report, Open Item 19 is closed.

Open Item 20 Open Item 20 required the NRC staff to resolve whether or not routine maintenance activities should result in increasing the EQ of the 6.9 kilovolt (kV) motors to Category I status from Category II as a result of the maintenance activities, in accordance with 10 CFR 50.49, Environmental qualification of electric equipment important to safety for nuclear power plants.

In its letter dated April 6, 2011, TVA provided additional information regarding Open Item 20.

TVA stated that, The refurbishment of the 6.9 kV motors for Unit 2 involved routine maintenance activities. These maintenance activities did not modify or repair the motor insulation system originally supplied by Westinghouse. However, review of the original qualification report indicates that the testing performed meets the requirements for a Category I qualification. Motors which only require routine maintenance will have their binders revised and will be re-classified as Category I.

In one case (Containment Spray Pump Motor), the maintenance activities determined the need to rewind the motor. The rewound motor insulation system is qualified in accordance with the EPRI motor rewind program which meets Category I criteria.

The NRC staff performed an inspection to verify the qualification pedigree of the subject motors, as documented in NRC Inspection Report 0500391/2011605, dated August 5, 2011 (ADAMS Accession No. ML112201418). Based on the inspection results, Open Item 20 is closed.

Open Item 22 Open Item 22 required TVA to clarify its use of the term equivalent (e.g., identical, similar) regarding the replacement terminal blocks.

In its letter dated December 17, 2010 (ADAMS Accession No. ML103540560), TVA provided additional information regarding Open Item 22. TVA stated that, For EQ applications, the replacement terminal blocks will be new GE CR151B terminal blocks certified to test reports that document qualification to NUREG-0588, Category I criteria.

Based on this response, the NRC staff concluded that TVA adequately clarified the use of the term equivalent as it relates to the replacement of terminal blocks; and therefore, Open Item 22 is closed.

8-2

Open Item 23 Open Item 23 required the NRC staff to resolve whether or not TVA's reasoning for not upgrading the main steam isolation valve (MSIV) solenoids to Category I is a sound reason to the contrary, as specified in 10 CFR 50.49(l).

In its letter dated April 6, 2011, TVA provided additional information regarding Open Item 23.

TVA stated that it will qualify the MSIV solenoids to the Category I criteria.

Based on this information, the NRC staff finds Open Item 23 remains open until NRC inspection can be performed to verify that the MSIV solenoids have been qualified to the Category I criteria.

Open Item 24 Open Item 24 required TVA to submit supporting documentation to justify its establishment of a mild environment threshold for total integrated dose of less than 1x103 rads for electronic components such as semiconductors or electronic components containing organic material.

In Attachment 2 to its letter dated April 6, 2011, TVA provided calculation A Review of Electronic Components in a Radiation Environment of 5x104 RADS, in response to the NRC staffs request.

Based on its review of this calculation, the staff concludes that TVA has provided adequate justification for establishment of a mild environment threshold for the electronic components identified in the calculation for WBN Unit 2. Specifically, the staff concludes that the calculation demonstrates that the mild environment threshold ensures continued operation of electronic equipment under postulated conditions. Therefore, Open Item 24 is closed.

Open Item 27 In its letter dated December 6, 2010, for question RAI 8.2.2-1, TVA stated that The loading for a dual unit trip (item a) is slightly less than the loading with one unit in accident and a spurious accident signal in the other unit. Therefore, a separate load flow was not performed. The NRC staff requested that TVA provide a summary of margin studies based on scenarios described in FSAR Section 8.1 for common station service transformers (CSSTs) A, B, C, and D.

In its letter dated April 6, 2011, TVA stated that, A separate load flow was performed for a dual unit shutdown resulting from an abnormal operational occurrence with and without offsite power. TVA provided a summary of resulting loading on CSSTs. The staff reviewed the loading and margins available and concluded that the CSSTs are adequately rated for postulated conditions. Therefore, Open Item 27 is closed.

Open Item 28 Open Item 28 required TVA to provide the NRC staff a detailed discussion showing that the load tap changer (LTC) is able to maintain the 6.9 kV bus voltage control band given the normal and post-contingency transmission operating voltage band, bounding voltage drop on the grid, and plant conditions.

8-3

In its letter dated April 6, 2011, TVA provided the following details for LTCs:

CSSTs C and D: Taps +/-10 percent, Tap Step 1.25 percent, Total No. of Taps 17, Initial Time Delay 2 seconds, Operating Time 1 second. Taps are provided on each secondary winding.

CSSTs A and B: Taps +/-16.8 percent, Tap Step 1.05 percent, Total No. of Taps 33, Initial Time Delay 1 second, Operating Time 2 seconds. Taps are provided on the primary winding.

TVA stated that the LTCs for CSSTs C and D are set to regulate 6.9 kV shutdown board voltage at 7,071 V (102.5 percent), and the LTCs for CSSTs A and B are set to regulate the voltage at the 6.9 kV startup buses at 7,071 V (102.5 percent). The upper and lower setpoints of the dead bands are 7,132 V (103.4 percent) and 7,010 V (101.6 percent), respectively.

TVA evaluated the 6.9 kV shutdown board minimum voltage requirements considering a maximum (bounding) grid voltage drop of 9 kV and a minimum grid voltage of 153 kV and all plant conditions. The loadflow analyses concluded that the shutdown board voltage falls below the degraded voltage relay dropout setpoint due to block start of emergency loads, but it recovers above the degraded voltage relay reset setpoint in 5 seconds. The minimum time for the degraded voltage relays to isolate the offsite power from the 6.9 kV shutdown boards is 8.5 seconds. During normal operation and post-accident with bounding grid voltage (153 kV), the voltage on the 6.9 kV shutdown boards is maintained within the LTC control band.

TVA concluded that the offsite source is in compliance with GDC 17 [Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities, Appendix A, General Design Criteria for Nuclear Power Plants, General Design Criterion (GDC) 17, Electric Power Systems] and is able to supply offsite power to safety related loads with an accident in one unit, safe shutdown of the opposite unit, and the worst case single failure.

The NRC staff reviewed the summary of analyses provided and concluded that TVAs approach to evaluate the capability of the LTCs as acceptable because it meets the requirements of GDC 17. Therefore, Open Item 28 is closed.

Open Item 29 Open Item 29 required from TVA a detailed description of the transmission system grid conditions and the operating characteristics of the offsite power supply at the Watts Bar Hydro Plant (for dual-unit operation), including the operating voltage range, post contingency voltage drops (including bounding values and post-unit trip values), and operating frequency range. In addition, TVA was asked to provide the design operating voltage range of the shutdown boards (minimum and maximum voltage) and information regarding how low the Watts Bar Hydro Plant voltage could drop (assuming operation of the LTCs) while still supplying the worst-case shutdown board loads at the minimum design voltage of the shutdown boards. The NRC staff requested that the summary of the grid studies should address dual-unit operation, the transmission network interface available fault current changes, and the impact on the switchyard and plant switchgear and cabling.

In its letter dated June 7, 2011, TVA summarized the following salient points from the results of Revision 3 of its Watts Bar Nuclear Plant (WBN) - Transmission System Study (TSS) - Grid Voltage Study of the WBN Offsite Power System:

8-4

1. A new revision (Revision 3) has been issued which concludes that the offsite power system for Watts Bar Units 1 and 2 has adequate capacity to cope with an accident in one unit and a spurious accident signal in the second unit.

2. The normal frequency of the grid is 60 Hz, with very small perturbations above and below this value. Load shedding in compliance with North American Electric Reliability Corporation (NERC) and SERC Reliability Corporation (SERC) standards is initiated at 59.5 Hz. The final step in the program trips load at 58.7 Hz. Current studies show that the frequency will not drop below 57.5 Hz during any credible extreme contingencies.

3. The 161 kV transmission system voltage is maintained within NERC standards with a minimum design voltage of 95 percent. The normal operating range is 161-170 kV with 164 kV nominal voltage.

4. Post-contingency voltage drop (dual-unit operation) is 9 kV maximum with a bounding post unit trip value of 153 kV (minimum).

5. Design operating voltage range of the shutdown boards is 7,260 V maximum and 6,570 V minimum.

Based on the results of the TSS report and grid operating parameters provided by TVA in its letter dated June 7, 2011, the NRC staff concludes that the offsite source operating range meets the requirements of GDC 17 and is acceptable for WBN Units 1 and 2 operations. Therefore, Open Item 29 is closed.

Open Item 31 The NRC staff requested that TVA clarify the emergency diesel generator (EDG) loading sequence as explained in TVAs response to question RAI 8.3.1.11 in its letter dated December 6, 2010. Specifically, the staff identified statements such as (1) the load sequencing circuitry has features which minimize the impact of this event on the onsite power system, and (2) a safety injection signal received during the course of non-accident shutdown loading sequence will cause actions. The staff requested that TVA clarify whether the existing statements in the FSAR regarding automatic sequencing logic are correct. If the FSAR description is correct, TVA should explain how the EDG and logic sequencing circuitry will respond to a loss-of-coolant accident (LOCA) followed by a loss-of-offsite power (LOOP) scenario.

In its letter dated April 6, 2011, TVA provided the following clarification:

The design basis for WBN assumes a simultaneous LOOP - LOCA. The Hydraulic Analysis does not support a LOCA with a delayed LOOP event; however, the logic is designed to ensure that loads are re-sequenced during a LOCA with a delayed LOOP, to prevent a block start on a diesel generator. This logic does not impact the sequencing for the design bases event, simultaneous LOOP - LOCA.

LOOP - Delayed LOCA: When the LOOP occurs, the diesel will start, based on detection by the Loss of Voltage relay. Loads which sequence on due to a blackout [LOOP] signal (Charging Pump, Auxiliary Feedwater, Essential Raw Cooling Water Pump, Closed Cooling, etc.) will begin sequencing on. When a subsequent LOCA signal occurs, the diesel will remain running and connected to the Shutdown Board. Loads which are required for accident mitigation and which have previously sequenced on to the Shutdown Board, due to the LOOP, will 8-5

remain running. Loads which are not required for accident mitigation will be tripped. Remaining loads required for accident mitigation, which have not been sequenced on at the time of the LOCA, will have their timers reset to 0 and will sequence on at the appropriate time for the LOCA signal.

LOCA - Delayed LOOP: When the LOCA occurs, the loads which are not running in normal operation will block start. At the same time, the diesels will start on the LOCA signal, but will not tie to the Shutdown Board. When a subsequent LOOP occurs, all sequenced loads will be stripped from the board from a Loss of Voltage (approximately 86 percent) signal. Once the loss of voltage relay has reached its set point and the diesel is available, the diesel breaker will close and the sequence timers will begin to time. The first large motor (Centrifugal Charging Pump) connects at 5 seconds and is followed by the remaining accident required loads. This provides assurance that the voltage has decayed on the boards and no residual out of phase reconnection occurs.

The NRC staff concludes that TVAs clarification is adequate, since it provides the necessary information regarding the sequencing of loads in case of a non-simultaneous LOOP-LOCA event, and that such an event is considered as a beyond design basis event. Therefore, Open Item 31 is closed.

Open Item 33 TVA stated in Attachment 9 of its letter dated July 31, 2010, that certain design change notices (DCNs) are required or anticipated for completion of WBN Unit 2, and that these DCNs were unverified assumptions used in its analysis of the 125 Vdc vital battery system. Open Item 33 required the NRC staff to verify completion of these DCNs prior to issuance of the operating license.

The applicable DCNs are as follows:

• DCN 53421: removal/abandonment of Reciprocating Charging Pump 2-MTR-62-101, supplied from 480V SHDN BD 2B1-B, Compt. 3B.

• DCN 54636: cable modifications for Unit 2 AFWP Turbine Trip and Throttle Valve and Turbine Controls.

In its letter dated April 6, 2011, TVA stated that the above DCNs have been issued and that the NRC will be notified when the physical work has been completed for these two DCNs. Open Item 33 remains open until the NRC staff has verified by inspection that the DCNs have been incorporated into the WBN Unit 2 design.

8-6

9 AUXILIARY SYSTEMS 9.1 Fuel Storage Facility 9.1.4 Fuel Handling System In the U.S. Nuclear Regulatory Commissions (NRCs) Supplemental Safety Evaluation Report (SSER) 22, issued February 2011, Open Item 34 (Appendix HH) stated the following:

TVA stated that the method of compliance with [NUREG-0612, Control of Heavy Loads at Nuclear Power Plants: Resolution of Generic Technical Activity A-36, issued July 1980] Phase I guidelines would be substantially similar to the current Unit 1 program and that a new Section 3.12 will be added to the Unit 2 FSAR that will be materially equivalent to Section 3.12 of the current Unit 1 FSAR.

The NRC staff verified that, in Amendment 103, dated March 15, 2011, to the Watts Bar Nuclear Plant (WBN) Unit 2 final safety analysis report (FSAR), TVA added Section 3.12, Control of Heavy Loads, that is materially equivalent to Section 3.12 of the current WBN Unit 1 FSAR. Since TVAs method of compliance with the Phase I guidelines of NUREG-0612, Control of Heavy Loads at Nuclear Power Plants:

Resolution of Generic Technical Activity A-36, issued July 1980, for WBN Unit 2 is substantially similar to the current WBN Unit 1 program, the NRC staff finds TVAs response acceptable. Therefore, Open Item 34 is closed.

9.3 Process Auxiliaries 9.3.2 Process and Postaccident Sampling Systems The NRC staff reviewed WBN Unit 2 FSAR Section 9.3.2, Process Sampling System, and found only one substantive difference between this section and the comparable section in the WBN Unit 1 FSAR. WBN Unit 2 FSAR, Section 9.3.2.6, Postaccident Sampling Subsystem (Unit 1 Only), describes the postaccident sampling subsystem, but states that, The existing Post Accident Sampling System (PASS) is being abandoned in place and disconnected for Unit 2. Because WBN Unit 2 differs from the NRC-approved Unit 1 design due to the removal of the PASS from Unit 2, the staff reviewed the acceptability of removing the PASS from WBN Unit 2.

By letter dated June 14, 2000 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML003723268), the NRC staff issued, Safety Evaluation Related to Topical Report WCAP-14986, Revision 1, Westinghouse Owners Group Post Accident Sampling System Requirements (TAC No. MA4176). The staffs safety evaluation of WCAP-14986, Revision 1, concluded that the topical report provided a basis to eliminate the postaccident sampling system (PASS) as a required system for sampling the 15 parameters listed in Section 4 of the safety evaluation. The safety evaluation also identified four required actions to be completed by a licensee to eliminate the PASS, in accordance with WCAP-14986, Revision 1. TVA provided its responses to the required actions in Enclosure 1 to its letter to the NRC dated April 1, 2011 (ADAMS Accession No. ML110960407), as described below:

1. Establish a capability for classifying fuel damage events at the Alert level threshold (typically this is 300 microcuries per milliliter dose equivalent iodine).

9-1

Consistent with Regulatory Guide 1.97, Criteria for Accident Monitoring Instrumentation for Nuclear Power Plants, TVA stated that four safety-related high-range radiation monitors are located in the containment, and the monitors display and alarm in the control room. TVA performed a calculation that established the monitor responses for fuel damage at 300 microcuries per milliliter dose equivalent iodine.

TVA stated that, For an intact reactor coolant system (RCS), RCS sampling can be accomplished from the Hot Sample Room for classifying fuel damage at the Alert range. This sampling process will be proceduralized.

2. Develop contingency plans for obtaining and analyzing highly radioactive samples of reactor coolant, containment sump, and containment atmosphere.

TVA stated that it will implement the sampling requirements without the use of a dedicated PASS by obtaining alternate liquid reactor coolant and containment sump samples and upper and lower containment atmosphere samples. TVA stated that it performed a calculation to satisfy the requirements of Items II.B.2 and II.B.3 in NUREG-0737, Clarification of TMI Action Plan Requirements, issued November 1980, by demonstrating that the mission can be accomplished without exceeding 5 rem whole body dose, in accordance with General Design Criterion 19, Control Room, in Appendix A, General Design Criteria for Nuclear Power Plants, to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities. TVA concluded that the samples could be obtained and analyzed without exceeding the dose limits by imposing special conditions and requirements.

For the reactor coolant and containment sump samples, the following special conditions are required:

• The dose rate at 1 inch from the sample vessel does not exceed 1.178x106 millirem per hour (mrem/h).

• Protective clothing with a self-contained breathing apparatus (protection factor of 10,000) shall be worn.

• A lead pig with a minimum of 1 inch of lead is staged in the hot sample room.

For the upper and lower containment atmosphere grab samples, the following special requirements apply:

• The mission may not begin before 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the accident.

• The collection time for the iodine/particulate filter sample must not exceed 45 seconds.

• Protective clothing with a self-contained breathing apparatus (protection factor of 10,000) shall be worn.

• A lead pig with a minimum of 1 inch of lead is available for the transport of the samples.

TVA stated that it will issue procedures before startup for obtaining the samples.

9-2

3. A licensee must determine for its own plant that no decrease in the effectiveness of the emergency plan will result from the removal or downgrade of the PASS.

TVA stated that, In accordance with 10 CFR 50.54(q), a plant-specific evaluation has been made.

The evaluation determined that there is no decrease in the effectiveness of the Emergency Plan as a result of the downgrade/removal of Unit 2's PASS.

(The NRC staff documented its review and acceptance of TVAs proposed emergency plan in Section 13.3, Emergency Preparedness, of SSER 22, issued February 2011.)

4. Licensees will maintain offsite capability to monitor radioactive iodines.

TVA stated that existing plant emergency procedures require postaccident monitoring of radioactive iodines.

On the basis of its review of the information provided by TVA in its letter dated April 1, 2011 (ADAMS Accession No. ML110960407), the NRC staff concludes that TVAs responses to the actions required by the NRC staffs safety evaluation of WCAP-14986, Revision 1, are satisfactory. The staff further concludes that it is acceptable for TVA to remove the PASS from WBN Unit 2. Because the WBN Unit 2 design is otherwise substantially the same as the NRC-approved WBN Unit 1 design, the WBN Unit 2 process and postaccident sampling system designs are acceptable.

9-3

10 STEAM AND POWER CONVERSION SYSTEM 10.4 Other Features 10.4.8 Steam Generator Blowdown System In Section 10.4.8 of SSER 22, dated February 2011, the NRC staffs Open Item 36 (Appendix HH) stated that TVA should provide information to the NRC staff to enable verification that the SGBS [steam generator blowdown system] meets the requirements and guidance specified in the SER or provide justification that the SGBS meets other standards that demonstrate conformance to GDC [10 CFR Part 50, Appendix A, General Design Criterion] 1 and GDC 14.

In Enclosure 1 (item number 36) of its letter to the NRC dated April 6, 2011 (ADAMS Accession No. ML110980637), TVA stated that Section 2.1.1, Safety Functions, of the SGB System Description Documents N3-15-4002 (Unit 1) and WBN2-15-4002 (Unit 2), state the following:

The SGB piping downstream of the containment isolation valves and located in the main stream valve vault room shall be TVA Class G. This piping is seismically supported to maintain the pressure boundary.

The SGB piping located in the turbine building shall be TVA Class H.

The Unit 1 and Unit 2 SGB flow diagrams, 1, 2-47W801-2, also recognize the same TVA Class G and Class H class breaks located downstream of the safety-related SGB containment isolation valves.

The SGB flow diagrams and System Description document that TVA Class G and Class H classifications located downstream of the safety-related containment isolation valves are consistent with the data that was deleted in FSAR Section 10.4.8.1, Steam Generator Blowdown System - Design Basis, Item 6 Component and Code listings described above. It is also noted that NRC Quality Group D classification is equivalent to TVA Class G and H classifications as stated in the NUREG 0847 Section 3.2.2, System Quality Group Classification. Therefore, the design requirements in NRC GDC-1, Quality Standards and Records, and NRC GDC-14, Reactor Coolant Pressure Boundary are not challenged.

Amendment 104 to the Unit 2 FSAR will revise Table 3.2-2 to note that TVA Class G and H piping within the SGB System exists downstream of the safety-related containment isolation valves.

The information provided by TVA is sufficient to demonstrate that the SGBS conforms to GDC 1 and GDC 14. In its letter to the NRC dated June 3, 2011 (ADAMS Accession No.

10-1

ML11178A155), TVA stated that the same information intended to be placed into Table 3.2-2 was already provided in Table 3.2-2a. Therefore, this change to Table 3.2-2 is no longer needed... The staff verified that Table 3.2-2a, Classification of Systems Having Major Design Concerns Related to a Primary Safety Function, contained the appropriate information. Since the SGBS conforms to GDC 1 and GDC 14, TVAs response is acceptable to the NRC staff, and Open Item 36 is closed.

10.4.9 Auxiliary Feedwater System In Section 10.4.9 of SSER 23, dated July 2011, the NRC staffs Open Item 62 (Appendix HH) stated that Confirm TVAs change to FSAR Section 10.4.9 to reflect its intention to operate with each CST [condensate storage tank] isolated from the other.

The staff verified that in WBN Unit 2 FSAR, Amendment 103, dated March 15, 2011, TVA revised the wording in Section 10.4.9 to state that each CST is intended to operate independently in support on one unit, and no credit is taken in the safety analyses for the ability to crosstie the CSTs. Therefore, Open Item 62 is closed.

10-2

11 RADIOACTIVE WASTE SYSTEM 11.0 Summary Description The U.S. Nuclear Regulatory Commission (NRC) staff reviewed changes made by the Tennessee Valley Authority (TVA) to Section 11, Radioactive Waste Management Systems, of the Watts Bar Nuclear Plant (WBN) Unit 2 final safety analysis report (FSAR) as part of its review of TVAs application for an operating license for WBN Unit 2. In some portions of its review in the supplemental safety evaluation report (SSER) subsections below, the staff documented its evaluation of changes to FSAR Section 11 from both system engineering and radiological protection perspectives. In its review, the staff used the guidance in NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants:

LWR Edition (SRP), Chapter 11, Radioactive Waste Management, issued July 1981, and the staffs conclusions in NUREG-0847, Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant, Units 1 and 2 (SER), issued June 1982, as supplemented.

System Engineering The NRC staff reviewed Section 11 of WBN Unit 2 FSAR Amendment 101, dated October 29, 2010, and compared it to WBN Unit 1 updated FSAR Amendment 8, dated April 20, 2010. The staff concluded that no substantive differences between the two units exist in regard to the design and operation of the radioactive waste management systems. In Staff Requirements Memorandum (SRM)-SECY-07-0096, Possible Reactivation of Construction and Licensing Activities for the Watts Bar Nuclear Plant Unit 2, dated July 25, 2007 (Agencywide Documents Access and Management System Accession No. ML072060688), the Commission stated that it supports a licensing review approach that uses the current licensing basis for WBN Unit 1 as the reference basis for the review and licensing of WBN Unit 2. Because the staff had previously reviewed and approved the radioactive waste management system design for WBN Unit 1 and because there are no substantive differences in the design compared to WBN Unit 2, the staff concludes that the design of the liquid, gaseous, and solid radioactive waste systems and associated process and effluent radiological monitoring and sampling systems are acceptable.

Radiological Protection By Amendments 92, 95, 98, 99, 100, 101, 102, and 104 to the WBN Unit 2 FSAR, TVA revised FSAR Section 11 primarily to conform the WBN Unit 2 design basis to the design basis of the currently operating WBN Unit 1. The staff reviewed these amendments using the guidance in NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP), Chapter 11, Radioactive Waste Management, issued July 1981, and the staffs conclusions in NUREG-0847, Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant, Units 1 and 2 (SER), issued June 1982, as supplemented.

The multiple revisions to the FSAR have renumbered and renamed many of the tables and figures in FSAR Section 11. The staff finds these changes acceptable because renumbering the tables and figures within Section 11 does not in itself affect its previous safety conclusions.

By letter to the NRC dated November 9, 2010, TVA provided a reference table showing the Section 11 changes from FSAR Amendment 91 to the current (Amendment 100) table and paragraph designations. TVA provided this reference table as information to help the NRC staff 11-1

follow the development of FSAR Section 11. Unless otherwise indicated, this SSER references tables and paragraphs as they appear in FSAR Amendment 100.

TVA originally applied for the license for WBN before June 4, 1976. Therefore, consistent with the provisions in Section II.D of Appendix I, Numerical Guides for Design Objectives and Limiting Conditions for Operation To Meet the Criterion As Low as is Reasonably Achievable for Radioactive Material in Light-Water-Cooled Nuclear Power Reactor Effluents, to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities, TVA has committed to demonstrating compliance with the dose-based criteria in Guides on Design Objectives for Light-Water-Cooled Nuclear Power Reactors as proposed in Concluding Statement of Position of the Regulatory Staff in Docket-RM-50-2, dated February 20, 1974, pages 25-30, which is reproduced in an annex to Appendix I to 10 CFR Part 50, in lieu of providing a WBN liquid and gaseous effluent systems cost-benefit analysis. However, as discussed below in Section 11.4 of this SSER, the calculated doses to the maximally exposed member of the public no longer support the conclusion that the operation of WBN will meet the criteria in RM 50-2 from normal gaseous effluent releases. TVA must provide information to the NRC staff demonstrating that WBN Unit 2 meets the provisions in Section II.D of Appendix I to 10 CFR Part 50 for gaseous effluent releases. This is Open Item 135 (Appendix HH) as further described below in Section 11.3 of this SSER.

11.1 Source Terms In Amendments 92 and 95 to the WBN Unit 2 FSAR, TVA revised the text to several subsections of Section 11.1, Source Terms. These changes are editorial in nature and do not affect the technical information presented in FSAR Tables 11.1-1-11.1-7. Therefore, these changes did not affect the staffs original safety conclusions and are acceptable.

11.2 Liquid Radwaste Management System Engineering The NRC staff reviewed Section 11.2, Liquid Waste Systems, of WBN Unit 2 FSAR Amendment 101 and compared it to WBN Unit 1 updated FSAR Amendment 8. The staff concluded that no substantive differences between the two units exist in regard to the design and operation of the liquid waste processing system (LWPS).

WBN Units 1 and 2 partly share the LWPS. The WBN Unit 2 FSAR has two minor differences from the WBN Unit 1 updated FSAR; it describes the shared equipment in the auxiliary building, and it describes the monitor tank in Section 11.2.3.1, Component Design. The NRC staff finds that these differences are not substantive and that they have no impact on its previous conclusions on the liquid waste systems, as documented in the SER and its supplements.

The NRC staff previously concluded in Section 11.2 of the SER that the LWPS in WBN is capable of reducing the release of radioactive materials in liquid effluents to concentrations below the limits in 10 CFR Part 20, Standards for Protection against Radiation, during periods of fission product leakage from the fuel at design levels. Because no substantive differences between the two units exist in regard to the design and operation of the LWPS, the NRC staff concludes that the LWPS in WBN Unit 2 is capable of reducing the release of radioactive materials in liquid effluents to concentrations below the limits in 10 CFR Part 20 during periods of fission product leakage from the fuel at design levels and that it is therefore acceptable.

11-2

Radiological Protection The NRC staff reviewed the changes made by TVA in Section 11.2 of Amendments 95, 98, 101, 102, and 104 to the WBN Unit 2 FSAR in support of the operating license application for WBN Unit 2. In its review, the staff used the guidance in SRP Section 11.2, Liquid Waste Management System, Revision 2. The NRC staff based its acceptance criteria, in part, on the relevant requirements in the following regulations:

• 10 CFR 50.34a(c) as it relates to the provision of a description of the equipment and procedures for the control of gaseous and liquid effluents and for the maintenance and use of equipment installed in radioactive waste systems, under 10 CFR 50.34a(a)

• 10 CFR Part 20 as it relates to the release of radioactivity in effluents to unrestricted areas

• Appendix I to 10 CFR Part 50 as it relates to the numerical guides for design objectives and limiting conditions for operation to meet the as low as reasonably achievable (ALARA) criterion in Appendix I

• General Design Criterion (GDC) 60, Control of Releases of Radioactive Materials to the Environment, in Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50 as it relates to the design of radioactive waste management systems necessary to control releases of liquid radioactive materials to the environment

• GDC 61, Fuel Storage and Handling and Radioactivity Control, of Appendix A to 10 CFR Part 50 as it relates to the design of radioactive waste systems necessary to ensure adequate safety under normal and postulated accident conditions FSAR Table 11.2-4, Total Annual Discharge Liquid Waste Processing System [per unit in accordance with Appendix I to 10 CFR Part 50] prior to Treatment, represents the total annual discharge of liquid effluent before the processing of any liquid waste. Amendments 95 and 102 to the FSAR made some inconsequential revisions to this table. These changes did not affect the staffs previous safety conclusion and, therefore, are acceptable.

In Amendments 98, 101, and 104 to the FSAR, TVA revised the description of the liquid effluent releases from different plant operational modes as described in FSAR Section 11.2.6.5. The NRC licensed WBN Unit 1 based on the assumption that the plant would release liquid effluents from steam generator blowdown (SGBD) and the regeneration of condensate demineralizers (CDs) as unprocessed effluent. FSAR Section 11.2.6.5.1 states that this operating mode is still the expected mode for WBN Unit 2 normal operations. However, TVA revised the FSAR to evaluate the following three WBN Unit 2 operating modes with steam generator tube leakage:

(1) tube leakage with SGBD concentrations above 3.65x10-5 microcuries per cubic centimeter (µCi/cm3), the routing of SGBD to the condensate system through CDs, and the release of CD regenerative effluents without additional processing (2) tube leakage with SGBD concentrations above 3.65x10-5 µCi/cm3, the routing of SGBD to the condensate system through CDs, and the processing of CD regenerative effluents with mobile demineralizer before their offsite release 11-3

(3) normal operations with the release of untreated SGBD and with discharge concentrations less than 3.65x10-5 µCi/cm3 (corresponding to the 5-curie (Ci) total annual liquid release technical specification limit)

FSAR Amendments 95, 98, 101, 102, and 104 revised Table 11.2-5, Total Annual Discharge Liquid Waste Processing System Annual Discharge (Ci) After Processing, and added Tables 11.2-5a-11.2-5d to reflect these operating modes. Columns 4, 5, and 8 of Table 11.2-5 present the liquid effluent isotopic spectrums and the total annual radioactivity released in liquid effluents with or without processing of the different waste streams, corresponding to Operating Modes 1, 2, and 3 listed above, respectively. These total annual releases are compared to the 5-Ci release limit for each reactor in RM 50-2, as annexed to Appendix I to 10 CFR Part 50. In addition, Tables 11.2-5a, 11.2-5b, and 11.2-5d compare the nominal annual release activity values given in Columns 4, 5, and 8 of Table 11.2-5, respectively, to the limits in 10 CFR Part 20. The sum of the ratios of each isotope concentration (C) to its corresponding effluent concentration limit (ECL) (as listed in Column 2 of Table 2 in Appendix B, Annual Limits on Intake (ALIs) and Derived Air Concentrations (DACs) of Radionuclides for Occupational Exposure; Effluent Concentrations; Concentrations for Release to Sewerage, to 10 CFR Part 20) is calculated. Consistent with the requirements in 10 CFR 20.1302(b)(2)(i), a C/ECL sum of less than 1.0 indicates that this annual average effluent release is within the limits in 10 CFR 20.1301, Dose Limits for Individual Members of the Public.

Column 8 of Table 11.2-5 and Table 11.2-5d clearly indicate that the liquid releases from normal operation of WBN Unit 2 will be within the 5-Ci limit for total annual activity in Appendix I to 10 CFR Part 50 and for the annual average concentration limits in Appendix B to 10 CFR Part 20 and, therefore, are acceptable. In addition, Column 5 of Table 11.2-5 and Table 11.2-5b show the same for operations with steam generator tube leakage, with SGBD diverted to the condensate system and the CD regeneration effluent processed by the mobile demineralizer. Table 11.2-5 indicates that the source term represented by Column 5 of Table 11.2-5 is bounded by the expected normal operating source term listed in Column 8 of Table 11.2-5. Therefore, operating in this mode is acceptable. However, Table 11.2-5a clearly indicates that the source term listed in Column 4 of Table 11.2-5 does not meet the concentration limits in Appendix B to 10 CFR Part 20. Long-term operation with significant steam generator tube leakage (e.g., diversion of SGBD to the condensate system) without additional processing of CD effluents is not acceptable. Therefore, TVA will control actual offsite releases from various operating modes in accordance with the offsite dose calculational manual and WBN technical specifications to ensure that doses to members of the public will be within the limits in 10 CFR Part 20 and will meet the design criteria of Appendix I to 10 CFR Part 50.

In FSAR Amendment 95, TVA updated the estimated year 2040 population within a 50-mile radius as listed in Table 11.2-6, Tennessee River Reaches within 50-Mile Radius Downstream of WBN. In addition, FSAR Amendment 104 revised FSAR Section 11.2.9.1 to clarify the basis for the population growth factor of 1.24 used in TVAs analysis of doses from public water supplies. These changes did not impact the staffs prior safety conclusion and, therefore, are acceptable.

In FSAR Amendments 95 and 100, TVA updated the whole body and organ doses for the maximum exposed individual in each critical age group listed in Table 11.2-7, Watts Bar Nuclear Plant Doses from Liquid Effluents for Year 2040, based on the expected liquid effluent releases from normal operation of WBN Unit 2 (Column 8 of Table 11.2-5). These updates resulted in minor changes to the calculated doses for individual organs and individual age 11-4

groups. However, the maximum annual total body dose is to the adult (0.72 millirem (mrem)),

and the maximum exposed organ is the teen liver (1.00 mrem); both are unchanged. The revised doses are still well within the Appendix I to 10 CFR Part 50 design objectives of 3 mrem to the total body and 10 mrem to any organ. Therefore, these changes did not impact the staffs prior safety conclusion that WBN Unit 2 meets the design criteria for liquid effluent releases in Appendix I to 10 CFR Part 50 and RM 50-2, and, therefore, are acceptable.

11.3 Gaseous Waste Management System Engineering The NRC staff reviewed Section 11.3, Gaseous Waste Systems, of WBN Unit 2 FSAR Amendment 101 and compared it to WBN Unit 1 updated FSAR Amendment 8. The staff concluded that no substantive differences between the two units exist in regard to the design and operation of the gaseous waste processing systems (GWPS).

WBN Units 1 and 2 partially share the GWPS. The only difference in the WBN Unit 2 FSAR from the WBN Unit 1 updated FSAR is that the WBN Unit 2 FSAR provides an updated description of the turbine building vents to reflect two-unit operation. The difference is not substantive and has no impact on the NRC staffs previous conclusions on the GWPS, as documented in the SER and its supplements.

In the SER, the NRC staff concluded that the GWPS at WBN is capable of reducing (1) radioactive materials in effluents ALARA in accordance with 10 CFR 50.34a and (2) the release of radioactive materials in gaseous effluents to concentrations below the limits in 10 CFR Part 20 during periods of fission product leakage from the fuel at design levels.

Because no substantive differences between the two units exist in regard to the design and operation of the GWPS, the NRC staff concludes that the GWPS in WBN Unit 2 is capable of reducing (1) radioactive materials in effluents ALARA in accordance with 10 CFR 50.34a(a), as referenced in 10 CFR 50.34a(c), and (2) the release of radioactive materials in gaseous effluents to concentrations below the limits in 10 CFR Part 20 during periods of fission product leakage from the fuel at design levels. Therefore, the GWPS at WBN Unit 2 is acceptable.

Radiological Protection The NRC staff reviewed the changes made by TVA in Section 11.3 of Amendments 95, 98, 99, 100, and 104 to the WBN Unit 2 FSAR in support of the operating license application for WBN Unit 2. In its review, the staff used the guidance in SRP Section 11.3, Gaseous Waste Management System, Revision 2. The NRC staff based its acceptance criteria, in part, on the relevant requirements in the following regulations:

• 10 CFR 50.34a(c) as it relates to the provision of a description of the equipment and procedures for the control of gaseous and liquid effluents and for the maintenance and use of equipment installed in radioactive waste systems, under 10 CFR 50.34a(a)

• 10 CFR Part 20 as it relates to the release of radioactivity in effluents to unrestricted areas

• Appendix I to 10 CFR Part 50 as it relates to the numerical guides for design objectives and limiting conditions for operation to meet the ALARA criterion given in Appendix I 11-5

• GDC 60 of Appendix A to 10 CFR Part 50 as it relates to the design of radioactive waste management systems necessary to control releases of gaseous radioactive materials to the environment

• GDC 61 of Appendix A to 10 CFR Part 50 as it relates to the design of radioactive waste systems necessary to ensure adequate safety under normal and postulated accident conditions In FSAR Amendments 95 and 98, TVA made several revisions to the descriptions of the WBN Unit 2 GWPS design. In addition, Amendment 95 deleted references to the boron recycle system from Table 11.3-3 and Table 11.3-4 in Section 11.3.2, System Descriptions. These changes did not affect TVAs expected annual gaseous release from the GWPS as presented in Table 11.3-5 of the FSAR. Therefore, these revisions did not affect the staffs previous safety conclusion and are acceptable.

In FSAR Amendments 95, 98, 99, and 104, TVA made several revisions of mostly an editorial nature to the descriptions of gaseous effluent release pathways in FSAR Section 11.3.7, Radioactive Releases (and to the gaseous effluent release analysis parameters listed in Table 11.3-6) that resulted in minor changes to the radioactive isotopic release estimates listed in Table 11.3-7, Annual Radioactive Releases with Purge Air Filters (Curies/Year/Reactor).

However, Amendments 95, 98, and 104 also revised the gaseous release assumptions in Table 11.3-6, Radioactive Gaseous Effluent Parameters, that had a more substantial impact on the estimated annual gaseous releases from the WNB Unit 2 containment building. The estimate of releases from the containment building before Amendment 95 was based on an assumed 22 containment purges per year. However, TVA stated that it does not normally purge the WBN containment during power operations. Instead, it continuously vents containment at a flow rate of 100 cubic feet per minute through a high-efficiency particulate air filter and charcoal bed. Amendments 95 and 98 added Table 11.3-7c to provide the gaseous isotopic release source term expected from this filtered-vent mode of operation. Table 11.3-7c lists radioactive releases that, like those in Table 11.3-7, are based on the radioactive source term assumptions in American National Standards Institute 18.1-1984, Radioactive Source Term for Normal Operation for Light-Water Reactors, as referenced in NUREG-0017, Calculation of Releases of Radioactive Materials in Gaseous and Liquid Effluents from Pressurized-Water Reactors (PWRs) (PWR GALE Code), Revision 1, issued April 1985, and adjusted for WBN-specific parameters. Amendment 104 revised Table 11.2-6 to clarify that TVA used the estimated releases in Table 11.3-7c to demonstrate compliance with Appendix I to 10 CFR Part 50 (e.g., the basis for the calculated site boundary doses presented in Table 11.3-10) because they more closely reflect normal operations at WBN. The NRC staff performed an independent assessment of the expected gaseous releases from WBN operating in the continuous filtered containment vent mode. The staff used the input parameters listed in Table 1.2 of SSER 16, issued September 1995, revised to reflect zero containment purges per year; a low volume continuous containment venting of 100 cubic feet per minute; and filter efficiencies of 70 percent for iodine and 99 percent for particulates to calculate the expected gaseous release from WBN with the PWR GALE computer code (NUREG-0017). The results of the staffs assessment, listed below in Table-11.3-1 of this SSER, show agreement with the release estimates listed in FSAR Table 11.3-7c to within 10 percent for the dose-significant isotopes (e.g., iodine (I)-131, I-133, xenon (Xe)-133), carbon (C)-14, and hydrogen (H)-3). Therefore, these changes are acceptable.

In FSAR Amendments 95 and 98, TVA also added Tables 11.3-7a and 11.3-7b to demonstrate that these estimated gaseous releases are within the limiting values in Appendix B to 11-6

10 CFR Part 20. The isotopic values in FSAR Table 11.3-7a are from Table 11.3-7; these values adjusted to the isotopic values expected for operations with design-basis fuel leakage (up to 1-percent failed fuel). Columns 7 and 8 of Table 11.3-7a list the C/ECL ratios for each isotope in the adjusted source term for single-unit operation and dual-unit operation, respectively. Similarly, Table 11.3-7b adjusts the isotopic values and lists the C/ECL ratios for the expected isotopic releases in Table 11.3-7c. The sum of the C/ECL ratios in both Table 11.3-7a and Table 11.3-7b are less than 1.0, thus indicating that WBN will meet the public dose limits in 10 CFR Part 20 when it operates under either of these assumed conditions.

Therefore, the gaseous releases reflected in Tables 11.3-7 and 11.3-7c are acceptable.

Table 11.3-1 Staff Values for WBN Gaseous Release Source Terms TOTAL ANNUAL RELEASE (Ci/Year/Reactor)

Kr-85m 1.7x10+01 Cr-51 5.92x10-04

+03 Kr-85 2.2x10 Mn-54 4.31x10-04 Kr-87 7.0 Co-57 8.20x10-06

+01 Kr-88 2.3x10 Co-58 2.32x10-02

+03 Xe-131m 1.1x10 Co-60 8.74x10-03 Xe-133m 4.8x10+01 Fe-59 7.70x10-05

+03 Xe-133 3.0x10 Sr-89 2.98x10-03 Xe-135m 4.0 Sr-90 1.14x10-03

+02 Xe-135 1.6x10 Zr-95 1.00x10-03 Xe-138 4.0 Nb-95 2.45x10-03

+01 Ar-41 3.40x10 Ru-103 7.70x10-05

-02 Br-84 5.07x10 Ru-106 7.50x10-05 I-131 1.6x10-01 Sb-125 6.09x10-05

-01 I-133 4.9x10 Cs-134 2.27x10-03

-04 Ba-140 4.00x10 Cs-136 8.01x10-05

-05 Ce-141 3.95x10 Cs-137 3.48x10-03 H-3 1.39x10+02 C-14 7.30 In 2008, TVA revised its assessments of the offsite radiological impact as a result of gaseous effluent releases from WBN during normal operations. These revised dose assessments reflect the following:

• the revised estimates of gaseous releases from containment in FSAR Table 11.3-7c

• revised annual average dispersion factors (X/Qs) and deposition factors (D/Qs) based on updated meteorology data (1986 to 2005)

• revised dose receptor and pathway information indicated in the 2007 land use survey

• revised population growth estimates based on the 2000 U.S. census In FSAR Amendments 95, 100, and 104, TVA revised Table 11.3-8, Data on Points of Interest near Watts Bar Nuclear Plant, to reflect the updated locations of the dose receptor points of interest (along with their associated X/Qs, D/Qs, terrain adjustment factors, and milk cow feeding factors) that TVA used in these revised dose assessments. With the exception of four residences and two gardens, the locations of the nearest resident and nearest garden in each of the 16 compass sectors changed. In addition, only three (one in the east-southeast (ESE) 11-7

sector and two in the south-southwest (SSW) sector) of the eight former cow milk producing locations remain. Of these changes, the most significant is the revised location of the nearest garden in the SSW sector. This new garden, located 1.23 miles (1,979 meters) from the plant, has the highest X/Q and D/Q values and is the limiting garden for the leafy vegetable consumption dose pathway. As a result, the leafy vegetable consumption pathway is the major contributor (more than 50 percent) to the calculated maximum exposed organ dose.

In FSAR Amendments 95, 98, and 104, TVA revised the calculated doses for the maximum exposed individual member of the public in Table 11.3-10, Watts Bar Nuclear Plant Individual Doses from Gaseous Effluents, and in FSAR Amendments 95 and 104, TVA revised the integrated 50-mile population doses in Table 11.3-11, Summary of Population Doses, to reflect TVAs revised dose assessments.

To verify that there is reasonable assurance that WBN can operate within the design criteria of Appendix I to 10 CFR Part 50 and the limiting values in 40 CFR Part 190, Environmental Radiation Protection Standards for Nuclear Power Operations, the NRC staff tasked Pacific Northwest National Laboratory to performed independent confirmatory dose calculations using the GASPAR II computer code described in NUREG/CR-4653, GASPAR IITechnical Reference and User Guide, issued March 1987. These calculations assumed the gaseous release estimates in Table 11.3-1 of this SSER. The revised FSAR Table 11.3-8 and the enclosure to TVAs letter dated May 26, 2011, provided the site-specific input parameters, with the exception of the X/Q and D/Q values. Analysts calculated the X/Q and D/Q values independently using the methods and models in NUREG/CR-2919, XOQDOQ Computer Program for the Meteorological Evaluation of Routine Effluent Releases at Nuclear Power Plants, issued 1982. Consistent with Regulatory Guide (RG) 1.70, Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition), Revision 3, issued November 1978, the analysts used WBN site-specific hourly meteorological data for a 3-year period from January 2004 to December 2006 as the basis for these calculations. Table 11.3-2 lists the X/Q and D/Q factors used in this independent dose assessment.

Table-11.3-2 Values for Air Concentration and Ground Depositiona LOCATION SECTOR DISTANCE DISTANCE X/Qb D/Q (mi) (m) (s/m3) (1/m2)

Unrestricted N 0.96 1,550 Area 2.8x10-06 7.1x10-09 Unrestricted NNE 1.23 1,980 Area 4.2x10-06 1.2x10-08 Unrestricted NE 0.98 1,580 Area 6.8x10-06 1.1x10-08 Unrestricted ENE 0.85 1,370 Area 9.4x10-06 1.1x10-08 Unrestricted E 0.80 1,280 Area 1.2x10-05 1.3x10-08 Unrestricted ESE 0.78 1,250 Area 1.1x10-05 1.5x10-08 Unrestricted SE 0.78 1,250 Area 7.1x10-06 1.1x10-08 Unrestricted SSE 0.78 1,250 Area 3.3x10-06 8.4x10-09 11-8

LOCATION SECTOR DISTANCE DISTANCE X/Qb D/Q (mi) (m) (s/m3) (1/m2)

Unrestricted S 0.83 1,340 Area 3.0x10-06 1.1x10-08 Unrestricted SSW 0.96 1,550 Area 2.3x10-06 9.2x10-09 Unrestricted SW 1.04 1,670 Area 2.2x10-06 5.6x10-09 Unrestricted WSW 0.89 1,430 Area 2.2x10-06 5.0x10-09 Unrestricted W 0.91 1,460 Area 1.1x10-06 1.8x10-09 Unrestricted WNW 0.87 1,400 Area 1.9x10-06 2.9x10-09 Unrestricted NW 0.87 1,400 Area 1.1x10-06 1.8x10-09 Unrestricted NNW 0.91 1,460 Area 1.0x10-06 1.8x10-09 Nearest N 1.33 2,134 Residence 1.7x10-06 4.1x10-09 Nearest NNE 2.24 3,600 Residence 1.7x10-06 4.3x10-09 Nearest NE 2.08 3,353 Residence 2.2x10-06 3.1x10-09 Nearest ENE 1.50 2,414 Residence 4.1x10-06 4.3x10-09 Nearest E 2.03 3,268 Residence 3.0x10-06 2.7x10-09 Nearest ESE 2.74 4,416 Residence 1.8x10-06 1.7x10-09 Nearest SE 0.85 1,372 Residence 6.2x10-06 9.0x10-09 Nearest SSE 0.95 1,524 Residence 2.4x10-06 6.0x10-09 Nearest S 0.98 1,585 Residence 2.3x10-06 8.6x10-09 Nearest SSW 1.23 1,979 Residence 1.6x10-06 6.0x10-09 Nearest SW 2.63 4,230 Residence 5.2x10-07 1.1x10-09 Nearest WSW 1.14 1,829 Residence 1.5x10-06 3.3x10-09 Nearest W 1.80 2,896 Residence 3.9x10-07 5.6x10-10 Nearest WNW 1.02 1,646 Residence 1.5x10-06 2.2x10-09 Nearest NW 1.28 2,061 Residence 6.0x10-07 9.4x10-10 Nearest NNW 2.73 4,389 Residence 1.9x10-07 2.7x10-10 11-9

LOCATION SECTOR DISTANCE DISTANCE X/Qb D/Q (mi) (m) (s/m3) (1/m2)

Nearest N 4.75 7,644 Garden 1.6x10-07 2.9x10-10 Nearest NNE 3.84 6,173 Garden 6.0x10-07 1.4x10-09 Nearest NE 2.08 3,353 Garden 2.2x10-06 3.1x10-09 Nearest ENE 3.06 4,927 Garden 1.2x10-06 1.0x10-09 Nearest E 3.96 6,372 Garden 9.4x10-07 6.7x10-10 Nearest ESE 2.96 4,758 Garden 1.5x10-06 1.4x10-09 Nearest SE 2.88 4,633 Garden 9.2x10-07 9.5x10-10 Nearest SSE 4.63 7,454 Garden 1.8x10-07 2.9x10-10 Nearest S 1.40 2,254 Garden 1.4x10-06 4.9x10-09 Nearest SSW 1.23 1,979 Garden 1.6x10-06 6.0x10-09 Nearest SW 5.03 8,100 Garden 1.7x10-07 3.2x10-10 Nearest WSW 2.90 4,667 Garden 3.3x10-07 5.6x10-10 Nearest W 3.18 5,120 Garden 1.5x10-07 1.9x10-10 Nearest WNW 3.67 5,909 Garden 9.6x10-08 1.1x10-10 Nearest NW 1.97 3,170 Garden 2.3x10-07 3.3x10-10 Nearest NNW 2.86 4,602 Garden 1.8x10-07 2.5x10-10 Milk Animal SSW 1.42 2,286 1.2x10-06 4.7x10-09 Milk Animal SSW 2.08 3,353 6.8x10-07 2.4x10-09 Milk Animal ESE 4.17 6,706 9.3x10-07 7.6x10-10 a

Based on meteorological data from January 2004 to December 2006.

b Depleted and 8-day decay.

The NRC staff performed independent dose calculations for the liquid and gaseous effluent pathways at WBN Unit 2 and compared the results to the TVA calculations, as listed below in Table 11.3-3 of this SSER. The staff concludes that there is reasonable agreement between the TVA dose assessment and the NRC staffs assessment. Both assessments indicate dose values that are well within the corresponding design objectives in Appendix I to 10 CFR Part 50.

In addition, both dose assessments indicate that the total doses from WBN liquid and gaseous effluents will be a small fraction of the limiting values in 10 CFR 20.1301 (100 mrem to a member of the public) and in 40 CFR Part 190 (25 mrem to the whole body, 75 mrem to the thyroid, and 25 mrem to any other organ of any member of the public), as referenced in 10 CFR 20.1301(e).

11-10

Table 11.3-3 Calculated Appendix I to 10 CFR Part 50 Dose Commitments to a Maximally Exposed Individual for WBN ANNUAL DOSE PER REACTOR UNIT Appendix Ia Calculated Dosesb Parameter Design Objectives TVA NRC Liquid Effluents Dose to Total BodyAll Pathways (mrem) 3 0.72 0.64 Dose to Any OrganAll Pathways (mrem) 10 1.00 1.49 Noble Gas Effluents (at Site Boundary)

Gamma Dose in Air (mrad) 10 0.80 0.90 Beta Dose in Air (mrad) 20 2.71 3.59 Dose to Total Body of an Individual (mrem) 5 0.57 0.51 Dose to Skin of an Individual (mrem) 15 1.54 2.60 Radioiodines and Particulatesc Dose to Any OrganAll Air Pathways (mrem) 15 9.15 9.75d a

Design objectives from Sections II.A, II.B, and II.C of Appendix I to 10 CFR Part 50 consider doses to the maximally exposed individual.

b This table represents locations that result in maximum doses.

c C-14 and H-3 have been added to this category.

d Child thyroid is the maximally exposed organ.

Both TVAs and the staffs calculations indicate that the design objectives in Sections II.A, II.B, and II.C of Appendix I to 10 CFR Part 50 are met. However, the calculations do not support a conclusion that the criteria for gaseous effluents in RM 50-2, and thus Section II.D of Appendix I, are met. As noted in SSER Section 11.0 above, TVA has committed to demonstrating compliance with the dose-based criteria in RM 50-2, in lieu of providing a WBN liquid and gaseous effluent systems cost-benefit analysis. Specifically, Table 11.3-3 of this SSER indicates that the calculated maxim organ dose from the operation of two reactor units at the WBN site would be in excess of 18 mrem. This result does not meet Criterion C.1 in RM 50-2 for gaseous effluent releases of 15 mrem per year to the maximally exposed organ from all light-water-cooled nuclear power reactors at a site. Section II.D of Appendix I to 10 CFR Part 50 states, In addition to the provisions of paragraphs A, B, and C above, the applicant shall include in the radwaste system all items of reasonably demonstrated technology that, when added to the system sequentially and in order of diminishing cost-benefit return, can for a favorable cost-benefit ratio effect reductions in dose to the population reasonably expected to be within 50 miles of the reactor. TVA has not provided the analysis required by Section II.D of Appendix I to 10 CFR Part 50. TVA must demonstrate through a cost-benefit analysis that reasonable changes to the design of the WBN gaseous effluent processing systems would not sufficiently reduce the collective dose to the public within a 50-mile radius. Therefore, the staff cannot conclude that the doses to members of the public from effluent releases during the normal operation of WBN will be ALARA. This is Open Item 135 (Appendix HH).

11-11

11.4 Solid Waste Management System The NRC staff reviewed Section 11.5, Solid Waste Management System, of Amendment 101 to the WBN Unit 2 FSAR and compared it to WBN Unit 1 updated FSAR Amendment 8. The staff concluded that no substantive differences between the two units exist in regard to the design and operation of the solid waste management system. WBN Units 1 and 2 share the solid waste management system for WBN.

The NRC staff previously documented its review and acceptance of the solid waste management system at WBN Unit 1 in Section 11.4 of both the SER and SSER 16. Because no substantive differences between the two units exist in regard to the design and operation of the solid waste management system, the staff concludes that the solid waste management system at WBN Unit 2 is acceptable.

11.5 Process and Effluent Radiological Monitoring and Sampling Systems The NRC staff reviewed Section 11.4, Process and Effluent Radiological Monitoring and Sampling System, of Amendment 101 to the WBN Unit 2 FSAR and compared it to WBN Unit 1 updated FSAR Amendment 8. The staff concluded that no substantive differences between the two units exist in regard to the design and operation of the process and effluent radiological monitoring and sampling system.

The WBN Unit 2 FSAR has two minor differences from the WBN Unit 1 updated FSAR. The WBN Unit 2 FSAR describes (1) an additional condenser vacuum air exhaust monitor and (2) the differences between the containment building lower compartment and the containment building upper compartment monitors. These differences do not impact the NRC staffs previous conclusions on the process and effluent radiological monitoring and sampling system, as documented in Sections 11.5 of the SER; SSER 16; and SSER 20, issued February 1996.

The staff previously concluded that the process and effluent radiological monitoring and sampling system at WBN Unit 1 met the requirements in GDC 60; GDC 63, Monitoring Fuel and Waste Storage; and GDC 64, Monitoring Radioactivity Releases, of Appendix A to 10 CFR Part 50 and the guidelines in RG 1.21, Measuring, Evaluating, and Reporting Radioactivity in Solid Wastes and Releases of Radioactive Materials in Liquid and Gaseous Effluents from Light Water-Cooled Nuclear Power Plants, Revision 1, issued June 1974; RG 1.97, Criteria for Accident Monitoring Instrumentation for Nuclear Power Plants, Revision 2, issued December 1980; and the intent and purpose of RG 4.15, Quality Assurance for Radiological Monitoring Programs (Normal Operations)Effluent Streams and the Environment, Revision 1, issued February 1979.

Because no substantive differences between the two units exist in regard to the design and operation of the process and effluent radiological monitoring and sampling system, the NRC staff concludes that the system at WBN Unit 2 meets the requirements in GDC 60, GDC 63, and GDC 64 of Appendix A to 10 CFR Part 50 and the guidelines in RG 1.21, Revision 1; RG 1.97, Revision 2; and the intent and purpose of RG 4.15, Revision 1, and that it is therefore acceptable.

11-12

12 RADIATION PROTECTION 12.1 General In Amendments 92, 95, 97, 98, 99, 100, 101, and 104 to the Watts Bar Nuclear Plant (WBN)

Unit 2 final safety analysis report (FSAR), the Tennessee Valley Authority (TVA) revised the FSAR principally to conform the WBN Unit 2 design basis to the design basis of WBN Unit 1.

The U.S. Nuclear Regulatory Commission (NRC) staff reviewed these amendments against the criteria in Chapter 12, Radiation Protection, of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP); Item II.B.2, Plant Shielding, of NUREG-0737, Clarification of TMI Action Plan Requirements, issued November 1980; and the staff's conclusions in NUREG-0847, Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant, Units 1 and 2, issued June 1982, as modified by supplemental safety evaluation reports (SSERs) 5, 10, 14, and 18.

Shielding is provided to reduce levels of radiation. Ventilation is arranged to control the flow of potentially contaminated air. Radiation monitoring systems are employed to measure levels of radiation in potentially occupied areas and to measure airborne radioactivity throughout the plant. A health physics program is provided for plant personnel and visitors during reactor operation, maintenance, refueling, radioactive waste (radwaste) handling, and inservice inspection. The basis for staff acceptance of the WBN Radiation Protection Program is that doses to personnel will be maintained within the limits of Title 10 of the Code of Federal Regulations (10 CFR) Part 20, Standards for Protection against Radiation, and that TVAs radiation protection designs and program features are consistent with the guidelines of Regulatory Guide (RG) 8.8, Revision 3, Information Relevant to Ensuring that Occupational Radiation Exposures at Nuclear Power Stations Will Be As Low As Is Reasonably Achievable, issued June 1978, 12.2 Ensuring That Occupational Radiation Exposures Are As Low As Reasonably Achievable In FSAR Amendment 92, dated December 18, 2008, TVA made minor editorial changes to the description of policies and procedures in Section 12.1.3, ALARA Operational Considerations.

These changes did not impact the staffs previous safety conclusions in the safety evaluation report (SER) and SSERs and are therefore acceptable.

12.3 Radiation Sources The NRC staff reviewed the changes made by TVA in Amendment 92; Amendment 95, dated November 24, 2009; and Amendment 97, dated January 11, 2010, to WBN Unit 2 FSAR Section 12.2, Radiation Sources. The staff used the guidance of SRP Section 12.2, Radiation Sources, Revision 2, issued July 1981, in its review. The NRC staffs acceptance criteria for Section 12.2 are based, in part, on the relevant requirements of the following regulations:

• 10 CFR 50.34(b)(3), as it pertains to the kinds and quantities of radioactive materials expected to be produced in the operation of WBN Unit 2

• 10 CFR Part 20, Subparts C, Occupational Dose Limits, and D, Radiation Dose Limits for Individual Members of the Public, as they pertain to maintaining exposures to radioactive materials within the occupational and public dose limits, respectively 12-1

• 10 CFR Part 20, Subpart H, Respiratory Protection and Controls To Restrict Internal Exposure in Restricted Areas, as it relates to the control of airborne radioactivity areas

• General Design Criterion (GDC) 61, Fuel Storage and Handling and Radioactivity Control, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, as it relates to systems that contain radioactive materials FSAR Amendments 92 and 95 revised Tables 12.2-19, Estimated Average Airborne Radioactivity Concentrations in the Containment Building, and 12.2-22, Estimated Average Airborne Radioactivity Concentrations in the Instrument Room, with recalculated values for expected airborne radioactivity in the containment building and the instrument room, respectively. TVA recalculated the values to account for an error in the radioactive liquid leak rate assumed in the original calculations and a revised assumption of the temperature difference between the upper and lower levels of containment. The increased temperature difference increases natural circulation flow from the lower to the upper containments, resulting in a somewhat lower expected concentration in the lower containment and a correspondingly higher concentration of airborne radioactivity in the upper containment.

These recalculations did not significantly change the expected overall airborne concentrations in their respective plant areas. The sum of the derived air concentration (DAC) fractions for the lower containment indicates that the expected airborne concentration still exceeds the NRCs definition in 10 CFR Part 20 of an airborne radioactivity area, requiring controls over personnel access consistent with the requirements in Subpart H of 10 CFR Part 20. The total DAC fractions for the upper containment and the instrument room are still each expected to be a fraction of the concentrations that would require controlling them as an airborne radioactivity area. Therefore, these changes did not impact the staffs previous safety conclusion in the SER and SSERs and are therefore acceptable.

FSAR Amendment 95 and Amendment 104, dated June 3, 2011, revised Section 12.2.1.3, Sources During Refueling, and Table 12.2-13, Irradiated In-Core Detector Drive Wire Sources (MEV/CM-SEC), to include a description of the in-core instrumentation thimble assemblies (IITAs) as important radioactive sources during refueling operations, replacing the previous discussion of the in-core detector bottom-mounted instrumentation (BMI) thimble tubes. In its letter dated June 3, 2010, which responded to NRCs Request for Additional Information (RAI) 12-1, TVA stated that the IITAs and BMI thimble tubes would be exposed to the same neutron flux during power operations and therefore would exhibit radiation dose rates of similar magnitude. The radiological hazards posed by this source term change should be no greater than previously described. Therefore, these changes did not impact the staffs previous safety conclusion in the SER and SSERs and they are acceptable.

In FSAR Amendment 100, dated September 1, 2010, TVA revised the description of the control rods in Section 12.2.1.3 by deleting any reference to boron carbide (B4C). As revised, the FSAR indicates that the reactor control rod absorber material is silver-indium-cadmium, with the radiation source strength listed in Table 12.2-14, Irradiated Ag-In-Cd Control Rod Sources.

Because, as indicated in the original FSAR text, B4C is not a significant source of gamma radiation, this change did not impact the staffs previous safety conclusions in the SER and SSERs and it is therefore acceptable.

12-2

12.4 Radiation Protection Design Features The NRC staff reviewed the changes made by TVA in FSAR Amendment 97; Amendment 98, dated May 7, 2010; and Amendment 99, dated May 27, 2010, to Section 12.3, Radiation Protection Design Features. The staff used the guidance of SRP Section 12.3-12.4, Radiation Protection Design Features, Revision 2, issued July 1981, in its review. The NRC staffs acceptance criteria are based, in part, on the relevant requirements of the following regulations:

• 10 CFR 50.34(b)(3), as it pertains to the kinds and quantities of radioactive materials expected to be produced in the operation of WBN Unit 2 and the means for controlling and limiting radioactive effluents and radiation exposures within the limits of 10 CFR Part 20

• 10 CFR Part 20, Subpart F, Surveys and Monitoring, as it pertains to facilities sufficient to support adequate radiation surveys and monitoring and to maintain exposures to radioactive materials within the occupational and public dose limits, respectively

• 10 CFR Part 20, Subpart G, Control of Exposure from External Sources in Restricted Areas, as it pertains to controlling access to high and very high radiation areas

• 10 CFR Part 20, Subpart H, as it relates to the control of airborne radioactivity areas

• GDC 61 of Appendix A to 10 CFR Part 50, as it relates to systems that contain radioactive materials In FSAR Amendments 97 and 98, TVA revised the wording in Section 12.3.1, Facility Design Features, concerning the description of ventilation airflow at WBN. The net change of these revisions did not alter the original design description, which states that the WBN ventilation system provides airflow from cleaner areas to areas with a higher potential for airborne radioactivity, which are, in turn, exhausted to the atmosphere through air cleaning units.

Therefore, these changes did not impact the staffs previous safety conclusion in the SER and SSERs and are therefore acceptable.

In FSAR Amendment 97, TVA revised the discussion of the radiation source term used in the facility design in Section 12.3.1 to conform to the WBN Unit 1 design basis. The radiation source term in plant systems and components during normal operation (tabulated system sources contained in FSAR Section 12.2) are based on the methodology in American National Standards Institute/American Nuclear Society (ANSI/ANS)-18.1-1984, Radioactive Source Terms for Normal Operation of Light Water Reactors. The use of ANSI/ANS-18.1 (formerly ANSI N237) as the basis for the source term assumed in plant design features is consistent with the acceptance criteria in SRP Section 12.2, Revision 2, and does not impact the staffs previous safety conclusion in the SER and SSERs. Therefore, the use of this standard is acceptable.

In FSAR Amendments 97 and 99, TVA revised Section 12.3.2, Shielding, by adding descriptions of additional outside support areas. These areas within the plant protected area are currently within the WBN Unit 1 design basis and available for WBN Unit 2 operations. The area adjacent to the condensate demineralizer waste evaporator building is used for temporary storage of dry active waste. TVA will use administrative controls to limit the dose rates from, and regulate personnel access to, dry active waste containers stored in this area. In addition, a 12-3

decontamination building located within the protected area (see FSAR Figure 2.4-40D-1) is used for the decontamination of small articles, such as tools, equipment, and scrap metals.

Although it will be used for interim storage of the articles being decontaminated, it will not be used for permanent storage of radioactive materials. The decontamination processes employed preclude the generation of liquid wastes. Portable ventilation with monitored, high-efficiency particulate air filtered exhaust is provided to ensure compliance with airborne effluent limits.

These changes did not impact the NRC staffs previous conclusion that the radiation protection design features meet the criteria of the SRP Section 12.3-12.4 in the SER and SSERs and are therefore acceptable.

In FSAR Amendment 97, TVA reformatted the description of the radiation protection design features employed for plant valves and valve operating stations in Section 12.3.3, Ventilation.

Although an extensive editorial change, TVA made no substantial change to the technical information provided. In addition, TVA made several editorial changes to the descriptions of the plant radiation shielding, but made no substantial change to the technical information provided.

Therefore, these changes did not impact the staffs previous safety conclusion in the SER and SSERs and are therefore acceptable.

In FSAR Amendment 97, TVA deleted FSAR Figures 12.3-18 and 12.3-19. These figures contained the drawings of WBN radiation protection design features, including controlled access areas, decontamination areas, and onsite laboratories and counting rooms. In lieu of providing drawings depicting these radiation protection design features, TVA provided a description of each. In response to RAI 12-7 regarding the FSAR changes, TVA provided clarifying information in its letters dated June 3 and October 4, 2010. In its October 4, 2010, letter, TVA stated that the WBN Unit 2 access controls to radiological areas (including contaminated areas),

personnel and equipment decontamination facilities, onsite laboratories and counting rooms, and health physics facilities (including dosimetry issue, respiratory protection bioassay, and radiation protection management and technical staff) are all common to WBN Unit 1.

Furthermore, TVA stated that these facilities are sized and situated properly to support two operating units. Based on TVAs response, the staff concluded that the FSAR changes did not impact the staffs previous safety conclusion, as documented in SSER 18, issued October 1995.

Therefore, the changes are acceptable. TVA should provide an update to the FSAR reflecting the radiation protection design features descriptive information provided in its letter dated October 4, 2010. This is Open Item 112 (Appendix HH).

In FSAR Amendments 97 and 101, TVA revised the frequencies for area radiation monitor calibration and maintenance as described in FSAR Section 12.3.4.1.3, Area Monitor Calibration and Maintenance. Currently, WBN is on an 18-month fuel cycle. TVA changed the frequency for monitor calibrations from at least once per fuel cycle, to at least once per 22.5 months (18 months plus 25%). This change has no practical operational impact since the staff commonly applies a +/-25-percent leeway for completing periodic maintenance activities.

Therefore, the staff finds this change in frequency for monitor calibration acceptable. TVA also changed the frequency for monitor channel operability tests (COTs) from quarterly to periodically.

In response to a staff RAI, TVA provided a calculation in a letter dated June 3, 2010, that purported to provide a statistical basis for setting the COT frequency for several in-plant area radiation monitors based on the operational maintenance history of WBN Unit 1. Although the NRC staff agrees that actual maintenance history can be used as a basis for establishing the frequency of routine maintenance, the staff identified several deficiencies in the calculations provided by TVA. In a July 25, 2011, meeting, TVA stated that it will revise the FSAR to indicate 12-4

that the COT frequency for WBN nonsafety-related area radiation monitors will be performed quarterly or periodically at a frequency consistent with monitor operational maintenance history.

This alternate frequency will be based on test data from monitors of the same type and model as the WBN Unit 2 monitors, operated under similar environmental conditions (e.g., temperature, humidity). A statistical analysis of these data will establish that, at the COT frequency selected, there is at least a 95-percent probability at a 95-percent confidence level (i.e., less than or equal to a 5-percent Type I error (false alarm) and a 5-percent Type II error (failed alarm), respectively) that each monitor will be found within the established as found acceptance criteria in subsequent tests. TVA should provide an update to the FSAR reflecting the justification for the periodicity of the COT frequency for WBN nonsafety-related area radiation monitors described in this paragraph. This is Open Item 113 (Appendix HH).

In FSAR Amendment 97, TVA added two area radiation monitors to the list of monitors for the spent fuel pit area (0-RE-90-102 and 103) in Table 12.3-4, Location of Plant Area Radiation Monitors. Each monitor uses a Geiger-Mueller type gamma detector, with its own independent high-voltage power supply and a range of 1x10-1 to 1x104 milliroentgen per hour. Visual and audible alarms are provided in the control room upon detection of high radiation or instrument malfunction. In addition, visual and audible alarms are provided that annunciate locally upon detection of high radiation. These two monitors are located on opposite sides of the 757-foot elevation of the auxiliary building and, with the existing area monitors (1-RE-90-1 and 2-RE-90-1), alert personnel in the vicinity of the fuel storage areas of excessive radiation for personnel protection and to initiate safety actions. The staff concludes that WBN meets the radiation monitoring requirements of 10 CFR 50.68, Criticality Accident Requirements, and is therefore acceptable. TVA should update the FSAR to state that WBN meets the radiation monitoring requirements of 10 CFR 50.68. This is Open Item 114 (Appendix HH).

In FSAR Amendment 97, TVA revised the description of the auxiliary building airborne monitoring channels in Section 12.3.4.2, Airborne Particulate Radioactivity Monitoring, and Table 12.3-5, Airborne Particulate Activity Monitoring Channels. Airborne contamination in normally occupied areas of the auxiliary building is monitored with the particulate and iodine channels of the auxiliary building ventilation monitor. Each channel is capable of detecting an integrated change in airborne radioactivity equal to 10 DAC hours (listed in Appendix B, Annual Limits on Intake (ALIs) and Derived Air Concentrations (DACs) of Radionuclides for Occupational Exposure; Effluent Concentrations; Concentrations for Release to Sewerage, to 10 CFR Part 20) in the area monitored, taking into account dilution in the ventilation system flow. Portable continuous air monitors are provided for the spent fuel pool area, the holdup valve gallery general area, the safety injection pump general area, and the waste packing area shipping bay, as listed in FSAR Table 12.3-4. The four channels of air monitoring provided in these frequently occupied areas have visual and audible alarms that indicate locally and in the control room upon detection of high radiation or monitor malfunction. The monitor reading outputs for these four channels are recorded on a common, multipoint recorder in the control room. Each monitor is provided with emergency power to ensure operation during loss of power conditions. Locally alarming, fixed-filter, portable continuous air monitors, with a range from 0.1 to 100 DAC, are also provided for the less frequently occupied WBN Unit 1 hot sample room and the waste packing area, in addition to the control room and the WBN Unit 2 hot sample room locations addressed in SSER 18. By letter dated February 25, 2011, TVA stated that the portable monitors, as listed in Table 12.3-4, are calibrated every 6 months and source checked weekly to ensure adequate monitor performance.

These changes to the auxiliary building airborne monitoring reflect the current operational configuration of WBN Unit 1. They do not alter the staffs conclusion in SSER 18 that use of 12-5

portable continuous airborne monitors is acceptable and that the licensee meets the monitoring requirements in 10 CFR 20.1501, General.

12.5 Dose Assessment The NRC staff reviewed the changes made by TVA in Amendment 95 to Section 12.4, Dose Assessment, of the WBN Unit 2 FSAR and evaluated the changes using the relevant requirements of 10 CFR 50.34(b)(3) as they pertain to the kinds and quantities of radioactive materials expected to be produced in the operation of WBN Unit 2 and the means for controlling and limiting radioactive effluents and radiation exposures within the limits of 10 CFR Part 20.

The staff also referred to the acceptance criteria provided in the guidance of SRP Section 12.3-12.4, Revision 2, and the specific guidance on radiation exposure dose assessments provided in RG 8.19, Revision 1, Occupational Radiation Dose Assessment in Light-Water Reactor Power PlantsDesign Stage Man-Rem Estimates, issued June 1979.

Amendment 95 revised FSAR Section 12.4 to estimate the radiation exposure expected with the operation of WBN Unit 2. In lieu of a detailed prospective estimate of occupational radiation exposures, and consistent with the guidance RG 8.19, TVA has estimated the expected annual collective dose for WBN Unit 2 based on the actual radiation exposures experienced in the operating WBN Unit 1. Since WBN Units 1 and 2 are nearly identical designs that share many radiation protection facilities, as well as program infrastructure, the staff finds that the use of the WBN Unit 1 exposure data to estimate the expected dose impact of operating WBN Unit 2 is technically sound and acceptable.

Occupational radiation exposure data from 1997 to 2007 reported for WBN Unit 1 by TVA in its annual occupational radiation exposure reports (available in the NRCs Agencywide Documents Access and Management System) indicate an annual average collective dose of 82 person-rem (or 98 person-rem, if the 180 person-rem steam generator replacement from the 2006 outage is included). This exposure history is comparable to the collective dose average for all pressurized-water reactors during that same time period (i.e., 91 person-rem, as derived from Table 4.2 of NUREG-0713, Volume 29, Occupational Radiation Exposure at Commercial Nuclear Power Reactors and Other Facilities, 2007, Fortieth Annual Report).

TVA stated in its letter dated June 3, 2010, that it expects WBN Unit 2 exposures to be lower than the WBN Unit 1 experience because of a number of design changes that will be implemented for WBN Unit 2 before power operations. By implementing these design changes before power operations, WBN Unit 2 will benefit from the associated lower radiation levels in the preoperational plant. In addition, many of these design changes will be implemented in whole or in part specifically for dose reduction purposes during normal plant operations. These changes include (1) removal of the reactor coolant system resistance temperature detector bypass system, (2) installation of reactor vessel head shielding, (3) implementation of reactor coolant zinc injection, (4) steam generator channel head polishing/electropolishing, (5) restoration of shield wall penetrations with high density elastomeric sealant, (6) rerouting chemical and volume control system letdown piping from accessible areas, and (7) addition of polar crane wall door shielding.

Based on the information provided by TVA in its letter to the NRC dated June 3, 2010, and because historical experience has demonstrated that the average annual collective dose to operate WBN Unit 1 was less than 100 person-rem, the staff concludes that there is reasonable assurance that WBN Unit 2 can be operated at or below 100 person-rem average annual collective dose. Therefore, FSAR Section 12.4 is acceptable. TVA should update the FSAR to 12-6

reflect the information regarding design changes to be implemented to lower radiation levels, as provided in its letter to the NRC dated June 3, 2010. This is Open Item 115 (Appendix HH).

12.6 Health Physics Program The NRC staff reviewed the changes made by TVA in Amendments 97 and 98 to Section 12.5, Radiation Protection Program, of the WBN Unit 2 FSAR and evaluated the changes using the relevant requirements of the following regulations:

• 10 CFR 50.34(b)(3), as it pertains to the kinds and quantities of radioactive materials expected to be produced in the operation of WBN Unit 2 and the means for controlling and limiting radioactive effluents and radiation exposures within the limits of 10 CFR Part 20

• 10 CFR 20.1101, Radiation Protection Programs, as it pertains to implementing radiation protection programs sufficient to ensure compliance with 10 CFR Part 20 requirements and to ensure that occupational doses and doses to members of the public are as low as reasonably achievable

• 10 CFR Part 20, Subpart F, as it pertains to providing adequate radiation survey and monitoring programs sufficient to support maintaining doses from exposures to radioactive materials within the occupational and public dose limits

• 10 CFR Part 20, Subpart G, as it pertains to controlling access to high and very high radiation areas

• 10 CFR Part 20, Subpart H, as it relates to the control of airborne radioactivity areas The staff also referred to the acceptance criteria provided in the guidance of SRP Section 12.5, Revision 2, Operational Radiation Protection Program, issued July 1981.

In FSAR Amendment 95, TVA made several editorial changes to FSAR Section 12.5 resulting from organizational changes at WBN. With the exception of the following two issues, these did not impact the staffs previous safety conclusion, as documented in SSER 14, issued December 1994, and are therefore acceptable. The remaining two issues are related to the qualifications of the radiation protection manager (RPM). FSAR Section 12.5.1 states that, The minimum qualification requirements for the Radiation Protection Manager are stated in Section 13.1.3. FSAR Section 13.1.3 states that, Nuclear Power (NP) personnel at the Watts Bar plant will meet the qualification and training requirements of NRC Regulatory Guide 1.8 with the alternatives as outlined in the Nuclear Quality Assurance Plan, TVA-NQA-PLN89-A.

Specifically, TVA modified its commitment to the personnel qualification standards in RG 1.8, Qualification and Training of Personnel for Nuclear Power Plants, by adding the caveat, with the alternatives as outlined in the Nuclear Quality Assurance Plan. It was unclear to the staff whether or not TVA was committed to (1) the requirement that the RPM have 5 years of professional experience and (2) the 3-month time limit on temporarily assigning an RPM who does not meet the RPM qualifications (ANSI/ANS-3.1-1981, Selection, Qualification and Training of Personnel for Nuclear Power Plants, as referenced in RG 1.8). In response to RAIs 12-13 and 12-14, TVA clarified in its letter to the NRC dated October 4, 2010, that it will meet the requirements of RG 1.8, Revision 2, and ANSI/ANS-3.1-1981 for all new personnel qualifying on positions identified in RG 1.8, Regulatory Position C.1, after January 1, 1990.

12-7

These changes are consistent with the staffs acceptance criteria 12.5.A of SRP Section 12.5 as they pertain to staff qualifications and are, therefore, acceptable. TVA should update the FSAR to reflect the qualification standards of the RPM as provided in its letter to the NRC dated October 4, 2010. This is Open Item 116 (Appendix HH).

12.7 NUREG-0737 Items 12.7.1 Plant Shielding (II.B.2)

NUREG-0737, Item II.B.2, states, in part, that Each licensee shall provide for adequate access to vital areas and protection of safety equipment by design changes, increased permanent or temporary shielding, or postaccident procedural controls. GDC 19, Control Room, of Appendix A to 10 CFR Part 50, requires, in part, that, Adequate radiation protection shall be provided to permit access and occupancy of the control room under accident conditions...Equipment at appropriate locations outside the control room shall be provided (1) with a design capability for prompt hot shutdown of the reactor.

In FSAR Amendment 97, TVA revised the list in FSAR Section 12.3.2.2, Design Description, of postaccident activities that require personnel access to vital areas of the plant, adding three and deleting the activities at the postaccident sampling facility. TVA added activities regarding (1) control or verification functions in the motor-generator set room or the 480-volt shutdown board room, or both, (2) installing the component cooling system/essential raw cooling water spool piece, and (3) refilling the refueling water storage tank following a loss-of-coolant accident. Operation of the postaccident sampling system (PASS) was deleted, since emergency operating procedures no longer rely on the results of a primary coolant sample during an accident, and technical specifications no longer require the operability of the PASS.

The staff requested information on the dose consequences of the vital missions discussed in Section 12.3.2.2, including plant layout drawings depicting radiation zones during accident conditions and access/egress routes. By letters dated June 3 and December 10, 2010, TVA provided dose calculations and plant layout drawings depicting the access to, and egress from, WBN vital areas. TVA supplemented this information in a letter to the NRC dated February 25, 2011. TVAs commitments to clarify the calculational basis and establish corresponding implementing procedures for access to these vital areas, as stated in its February 25, 2011, letter, are subject to verification by NRC inspection.

The staff concludes that TVA has demonstrated, by design calculations, that the actions necessary to mitigate the consequences of a design-basis accident at WBN Unit 2 can be performed such that occupational doses to plant operators are maintained within the dose criteria of GDC 19, as required by NUREG-0737, Item II.B.2. Therefore, the staff concludes that the shielding design for WBN Unit 2 is acceptable. TVA should update the FSAR to reflect the calculational basis for access to vital areas as provided in its letter dated February 25, 2011.

This is Open Item 117 (Appendix HH).

12-8

13 CONDUCT OF OPERATIONS 13.6 Physical Security 13.6.6 Cyber Security Plan 13.6.6.1 Introduction By letter dated July 23, 2010 (Agency-wide Documents Access and Management System (ADAMS) Accession No. ML102090051), supplemented by letters dated October 1, 2010, April 7, 2011, June 10, 2011, and August 4, 2011 (ADAMS Accession Nos. ML102790047, ML111080066, ML111650641, and ML11222A104), the Tennessee Valley Authority (TVA, or the applicant) submitted a Cyber Security Plan (CSP) and a proposed implementation schedule required by Title 10 of the Code of Federal Regulations (10 CFR) Section 73.54 (Reference 1).

On April 7, 2011 (ADAMS Accession No. ML111080066), the applicant supplemented its CSP to address (1) scope of systems in response to the October 21, 2010 Commission decision (Reference 5); (2) records retention; and (3) implementation schedule. The applicant submitted a Revision 0 of the CSP incorporating all of the changes and/or additional information.

13.6.6.2 Regulatory Basis General Requirements Consistent with 10 CFR 73.54(a), the applicant must provide high assurance that digital computer and communication systems, and networks are adequately protected against cyber attacks, up to and including the design basis threat (DBT), as described in 10 CFR 73.1. The applicant shall protect digital computer and communication systems and networks associated with: (i) safety-related and important-to-safety functions; (ii) security functions; (iii) emergency preparedness functions, including offsite communications; and (iv) support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions. The Rule specifies that digital computer and communication systems and networks associated with these functions must be protected from cyber attacks that would adversely impact the integrity or confidentiality of data and software; deny access to systems, services, or data; or provide an adverse impact to the operations of systems, networks, and associated equipment.

In the October 21, 2010, Staff Requirements Memorandum (SRM)-COMWCO-10-0001, the Commission stated that the NRCs cyber security rule at 10 CFR 73.54 should be interpreted to include structures, systems, and components (SSCs) in the balance of plant (BOP) that have a nexus to radiological health and safety. The staff determined that SSCs in the BOP that have a nexus to radiological health and safety are those that could directly or indirectly affect reactivity of a nuclear power plant (NPP), and are therefore within the scope of important-to-safety functions described in 10 CFR 73.54(a)(1).

Elements of a Cyber Security Plan As stated in 10 CFR 73.54(e), the applicant must establish, implement, and maintain a CSP that satisfies the Cyber Security Program requirements of this regulation. In addition, the CSP must describe how the applicant will implement the requirements of the regulation and must account for the site-specific conditions that affect implementation. One method of complying with this regulation is to describe within the CSP how the applicant has achieved high assurance that all 13-1

digital computer and communication systems and networks associated with safety, security, and emergency preparedness (SSEP) functions are protected from cyber attacks.

Regulatory Guide 5.71 and Nuclear Energy Institute (NEI) 08-09, Revision 6 Regulatory Guide (RG) 5.71, Cyber Security Programs for Nuclear Facilities, (Reference 2) describes a regulatory position that promotes a defensive strategy consisting of a defensive architecture and a set of security controls based on standards provided in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Recommended Security Controls for Federal Information Systems and Organizations and NIST SP 800-82, Guide to Industrial Control Systems Security, dated September 29, 2008. NIST SP 800-53 and SP 800-82 are based on well-understood cyber threats, risks, and vulnerabilities, coupled with equally well-understood countermeasures and protective techniques. RG 5.71 divides the above-noted security controls into three broad categories: technical, operational, and management.

RG 5.71 provides a framework to aid in the identification of those digital assets that applicants must protect from cyber attacks. These identified digital assets are referred to as critical digital assets (CDAs). Applicants should address the potential cyber security risks to CDAs by applying the defensive architecture and addressing the collection of security controls identified in RG 5.71. RG 5.71 includes a CSP template that provides one method for preparing an acceptable CSP.

The NRC staff stated in a letter (

Subject:

Nuclear Energy Institute [NEI] 08-09, Cyber Security Plan Template, Revision 6), dated May 5, 2010 (ADAMS Accession No. ML101190371), that the applicant may use the template in NEI 08-09, Revision 6 (Reference 3), to prepare an acceptable CSP, with the exception of the definition of cyber attack. The NRC staff subsequently reviewed and approved by letter dated June 7, 2010 (ADAMS Accession No. ML101550052), a definition for cyber attack to be used in submissions based on NEI 08-09, Revision 6 (Reference 4). The applicant submitted a CSP for WBN Unit 2 that was based on the template provided in NEI 08-09, Revision 6 and included a definition of cyber attack acceptable to the NRC staff in the deviation table which was referenced as an Attachment to Enclosure 3 within the CSP package. The deviation lists the location of the term cyber attack within the NEI 08-09, Revision 6 template; the original NEI 08-09 definition; the definition used by the WBN Unit 2 CSP; and the source of the latest definition, as provided by the NRC. Additionally, the applicant submitted a supplement to its CSP on April 7, 2011, to include information on SSCs in the BOP that, if compromised, could affect NPP reactivity.

RG 5.71 and NEI 08-09, Revision 6 are comparable documents; both are based on essentially the same general approach and same set of technical, operational, and management security controls. The submitted CSP was reviewed against the corresponding sections in RG 5.71.

13.6.6.3 Technical Evaluation The NRC staff performed a technical evaluation of the applicants submittal. The applicants submittal conformed to the guidance in NEI 08-09, Revision 6, which was found to be acceptable by the NRC staff and comparable to RG 5.71 to satisfy the requirements contained in 10 CFR 73.54. The staff reviewed the applicants submittal against the requirements of 10 CFR 73.54 following the guidance contained in RG 5.71. The staffs evaluation of each section of TVAs submittal is discussed below.

13-2

13.6.6.3.1 Scope and Purpose The applicants CSP establishes a means to achieve high assurance that digital computer and communication systems and networks associated with the following functions are adequately protected against cyber attacks up to and including the design basis threat (DBT):

1. Safety-related and important-to-safety functions;

2. Security functions;

3. Emergency preparedness functions, including offsite communications; and

4. Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.

The submitted CSP describes achievement of high assurance of adequate protection of systems associated with the above functions from cyber attacks by:

• Implementing and documenting the baseline security controls as described in Section 3.1.6 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.3 described in RG 5.71; and

• Implementing and documenting a Cyber Security Program to maintain the established cyber security controls through a comprehensive life cycle approach as described in Section 4 of NEI 08-09, Revision 6, which is comparable to Appendix A, Section A.2.1 of RG 5.71.

The staff noted that in its submittal dated April 7, 2011, the applicant indicated that the scope of systems includes those BOP SSCs that have an impact on NPP reactivity, if compromised and is consistent with SRM-COMWCO-10-0001.

The NRC staff reviewed the above information and found no deviation from Regulatory Position C.3.3 in RG 5.71 and Appendix A, Section A.2.1 of RG 5.71. The NRC staff finds that the applicant established adequate measures to implement and document the Cyber Security Program, including baseline security controls. Based on the above, the NRC staff finds that the CSP adequately establishes the Cyber Security Program, including baseline security controls.

13.6.6.3.2 Analyzing Digital Computer Systems and Networks and Applying Cyber Security Controls The applicants CSP states that the Cyber Security Program is established, implemented, and maintained as described in Section 3.1 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3 described in RG 5.71 to:

• Analyze digital computer and communications systems and networks, and

• Identify those assets that must be protected against cyber attacks to satisfy 10 CFR 73.54(a).

The submitted CSP describes how the cyber security controls in Appendices D and E of NEI 08-09, Revision 6, which are comparable to Appendices B and C in RG 5.71, are addressed to protect CDAs from cyber attacks.

13-3

This section is comparable to Regulatory Position C.3 in RG 5.71 without deviation. Based on the above, the NRC staff finds that the CSP adequately addresses security controls.

13.6.6.3.3 Cyber Security Assessment and Authorization The applicant provided information addressing the creation of a formal, documented, cyber security assessment and authorization policy. This included a description concerning the creation of a formal, documented procedure comparable to Section 3.1.1 of NEI 08-09, Revision 6.

The applicant established measures to define the purpose, scope, roles, responsibilities, management commitment, and coordination, and to facilitate the implementation of the cyber security assessment and authorization policy.

The applicant listed several organizational functions that are involved in the coordination of the policy components (scope, roles, responsibilities, etc.). These functions include Engineering, Computer Engineering, Operations, Security and Emergency Preparedness. However, the applicant fails to indicate which type of plant/enterprise organizational entities implement these functions (i.e., offices, divisions, departments, branches, etc.). The Regulatory Position C.3.1.1 in RG 5.71 notes that the required coordination for policy is accomplished among applicant departments. Since the WBN Unit 2 CSP specifically mentions discreet organizational functions that will be involved in the coordination of policy components, it is apparent the applicant intends to meet the requirements for security assessment. Therefore, this deviation is acceptable.

Based on the above, the NRC staff finds that the CSP adequately established controls to develop, disseminate, and periodically update the cyber security assessment and authorization policy and implementing procedure.

13.6.6.3.4 Cyber Security Assessment Team The Cyber Security Assessment Team (CSAT) responsibilities include conducting the cyber security assessment, documenting key findings during the assessment, and evaluating assumptions and conclusions about cyber security threats. The submitted CSP outlines the requirements, roles and responsibilities of the CSAT comparable to Section 3.1.2 of NEI 08-09, Revision 6. It also describes that the CSAT has the authority to conduct an independent assessment.

The submitted CSP describes that the CSAT will consist of individuals with knowledge about information and digital systems technology; nuclear power plant operations, engineering, and plant technical specifications; and physical security and emergency preparedness systems and programs. The CSAT description in the CSP is comparable to Regulatory Position C.3.1.2 in RG 5.71.

The submitted CSP lists the roles and responsibilities for the CSAT which included performing and overseeing the cyber security assessment process; documenting key observations; evaluating information about cyber security threats and vulnerabilities; confirming information obtained during tabletop reviews, walk-downs, or electronic validation of CDAs; and identifying potential new cyber security controls.

13-4

This section is comparable to Regulatory Position C.3.1.2 in RG 5.71 without deviation. Based on the above, the NRC staff finds that the CSP adequately establishes the requirements, roles and responsibilities of the CSAT.

13.6.6.3.5 Identification of Critical Digital Assets The submitted CSP describes that the applicant will identify and document critical digital assets (CDA) and critical systems, including a general description, the overall function, the overall consequences if a compromise were to occur, and the security functional requirements or specifications as described in Section 3.1.3 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.1.3 of RG 5.71. Based on the above, the NRC staff finds that the CSP adequately describes the process to identify CDAs.

13.6.6.3.6 Examination of Cyber Security Practices The submitted CSP describes how the CSAT will examine, and document the existing cyber security policies, procedures, and practices; existing cyber security controls; detailed descriptions of network and communication architectures (or network/communication architecture drawings); information on security devices; and any other information that may be helpful during the cyber security assessment process as described in Section 3.1.4 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.1.2 of RG 5.71. The examinations will include an analysis of the effectiveness of the existing Cyber Security Program and cyber security controls. The CSAT will document the collected cyber security information and the results of their examination of the collected information.

This section is comparable to Regulatory Position C.3.1.4 in RG 5.71 without deviation. Based on the above, the NRC staff finds that the CSP adequately describes the examination of cyber security practices.

13.6.6.3.7 Tabletop Reviews and Validation Testing The submitted CSP describes tabletop reviews and validation testing, which confirm the direct and indirect connectivity of each CDA and identify direct and indirect pathways to CDAs. The CSP states that validation testing will be performed electronically or by physical walkdowns.

The applicants plan for tabletop reviews and validation testing is comparable to Section 3.1.5 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.1.4 of RG 5.71. Based on the above, the NRC staff finds that the CSP adequately describes tabletop reviews and validation testing.

13.6.6.3.8 Mitigation of Vulnerabilities and Application of Cyber Security Controls The submitted CSP describes the use of information collected during the cyber security assessment process (e.g., disposition of cyber security controls, defensive models, defensive strategy measures, site and corporate network architectures) to implement security controls in accordance with Section 3.1.6 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.3 and Appendix A.3.1.6 to RG 5.71. The CSP describes the process that will be applied in cases where security controls cannot be implemented.

The submitted CSP notes that before the applicant can implement security controls on a CDA, it will assess the potential for adverse impact in accordance with Section 3.1.6 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.3 of RG 5.71. Based on the above, 13-5

the NRC staff finds that the CSP adequately describes mitigation of vulnerabilities and application of security controls.

13.6.6.3.9 Incorporating the Cyber Security Program into the Physical Protection Program The submitted CSP states that the Cyber Security Program will be reviewed as a component of the Physical Security Program in accordance with the requirements of 10 CFR 73.55(m). This is comparable to Section 4.1 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.4 of RG 5.71.

This section is comparable to Appendix A, Section A.3.2 in RG 5.71 without deviation. Based on the above, the NRC staff finds that the CSP adequately describes review of the CSP as a component of the physical security program.

13.6.6.3.10 Cyber Security Controls The submitted CSP describes how the technical, operational and management cyber security controls contained in Appendices D and E of NEI 08-09 Revision 6, which are comparable to Appendices B and C in RG 5.71, are evaluated and dispositioned based on site specific conditions during all phases of the Cyber Security Program. The CSP describes that many security controls have actions that are required to be performed on specific frequencies and that the frequency of a security control is satisfied if the action is performed within 1.25 times the frequency specified in the control, as applied, and as measured from the previous performance of the action as described in Section 4.2 of NEI 08-09, Revision 6.

This section is comparable to Appendix A, Section A.3.1.6 in RG 5.71 without deviation. Based on the above, the NRC staff finds that the CSP adequately describes implementation of cyber security controls.

13.6.6.3.11 Defense-in-Depth Protective Strategies The submitted CSP describes the implementation of defensive strategies that ensure the capability to detect, respond to, and recover from a cyber attack. The CSP specifies that the defensive strategies consist of security controls, defense-in-depth measures, and the defensive architecture. The submitted CSP notes that the defensive architecture establishes the logical and physical boundaries to control the data transfer between these boundaries.

The applicant established defense-in-depth strategies by: implementing and documenting a defensive architecture as described in Section 4.3 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.2 in RG 5.71; a physical security program, including physical barriers; the operational and management controls described in Appendix E of NEI 08-09, Revision 6, which is comparable to Appendix C to RG 5.71; and the technical controls described in Appendix D of NEI 08-09, Revision 6, which is comparable to Appendix B to RG 5.71.

Regulatory Position C.3.2.1 in RG 5.71 describes a defensive architecture that includes five concentric cyber security defensive levels separated by security boundaries, such as firewalls and diodes, at which digital communications are monitored and restricted. Systems requiring the greatest degree of security are located within a greater number of boundaries. According to the Regulatory Position C.3.2.1 in RG 5.71, only one-way data flows are allowed from Level 4 to Level 3 and from Level 3 to Level 2. (In this architecture, Level 4 is the most secure level; 13-6

Level 3 is the next most secure level; and so on, reaching Level 0, which has the least protections accorded for digital assets and systems.) The submitted CSP covers both deterministic and non-deterministic information flows between Levels 3 and 4. However, the CSP allows only deterministic (diode or air gap) one-way flows from Level 3 to Level 2, effectively isolating Levels 3 and 4 from the lower levels. Information flows between Level 3 and Level 4 are restricted through the use of either (1) one or more deterministic devices (data diodes or air gaps) that Isolate CDAs in Level 4; or (2) firewall(s) and network-based intrusion detection system(s) that implement the Information Flow Enforcement cyber security control in NEI 08-09, Revision 6, Appendix D, Section 1.4 and the rule set characteristics for non-deterministic information flow enforcement described in the Defense-in-Depth cyber security control In NEI 08-09, Revision 6, Appendix E, Section 6 using the guidance in Section 3.1.6 of the CSP.

Based on the above, the NRC staff finds that the CSP adequately describes implementation of defense-in-depth protective strategies.

13.6.6.3.12 Ongoing Monitoring and Assessment The submitted CSP describes how ongoing monitoring of cyber security controls to support CDAs is implemented comparable to Appendix E of NEI 08-09, Revision 6, which is comparable to Regulatory Positions C.4.1 and C.4.2 of RG 5.71. The ongoing monitoring program includes configuration management and change control; cyber security impact analysis of changes and changed environments; ongoing assessments of cyber security controls; effectiveness analysis (to monitor and confirm that the cyber security controls are implemented correctly, operating as intended, and achieving the desired outcome) and vulnerability scans to identify new vulnerabilities that could affect the security posture of CDAs.

This section is comparable to Regulatory Position C.4.1 and C.4.2 of RG 5.71 without deviation.

Based on the above, the NRC staff finds that the CSP adequately describes ongoing monitoring and assessment.

13.6.6.3.13 Modification of Digital Assets The submitted CSP describes how cyber security controls are established, implemented, and maintained to protect CDAs. These security controls ensure that modifications to CDAs are evaluated before implementation, that the cyber security performance objectives are maintained, and that acquired CDAs have cyber security requirements in place to achieve the sites Cyber Security Program objectives. This is comparable to Section 4.5 of NEI 08-09, Revision 6, which is comparable to Appendices A.4.2.5 and A.4.2.6 of RG 5.71.

Based on the above, the NRC staff finds that the CSP adequately describes modification of digital assets.

13.6.6.3.14 Attack Mitigation and Incident Response The submitted CSP describes the process to ensure that SSEP functions are not adversely impacted due to cyber attacks in accordance with Section 4.6 of NEI 08-09, Revision 6, which is comparable to Appendix C, Section C.8 of RG 5.71. The CSP includes a discussion about creating incident response policy and procedures, and addresses training, testing and drills, incident handling, incident monitoring, and incident response assistance. It also describes 13-7

identification, detection, response, containment, eradication, and recovery activities comparable to Section 4.6 of NEI 08-09, Revision 6.

This section is comparable to Appendix C, Section C.8 of RG 5.71 without deviation. Based on the above, the NRC staff finds that the CSP adequately describes attack mitigation and incident response such that there is high assurance of attack mitigation and incident response.

13.6.6.3.15 Cyber Security Contingency Plan The submitted CSP describes creation of a Cyber Security Contingency Plan and policy that protects CDAs from the adverse impacts of a cyber attack described in Section 4.7 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.3.2.7 and Appendix C.9 of RG 5.71. The applicant describes the Cyber Security Contingency Plan that would include the response to a cyber attack. The plan includes procedures for operating CDAs in a contingency, roles and responsibilities of responders, processes and procedures for backup and storage of information, logical diagrams of network connectivity, current configuration information, and personnel lists for authorized access to CDAs.

This section is comparable to Regulatory Position C.3.3.2.7 of RG 5.71 without deviation.

Based on the above, the NRC staff finds that the CSP adequately describes the cyber security contingency plan.

13.6.6.3.16 Cyber Security Training and Awareness The submitted CSP describes a program that establishes the training requirements necessary for the applicants personnel and contractors to perform their assigned duties and responsibilities in implementing the Program in accordance with Section 4.8 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.3.2.8 of RG 5.71.

The CSP states that individuals will be trained with a level of cyber security knowledge commensurate with their assigned responsibilities in order to provide high assurance that individuals are able to perform their job functions in accordance with Appendix E of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.3.2.8 of RG 5.71 and describes three levels of training: awareness training, technical training, and specialized cyber security training.

Based on the above, the NRC staff finds that the CSP adequately describes the cyber security training and awareness.

13.6.6.3.17 Evaluate and Manage Cyber Risk The submitted CSP describes how cyber risk is evaluated and managed utilizing site programs and procedures comparable to Section 4.9 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.4 and Appendix C, Section C.13 of RG 5.71. The CSP describes the Threat and Vulnerability Management program, Risk Mitigation, Operational Experience Program; and the Corrective Action Program and how each will be used to evaluate and manage risk.

13-8

This section is comparable to Regulatory Position C.4 and Appendix C, Section C.13 of RG 5.71 without deviation. Based on the above, the NRC staff finds that the CSP adequately describes evaluation and management of cyber risk.

13.6.6.3.18 Policies and Implementing Procedures The CSP describes development and implementation of policies and procedures to meet security control objectives in accordance with Section 4.10 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.5 and Appendix A, Section A.3.3 of RG 5.71. This includes the process to document, review, approve, issue, use, and revise policies and procedures.

The CSP also describes the applicants procedures to establish specific responsibilities for positions described in Section 4.11 of NEI 08-09, Revision 6, which is comparable to Appendix C, Section C.10.10 of RG 5.71.

This section is comparable to Regulatory Position C.3.5, Appendix A, Section A.3.3, and Appendix C, Section C.10.10 of RG 5.71 without deviation. Based on the above, the NRC staff finds that the CSP adequately describes cyber security policies and implementing procedures.

13.6.6.3.19 Roles and Responsibilities The submitted CSP describes the roles and responsibilities for the qualified and experienced personnel, including the Cyber Security Program Sponsor, the Cyber Security Program Manager, Cyber Security Specialists, the Cyber Security Incident Response Team (CSIRT), and other positions as needed. The CSIRT takes action in accordance with the Incident Response Plan when required to safeguard CDAs from cyber security compromise and to assist with the eventual recovery of compromised systems. Implementing procedures establish roles and responsibilities for each of the cyber security roles in accordance with Section 4.11 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.3.1.2, Appendix A, Section A.3.1.2, and Appendix C, Section C.10.10 of RG 5.71.

Based on the above, the NRC staff finds that the CSP adequately describes cyber security roles and responsibilities.

13.6.6.3.20 Cyber Security Program Review The submitted CSP describes how the Cyber Security Program establishes the necessary procedures to implement reviews of applicable program elements in accordance with Section 4.12 of NEI 08-09, Revision 6, which is comparable to Regulatory Position C.4.3 and Appendix A, Section A.4.3 of RG 5.71.

Based on the above, the NRC staff finds that the CSP adequately describes Cyber Security Program review.

13.6.6.3.21 Document Control and Records Retention and Handling The submitted CSP describes that the applicant has established the necessary measures and governing procedures to ensure that sufficient records of items and activities affecting cyber security are developed, reviewed, approved, issued, used, and revised to reflect completed work. The CSP described that superseded portions of certain records will be retained for at 13-9

least three years after the record is superseded, while audit records will be retained for no less than 12 months in accordance with Section 4.13 of NEI 08-09, Revision 6. However, this guidance provided by industry to applicants did not fully comply with the requirements of 10 CFR 73.54.

In a letter dated February 28, 2011 (ADAMS Accession No. ML110600204), NEI sent to NRC proposed language for applicants use to respond to the generic records retention issue, to which the NRC had no technical objection (Ref: Letter from NRC dated March 1, 2011, ADAMS Accession No. ML110490337). The proposed language clarified the requirement by providing examples (without providing an all-inclusive list) of the records and supporting technical documentation that are needed to satisfy the requirements of 10 CFR 73.54. All records will be retained until the Commission terminates the license, and the applicant shall maintain superseded portions of these records for at least three (3) years after the record is superseded, unless otherwise specified by the Commission. By retaining accurate and complete records and technical documentation until the license is terminated, inspectors, auditors, or assessors will have the ability to evaluate incidents, events, and other activities that are related to any of the cyber security elements described, referenced, and contained within the applicants NRC-approved CSP. It will also allow the applicant to maintain the ability to detect and respond to cyber attacks in a timely manner, in the case of an event. In a letter dated April 7, 2011 (ADAMS Accession No. ML111080066), the applicant responded to the records retention issue using the language proposed by NEI. Therefore, the staff finds this deviation from NEI 08-09, Revision 6 to be acceptable.

This section is comparable to Regulatory Position C.5 and Appendix A, Section A.5 of RG 5.71 without deviation. Based on the above, the NRC staff finds that the CSP adequately describes cyber security document control and records retention and handling.

13.6.6.3.22 Implementation Schedule The submitted CSP provides a proposed implementation schedule for the Cyber Security Program. In a letter dated February 28, 2011 (ADAMS Accession No. ML110600206), NEI sent to NRC a template for applicants to use to submit their CSP implementation schedules, to which the NRC had no technical objection (Ref: Letter from NRC dated March 1, 2011, ADAMS Accession No. ML110070348). These key milestones include:

• Establish the Cyber Security Assessment Team (CSAT);

• Identify CSs and CDAs;

• Install a deterministic one-way device between lower level devices and higher level devices;

• Implement the security control Access Control For Portable And Mobile Devices;

• Implement observation and identification of obvious cyber related tampering to existing insider mitigation rounds by incorporating the appropriate elements;

• Identify, document, and implement cyber security controls as per Mitigation of Vulnerabilities and Application of Cyber Security Controls for CDAs that could adversely impact the design function of physical security target set equipment;

• Commence ongoing monitoring and assessment activities for those target set CDAs whose security controls have been implemented.

On May 10, 2011, the NRC staff met with the applicant to discuss the WBN Unit 2 implementation schedule. In a letter dated June 10, 2011 (ADAMS Accession No.

13-10

ML111650641), the applicant provided a revised implementation schedule using the NEI template. The NRC staff considers this June 10, 2011, supplement the approved schedule for WBN Unit 2 as required by 10 CFR 73.54. In this letter, TVA took exception to meeting the last three milestones of the NEI template prior to Fuel Load and Reactor Startup (Milestone #6b -

Implement NEI 08-09 Revision 6 Appendix D technical cyber security controls ; Milestone #7

- Ongoing monitoring and assessment activities commence; Milestone #8 - Full implementation of WBN Unit 2 CSP for all SSEP functions). The applicants implementation schedule submittal stated that an upgrade to two systems common to the operations of both WBN Unit 1 and WBN Unit 2 would not be deployed prior to the WBN Unit 2 Fuel Load and Reactor Startup. These are: (a) the Security Computer system and (b) the corporate-wide emergency preparedness system(s). The current Security Computer system supports the plants physical security operations, and is being replaced by a new version, which will not be installed until after the scheduled WBN Unit 2 startup. The emergency preparedness system(s) are corporate based and interface with the applicants fleet nuclear operations. The emergency preparedness systems include the emergency notification system, prompt notification system, telephone system, dose assessment system, and the Central Emergency Control Center.

Modification of these fleet-wide systems is scheduled for completion in accordance with the WBN Unit 1 full implementation date, which is September 2014. Furthermore, these systems will be in full compliance with 10 CFR 73.55 when the existing TVA exemption (ADAMS Accession No. ML100060376) expires on September 24, 2012.

The Security Computer system is a closed system with no external access. The logical isolation and existing physical security provide substantial defense-in-depth such that there is reasonable assurance that the system is secure from cyber attacks.

The applicant noted in its June 10, 2011, submittal that the existing corporate based

[emergency preparedness] systems were assessed as part of the NEI 04-04 cyber security assessment process and remediation actions identified as part of that process have been implemented. The staff found this rationale unacceptable since the NEI 04-04 guidance was only endorsed by the NRC as interim guidance pending the issuance of 10 CFR 73.54. The applicant subsequently submitted a letter dated August 4, 2011 (ADAMS Accession No. ML11222A104), that provided additional information that detailed their mitigation efforts. The applicant stated that the completion of remediation efforts on three EP systems previously assessed as operating at an unacceptable risk level, resulted in an acceptable risk level, based on the NEI 04-04 assessment criteria. The August 4, 2011, submission was accompanied by extensive documentation of the applicants efforts in its internal assessment of critical EP systems. While the scope and depth of the risk assessments are considerable, the staff found this rationale unacceptable for the same reasons as noted above. Since the NEI 04-04 assessment criteria is considered as interim guidance by the NRC, the assigning of an acceptable risk designation based on that guidance, even for systems that have been remediated, does not meet the NRCs requirement for high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design-basis threat. However, the applicants efforts at achieving compliance with 10 CFR 73.54 need to be considered.

In its June 10, 2011, submittal, the applicant proposed two license conditions. Each one requested the grant of an operating license, noting that the Security Computer system and relevant EP systems will be implemented to the NEI 08-09 standards described in the CSP by the WBN Unit 1 full implementation date. The staff reviewed the proposed license condition(s) and found them acceptable for the following reasons:

13-11

• The assessment measures taken by the applicant to determine the effectiveness of cyber security protections were based on the NEI 04-04 self assessment criteria.

However, this guidance was used by other licensees in the interim period as they moved from their existing cyber security programs towards compliance with 10 CFR 73.54.

Furthermore, the applicant addressed the remediation of vulnerabilities discovered during its assessment.

• The interim measures used to protect the applicants CDAs provide reasonable assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design-basis threat.

As with other licensees, this interim approach is considered adequate until the applicants CSP is fully implemented.

• The EP systems and the Security Computer (for both WBN Unit 1 and WBN Unit 2) will be fully compliant with 10 CFR 73.54 by the full implementation date provided in the WBN Unit 1 CSP implementation schedule. All other portions of the WBN Unit 2 CSP are scheduled to be implemented prior to the WBN Unit 2 start-up date.

The documented license conditions should be viewed as a full-faith effort on the applicants part to attain full compliance with the criteria specified in its CSP and to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design-basis threat. If full compliance is not met by the date stipulated in the proposed license conditions, the NRC should proceed with a review of the applicants operating license. Based on the above discussion, the NRC staff proposes the following two license conditions:

Cyber Security Proposed License Condition 1:

The licensee shall implement the requirements of 10 CFR 73.54(a)(1)(ii) as they relate to the security computer. Completion of these actions will occur consistent with the full implementation date of September 30, 2014, as established in the licensees letter dated April 7, 2011, Response to Request for Additional Information Regarding Watts Bar Nuclear Plant Cyber Security Plan License Amendment Request, Cyber Security Plan Implementation Schedule - Watts Bar Nuclear Plant Unit 1.

Cyber Security Proposed License Condition 2:

The licensee shall implement the requirements of 10 CFR 73.54(a)(1)(iii) as they relate to the corporate based systems that support emergency preparedness. Completion of these actions will occur consistent with the Watts Bar Nuclear Plant Unit 1 implementation schedule established in the licensees letter dated April 7, 2011, Response to Request for Additional Information Regarding Watts Bar Nuclear Plant Cyber Security Plan License Amendment Request, Cyber Security Plan Implementation Schedule - Watts Bar Nuclear Plant Unit 1.

Based on the above and the provided schedule ensuring timely implementation of those protective measures that provide a higher degree of protection against cyber attack, the NRC staff finds the Cyber Security Program implementation schedule is satisfactory.

13-12

13.6.6.4 Differences from NEI 08-09, Revision 6 In addition to the table of deviations found in Enclosure 3, Attachment 1 of the applicants CSP, the NRC staff notes the following additional differences between the applicants submission and NEI 08-09, Revision 6:

• In Section 3.1, Scope and Purpose, the applicant clarified the definition of important-to-safety functions, consistent with SRM-COMWCO-10-0001.

• In Section 3.21, Document Control and Records Retention and Handling, the applicant clarified the definition of records and supporting documentation that will be retained to conform to the requirements of 10 CFR 73.54.

• In Section 3.22, Implementation Schedule, the applicant submitted a revised implementation schedule, specifying the interim milestones and the final implementation date, including supporting rationale.

In its letter dated July 23, 2010, to the NRC requesting approval of the submitted WBN Unit 2 cyber security plan, the applicant referenced the inclusion of an Attachment to Enclosure 3. is the CSP; the Attachment is the Deviation Table which lists the deviations from the NEI 08-09 Revision 6 template. For that reason, the staff considers that the full evaluation of the CSP must include a review of the deviations taken to those sections of NEI 08-09, REVISION 6 as listed in the WBN Unit 2 cyber security plan. The following deviation is incorporated in the Attachment to Enclosure 3.

• The applicant deviated from the definition of cyber attack. The original definition of cyber attack is defined as:

any event in which there is reason to believe that an adversary has committed or caused, or attempted to commit or cause, or has made a credible threat to commit or cause malicious exploitation of a SSEP function

• The new definition of cyber attack as provided by the WBN Unit 2 CSP is the following:

any event in which there is reason to believe that an adversary has committed or caused, or attempted to commit or cause, or has made a credible threat to commit or cause malicious exploitation of a CDA The deviation table notes that the authorization for this change is the June 7, 2010, letter from the NRC to the NEI, indicating acceptance of the updated definition of cyber attack. The NRC staff finds this deviation is acceptable because it uses the NRC-accepted definition of cyber attack.

The NRC staff finds all of these deviations to be acceptable as discussed in the respective sections.

13.6.6.5 Conclusion The NRC staffs review and evaluation of the applicants CSP was conducted using the staff positions established in the relevant sections of RG 5.71. Based on the NRC staffs review, the 13-13

NRC finds that the applicant addressed the information necessary to satisfy the requirements of 10 CFR 73.54, 10 CFR 73.55(a)(1), 10 CFR 73.55(b)(8), and 10 CFR 73.55(m), and that the applicants Cyber Security Program provides high assurance that CDAs are adequately protected against cyber attacks, up to and including the design basis threat as described in 10 CFR 73.1.

Therefore, the NRC staff finds the information contained in this CSP to be acceptable and upon successful implementation of this program, operation of WBN Unit 2 will not be inimical to the common defense and security.

13.6.6.6 References

1. 10 CFR 73.54, Protection of Digital Computer and Communication Systems and Networks, March 27, 2009.

2. Regulatory Guide 5.71, Cyber Security Programs for Nuclear Facilities, January 2010.

(ADAMS Accession No. ML090340159)

3. Letter from J. Roe, Nuclear Energy Institute, to S. Morris, NRC, NEI 08-09, Revision 6, Cyber Security Plan for Nuclear Power Reactors, April 2010, April 28, 2010. (ADAMS Accession No. ML101180434)

4. Letter from R. Correia, NRC, to J. Roe, Nuclear Energy Institute, Nuclear Energy Institute 08-09, Cyber Security Plan Template, Rev. 6, May 5, 2010. (ADAMS Accession No. ML101190371)

5. Staff Requirements Memorandum (SRM)-COMWCO-10-0001, Regulation of Cyber Security at Nuclear Power Plants, October 21, 2010. (ADAMS Accession No. ML102940009, publicly available) 13-14

15 ACCIDENT ANALYSIS 15.2 Normal Operation and Anticipated Transients 15.2.1 Loss-of-Cooling Transients 15.2.1.1 Partial Loss-of-Coolant-Flow Accident Regulatory Evaluation Section 15.2.5, Partial Loss of Forced Reactor Coolant Flow, of the final safety analysis report (FSAR) for Watts Bar Nuclear Plant (WBN) Unit 2, describes the results of the Tennessee Valley Authoritys (TVAs) analysis of an accident involving a partial loss of coolant flow. An accident involving a partial loss of coolant flow can result from a mechanical or electrical failure in a reactor coolant pump (RCP) or from a fault in the power supply to the pump or pumps supplied by an RCP bus. A decrease in reactor coolant flow, occurring while the plant is at power, could lead to a degradation of core heat transfer and cause an increase in fuel temperature. Fuel damage could then result, if specified acceptable fuel design limits (SAFDLs) are exceeded during the transient.

In its review, the staff of the U.S. Nuclear Regulatory Commission (NRC) referred to the guidance in Section 15.3.1-15.3.2, Revision 2, Loss of Forced Reactor Coolant Flow Including Trip of Pump Motor and Flow Controller Malfunctions, of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR [Light-Water Reactor] Edition, issued July 1981 (SRP). The NRC staffs review covered (1) the postulated initial core and reactor conditions, (2) the methods used by TVA in its thermal and hydraulic analyses, (3) the sequence of events for the accident, (4) the assumed responses of reactor system components, (5) the functional and operational characteristics of the reactor protection system (RPS), (6) operator actions, and (7) the results of the transient analyses. The NRCs acceptance criteria are based, in part, on the following regulatory requirements:

• General Design Criterion (GDC) 10, Reactor Design, in Appendix A, General Design Criteria for Nuclear Power Plants, to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities, insofar as it requires that the reactor coolant system (RCS) be designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations, including anticipated operational occurrences (AOOs)

• GDC 15, Reactor Coolant System Design, insofar as it requires that the RCS and its associated auxiliary systems be designed with margin sufficient to ensure that the design conditions of the reactor coolant pressure boundary (RCPB) are not exceeded during any condition of normal operation

• GDC 26, Reactivity Control System Redundancy and Capability, insofar as it requires that a reactivity control system be provided and be capable of reliably controlling the rate of reactivity changes to ensure that, under conditions of normal operation, including AOOs, SAFDLs are not exceeded 15-1

An accident involving a partial loss of coolant flow is a Condition II event (a fault of moderate frequency, or AOO). 2 These faults, at worst, result in a reactor trip with the plant being capable of returning to operation. In its analysis of Condition II events in pressurized-water reactors (PWRs), the staff uses, in part, the following specific acceptance criteria, as described in SRP Section 15.3.1-15.3.2, in making its determination that the regulatory requirements are satisfied:

(1) Pressure in the RCS and main steam system (MSS) should be maintained below 110 percent of the design values, in accordance with the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (ASME Code).

(2) Fuel cladding integrity shall be maintained by ensuring that the minimum departure from nucleate boiling (DNB) ratio (DNBR) remains above the 95/95 DNBR safety limit (i.e., there will be at least a 95-percent probability that DNB will not occur on the limiting fuel rods during normal operation, operational transients, or any transient conditions arising from faults of moderate frequency (Condition I and II events) at a 95-percent confidence level).

(3) An AOO should not generate a postulated accident without other faults occurring independently or result in a consequential loss of function of the RCS or reactor containment barriers.

Technical Evaluation The turbine generator normally supplies power for the RCPs through individual electrical boards. In the event of a generator trip, the RCPs draw power from external power lines and continue to operate. In the event of a turbine trip that does not involve an electrical fault or a thrust-bearing failure, which would require tripping the generator from the network, the generator would remain connected to the network for about 30 seconds. The RCPs would continue to provide full coolant flow during that period.

Since each RCP is powered separately, a single board fault could not result in the loss of more than one RCP. The event that TVA evaluated, therefore, is a partial loss of flow involving the loss of one RCP, with four reactor coolant loops initially in operation.

The necessary protection against an accident involving a partial loss of coolant flow is provided by the low primary coolant flow reactor trip, which is actuated by two out of three low-flow signals in any reactor coolant loop. Above approximately 48-percent power (RPS setpoint Permissive 8), low flow in any loop will actuate a reactor trip. Below Permissive 8 and above Permissive 7 (approximately 10-percent power), low flow in any two loops will actuate a reactor trip.

TVA performed this event analysis using three NRC-approved digital computer codes:

2 See Supplemental Safety Evaluation Report (SSER) 24, Section 4.4.10, for a description of the accident condition classification system, or see American Nuclear Society (ANS) 51.1, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants (replaces American National Standards Institute (ANSI) N18.2), issued 1983.

15-2

(1) The LOFTRAN code calculated the loop and core flow transients, predicted the time of the reactor trip based on loop flow and nuclear power, and generated the resulting RCS pressure and temperature transients.

(2) Then, the FACTRAN code calculated the heat flux transient based on the nuclear power and coolant flow input from LOFTRAN.

(3) Finally, the VIPRE-01 code calculated the DNBR transients (typical and thimble fuel cells) based on input from FACTRAN (heat flux) and LOFTRAN (coolant flow).

The DNBR evaluation, performed using the revised thermal design procedure (RTDP) methodology, 3 indicates that the minimum DNBR for both typical and thimble cells remains above the design-limit value throughout the event. Therefore, the SAFDLs are met. The LOFTRAN analysis results indicate that the maximum RCS pressure does not exceed the RCPB pressure limit.

Conclusion The NRC staff has reviewed TVAs analyses of the event involving a decrease in reactor coolant flow and concludes that it used acceptable analytical models. The NRC staff further concludes that TVA has demonstrated that the reactor protection and safety systems will ensure that the SAFDLs and the RCPB pressure limits will not be exceeded as a result of this event. Based on this, the NRC staff concludes that WBN Unit 2 meets the requirements of GDC 10, 15, and 26.

15.2.1.2 Loss of External Electrical Load and/or Turbine Trip Regulatory Evaluation Section 15.2.7, Loss of External Electrical Load and/or Turbine Trip, of the FSAR for WBN Unit 2 describes the results of TVAs analysis of a loss of external electrical load or turbine trip, or both. In the event of a turbine trip, the reactor will be tripped directly (unless below approximately 50-percent power) from a signal derived from the turbine autostop oil pressure or turbine throttle valve position. The automatic steam dump system will discharge the excess steam and limit the resulting increase in RCS temperature. The rise in RCS pressure would normally be limited by the automatic pressurizer pressure control system. If the turbine condenser is not available, the excess steam will be dumped to the atmosphere and the main feedwater system will also not be available, since the main feedwater pump turbines exhaust to the condenser. Feedwater would then be supplied by the auxiliary feedwater (AFW) system.

In its review, the NRC staff referred to the guidance in SRP Section 15.2.1-15.2.5, Revision 2, Loss of External Load; Turbine Trip; Loss of Condenser Vacuum; Closure of Main Steam Isolation Valve (BWR [Boiling-Water Reactor]); and Steam Pressure Regulator Failure (Closed). The NRC staffs review covered the sequence of events, the analytical models used for analyses, the values of parameters used in the analytical models, and the results of the transient analyses. The NRC based its acceptance criteria, in part, on the following regulatory requirements:

3 See Friedland, A. J. and S. Ray, Revised Thermal Design Procedure, WCAP-11397-P-A (Proprietary),

WCAP-11398-A (Nonproprietary), April 1989.

15-3

• GDC 10, insofar as it requires that the RCS be designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations, including AOOs

• GDC 15, insofar as it requires that the RCS and its associated auxiliary systems be designed with margin sufficient to ensure that the design conditions of the RCPB are not exceeded during any condition of normal operation

• GDC 26, insofar as it requires that a reactivity control system be provided and be capable of reliably controlling the rate of reactivity changes to ensure that, under conditions of normal operation, including AOOs, SAFDLs are not exceeded An accident involving a partial loss of coolant flow is a Condition II event (a fault of moderate frequency, or AOO). These faults, at worst, result in a reactor trip with the plant being capable of returning to operation. In its analysis of Condition II events in PWRs, the staff uses, in part, the following specific acceptance criteria, as described in SRP Section 15.2.1-15.2.5, in making its determination that the regulatory requirements are satisfied:

(1) Pressure in the RCS and MSS should be maintained below 110 percent of the design values, in accordance with the ASME Code.

(2) Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR safety limit (i.e., there will be at least a 95-percent probability that DNB will not occur on the limiting fuel rods during normal operation, operational transients, or any transient conditions arising from faults of moderate frequency (Condition I and II events) at a 95-percent confidence level).

(3) An AOO should not generate a postulated accident without other faults occurring independently or result in a consequential loss of function of the RCS or reactor containment barriers.

Technical Evaluation TVA has considered two cases of loss of external electrical load or turbine trip, or both: one to show that the SAFDLs are not violated and one to show that the RCPB pressure limit is met.

Both cases are postulated as turbine trips from full power without direct reactor trips.

In the DNB case, the initial reactor power, pressurizer pressure, and RCS temperature are assumed to be at their nominal, full-power values, as per the RTDP methodology. The RTDP methodology includes the assumption of minimum measured RCS flow for the DNB evaluation.

The pressurizer spray and power-operated relief valves (PORVs) are assumed to be operational. This is conservative, since it limits the rise in RCS pressure, which tends to keep the calculated DNBRs low.

In the RCS overpressure case, the initial reactor power and RCS temperature are assumed to be at their maximum full-power values, including allowances for calibration and instrument errors. The initial RCS pressure is assumed to be at its minimum value (i.e., a 50-pound-per-square-inch (psi) uncertainty allowance is subtracted from the nominal pressurizer pressure, to delay the time the high-pressurizer pressure reactor trip signal is generated). A low RCS flow is assumed (i.e., thermal design RCS flow) to reduce the rate of primary-to-secondary heat transfer. The pressurizer spray and PORVs are assumed to be unavailable. This is conservative, since it allows the RCS pressure to rise to higher levels.

15-4

In both cases, the direct reactor trip on turbine trip is assumed to be unavailable. In addition, the turbine condenser is assumed to be lost, which results in the unavailability of the steam dump system, steam generator (SG) PORVs, and main feedwater system. Consequently, steam is not released until the SG pressure rises to the safety valve setpoints and feedwater is supplied by the AFW system.

TVA performed this event analysis using three NRC-approved digital computer codes:

(1) The LOFTRAN code calculated the loop and core flow transients, predicted the time of the reactor trip based on loop flow and nuclear power, and generated the resulting RCS pressure and temperature transients.

(2) Then, the FACTRAN code calculated the heat flux transient based on the nuclear power and coolant flow input from LOFTRAN.

(3) Finally, the VIPRE-01 code calculated the DNBR transients (typical and thimble fuel cells) based on input from FACTRAN (heat flux) and LOFTRAN (coolant flow).

The results of both case analyses indicate that the reactor is tripped by the high pressurizer pressure signal. The results of the DNB case analysis indicate that the minimum DNBR remains above the design limit value throughout the event. Therefore, the SAFDLs are met.

The results of the RCS overpressure case analysis indicate that the maximum RCS pressure does not exceed the RCPB pressure limit. Therefore, the RCPB pressure limit is met.

One of the analysis acceptance criteria for an event involving the loss of external electrical load or turbine trip, or both, an AOO, is that it must not be allowed to develop into a more serious Condition III or IV event. This can occur if a pressurizer PORV opens and relieves water. Since the pressurizer PORVs are not qualified to relieve water, they are assumed to fail open after having passed water. A failed-open valve is considered to be a small-break loss-of-coolant accident (LOCA) at the top of the pressurizer, a Condition III event. The results of the event analyses involving the loss of external electrical load or turbine trip, or both, indicate that the pressurizer does not fill at any time during the transient. Therefore, the pressurizer PORVs would not be called upon to relieve water. The possibility that one or more of the pressurizer PORVs could fail open, caused by water being relieved through them, is thereby precluded.

Consequently, this analysis acceptance criterion, for AOOs, is satisfied.

Conclusion The NRC staff has reviewed TVAs analyses of an event involving the loss of external electrical load or turbine trip, or both, and concludes that it used acceptable analytical models. The NRC staff further concludes that TVA has demonstrated that the reactor protection and safety systems will ensure that the SAFDLs and the RCPB pressure limits will not be exceeded as a result of this event. Based on this, the NRC staff concludes that WBN Unit 2 meets the requirements of GDC 10, 15, and 26.

15-5

15.2.1.3 Loss of Normal Feedwater Regulatory Evaluation Section 15.2.8, Loss of Normal Feedwater, of the FSAR for WBN Unit 2 describes the results of TVAs analysis of a loss of normal feedwater (LONF). An LONF, which could be caused by pump failures, valve malfunctions, or a loss of offsite alternating current (ac) power, impairs the ability of the secondary system (i.e., the MSS) to remove the heat generated from the reactor core. LONF flow results in an increase in reactor coolant temperature and pressure that could lead to fuel damage. A reactor trip, usually on a low-low water level in any SG, is relied upon to prevent fuel damage. After the reactor trip, decay heat is removed by the AFW system.

In its review, the NRC staff referred to the guidance in SRP Section 15.2.7, Revision 2, Loss of Normal Feedwater Flow. The NRC staffs review covered the sequence of events, the analytical models used for analyses, the values of parameters used in the analytical models, and the results of the transient analyses. The NRC based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 10, insofar as it requires that the RCS be designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations, including AOOs

• GDC 15, insofar as it requires that the RCS and its associated auxiliary systems be designed with margin sufficient to ensure that the design conditions of the RCPB are not exceeded during any condition of normal operation

• GDC 26, insofar as it requires that a reactivity control system be provided and be capable of reliably controlling the rate of reactivity changes to ensure that, under conditions of normal operation, including AOOs, SAFDLs are not exceeded The LONF accident is a Condition II event (a fault of moderate frequency, or AOO). These faults, at worst, result in the reactor trip with the plant being capable of returning to operation. In its analysis of Condition II events in PWRs, the staff uses, in part, the following specific acceptance criteria, as described in SRP Section 15.2.7, in making its determination that the regulatory requirements are satisfied:

(1) Pressure in the RCS and MSS should be maintained below 110 percent of the design values in accordance with the ASME Code.

(2) Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95-DNBR safety limit (i.e., there will be at least a 95-percent probability that DNB will not occur on the limiting fuel rods during normal operation, operational transients, or any transient conditions arising from faults of moderate frequency (Condition I and II events) at a 95-percent confidence level).

(3) An AOO should not generate a postulated accident without other faults occurring independently or result in a consequential loss of function of the RCS or reactor containment barriers.

15-6

Technical Evaluation The LONF is basically a loss of heat sink. It is important to reduce the mismatch between the core heat generation rate (in the primary coolant side) and the heat removal rate (in the secondary side). This involves tripping the reactor and starting the AFW system. Tripping the reactor reduces the core heat generation rate to decay heat levels, and supplying AFW flow to the SGs takes up, in part, the heat removal function of the normal feedwater system. If a heat sink is not supplied following the reactor trip, decay heat would cause the reactor coolant to heat up, expand into the pressurizer, and possibly flow out of the RCS through the pressurizer relief or safety valves. Significant loss of water from the RCS could conceivably lead to core damage.

Tripping the plant before the SG heat removal capability is compromised ensures that the DNBR safety limit is not violated. Therefore, the fuel cladding integrity is shown to be maintained.

The AFW system at WBN Unit 2 consists of two motor-driven AFW pumps (MDAFWPs) and one turbine-driven AFW pump (TDAFWP). Both MDAFWPs can match the flow supplied by the TDAFWP. The reactor is tripped, and two MDAFWPs are started on a low-low water level in any SG. Since a low-low water level is the direct effect of an LONF, it is appropriate that this would be the condition that actuates the automatic RPS. Two MDAFWPs are also started on a trip of turbine-driven main feedwater pumps, a safety injection (SI) signal, or a loss of offsite power (LOOP). The TDAFWP is started on a low-low level in any two SGs, on a trip of turbine-driven main feedwater pumps, an SI signal, or a LOOP.

In the event of a LOOP, the MDAFWPs are supplied by the emergency diesel generators (EDGs), and the TDAFWP is supplied by steam from the secondary system. The turbine exhausts the secondary steam to the atmosphere. The MDAFWPs and TDAFWP take suction from the condensate storage tank.

One of the objectives of the LONF analysis is to show that the AFW system is capable of removing enough stored and residual heat to prevent water relief from the pressurizer and consequently a loss of water from the reactor core.

TVA presented two case analyses of the LONF, using the NRC-approved LOFTRAN code.

LOFTRAN is capable of calculating transient values of the parameters of interest, including the SG water level, pressurizer water level, and RCS average temperature. The two cases considered the plant response to LONF with and without offsite power available. The limiting case, with respect to water relief from the pressurizer and loss of water from the reactor core, is the case in which offsite power is assumed to be unavailable. TVA made several conservative assumptions in its limiting analysis, including the following:

• The low-low SG level trip setpoint is conservatively assumed to be low (0.0 percent of the narrow range span). The low level trip setpoint results in a longer time until the reactor trip.

• The plant is assumed to be operating at 102 percent of rated power at the time the LONF occurs. If offsite power is assumed to be available, then the RCP heat is added to the RCS. These assumptions maximize the heat source or sink mismatch between the primary and secondary coolant systems.

• Only the two MDAFWPs are assumed to be available for heat removal. The pumps are started 1 minute after the low-low SG level trip setpoint is reached. The assumed single 15-7

failure is the failure of the TDAFWP to start. Thus, only half the AFW system capacity is provided.

The results of the LONF analysis demonstrate the adequacy of the RPS and the AFW system in removing long-term decay heat and preventing fuel damage by maintaining RCS water inventory in the core region. Following the LONF, the water level in the SGs falls to the low-low SG level trip setpoint, which trips the reactor and begins the AFW pump startup sequence. One minute following the low-low level trip, both of the MDAFWPs are operating at full speed and providing a heat sink for the core residual heat. The results show that the pressurizer water level rises but not enough to fill the pressurizer. Therefore, the LONF is not expected to lead to a loss of RCS inventory from the pressurizer.

A related analysis acceptance criterion for the LONF is that an AOO must not be allowed to develop into a more serious Condition III or IV event. This can occur if a pressurizer PORV opens and relieves water. Since the pressurizer PORVs are not qualified to relieve water, they are assumed to fail open after having passed water. A failed-open valve is considered to be a small-break LOCA at the top of the pressurizer, a Condition III event. The results of the LONF analyses indicate that the pressurizer does not fill at any time during the transient. Therefore, the pressurizer PORVs would not be called upon to relieve water. The possibility that one or more of the pressurizer PORVs could fail open, caused by water being relieved through them, is thereby precluded. Consequently, this analysis acceptance criterion for AOOs is satisfied.

The analysis results also show that the RCS pressure does not exceed the RCPB safety limit.

In the LONF, the RCS pressure is limited by the pressurizer relief and safety valves. DNB, if it occurred, would occur before the reactor is tripped, when power is high and RCS flow is low (because of the RCP coastdown caused by the LOOP). This is virtually the same transient that is analyzed for the event involving a loss of forced RCS flow. The analysis results of the event involving a loss of forced RCS flow indicate that the DNBR safety limit is met.

Conclusion The NRC staff has reviewed TVAs analyses of the LONF event and concludes that it used acceptable analytical models. The NRC staff further concludes that TVA has demonstrated that the reactor protection and safety systems will ensure that the SAFDLs and the RCPB pressure limits will not be exceeded as a result of the LONF flow. Results of the LONF analysis show that the AFW system capacity is such that RCS water is not relieved from the pressurizer relief or safety valves. Therefore, fuel damage is not predicted. Based on this, the NRC staff concludes that WBN Unit 2 meets the requirements of GDC 10, 15, and 26.

15.2.1.4 Coincident Loss of Onsite and External (Offsite) AC Power to the StationLoss of Offsite Power to the Station Auxiliaries Section 15.2.9, Coincident Loss of Onsite and External (Offsite) AC Power to the StationLoss of Offsite Power to the Station Auxiliaries, of the FSAR for WBN Unit 2 describes the results of TVAs analysis of a loss of ac power to the site. A complete loss of all offsite power (no emergency ac power) may result in the loss of all power to the plant auxiliaries (e.g., the RCPs, condensate pumps). The loss of power may be caused by a complete loss of the offsite grid, accompanied by a turbine generator trip at the station, or by a loss of the onsite ac distribution system (Sections 15.2.7, Loss of External Electrical Load and/or Turbine Trip; 15.2.8, Loss of Normal Feedwater; and 15.3.4, Complete Loss of Forced Reactor Coolant Flow, of the FSAR for WBN Unit 2 describe related TVA analyses).

15-8

For a LOOP event, the EDGs are available to supply ac power to support plant safe shutdown.

A station blackout (SBO) event differs from a LOOP in that, for the unit in SBO, both EDGs are lost or are not available for the SBO coping period (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />). The non-SBO unit is assumed to have a single failure, such that only one EDG is available to support safe shutdown. An SBO event is beyond the design basis for WBN.

The regulatory requirements for SBO appear in 10 CFR 50.63, Loss of All Alternating Current Power. TVA proposed actions for WBN to meet the regulatory requirements of 10 CFR 50.63, and the NRC staff accepted them in safety evaluations in 1993. 4 The conclusions in the staffs 1993 safety evaluations remain valid for WBN Unit 2.

15.2.2 Increased Cooling Transients 15.2.2.1 Startup of an Inactive Loop at an Incorrect Temperature Regulatory Evaluation Section 15.2.6, Startup of an Inactive Reactor Coolant Loop, of the FSAR for WBN Unit 2 describes the results of TVAs analysis of the startup of an inactive loop at an incorrect temperature. The startup of an event involving an inactive loop is classified as a Condition II event (AOO).

The startup of an inactive loop is a plant transient that may result in either an increased core flow or the introduction of cooler water into the core. This event causes an increase in core reactivity caused by the decreased moderator temperature or moderator boron concentration.

In its analysis in FSAR Section 15.2.6.2, TVA concluded the following:

The Startup of an Inactive Loop event results in an increase in reactor vessel flow while the reactor remains in a subcritical condition. No analysis is required to show that the minimum DNBR limit is satisfied for this event.

In its review, the NRC staff referred to the guidance in SRP Section 15.4.4-15.4.5, Revision 2, Startup of an Inactive Loop or Recirculation Loop at an Incorrect Temperature, and Flow Controller Malfunction Causing an Increase in BWR Core Flow Rate. The NRC based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 10, insofar as it requires that the RCS be designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations, including AOOs

• GDC 15, insofar as it requires that the RCS and its associated auxiliary systems be designed with margin sufficient to ensure that the design conditions of the RCPB are not exceeded during an AOO 4

See letters from P. Tam, NRC, to M. Medford, TVA: (1) [WBN]Compliance with 10 CFR 50.63, Station Blackout, March 18, 1993 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML073200312), and (2) [WBN]Supplemental Safety Evaluation on Compliance with 10 CFR 50.63, Station Blackout, September 9, 1993 (ADAMS Accession No. ML073200357).

15-9

• GDC 26, insofar as it requires that a reactivity control system be provided and be capable of reliably controlling the rate of reactivity changes to ensure that, under conditions of normal operation, including AOOs, SAFDLs are not exceeded

• GDC 20, Protection System Functions, insofar as it requires that the protection system be designed to automatically initiate the operation of appropriate systems to ensure that SAFDLs are not exceeded as a result of operational occurrences

• GDC 28, Reactivity Limits, insofar as it requires that the reactivity control systems be designed to ensure that the effects of postulated reactivity accidents can neither result in damage to the RCPB greater than limited local yielding, nor disturb the core, its support structures, or other reactor vessel internals so as to significantly impair the capability to cool the core Technical Evaluation This event postulates the startup of an idle RCP without first raising the temperature of the inactive loop hot leg to the core inlet temperature. This would cause relatively cold water to be pumped into the core. The introduction of colder water would increase core reactivity and power because of the effect of the negative moderator temperature coefficient.

In its letter dated February 2, 2010 (ADAMS Accession No. ML100550326), TVA provided Developmental Revision B of the WBN Unit 2 technical specifications (TS). Proposed Limiting Condition for Operation 3.4.4 states that Four RCS loops shall be OPERABLE and in operation, in Modes 1 and 2. This is the same TS requirement for WBN Unit 1 and is acceptable to the NRC staff. The TS of WBN Unit 2 require all RCPs to be operating while the plant is in Modes 1 and 2. The plant is not authorized to operate with an inactive loop.

Conclusion Evaluation of the startup of an inactive loop at an incorrect temperature pertains only to plants that are authorized to operate with a loop out of service. Since WBN Unit 2 is not authorized to operate with a loop out of service, the staff did not evaluate the event.

15.2.2.2 Excessive Heat Removal Due to Feedwater System Malfunctions Regulatory Evaluation Section 15.2.10, Excessive Heat Removal due to Feedwater System Malfunctions, of the FSAR for WBN Unit 2 describes the results of TVAs analysis of excessive heat removal caused by feedwater system malfunctions. A decrease in feedwater temperature and an increase in feedwater flow are two examples of feedwater system malfunctions that can cause an increase in heat removal rate. Excessive heat removal caused by feedwater system malfunctions is classified as a Condition II event (AOO).

A decrease in feedwater temperature may be caused by the spurious opening of a low-pressure feedwater heater bypass valve. This would cause a sudden reduction in feedwater temperature at the inlet of the high-pressure heaters and an increase in extraction steam flow to the heaters.

Excessive feedwater flow could be caused by the full opening of one or more feedwater control valves because of a feedwater control system malfunction or an operator error.

15-10

In its review, the NRC staff referred to the guidance in SRP Section 15.1.1-15.1.4, Revision 2, Decrease in Feedwater Temperature, Increase in Feedwater Flow, Increase in Steam Flow, and Inadvertent Opening of a Steam Generator Relief or Safety Valve. The NRC staffs review covered (1) postulated initial core and reactor conditions, (2) methods of thermal and hydraulic analyses, (3) the sequence of events, (4) assumed reactions of reactor system components, (5) functional and operational characteristics of the RPS, (6) operator actions, and (7) the results of the transient analyses. The NRC based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 10, insofar as it requires that the RCS be designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations, including AOOs

• GDC 15, insofar as it requires that the RCS and its associated auxiliary systems be designed with margin sufficient to ensure that the design conditions of the RCPB are not exceeded during any condition of normal operation

• GDC 26, insofar as it requires that a reactivity control system be provided and be capable of reliably controlling the rate of reactivity changes to ensure that, under conditions of normal operation, including AOOs, SAFDLs are not exceeded

• GDC 20, insofar as it requires that the RPS be designed to initiate automatically the operation of appropriate systems, including the reactivity control systems, to ensure that SAFDLs are not exceeded during any condition of normal operation, including AOOs Technical Evaluation Decrease in Feedwater Temperature A decrease in feedwater temperature will cause an increase in core power by decreasing the reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and the RCS. The high nuclear flux, overtemperature reactor coolant loop differential temperature (T), and overpower T (OT) reactor trips are available to prevent any power increase high enough to produce a DNBR that is lower than the safety analysis limit (SAL) value.

At hot full power (HFP), the reduction in feedwater temperature increases the load demand on the plant. The net effect on the RCS caused by a reduction in feedwater temperature is similar to the effect of increasing the secondary steam flow (i.e., the reactor will reach a new equilibrium condition at a power level corresponding to the new SG T). If a reactor trip is required, it will be demanded by the high nuclear flux or the OT trip logic. No single failure will prevent the operation of the RPS.

At hot zero power (HZP), the reduction in feedwater temperature increases the RCS temperature and results in a core reactivity insertion, caused by the effect of the negative moderator temperature coefficient of reactivity. However, this effect decreases as load and feedwater flow decrease, so that the transient response at HZP is less severe than the transient response at HFP.

The staff predicts that the decrease in feedwater temperature at HZP would be bounded by the same event occurring at HFP, which would have a similar effect on the plant as an excessive 15-11

load increase, described in Section 15.2.11, Excessive Load Increase Incident, of the FSAR for WBN Unit 2. Section 15.2.10 of the WBN Unit 2 FSAR does not present a specific analysis of the decrease in feedwater temperature; however, the NRC staff concludes that such an analysis is not necessary, since the transient effect would be represented by the excessive load increase analysis. The reactor trip, if required, would prevent the occurrence of DNB.

Increase in Feedwater Flow An increase in feedwater flow could be caused by the full opening of one or more feedwater control valves caused by a feedwater control system malfunction or an operator error. At HFP, this raises the load demand. At HZP, the additional feedwater causes a decrease in RCS temperature, which increases core reactivity, caused by the effect of the negative moderator temperature coefficient of reactivity. Eventually, the SG high-high level trip will demand a turbine trip, which includes closure of the feedwater control and isolation valves.

The event involving an increase in feedwater flow is considered for the opening of one and of all feedwater control valves, at HFP and HZP, and with automatic and manual rod control assumed.

Section 15.2.10 of the WBN Unit 2 FSAR references a generic study, performed by Westinghouse (WCAP-11397-P-A (proprietary), WCAP-11398-A (nonproprietary)), which shows that this event, when evaluated at HZP, is less severe than the event that is evaluated at HFP, for feedwater flow rates that are less than 150 percent of the nominal feedwater flow rate.

Therefore, in FSAR Section 15.2.10, TVA presented the HFP case analyses. The NRC staff accepts this conclusion, since it is supported by analyses of other plants of similar design, which show that the maximum reactivity insertion rate, caused by the increased feedwater flow, would be less than the maximum reactivity insertion rate that is analyzed in WBN Unit 2 FSAR Section 15.2.1, Uncontrolled Control Rod Assembly Withdrawal from a Subcritical Condition.

Protection is provided by, among other things, the power range high neutron flux trip (low setting), which is credited to apply at approximately 35-percent power.

At HFP, the reactor could be tripped by signals from the OT and overtemperature T protection logic, as well as from high nuclear flux. Continued addition of excessive feedwater is prevented by the SG high-high level trip, which trips the turbine; closes the feedwater control valves, isolation valves, and feedwater pump discharge valves; and trips the main feedwater pumps. The analyses credit the feedwater isolation functions on receipt of the SG high-high level turbine trip signal, but the reactor trip relies on receipt of the OT or overtemperature T reactor trip signal.

The effects of excessive heat removal caused by a feedwater system malfunction transient were analyzed with the LOFTRAN computer code. LOFTRAN simulates a multiloop RCS, neutron kinetics, the pressurizer (including relief and safety valves, as well as spray), SGs, SG safety valves, and the feedwater system. The code calculates pertinent plant parameters, including RCS temperatures, pressurizer pressure, and core power level.

The parameter of interest in the analyses of a feedwater system malfunction is DNBR.

Therefore, the accident is analyzed using the RTDP (i.e., initial reactor power, pressure, and RCS temperatures are assumed to be at their nominal values, and uncertainties in initial conditions are included in the DNBR limit). Since a high power level, which results from the overcooling effect of excessive feedwater, would lead to lower DNBR values, the analyses 15-12

assumed a conservatively high, negative moderator temperature coefficient of reactivity, typical of end-of-life (EOL) core conditions.

Each of the HFP analyses considered both automatic and manual rod control operating modes.

In practice, automatic rod control is not used.

The two scenarios, an increase in feedwater flow to one SG and an increase in feedwater flow to all SGs, result in very different transients. Both indicate that the minimum DNBR remains above the DNBR safety limit.

When feedwater flow to one SG undergoes a step increase, there is a significant rise in the core power level and pressurizer pressure and a reduction in DNBR to a new, relatively stable level.

This continues until enough feedwater has been pumped into the SG to cause the water level to rise to the high-high water level setpoint. Then, all the main feedwater isolation, control, and pump discharge valves are closed, and the main feedwater pumps are tripped. The termination of feedwater causes the RCS temperature to rise, and this heatup leads to an overtemperature T reactor trip. FSAR Section 15.2.10 indicates that the overtemperature T reactor trip setpoint is reached a few seconds after feedwater is isolated. The DNBR rises rapidly after the reactor is tripped. The NRC staff accepts these analysis results and observes that the principal protection, for this event, is the feedwater isolation function, which leads to a reactor trip. This is characteristic of an effective protection system design, since the protection system logic addresses, directly, the cause of the event (i.e., an oversupply of feedwater). No single active failure will prevent RPS operation.

When feedwater flow to all SGs undergoes a step increase, the core power level rises to a higher level than in the previous, single SG case. This leads to an earlier reactor trip, caused by overtemperature T, and consequently, an earlier end to the DNBR degradation. The feedwater isolation occurs later, after the reactor trip, and has little or no effect upon the DNBR transient, since in any case the reactor shutdown would terminate main feedwater flow.

The analysis results show that DNB does not occur at any time during the excessive feedwater flow incident; thus, the ability of the primary coolant to remove heat from the fuel rod is not reduced.

Conclusion The results of TVAs analysis show that the DNBRs calculated for an excessive feedwater addition at power are above the SAL values. Therefore, no fuel or clad damage is predicted.

The NRC staff has reviewed TVAs analyses of the events involving excessive heat removal caused by feedwater system malfunctions described above and concludes that it used acceptable analytical models. The NRC staff further concludes that TVA has demonstrated that the reactor protection and safety systems will ensure that the SAFDLs and the RCPB pressure limits will not be exceeded as a result of these events. Based on this, the NRC staff concludes that the plant will meet the requirements of GDC 10, 15, 20, and 26.

15.2.2.3 Excessive Load Increase Incident Section 15.2.11 of the WBN Unit 2 FSAR describes the results of TVAs analysis of excessive heat removal caused by an excessive load increase incident. An excessive load increase incident is defined as a rapid increase in the steam flow that causes a power mismatch between 15-13

the reactor core power and the SG load demand. The reactor is designed to accommodate a 10-percent step load increase or a 5-percent-per-minute ramp load increase in the range of 15 to 100 percent of full power without requiring an automatic reactor trip.

An automatic reactor trip signal could be generated by the RPS from any of the following four conditions:

(1) overpower reactor coolant loop T (2) overtemperature T (3) power range high neutron flux (4) low pressurizer pressure Excessive load increase is an increase in the heat removal rate that causes a decrease in moderator temperature. In the presence of a negative moderator temperature coefficient, this increases the core reactivity and power level (or, if applicable, decreases shutdown margin).

Any unplanned power level increase may result in fuel damage or excessive reactor system pressure. Reactor protection and safety systems are available, if necessary, to mitigate the transient. The excessive load increase incident is classified as a Condition II event (AOO).

Regulatory Evaluation In its review, the NRC staff referred to the guidance in SRP Section 15.1.1-15.1.4, Revision 2.

The NRC based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 10, insofar as it requires that the RCS be designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations, including AOOs

• GDC 15, insofar as it requires that the RCS and its associated auxiliary systems be designed with margin sufficient to ensure that the design conditions of the RCPB are not exceeded during any condition of normal operation

• GDC 26, insofar as it requires that a reactivity control system be provided and be capable of reliably controlling the rate of reactivity changes to ensure that, under conditions of normal operation, including AOOs, SAFDLs are not exceeded

• GDC 20, insofar as it requires that the RPS be designed to initiate automatically the operation of appropriate systems, including the reactivity control systems, to ensure that SAFDLs are not exceeded during any condition of normal operation, including AOOs Technical Evaluation TVA postulated four 10-percent step-load increase cases for consideration: two cases under beginning of core life conditions, with and without automatic rod control, and two cases under end of core life conditions, with and without automatic rod control.

At the beginning of life (BOL), there will be little or no core reactivity increase caused by the decrease in moderator temperature. This is because, at BOL, the moderator temperature coefficient of reactivity and the Doppler-only power coefficient are at their least negative values.

The NRC staff expects that the BOL cases, with or without automatic rod control, would have a small effect on the core reactivity and the power level.

15-14

At EOL, the moderator temperature coefficient of reactivity and Doppler-only power coefficient curve would have their most negative values. This would produce the most reactivity feedback caused by changes in the core coolant temperature. Automatic rod control would tend to offset the resulting increase in the core reactivity and power level. Therefore, the more severe case is expected to be the 10-percent step-load increase without automatic rod control.

For the excessive load increase incident, TVA determined that the DNBR safety limit is not violated by evaluating a number of initial conditions, within which core power level, average coolant temperature, and pressurizer pressure were varied in a region around the normal full-power operating conditions. The various initial conditions, or statepoints, were chosen to represent the variations that could occur during an excessive load increase scenario. Biases were applied (e.g., higher power level and lower RCS pressure) to minimize the DNBR.

TVA compared the RCS temperature, pressurizer pressure, and core power level (indicated by T) for each of the various initial conditions, or statepoints, to the RCS temperature, pressurizer pressure, and core power level values that would produce the DNBR SAL. Figure 15.1-1, Illustration of Overtemperature and Overpower Delta-T Protection, in the FSAR for WBN Unit 2 and reproduced below depicts the locus of points, on a plot of T versus average T (degrees Celsius (C) (Fahrenheit (F)), at which the DNBR is at the DNBR SAL. This figure also depicts plots of the calculated overpower and overtemperature T reactor trip setpoints that are intended to trip the reactor before conditions can reach those corresponding to the DNBR SAL.

15-15

Figure 15.1-1 Illustration of overtemperature and overpower delta-T protection Using FSAR Figure 15.1-1, the NRC staff located the nominal operating condition (Tavg=588.2 degrees F and T=58.4 degrees F) and designated it as point A. The nominal operating condition lies well below and to the left of the DNBR SAL and overtemperature T lines that correspond to operation at nominal pressure (2,250 pounds-force per square inch (psia)). Point A represents the plant operating conditions that would exist before the occurrence of a 10-percent step-load increase. A second point (point B), representing operation at 110-percent power (i.e., the endpoint of a 10-percent step-load increase) was marked on the figure at Tavg=591.1 degrees F and T=64.2 degrees F. The line connecting the two points maps the path, from point A to point B, of an excessive load increase incident relative to the DNBR SAL. It extends upward and to the right, toward the DNBR SAL and overtemperature T lines that correspond to operation at nominal pressure.

If the 10-percent step-load increase does not cause the RCS to depressurize, then the overtemperature T reactor trip is not demanded. However, the excessive load could cause a 15-16

drop in RCS pressure. The FSAR contains transient plots of a 10-percent step-load increase to illustrate how RCS temperature and pressure and core power might be expected to behave in a typical Westinghouse plant during each of the four aforementioned cases. In no case did the RCS depressurize below 2,000 psia. Therefore, the 10-percent step-load increase, represented by line A-B, could result in an overtemperature T reactor trip, if the RCS depressurizes, and this would prevent the core from reaching the conditions characteristic of a DNBR at the SAL value. Line A-B also indicates that, if there is little or no depressurization of the RCS, a reactor trip would not be demanded. In either instance, the DNBR SAL would not be violated.

Therefore, the NRC staffs exercise, employing FSAR Figure 15.1-1, verifies TVAs conclusion that the DNBR SAL is not violated in the event of an excessive load increase incident. The nature of the event (a cooldown and possible depressurization) indicates that RCPB integrity is not challenged. Although a reactor trip might be required, it could not be prevented, delayed, or otherwise impeded by a single failure.

Conclusion The NRC staff has reviewed TVAs analyses of the excessive load increase incident and concludes that it used acceptable analytical models. The NRC staff further concludes that TVA has demonstrated that the SAFDLs and the RCPB pressure limits will not be exceeded as a result of these events. Based on its review, the NRC staff concludes that WBN Unit 2 meets the requirements of GDC 10, 15, 20, and 26.

15.2.2.4 Accidental Depressurization of the Main Steam System WBN Unit 2 FSAR Section 15.2.13 describes the results of TVAs analysis of an accidental depressurization of the main steam system. Depressurization of the main steam system can result from an inadvertent opening of a single steam dump, relief or safety valve. The increase in steam flow, due to an open steam dump, relief or safety valve, causes an increase in rate of heat removal from the primary coolant system.

Regulatory Evaluation Excessive heat removal causes a decrease in moderator temperature which increases core reactivity and can lead to a power level increase and a decrease in shutdown margin. Any unplanned power level increase may result in fuel damage or excessive reactor system pressure. Reactor protection and safety systems are actuated to mitigate the transient. The NRC staff used the guidance in SRP Section 15.1.1-15.1.4, Decrease in Feedwater Temperature, Increase in Feedwater Flow, Increase in Steam Flow, and Inadvertent Opening of a Steam Generator Relief or Safety Valve, Revision 2. The NRC staff's review covered (1) postulated initial core and reactor conditions, (2) methods of thermal and hydraulic analyses, (3) the sequence of events, (4) assumed reactions of reactor system components, (5) functional and operational characteristics of the reactor protection system, (6) operator actions, and (7) the results of the transient analyses. The NRCs acceptance criteria are based, in part, on the following regulatory requirements:

• General Design Criterion (GDC) 10, Reactor Design, in Appendix A, General Design Criteria for Nuclear Power Plants, to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities, insofar as it requires that the reactor coolant system (RCS) be designed with appropriate margin 15-17

to ensure that specified acceptable fuel design limits (SAFDLs) are not exceeded during normal operations, including anticipated operational occurrences (AOOs).

• GDC 15, Reactor Coolant System Design, insofar as it requires that the RCS and its associated auxiliary systems be designed with margin sufficient to ensure that the design conditions of the reactor coolant pressure boundary (RCPB) are not exceeded during any condition of normal operation.

• GDC 20, Protection System Functions, insofar as it requires that the protection system be designed to automatically initiate the operation of appropriate systems to ensure that SAFDLs are not exceeded as a result of operational occurrences

• GDC 26, Reactivity Control System Redundancy and Capability, insofar as it requires that a reactivity control system be provided and be capable of reliably controlling the rate of reactivity changes to ensure that, under conditions of normal operation, including AOOs, SAFDLs are not exceeded.

The accidental depressurization of the main steam system is classified as an AOO or American Nuclear Society (ANS) Condition II event. It is also known as the credible steam line break.

Technical Evaluation The increased heat removal from the reactor coolant system following the accidental depressurization of the main steam system causes a drop in moderator (reactor coolant) temperature. In the presence of a negative moderator temperature coefficient, the cooldown results in a reduction of core shutdown margin, and possibly a return to critical, after a reactor trip. The most reactive rod is assumed to be stuck in its fully withdrawn position. Power generation, in the region of the stuck rod cluster control assembly (RCCA), could result in departure from nucleate boiling (DNB). If this should occur, it would violate the SAFDLs and the ANS Condition II acceptance criteria. Protection against an accidental depressurization of the main steam system is available from:

1. Reactor trip, either directly from high neutron flux, overpower T (delta-T; change in reactor coolant temperature), or overtemperature T, or from a safety injection signal;

2. Safety injection, actuated by low pressurizer pressure, high containment pressure, or low steamline pressure;

3. Steamline isolation, actuated by high-high containment pressure, low steam line pressure, or high negative steam line pressure rate (below permissive setpoint P-11);

and

4. Main feedwater line isolation, actuated by a safety injection signal.

A series of steam line break analyses (Reference 1), which were performed for a variety of break sizes, indicated that the larger break sizes resulted in higher post-trip peak power levels and lower minimum DNB ratios than did the smaller break sizes. Based on these sensitivity studies, TVA concluded that the accidental depressurization of the main steam system is less severe than the main steam line break (MSLB), which is analyzed by TVA in FSAR Section 15.4.2, Major Secondary System Pipe Rupture (which is reviewed by the NRC staff in Section 15.3.2 of this SSER). The NRC staff agrees with TVA, for the following reasons:

15-18

1. The series of steam line break analyses (Reference 1), upon which TVAs conclusion is based, has been reviewed and accepted by the NRC staff for use in licensing applications for four-loop Westinghouse plants.

2. MSLBs of all break sizes, from the inadvertent opening a steam system valve to the full rupture of a main steamline, are judged against the same benchmark, the ANS Condition II acceptance criteria. Therefore, a direct comparison of MSLBs of various break sizes is meaningful.

3. The same reactor protection and engineered safeguards logic is in effect, and is applied, for all MSLB break sizes. Therefore, there will be no differences due to systems effects.

For example, at hot zero power (HZP), with end-of-life (EOL) conditions, an accidental depressurization of the main steam system, and an MSLB would both be expected to derive protection from the same protection logic, in the first protection system intervention seen in the transients sequence of events (i.e., a reactor trip, safety injection and steam line isolation would be demanded by the low steam line pressure signal, in both cases). If the protection system were to have another logic that is effective in some cases; but not others (e.g., steam line isolation on high steam flow, which would occur during large breaks, but not during small breaks), then all break sizes could not be compared, since the systems effect could eliminate the common basis needed for comparison. The accidental depressurization of the main steam system, an ANS Condition II event, results in a higher DNB ratio than does an MSLB, which is an ANS Condition IV event that is analyzed as if it were an ANS Condition II event.

Therefore, the MSLB, reviewed in Section 15.3.2 of this SSER, is the limiting event.

Conclusion The NRC staff reviewed TVAs evaluation of the accidental depressurization of the main steam system and concludes that TVAs evaluation has been performed using the results of a series of NRC-accepted, and applicable analyses. The NRC staff further concludes that the accidental depressurization of the main steam system will not cause the SAFDLs and the RCPB pressure limits to be exceeded. Based on this, the NRC staff concludes that WBN Unit 2 will meet the requirements of GDCs 10, 15, 20, and 26, in the event of an accidental depressurization of the main steam system. The staff also concludes that the accidental depressurization of the main steam system meets the acceptance criteria for ANS Condition II events, since the limiting steam line break event, the MSLB, also meets the acceptance criteria for ANS Condition II events, as shown by TVAs analysis in FSAR Section 15.4.2 and as evaluated by the NRC staff in Section 15.3.2 of this SSER.

15-19

Minor Secondary System Pipe Breaks TVAs analysis of minor secondary system pipe breaks is provided in WBN Unit 2 FSAR Section 15.3.2. Minor secondary system pipe breaks are defined to be MSLB events which produce steam release rates that are characteristic of steam system pipe ruptures that are not greater than 6 inches in diameter.

Regulatory Evaluation The regulatory evaluation of SSER Section 15.2.2.4, Accidental Depressurization of the Main Steam System, applies to minor secondary system pipe breaks.

Minor secondary system pipe breaks are classified as ANS Condition III (infrequent fault) events. However, minor secondary system pipe breaks are judged according to ANS Condition II acceptance criteria.

Technical Evaluation The steam releases from minor secondary system pipe breaks would be greater than the steam release from an accidental depressurization of the main steam system, but less than the steam release from an MSLB. All of these steamline break events are comparable, since they are all evaluated or analyzed according to ANS Condition II acceptance criteria. The technical evaluation in SSER Section 15.2.2, Accidental Depressurization of the Main Steam System, applies to minor secondary system pipe breaks.

Minor secondary system pipe breaks are less severe than the MSLB.

Conclusion The NRC staff has reviewed TVAs evaluation of minor secondary system pipe breaks as provided in FSAR Section 15.3.2, and concludes that TVAs evaluation has been performed using the results of a series of NRC-accepted, and applicable analyses. The NRC staff further concludes that the minor secondary system pipe breaks will not cause the SAFDLs and the RCPB pressure limits to be exceeded. Based on this, the NRC staff concludes that WBN Unit 2 will meet the requirements of GDCs 10, 15, 20, and 26, in the event of a minor secondary system pipe break. The staff also concludes that the minor secondary system pipe breaks meet the acceptance criteria for ANS Condition II events, since the limiting steamline break event, the MSLB, also meets the acceptance criteria for ANS Condition II events, as shown by TVAs analysis in FSAR Section 15.4.2 and as evaluated by the NRC staff in Section 15.3.2 of this SSER.

Reference

1. WCAP-9226-P-A, Revision 1, Reactor Core Response to Excessive Secondary Steam Releases, S. D. Hollingsworth and D. C. Wood, Original Version - January 1978, Approved Version - February 1998 15-20

15.2.3 Change in Coolant Inventory Transients 5 15.2.3.1 Inadvertent Operation of Emergency Core Cooling System and Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory WBN Unit 2 FSAR Section 15.2.14 provides TVAs analysis of an inadvertent operation of the emergency core cooling system (ECCS). The inadvertent operation of the ECCS could be caused by operator error or by a spurious SI actuation signal. When the ECCS is actuated, the centrifugal charging pumps pump water from the refueling water storage tank into the cold legs of the RCS. The SI pumps are also started, but they cannot deliver any flow, since the shutoff head of these pumps is lower than the nominal RCS pressure. If allowed to continue, the charging flow could fill the pressurizer, open the pressurizer PORVs, and cause them to relieve water. Since the PORVs are not qualified for water relief, they could fail to reseat and thereby transform the event into a small-break LOCA.

WBN Unit 2 FSAR Section 15.2.15 provides TVAs analysis of a chemical and volume control system (CVCS) malfunction during power operation, and FSAR Section 15.2.4, Uncontrolled Boron Dilution, provides a related analysis. The CVCS malfunction that increases RCS inventory could be caused by operator error or by an erroneous control signal. For example, a fault could be a false low pressurizer water level signal, which would demand that charging flow increase to its maximum rate. If a second pressurizer level transmitter were to fail in an as-is condition or a low condition (this could be postulated as the worst single failure), the reactor trip signal, which requires two out of the three high pressurizer level channel inputs, would be defeated. If allowed to continue, the charging flow could produce the same consequences as an inadvertent operation of the ECCS (above).

There are no automatic reactor protection or safety systems available to mitigate these events; therefore, it is necessary to shut off the charging flow manually.

Regulatory Evaluation Table 15-1 of Regulatory Guide 1.70, Revision 2, Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition), issued September 1975, lists the inadvertent operation of ECCS and the CVCS malfunction as events that can cause an increase in reactor coolant inventory. Both events are classified as AOOs or Condition II events.

Condition II events are expected to result, at worst, in a reactor trip with the plant being capable of returning to operation. Condition II events must not develop into more serious faults (i.e., Condition III or IV events) or result in fuel rod failures or overpressurization of the RCS or secondary systems.

In its review, the NRC staff used the guidance in SRP Section 15.5.1-15.5.2, Inadvertent Operation of ECCS and Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory, Revision 2. The NRC staffs review covered (1) the sequence of events, (2) the analytical model used for analyses, (3) the values of parameters used in the 5

Section 15.3.1 of this SSER includes the NRC staffs review of FSAR Section 15.3.1, Loss of Reactor Coolant from Small Ruptured Pipes or from Cracks in Large Pipes which Actuate the Emergency Core Cooling System (small-break LOCAs).

15-21

analytical model, and (4) the results of the transient analyses. The NRC based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 10, insofar as it requires that the RCS be designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations, including AOOs

• GDC 15, insofar as it requires that the RCS and its associated auxiliary systems be designed with margin sufficient to ensure that the design conditions of the RCPB are not exceeded during any condition of normal operation

• GDC 26, insofar as it requires that a reactivity control system be provided and be capable of reliably controlling the rate of reactivity changes to ensure that, under conditions of normal operation, including AOOs, SAFDLs are not exceeded Technical Evaluation The guidelines of SRP Sections 15.5.1-2 and the GDC requirements focus attention on the principal acceptance criterion upon which accident analysis results of AOO events are generally judged (i.e., meeting the SAFDLs). However, for the two RCS mass addition events, meeting the SAFDLs is not the primary concern. The inadvertent operation of an ECCS event is initiated by a spurious SI signal, which demands a reactor trip. The possibility of violating the safety limit for DNB, therefore, is eliminated at the outset of the event. The CVCS malfunction that increases RCS inventory is a scenario in which makeup water is added to the RCS, without changing the core boron concentration or temperature. Therefore, there is no change in core reactivity and no power excursion. Under the circumstances, the calculated DNB ratio would not decrease. In fact, it could increase, since the mass addition, from the charging flow, causes RCS pressure to increase. Eventually, the reactor would trip on a high-pressurizer pressure or level signal.

Overpressurization of the RCS or MSS is not likely to occur, since the heat removal requirement is low (mainly decay heat), and the charging pump shutoff head is lower than 110 percent of the RCS design pressure.

For the RCS mass addition events, the AOO acceptance criterion of primary concern, especially in plants that employ charging pumps in their ECCS (e.g., WBN Unit 2) is the criterion that states that, by itself, a Condition II incident cannot generate a more serious incident of the Condition III or IV type without other incidents occurring independently (see ANS 51.1). This requirement limits the likelihood of initiating a more serious, rarely occurring Condition III or IV event at the relatively high frequency of a Condition II event. Charging flow, whether started by an SI signal or a malfunction in the CVCS, is capable of filling the pressurizer and causing PORVs to open and relieve water. Since the PORVs are not qualified to relieve water, they could potentially fail open. A stuck-open PORV would be considered a small-break LOCA at the top of the pressurizer, which is a Condition III event. Thus, the Condition II acceptance criterion would be violated. Compliance with this acceptance criterion can be demonstrated by showing that the operator, following established EOPs, has sufficient time to identify the problem and remedy it, by terminating the charging flow before the pressurizer can fill. In that case, the PORVs, if opened, would relieve only steam and could reasonably be expected to reseat properly.

TVA analyzed the two events, the inadvertent operation of ECCS and the CVCS malfunction that increases reactor coolant inventory, using the LOFTRAN computer code (WCAP-7907-P-A, 15-22

LOFTRAN Code Description, April 1984), which is accepted by the NRC staff. The code simulates the WBN Unit 2 RCS, including the ECCS, CVCS, pressurizer, pressurizer relief and safety valves, and pressurizer spray. The code computes pertinent plant variables, including temperatures, pressures, and pressurizer water volume.

Inadvertent Operation of ECCS In FSAR Section 15.2.14, TVA stated that the pressurizer is predicted to become water solid, but that the maximum pressure reached would remain below the opening setpoint for the pressurizer safety valve (PSV). TVA concluded that, since the PSVs would not open, they could not be damaged by water relief, and the inadvertent operation of the ECCS could not become a more serious plant condition. Satisfaction of the Condition II acceptance criterion is demonstrated by showing that the pressurizer PSVs would not open. In TVAs analysis, the PORVs are not modeled, to increase the likelihood of opening the PSVs. If the PORVs should open, TVA stated that they could be isolated by manually closing the PORV block valves.

The NRC staff has objected to this rationale since 2005 (see NRC Regulatory Issue Summary (RIS) 2005-29, Anticipated Transients that Could Develop into More Serious Events, dated December 14, 2005 (ADAMS Accession No. ML051890212)). This approach is problematic in several respects. For example, closing the PORV block valves is an action that is taken to mitigate a small-break LOCA event, not an inadvertent operation of the ECCS. It is evident that the Condition II acceptance criterion is not satisfied, since the inadvertent operation of the ECCS, a Condition II incident, has generated, in this example, a more serious incident of the Condition III type, a small-break LOCA. Therefore, the NRC staff requested that TVA demonstrate that the Condition II acceptance criterion is met.

TVA responded that WBN Unit 1 was not licensed to RIS 2005-29. The WBN Unit 1 licensing basis is the designated reference for the WBN 2 licensing effort (SECY-07-0096, Possible Reactivation of Construction and Licensing Activities for the Watts Bar Nuclear Plant Unit 2, dated June 7, 2007 (ADAMS Accession No. ML071220492)). However, WBN Unit 1 FSAR Chapter 15 states that all the Chapter 15 accident analyses would adhere to the ANS event classifications and meet the ANS analysis acceptance criteria that are specified for each of the event classes (ANS 51.1). Therefore, RIS 2005-29 applies to WBN Unit 2.

TVA submitted the requested analysis by a letter to the NRC dated April 29, 2011 (ADAMS Accession No. ML11124A062), supplemented by a letter dated May 24, 2011. TVAs analysis results show that the pressurizer water level increases but does not fill the pressurizer before the operator can terminate the charging flow. Spray flow is conservatively assumed to be in operation, since it helps to condense the pressurizer steam bubble and limit pressurizer pressure, which keeps the charging flow rate high. The ECCS injection (charging) flow is terminated by the operator, in accordance with plant emergency procedures, in response to the indicated increase in pressurizer level. The results indicate that, if the operator action to terminate the ECCS injection flow is taken within 10 minutes of the transient initiation, the pressurizer level will reach a maximum level about 1 minute later, which leaves about 100 cubic feet of pressurizer volume for the steam bubble. In its letter dated May 24, 2011, TVA stated that the operator response times that have been credited in the analysis of the inadvertent operation of the ECCS will be demonstrated on the simulator. These results are subject to NRC inspection and review.

15-23

The staff reviewed TVAs evaluation of the inadvertent operation of the ECCS event and agrees with TVAs assumptions, methods, and conclusions. The staff concludes that the operator has sufficient time to prevent this event from escalating into a more serious event.

CVCS Malfunction during Power Operation FSAR Section 15.2.15 contains TVAs analysis of the CVCS malfunction during power operation. The analysis predicts the peak pressurizer water volume to be 1,664 cubic feet, well below the pressurizer capacity of about 1,800 cubic feet. The analysis conservatively does not take credit for a reactor trip. The operator is assumed to terminate the charging flow 10 minutes after receipt of an alarm indicating that the charging flow is higher than planned. In its letter of May 24, 2011, TVA stated that the operator response times that have been credited in the CVCS malfunction analysis will be demonstrated on the simulator. These results are subject to NRC inspection and review.

TVA stated that it conducted simulator runs to determine the alarm response for the CVCS malfunction event. The simulator runs indicated that the CVCS charging flow high alarm was received within 1 minute. The next alarm, the letdown heat exchanger return flow alarm, would occur 1 minute later. Two more alarms, the boric acid blender flow deviation and the pressurizer level high deviation alarms, are expected 4 minutes into the event. If the pressurizer fill rate, shown on FSAR Figure 15.2.15-4, were to be extrapolated by an additional 3 minutes, the peak pressurizer water volume would rise from 1,664 cubic feet to about 1,778 cubic feet, which is still within the pressurizer volume capacity. The CVCS malfunction results would still be acceptable, if any one or more of the identified alarms were to be credited.

The NRC staff reviewed TVAs evaluation of the CVCS malfunction event and agrees with the its assumptions, methods, and conclusions. The staff concludes that the operator has sufficient time to prevent this event from escalating into a more serious event.

Conclusion The NRC staff reviewed TVAs analyses of the two mass addition events, the inadvertent operation of ECCS and the CVCS malfunction, and concludes that TVAs analyses used acceptable analytical assumptions and models. The NRC staff further concludes that TVA has demonstrated that the SAFDLs and the RCPB pressure limits will not be exceeded as a result of these events. The staff concludes that TVA has shown that neither of these events could escalate into a more serious event. Based on this, the NRC staff concludes that TVAs analyses show that the requirements of GDC 10, 15, and 26 are met for the WBN Unit 2 inadvertent operation of ECCS and CVCS malfunction events.

References

1. Regulatory Guide 1.70, Revision 2, Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition), September 1975.

2. ANS 51.1, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants (replaces ANSI N18.2), American Nuclear Society, 1983.

3. WCAP-7907-P-A, T.W.T. Burnett, et al., LOFTRAN Code Description, April 1984.

15-24

4. Regulatory Issue Summary 2005-29, Anticipated Transients That Could Develop Into More Serious Events, December 14, 2005. (ADAMS Accession No. ML051890212)

5. SECY-07-0096, Possible Reactivation of Construction and Licensing Activities for the Watts Bar Nuclear Plant Unit 2, June 7, 2007. (ADAMS Accession No. ML071220492)

6. NRC Letter to TVA, Watts Bar Nuclear Plant, Unit 2Audit Report of Westinghouse Documents Relating to Final Safety Analysis Report Accident Analyses (TAC No. ME4620), April 27, 2011.

7. TVA Letter to the NRC, Watts Bar Nuclear Plant (WBN) Unit 2Additional Responses to Request for Additional Information Regarding (1) Bottom Mounted Instrument (BMI) Tube Failure and (2) Mass Addition Events, May 24, 2011.

15.2.4 Reactivity and Power Distribution Anomalies 15.2.4.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcritical Condition WBN Unit 2 FSAR Section 15.2 contains the results of TVAs analysis of Condition II events (faults of moderate frequency). FSAR Section 15.2.1 provides TVAs analysis of an uncontrolled rod cluster control assembly (RCCA) bank withdrawal from a subcritical condition (rod withdrawal from subcritical (RWFS)). The RWFS event is an AOO. An uncontrolled control rod assembly withdrawal from subcritical or low-power startup conditions may be caused by a malfunction of the reactor control or rod control systems. This withdrawal will uncontrollably add positive reactivity to the reactor core, resulting in a power excursion.

Regulatory Evaluation In its review, the NRC staff used the guidance in SRP Section 15.4.1, Revision 3, Uncontrolled Control Rod Assembly Withdrawal from a Subcritical or Low Power Startup Condition. The NRC staffs review covered (1) the description of the causes of the transient and the transient itself, (2) the initial conditions, (3) the values of reactor parameters used in the analysis, (4) the analytical methods and computer codes used, and (5) the results of the transient analyses.

The NRC based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 10, insofar as it requires that the RCS be designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations, including AOOs

• GDC 20, insofar as it requires that the RPS be designed to initiate automatically the operation of appropriate systems, including the reactivity control systems, to ensure that SAFDLs are not exceeded during any condition of normal operation, including AOOs

• GDC 25, Protection System Requirements for Reactivity Control Malfunctions, insofar as it requires that the protection system be designed to ensure that SAFDLs are not exceeded for any single malfunction of the reactivity control systems 15-25

Technical Evaluation The RCCA drive mechanisms can withdraw no more than two banks at the same time and then, only in a predetermined withdrawal sequence. The RCCA drive mechanisms are capable of withdrawing banks at various speeds. For the RWFS event analysis, it is assumed that the two sequential control banks, which have the maximum combined worth, are simultaneously withdrawn at the maximum speed. Thus, the maximum reactivity insertion rate is analyzed.

The reactivity insertion caused by the RWFS event results in a very rapid rise in core neutron flux. Reactivity feedback, caused by the Doppler effect, counteracts the increase in neutron flux. The reactor is tripped on one of the high neutron flux signals. In this case, the RWFS analysis results indicate that the reactor is tripped by the power range high neutron flux (low setting) signal, at 35 percent of nominal. The low setting is 25 percent of nominal. TVA increased the assumed setpoint by 10 percent to account for uncertainties. FSAR Table 15.2-1, Time Sequence of Events for Condition II Events, gives the analysis results.

The reactivity insertion rate that is assumed by TVA in the RWFS analysis is 75 percent millirho (or 10-5 ) (pcm)/second. This is based upon a rod withdrawal speed of 45 inches/second and represents a conservatively high reactivity insertion rate, since it is higher than the highest possible rate.

TVA assumed that the initial condition of the reactor was at HZP for the transient analysis, with a very low neutron flux (equivalent to 1x10-9 of nominal). The initial power level (i.e., neutron flux) is assumed to be lower than would be characteristic of any shutdown mode. The assumption of a high reactivity insertion rate, occurring at a low initial power level, would tend to yield a high transient heat flux.

In this RWFS analysis, two of the four RCPs are assumed to be in operation. In Mode 2 (startup), all of the RCPs are required to be in operation. The RWFS analysis is conservative, since only two of the RCPs are assumed to be operating.

The RWFS analysis is applicable to operation in Modes 3 and 4, with two of the four RCPs assumed to be operating. Since the reactor is not assumed to trip until the power range high neutron flux (low setting) setpoint is reached, it is important to maintain RCS flow, within the analyzed range, to demonstrate that departure from DNB will not occur. In its letter dated February 2, 2010 (ADAMS Accession No. ML100550326), TVA provided Developmental Revision B of the WBN Unit 2 TS. Proposed Limiting Conditions for Operation 3.4.5 and 3.4.6 require that two RCS loops be in operation when the rod control system is capable of rod withdrawal, in Modes 3 (hot standby) and 4 (hot shutdown). This is the same TS requirement as for WBN Unit 1 and is acceptable to the NRC staff.

In reality, the RWFS event is expected to produce a less severe transient in Modes 3, 4, and 5 (cold shutdown) than in Mode 2 (startup) since, in these modes, the rod control system is manually controlled. If a single failure were to occur in the rod control system, then only one RCCA bank could withdraw, and its withdrawal speed would be lower than the automatic rod withdrawal speed. Also, the source range high neutron flux trip, which is required to be operable in these modes, would terminate the event by tripping any withdrawn and withdrawing rods before any significant power level could be attained. Thus, the slower reactivity insertion rate and earlier reactor trip will prevent the generation of any significant amount of power and consequent reduction of thermal margin.

15-26

TVA performed the RWFS analysis using the following three NRC-approved methods:

(1) TWINKLE (WCAP-7979-P-A, TWINKLE, A Multi-Dimensional Neutron Kinetics Computer Code, issued January 1975) is used to determine the average core nuclear power, using spatial neutron kinetics, including the various total core feedback effects (e.g., Doppler and moderator reactivity).

(2) The average heat flux and temperature transients are determined by performing a fuel rod transient heat transfer calculation with FACTRAN (WCAP-7908-A, FACTRANA FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod, Westinghouse Electric Corporation, issued December 1989).

(3) The average heat flux transient from FACTRAN is used by VIPRE-01 (Sung, Y. X., et al.,

VIPRE-01 Modeling and Qualification for Pressurized-Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, WCAP-14565-P-A (proprietary), issued October 1999) to calculate the DNBR transient.

The RWFS analysis results show that the peak nuclear power, more than 120 percent, is reached before the rods begin to drop into the core, indicating that Doppler feedback is effective in limiting this transient. The brief duration of this peak curtails the release of energy and resulting rise in fuel temperature. The minimum DNBR and the maximum heat flux, clad, and average fuel temperatures all occur soon after the reactor trip. The maximum heat flux is less than 40 percent of nominal, the peak fuel average temperature is less than 1,900 degrees F, and the peak clad inner temperature is about 710 degrees F. The minimum DNBR remains higher than the DNBR SAL.

Conclusion The NRC staff reviewed TVAs analysis of the RWFS event and concludes that it used acceptable analytical models. The NRC staff further concludes that TVA has demonstrated that the reactor protection and safety systems will ensure the SAFDLs are not exceeded. Therefore, the NRC staff concludes that WBN Unit 2 will meet the requirements of GDC 10, 20, and 25.

15.2.4.2 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power FSAR Section 15.2.2 contains TVAs analysis of an uncontrolled RCCA bank withdrawal at power (RWAP). The RWAP is classified as a Condition II event and is an AOO. An uncontrolled RCCA RWAP may be caused by a malfunction of the reactor control or rod control systems. This withdrawal will uncontrollably add positive reactivity to the reactor core, resulting in a power excursion.

Regulatory Evaluation In its review, the NRC staff used the guidance in SRP Section 15.4.2, Revision 3, Uncontrolled Control Rod Assembly Withdrawal at Power. The NRC staffs review covered (1) the description of the causes of the AOO and the description of the event itself, (2) the initial conditions, (3) the values of reactor parameters used in the analysis, (4) the analytical methods and computer codes, and (5) the results of the associated analyses.

15-27

The NRC based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 10, insofar as it requires that the RCS be designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations, including AOOs

• GDC 20, insofar as it requires that the RPS be designed to initiate automatically the operation of appropriate systems, including the reactivity control systems, to ensure that SAFDLs are not exceeded during any condition of normal operation, including AOOs

• GDC 25, insofar as it requires that the protection system be designed to ensure that SAFDLs are not exceeded for any single malfunction of the reactivity control systems Technical Evaluation RWAP causes the core heat flux and the reactor coolant temperature to rise and consequently core thermal margin to drop. If the reactor is not tripped, the RWAP could cause the SAFDLs to be exceeded.

The following five automatic reactor trip signals in the RPS could be effective in preventing a violation of the SAFDLs:

(1) power range neutron flux (two out of four channels)

(2) overtemperature T (change in reactor coolant temperature; T) (two out of four T channels)

(3) OT (two out of four T channels)

(4) high-pressurizer pressure (two out of four pressure channels)

(5) high-pressurizer water level (two out of three level channels)

When the reactor trip occurs, TVA assumed, in its analysis, that the highest worth assembly becomes stuck in its fully withdrawn position.

TVA analyzed the RWAP event under a variety of conditions to show that the automatic reactor trip functions of the RPS provide adequate protection for all of the conditions. For WBN Unit 2, TVA showed that adequate protection is provided by the first two of the listed reactor trips: the power range neutron flux and the overtemperature T reactor trip signals. The power range neutron flux and the overtemperature T reactor trip signals are the signals that are most directly responsive to conditions that can lead to a degradation of core thermal margin and fuel clad damage.

The other reactor trip signals are available but not required to yield acceptable results, as shown by TVAs RWAP analyses. The other reactor trip signals provide defense in depth. If a plants RWAP analyses were to indicate that a reactor trip is required from any automatic RPS reactor trip signal other than the power range neutron flux or the overtemperature T reactor trip signals, that plant could be considered to have less defense in depth.

TVA based its RWAP analyses on the NRC-approved Westinghouse RTDP methodology (WCAP-11397-P-A (proprietary); WCAP-11398-A (nonproprietary)). Accordingly, initial 15-28

conditions of core power, reactor coolant average temperature, and reactor coolant pressure are assumed to be at their nominal values.

The WBN Unit 2 analyses used the LOFTRAN Code (WCAP-7907-P-A (proprietary) and WCAP-7907-A (nonproprietary), issued April 1984). This code simulates the core using a point neutron kinetics model and also simulates the RCS, the pressurizer, the pressurizer relief and safety valves, the pressurizer spray, the SGs, and the SG safety valves. These models are used to calculate transient values for coolant temperatures and pressures, as well as the core power level. LOFTRAN uses the core limits, as illustrated in FSAR Figure 5.1-1, to conservatively estimate the DNBR for every time step of the RWAP transient. To obtain conservative values of DNBR, TVA makes a number of assumptions, as described in FSAR Section 15.2.2.2, Analysis of Effects and Consequences, which address initial reactor conditions, reactivity coefficient values, power at reactor trip, RCCA trip insertion characteristics, and the maximum positive reactivity insertion rate.

The RWAP event analysis is an assembly of many RWAP case analyses. As described in FSAR Section 15.2.2.2, TVA assumed three initial power levels: 100 percent, 60 percent, and 10 percent. For each power level, it analyzed the RWAP assuming minimum reactivity feedback (i.e., at BOL) and maximum reactivity feedback (i.e., at EOL).

TVA analyzed each of the six cases identified above for a range of reactivity insertion rates.

The high end of the selected reactivity insertion rate range is higher than the positive reactivity insertion rate that would result from the simultaneous withdrawal of the two RCCA banks having the maximum combined worth at the maximum withdrawal speed. The low end of the range approaches the reactivity insertion rate that would not require or invoke an automatic reactor trip from the RPS.

The RWAP analysis, therefore, consists of a large number of transient cases. If, for example, ten reactivity insertion rates are evaluated for each of the six combinations of initial power level and reactivity feedback (above), then 60 RWAP transient analyses would be performed. TVA described the transient results of one RWAP case, from full power, to show how the plant would respond to an RWAP. The results of all the RWAP case analyses are presented as transients.

TVA grouped them into a series of plots of minimum DNBR, as a function of the reactivity insertion rate.

TVA constructed the minimum DNBR plots in the following manner. For example, for a given combination of power level and reactivity feedback (e.g., 100-percent power at BOL), it performed a series of RWAP analyses for the selected range of reactivity insertion rates. The minimum DNBR is identified from the results of each transient and marked on the corresponding plot of DNBR versus reactivity insertion rate. For example, if the minimum DNBR is 1.9 from an analysis of an RWAP that is assumed to occur at full power, at BOL conditions, and with a reactivity insertion rate of 100 pcm/second, then this DNBR value would be marked on the 100-percent power, minimum feedback RWAP plot, at the x, y coordinate of 100 and 1.9.

The source of the reactor trip signal for each case is noted. High reactivity insertion rates tend to cause power excursions that lead to a reactor trip on a power range high neutron flux trip signal. Low reactivity insertion rates tend to degrade thermal margin and ultimately lead to a reactor trip, if necessary, on an overtemperature T trip signal. Other reactor trip signals, if required to obtain acceptable results, would also be noted.

15-29

For each case, it is expected that, as the assumed reactivity insertion rate is decreased, and the resulting power excursion is decreased, the power range high neutron flux trip setpoint is reached later in the transient. This could allow the calculated DNBR to drop to lower values. It is possible that, eventually, the power range high neutron flux trip setpoint could be reached too late to prevent the DNBR from dropping below its SAL. Before this could occur, the reactor would be tripped by the overtemperature T trip signal. Generally, the overtemperature T trip logic would provide effective protection over the range of slower reactivity insertion rates. Thus, it is expected that the minimum DNBR, for the series of RWAP analysis cases, would occur at the intersection of two curves: (1) minimum DNBR versus reactivity insertion rate for RWAP events that are terminated by reactor trips that are demanded by power range high neutron flux trip signals, and (2) minimum DNBR versus reactivity insertion rate for RWAP events that are terminated by reactor trips that are demanded by overtemperature T trip signals. The minimum DNBR that results from an RWAP analysis (e.g., RWAP at 100-percent power and BOL conditions) is the minimum of all the minimum DNBR values that result from all the constituent RWAP analyses that are performed for the range of reactivity insertion rates. This minimum DNBR value is then compared to the minimum DNBR values that result from other RWAP analyses (e.g., assuming other power levels or reactivity feedback conditions) to obtain the minimum DNBR for the licensing basis RWAP event. If this minimum DNBR is greater than the DNBR SAL, then it demonstrates that the SAFDLs are not exceeded.

The results of TVAs RWAP analyses for WBN Unit 2 indicate that the minimum DNBR, for all analyzed cases (i.e., the minimum of minima), is greater than the DNBR SAL. Thus, the staff concludes that TVA has demonstrated that the SAFDLs would not be exceeded during an RWAP event.

Conclusion The NRC staff reviewed TVAs analyses of the RWAP event and concludes that it used acceptable analytical models. TVA has shown that the high neutron flux and overtemperature T trip channels provide adequate protection over the entire range of possible reactivity insertion rates (i.e., the minimum value of DNBR is higher than the DNBR SAL for all the analyzed cases). Therefore, the NRC staff concludes that TVA has demonstrated that the reactor protection and safety systems will ensure the SAFDLs are not exceeded. Based on this, the NRC staff concludes that WBN Unit 2 will meet the requirements of GDC 10, 20, and 25.

15.2.4.3 Rod Cluster Control Assembly Misalignment FSAR Section 15.2.3 provides TVAs analysis of an RCCA misalignment. The misalignment is classified as a Condition II event and is an AOO. In this review, the RCCAs are also referred to as rods. In FSAR Section 15.2.3.1, TVA states the following:

Rod cluster control assembly (RCCA) misalignment accidents include:

(1) One or more dropped RCCAs within the same group; (2) A dropped RCCA bank; (3) Statically misaligned RCCA The NRC staffs review covered the types of control rod misalignments that are assumed to occur, including those caused by a system malfunction or operator error.

15-30

Regulatory Evaluation In its review, the NRC staff used the guidance in SRP Section 15.4.3, Revision 3, Control Rod Misoperation (System Malfunction or Operator Error). The staffs review covered (1) descriptions of rod position, flux, pressure, and temperature indication systems, and those actions initiated by these systems (e.g., turbine runback, rod withdrawal prohibit, rod block) that can mitigate the effects or prevent the occurrence of various misalignments, (2) the sequence of events, (3) the analytical model used for analyses, (4) important inputs to the calculations, and (5) the results of the analyses.

The NRC based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 10, insofar as it requires that the RCS be designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations, including AOOs

• GDC 20, insofar as it requires that the RPS be designed to initiate automatically the operation of appropriate systems, including the reactivity control systems, to ensure that SAFDLs are not exceeded during any condition of normal operation, including AOOs

• GDC 25, insofar as it requires that the protection system be designed to ensure that SAFDLs are not exceeded for any single malfunction of the reactivity control systems Technical Evaluation The specific acceptance criteria from SRP Section 15.4.3 that are applied to analyses and evaluations of AOOs (Condition II events) in making the staffs determination that the regulatory requirements are satisfied include, in part, the following:

(1) Pressure in the RCS and MSS should be maintained below 110 percent of the design values, in accordance with the ASME Code.

(2) Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95-DNBR safety limit (i.e., there will be at least a 95-percent probability that DNB will not occur on the limiting fuel rods during normal operation, operational transients, or any transient conditions arising from faults of moderate frequency (Condition I and II events) at a 95-percent confidence level).

(3) An AOO should not generate a postulated accident without other faults occurring independently or result in a consequential loss of function of the RCS or reactor containment barriers.

Three types of RCCA misalignment events are evaluated:

(1) one or more dropped RCCAs from the same group, an event occurring while in automatic rod control mode, that bounds the same event while in manual rod control mode, since a power overshoot could be induced by the automatic rod control system (2) a dropped RCCA bank, which is one that inserts more than about 500 pcm of negative reactivity 15-31

(3) a statically misaligned RCCA, which is any RCCA fully inserted, or bank D inserted to its rod insertion limits with a single RCCA in that bank fully withdrawn The dropped rod accident types (1) and (2) are assumed to be initiated by a single electrical or mechanical failure that causes any number and combination of rods from the same group of a given bank to drop to the bottom of the core. The resulting negative reactivity insertion causes nuclear power to quickly decrease. In manual rod control mode, a new equilibrium condition will be reached. In the automatic rod control mode, the rod control system receives signals from the excore detectors and the turbine that indicate the presence of a primary or secondary side power mismatch. As a result, partially inserted control rods are withdrawn, and this could cause a power overshoot to occur. An increase in the hot channel factor caused by skewed power distribution could also occur.

The dropped rod accidents can be detected by the following:

• nuclear instrumentation system (rapid reduction in core power level)

• excore neutron detectors or core exit thermocouples (asymmetric power distribution)

• rod at bottom signal

• rod deviation alarm (control banks only)

• rod position indication

• power distribution monitoring system (PDMS)

A misaligned RCCA can be detected by the following:

• nuclear instrumentation system (rapid reduction in core power level)

• rod deviation alarm (control banks only)

• rod position indication

• PDMS TVA evaluated the dropped rod accidents using the dropped rod methodology approved by the NRC and Westinghouse (Haessler, R. L. et al., Methodology for the Analysis of the Dropped Rod Event, WCAP-11394-P-A (proprietary); WCAP-11395-A (nonproprietary), issued January 1990), which demonstrates that, if certain initial operating conditions are met, the event would either result in a scram or would not violate the SAFDL limits. The methodology is reactor and cycle specific. No credit is taken for (1) a direct reactor trip caused by dropped RCCA(s) or (2) any automatic power reduction features actuated by the dropped RCCA(s).

The dropped rod methodology report (WCAP-11394-P-A (proprietary); WCAP-11395-A (nonproprietary)) describes the use of the Improved Thermal Design Procedure (ITDP)

(H. Chelemer, L.H. Boman, D.R. Sharp, Improved Thermal Design Procedure, WCAP-8567 (proprietary); WCAP-8753 (nonproprietary), issued July 1975 (approved April 1978)) in the DNBR evaluation. ITDP has since been replaced with the RTDP (WCAP-11397-P-A (proprietary); WCAP-11398-A (nonproprietary). The NRC has approved both ITDP and RTDP.

Using accepted methodology, TVA has shown that the DNBR would remain greater than the DNBR SAL for the dropped rod accidents and for static rod misalignment. This demonstrates that the SAFDLs will be met.

15-32

Conclusion The NRC staff has reviewed TVAs analyses of control rod misalignment events and concludes that it used acceptable analytical models. The NRC staff further concludes that TVA has demonstrated that the reactor protection and safety systems will ensure the SAFDLs will not be exceeded during normal or anticipated operational transients. Based on this, the NRC staff concludes that WBN Unit 2 will meet the requirements of GDC 10, 20, and 25.

15.2.4.4 Chemical and Volume Control System Malfunction that Results in a Decrease in Boron Concentration in the Reactor Coolant Regulatory Evaluation WBN Unit 2 FSAR Section 15.2.4, Uncontrolled Boron Dilution, contains TVAs analysis of a CVCS malfunction that results in a decrease in boron concentration in the reactor coolant (also known as B dilution). The event is an AOO and is classified as an ANS Condition II event.

Unborated water can be added to the RCS, through the CVCS. This may happen inadvertently because of operator error or CVCS malfunction and cause an unwanted increase in reactivity and a decrease in shutdown margin. The operator should stop this unplanned dilution before the shutdown margin is eliminated.

In its review, the NRC staff used the guidance in SRP Section 15.4.6, Inadvertent Decrease in Boron Concentration in the Reactor Coolant System (PWR), Revision 2. The NRC staffs review covered (1) conditions at the time of the unplanned dilution, (2) causes, (3) initiating events, (4) the sequence of events, (5) the analytical model used for analyses, (6) the values of parameters used in the analytical model, and (7) results of the analyses.

The NRC based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 10, insofar as it requires that the RCS be designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations, including AOOs

• GDC 15, insofar as it requires that the RCS and its associated auxiliary systems be designed with margin sufficient to ensure that the design conditions of the RCPB are not exceeded during any condition of normal operation

• GDC 26, insofar as it requires that a reactivity control system be provided and be capable of reliably controlling the rate of reactivity changes to ensure that, under conditions of normal operation, including AOOs, SAFDLs are not exceeded Technical Evaluation In its analysis of Condition II events in PWRs, including the B dilution event, the NRC staff uses, in part, the following specific acceptance criteria, as described in SRP Section 15.4.6, in making its determination that the regulatory requirements are satisfied:

(1) Pressure in the RCS and MSS should be maintained below 110 percent of the design values in accordance with the ASME Code.

15-33

(2) Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95-DNBR safety limit (i.e., there will be at least a 95-percent probability that DNB will not occur on the limiting fuel rods during normal operation, operational transients, or any transient conditions arising from faults of moderate frequency (Condition I and II events) at a 95-percent confidence level).

(3) An AOO should not generate a postulated accident without other faults occurring independently or result in a consequential loss of function of the RCS or reactor containment barriers.

The B dilution analysis is performed principally to show that the second criterion is met. It is basically a time-dependent reactivity balance to determine whether there is enough time available, for automatic or manual actions, to prevent the loss of all shutdown margin (i.e., to prevent the attainment of criticality). If criticality can be prevented during a B dilution, the minimum DNBR will remain above the 95/95 limit, the SAFDLs will not be exceeded, and thus the second criterion will be satisfied.

The boron dilution analysis does not explain how the first and third AOO acceptance criteria are met for boron dilution events. The staff considers these criteria are met for the B dilution event, based upon the following reasoning:

The first criterion can be violated by adding heat (e.g., by generating power), or mass (e.g., by operating the ECCS or the charging system) to the RCS. Heat addition is not a concern during a B dilution event, since the B dilution should not cause the core to become critical. The mass addition effects are addressed by analyses of two mass addition events, the inadvertent operation of the ECCS and the CVCS malfunction, which add water to the RCS at a higher rate than would a B dilution event. Results of these analyses show that the RCS pressure safety limit is met. Since the B dilution is known to be bounded by other analyzed events, with respect to RCS pressure, it is not necessary to report specific analyses for the B dilution event.

Identifying and reporting only the limiting events is an approach that is sanctioned by RG 1.70.

The first criterion can be also violated by adding heat or mass to the MSS. Analyses of events like the feedwater malfunction and the SG tube rupture, which add mass to the MSS, show that the MSS pressure limit is met. A B dilution event would not add any heat or mass to the MSS.

B dilution is not a limiting event with respect to MSS, since it is bounded by other analyzed events.

Adding mass or heat, or both, to the RCS can also violate the third criterion by causing the pressurizer to fill with water and open the pressurizer PORVs. Since they are not qualified for water relief, the PORVs can stick open and create a more serious event, a LOCA at the top of the pressurizer. This possibility is also addressed by analyses of the inadvertent operation of the ECCS and by a CVCS malfunction.

Therefore, TVAs B dilution analysis and the staffs review of it are focused upon the second criterion. The staff applies, in part, the following criteria, from SRP Section 15.4.6, to review B dilution event analyses, with respect to minimum DNBR requirements (i.e., the second criterion):

If operator action is required to terminate the transient, the following minimum time intervals must be available between the time an alarm announces an unplanned moderator dilution and the time shutdown margin is lost:

15-34

A. During refueling: 30 minutes.

B. During startup, cold shutdown, hot shutdown, hot standby, and power operation:

15 minutes.

However, TVA applied different benchmarks in its B dilution analyses, which are listed in TVAs response to a Request for Additional Information (RAI) 15.0.0-1.b, dated December 10, 2010:

If operator action is required to terminate the transient, the following minimum intervals must be available between the initiation of the uncontrolled boron dilution event and the time of complete loss of shutdown margin:

a. Refueling (Mode 6): 30 minutes

b. Startup and Power (Modes 2 and 1): 15 minutes TVAs B dilution analyses, performed in accordance with these benchmarks, (1) evaluate B dilution occurrences only in Modes 1, 2, and 6, and (2) define the time that is available for operator action to begin at the inception of the dilution, rather than at the time of an alarm or other indication.

During an audit conducted by the NRC staff on June 28-30, 2011, at the Westinghouse offices in Cranberry, PA, the NRC asked TVA for an evaluation or analysis of B dilution events occurring in Modes 3, 4, and 5. In its response, dated July 29, 2011, TVA stated the following:

The Watts Bar units were originally licensed to Regulatory Guide 1.70, Revision 0 and 1 which required explicit Boron Dilution calculations in Modes 1, 2 and 6. Subsequent revisions to Regulatory Guide 1.70 have added requirements to consider boron dilutions in all six operating modes.

However, WBN Unit 1 FSAR Chapter 15 states the following:

This chapter addresses the accident conditions listed in Table 15-1 of the NRC Standard Format and Content Guide, Regulatory Guide 1.70, Revision 2, which apply to WBN.

WBN Unit 2 FSAR Chapter 15 contains the same statement. The NRC issued SRP Section 15.4.6, which calls for analysis of the B dilution event in all modes of operation, in November 1975, and issued RG 1.70, Revision 2, in September 1975. Therefore, the NRC staff considers that RG 1.70, Revision 2, is the licensing basis for WBN Units 1 and 2.

TVA must provide the NRC staff with analyses of the B dilution event that meet the criteria of SRP Section 15.4.6, including a description of the methods and procedures used by the operators to identify the dilution path(s) and terminate the dilution, in order for the staff to determine that the analyses comply with GDC 10. This is Open Item 132 (Appendix HH).

Therefore, the staffs review in this SSER, is limited to the WBN Unit 2 B dilution event analyses for Modes 1, 2, and 6.

Table 15.2.4.4-1 summarizes the B dilution analysis results.

15-35

Table 15.2.4.4-1 Boron Dilution Analysis Results Indication No Shutdown Indication Time (min) Margin (min)

Mode 1: Power Operation (automatic rod control) LOW-LOW rod insertion limit t6 > t + 15 Mode 1: Power Operation (manual rod control) overtemperature T 1.3 33 Mode 2: Startup source range high flux t t + 26.4 Shutdown modes below P-6, and 104 counts/sec:

Mode 3: Hot Standby high flux at shutdown alarm (setting Mode 4: Hot Shutdown is automatically reduced as the Mode 5: Cold Shutdown count rate drops) not reported not reported dilution cannot occur due to administrative controls; source Mode 6: Refueling range high flux level alarm n/a n/a In addition to providing a shutdown alarm setting at 30 minutes following reactor shutdown, when in a hot standby, hot shutdown, and subsequent cold shutdown condition, and once below the P-6 interlock setpoint, the high-flux-at-shutdown alarm setpoint will be maintained at one-half decade or less above the source range count rate by readjusting its setpoint at least once every 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> during the first 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following shutdown and at least once per shift afterwards (as necessary).

The table indicates that there is enough time available to prevent the loss of shutdown margin during a B dilution, for Modes 1, 2, and 6. Therefore the SAFDLs will not be exceeded.

At power (Mode 1), TVA assumed a conservatively high dilution flow of 235 gallons per minute (gpm), delivered by three charging pumps. In fact, the third pump, a positive displacement charging pump, was abandoned by TVA but was nevertheless assumed to be operating for the purposes of this analysis. A low RCS water volume, 8,451 cubic feet, which corresponds to the active RCS volume, minus the volumes of the pressurizer and the reactor vessel upper head, was assumed to be available for dilution. A high initial boron concentration (1,500 parts per million (ppm)) was assumed. This corresponds to the critical concentration at hot full power, with rods inserted to their insertion limits, and without xenon. After the reactor trip, the critical boron concentration was assumed to be 1,250 ppm, which corresponds to HZP, with all but the most reactive rod inserted, and without xenon. Thus, a dilution of just 250 ppm would be enough to cause the core to return to critical.

TVA considered automatic and manual rod control modes in its analysis. In the automatic control mode, the rods would be inserted to compensate for the power and temperature increase caused by the boron dilution, and this would decrease the available shutdown margin.

The operator would be alerted by the rod insertion limit alarms that a boron dilution is occurring.

The analysis results indicate that more than 15 minutes are available for operator action from the time of the low-low rod insertion limit alarm to the loss of available shutdown margin. In manual rod control mode, the increase in power and temperature would lead to an automatic reactor trip from overtemperature T. Following the trip, the operator would have more than 15 minutes to terminate the boron dilution before losing shutdown margin.

6 In some cases, the time at which an indication (e.g., alarm or trip) is received was not provided. This time, denoted in the table by t, defines the beginning of the time interval that is available for operator action.

15-36

The results of the boron dilution analysis, as described by TVA and reported in FSAR Section 15.2.4, indicate that there is adequate time for the operator to terminate the boron dilution before shutdown margin is lost. Therefore, the B dilution analysis results for Modes 1 and 2 are acceptable, since the NRC staff can conclude that they show that there is sufficient time available for manual action to prevent the core from becoming critical, whether the available time interval is defined to begin at the inception of the event or at the receipt of an alarm. During refueling (Mode 6), certain valves are closed, in accordance with administrative controls, which block the flow of unborated makeup water to the RCS.

In its analysis, TVA did not consider Modes 3, 4, and 5, which are the three modes in which shutdown margin is the key initial condition for a B dilution event, which erodes shutdown margin. Therefore, the NRC staff did not draw a conclusion regarding the safety analyses of boron dilution events occurring in Modes 3, 4, and 5.

Conclusion The NRC staff reviewed TVAs analyses of the decrease in boron concentration in the reactor coolant caused by a CVCS malfunction and concludes that the applicants analyses used acceptable analytical models. The NRC staff further concludes that TVA has demonstrated that the reactor protection and safety systems and operator actions will ensure that the SAFDLs and the RCPB pressure limits will not be exceeded as a result of this event, for Modes 1, 2, and 6.

Based on this, the NRC staff concludes that the plant will meet the requirements of GDC 10, 15, and 26, in the event of a decrease in boron concentration in the reactor coolant caused by a CVCS malfunction occurring in Modes 1, 2, and 6. The staff did not evaluate B dilution events occurring in Modes 3, 4, and 5 (Open Item 132, Appendix HH).

References

1. NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Section 15.4.6, Inadvertent Decrease in Boron Concentration in the Reactor Coolant System (PWR), Revision 2, March 2007.

2. Regulatory Guide 1.70, Revision 2, Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition), September 1975.

3. Letter from M. Bajestani (TVA), to NRC, Watts Bar Nuclear Plant (WBN) Unit 2Final Safety Analysis Report (FSAR)Response to Requests for Additional Information, December 10, 2010.

4. Letter from D. Stinson (TVA), to NRC, Watts Bar Nuclear Plant (WBN) Unit 2Response to Request for Additional Information (RAI) Regarding June 28, 2011 NRC AuditSteam Line Break (SLB) and Other Miscellaneous RAIs, July 29, 2011.

15.2.4.5 Inadvertent Loading of a Fuel Assembly into an Improper Position FSAR Section 15.3.3 provides TVAs analysis of the inadvertent loading of a fuel assembly into an improper position in the reactor core. The event is classified as a Condition III event, defined as an infrequent event that may occur during the lifetime of the plant.

15-37

Regulatory Evaluation In its review, the NRC staff used the guidance in SRP Section 15.4.7, Revision 2, Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position. The NRC based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 13, Instrumentation and Control, insofar as it requires that instrumentation be provided to monitor variables and systems over their anticipated ranges for normal operation, for AOOs, and for accident conditions, as appropriate, to ensure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the RCPB, and the containment and its associated systems

• 10 CFR Part 100, Reactor Site Criteria, as it relates to offsite consequences resulting from reactor operations with an undetected misloaded fuel assembly The staff applies the following acceptance criteria to analyses and evaluations of Condition III events:

(1) Some fuel damage may be incurred, and this may prevent resumption of plant operations for a significant period, but the fuel damage shall be limited to a small fraction of the core loading.

(2) Any release of radioactive material shall not be sufficient to interrupt or restrict public use of those areas beyond the exclusion area.

(3) A Condition III fault will not, by itself, generate a Condition IV fault or result in a consequential loss of function of the RCS or containment barriers.

Meeting these criteria provides assurance that, in the event of an undetected fuel-loading error, radiation exposures at the site boundary will not exceed a small fraction of the reference values specified in 10 CFR Part 100. A small fraction is interpreted to be less than 10 percent of the 10 CFR Part 100 reference values.

Technical Evaluation The inadvertent loading of a fuel assembly into an improper position includes the fabrication of a fuel rod containing one or more pellets of the wrong (e.g., higher) enrichment and the inadvertent loading of one or more fuel assemblies requiring burnable poison rods into a new core without burnable poison rods.

An error in the enrichment distribution, caused by either rod placement or rod manufacture, in excess of the core design uncertainty margin could cause the skewing of power shapes to levels that are outside the design envelope. FSAR Section 15.3.3.1 states the following:

The Power Distribution Monitoring System is capable of revealing any assembly enrichment error or loading error which causes power shapes to be peaked in excess of the design value.

To reduce the probability of core loading errors, each fuel assembly is marked with an identification number and loaded in accordance with a core loading diagram. During core loading the identification number is checked before each 15-38

assembly is moved into the core. Serial numbers read during fuel movement are subsequently recorded on the loading diagram as a further check on proper placing after the loading is completed. In addition to the Power Distribution Monitoring System, thermocouples are located at the outlet of about one third of the fuel assemblies in the core. There is a high probability that these thermocouples would also indicate any abnormally high coolant enthalpy rise.

The WBN Unit 2 PDMS monitors variables that can affect the fission process and the integrity of the reactor core, which complies with GDC 13.

The PDMS is also used during startup testing to detect misloaded fuel before proceeding to power operation, and TVA uses administrative procedures to prevent fuel assembly loading errors during core loading.

As stated in FSAR Section 15.3.3.2, TVA used the TURTLE code to calculate the steady-state power distributions that would be measured in the core, following the misloading of a fuel assembly. TVA analyzed the following misloading configurations in the core regions:

• a case in which a Region 1 assembly is interchanged with a Region 3 assembly

• two cases in which a Region 1 assembly is interchanged with a neighboring Region 2 fuel assembly

• an enrichment error case, in which a Region 2 fuel assembly is loaded in the core central position

• a case in which a Region 2 fuel assembly, instead of a Region 1 assembly, is loaded near the core periphery For each of these five cases, the detector indications, measured as the percent deviation from normal, were reported. The selected fuel-loading errors represent the spectrum of potential inadvertent fuel misplacement and demonstrate that the power distribution effects resulting from fuel assembly loading errors (i.e., errors that are not detected by the PDMS) would cause only a small, acceptable perturbation, which would fall within the design power shape allowances.

FSAR Section 15.3.3.3 also states that fuel assembly enrichment errors would be prevented by administrative procedures implemented in fabrication. Despite these administrative procedures, if a fuel pin or pellet is produced with a higher-than-nominal enrichment, there may be a reduction in thermal margin; however, this effect would be limited to the region of that fuel pin.

Based on its review of the analyses provided by TVA in FSAR Section 15.3.3, the NRC staff concludes that there is reasonable assurance that an improperly loaded fuel assembly that could cause a significant safety problem would be detected by the instruments available to the operator.

Conclusion The NRC staff has reviewed TVAs analyses of the inadvertent loading of a fuel assembly into an improper position and concludes that it used acceptable analytical models. The NRC staff further concludes that TVA has demonstrated that the reactor protection and safety systems will 15-39

ensure that the Condition III acceptance criteria will be satisfied. Based on this, the NRC staff concludes that WBN Unit 2 will meet the requirements of GDC 13 and 10 CFR Part 100 in the event of an inadvertent loading of a fuel assembly into an improper position.

15.2.4.6 Single Rod Cluster Control Assembly Withdrawal at Full Power FSAR Section 15.3.6 contains TVAs analysis of an RCCA withdrawal at full power, classified as a Condition III event.

Regulatory Evaluation The NRC staffs review covered the event involving a single RCCA withdrawal at full power caused by operator error. FSAR Section 15.3.6 states the following:

The current WBN design basis for the single rod cluster control assembly (RCCA) withdrawal at full power event assumes no single electrical or mechanical failure in the rod control system could cause the accidental withdrawal of a single RCCA from the inserted bank at full power operation. The operator could deliberately withdraw a single RCCA in the control bank since this feature is necessary in order to retrieve an assembly should one be accidentally dropped. In the extremely unlikely event of simultaneous electrical failures which could result in single RCCA withdrawal, rod deviation and rod control urgent failure would both be displayed on the plant annunciator, and the rod position indicators would indicate the relative positions in the assemblies in the bank.

The urgent failure alarm also inhibits automatic rod withdrawal. Withdrawal of a single RCCA by operator action would result in activation of the same alarm and the same visual indications.

In its review, the NRC staff used the guidance of SRP Section 15.4.3, Revision 3. The staffs review covered (1) descriptions of rod position, flux, pressure, and temperature indication systems, as well as those actions initiated by these systems (e.g., turbine runback, rod withdrawal prohibit, rod block) that can mitigate the effects or prevent the occurrence of a single RCCA withdrawal, (2) the sequence of events, (3) the analytical model used for analyses, (4) important inputs to the calculations, and (5) the results of the analyses.

The NRC based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 10, insofar as it requires that the RCS be designed with appropriate margin to ensure that SAFDLs are not exceeded during normal operations, including AOOs

• GDC 20, insofar as it requires that the RPS be designed to initiate automatically the operation of appropriate systems, including the reactivity control systems, to ensure that SAFDLs are not exceeded during any condition of normal operation, including AOOs

• GDC 25, insofar as it requires that the protection system be designed to ensure that SAFDLs are not exceeded for any single malfunction of the reactivity control systems The staff applies the following acceptance criteria to analyses and evaluations of Condition III events:

15-40

(1) Some fuel damage may be incurred, and this may prevent resumption of plant operation for a significant period, but the fuel damage shall be limited to a small fraction of the core loading.

(2) Any release of radioactive material shall not be sufficient to interrupt or restrict public use of those areas beyond the exclusion area.

(3) A Condition III fault will not, by itself, generate a Condition IV fault or result in a consequential loss of function of the RCS or containment barriers.

Meeting these criteria provides assurance that, in the event of a single RCCA withdrawal, radiation exposures at the site boundary will not exceed a small fraction of the reference values specified in 10 CFR Part 100. A small fraction is interpreted to be less than 10 percent of the 10 CFR Part 100 reference values.

Technical Evaluation Since TVA has classified the single RCCA withdrawal as a Condition III event, there is a possibility that the SAFDLs may be violated. To demonstrate compliance with the first acceptance criterion, which specifies that only a limited amount of fuel damage can be incurred, TVA defined the acceptable amount of fuel damage to be no more than 5 percent. Based on experience with the type of fuel and core in WBN Unit 2, the staff agrees that this would be an acceptable amount of fuel damage for this Condition III event, since the consequential release of radioactivity would not be sufficient to interrupt or restrict public use of those areas beyond the exclusion radius. TVA used an NRC-approved methodology in its analysis, as documented in the references for FSAR Section 15.3.6.3.

As described above, TVA has identified no single electrical or mechanical failure in the rod control system that could cause the withdrawal of a single RCCA from an inserted bank at full power operation. The operator could deliberately withdraw a single RCCA in the control bank, since this feature is necessary to retrieve an assembly, should one be accidentally dropped.

TVA postulated the withdrawal of the worst case rod from bank D, when it is inserted to its insertion limit. The core was assumed to be at BOL and operating at full power. At BOL, the moderator temperature coefficient is at its minimum value. This maximizes the power excursion and minimizes the moderator temperature feedback on power distribution. This case was considered assuming operation at full power, both with and without automatic rod control. The case that assumes the operation of automatic rod control is somewhat artificial, since failures that could cause a single rod withdrawal would also immobilize the bank and thereby reduce this case to a variation of the manual rod control case.

The single RCCA withdrawal at full power is similar to the RWAP, except there is more local power peaking in the area of the withdrawn RCCA. This results in a lower minimum DNBR, which may be unacceptably low. TVA evaluated the single RCCA withdrawal at full power at the time of the expected reactor trip from an overtemperature T signal and found that less than 5 percent of the rods would have unacceptable DNBRs (i.e., DNBRs that are lower than the DNBR SAL). Thus, the SAFDLs would be exceeded in less than 5 percent of the rods.

Based on the core power distribution analysis results, the NRC staff concludes that less than 5 percent of the fuel rods would be in DNB. The analysis results show that TVAs fuel failure 15-41

criterion is satisfied. Therefore, the staff concludes that the analysis and calculated consequences of this event are acceptable.

Conclusion The NRC staff reviewed TVAs analyses of the single RCCA withdrawal at full power and concludes that it used acceptable analytical models. The NRC staff further concludes that TVA has demonstrated that the Condition III acceptance criteria will be satisfied. Based on this, the NRC staff concludes that WBN Unit 2 will meet the requirements of GDC 10, 20, and 25, in the event of a single RCCA withdrawal at full power.

15.3 Limiting Accidents 15.3.1 Loss-of-Coolant Accidents LOCAs are postulated accidents that would result in the loss of reactor coolant from piping breaks in the RCPB at a rate in excess of the capability of the normal reactor coolant makeup system to replenish it. Loss of significant quantities of reactor coolant would prevent heat removal from the reactor core, unless the water is replenished. The RPS and ECCS are provided to mitigate these accidents. FSAR Section 15.3.1 and Section 15.4.1, Major Reactor Coolant System Pipe Ruptures (Loss of Coolant Accident), contain TVAs analyses of LOCAs.

The NRC staffs review covered (1) the licensees determination of break locations and break sizes, (2) postulated initial conditions, (3) the sequence of events, (4) the analytical model used for analyses and calculations of the reactor power, pressure, flow, and temperature transients, (5) calculations of peak cladding temperature (PCT), total oxidation of the cladding, total hydrogen generation, changes in core geometry, and long-term cooling, (6) functional and operational characteristics of the reactor protection and ECCS systems, and (7) operator actions. In its review, the staff used the guidance provided in SRP Section 6.3, Revision 3, Emergency Core Cooling System, and in SRP Section 15.6.5, Revision 3, Loss-of-Coolant Accidents Resulting from Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary.

The NRC staff based its acceptance criteria, in part, on the following regulatory requirements:

• 10 CFR 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light-Water Nuclear Power Reactors, insofar as it establishes standards for calculating ECCS performance and acceptance criteria for that calculated performance

• 10 CFR Part 50, Appendix K, ECCS Evaluation Models, insofar as it establishes required and acceptable features of evaluation models for heat removal by the ECCS after the blowdown phase of a LOCA

• GDC 4, Environmental and Dynamic Effects Design Bases, insofar as it requires that structures, systems, and components important to safety be designed to accommodate the effects of, and to be compatible with, the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, including LOCAs

• GDC 27, Combined Reactivity Control Systems Capability, insofar as it requires that the reactivity control systems be designed to have a combined capability, in conjunction 15-42

with poison addition by the ECCS, of reliably controlling reactivity changes to ensure that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained

• GDC 35, Emergency Core Cooling, insofar as it requires that a system to provide abundant emergency core cooling shall be provided to transfer heat from the reactor core following any LOCA at a rate such that fuel and clad damage that could interfere with continued effective core cooling is prevented Technical Evaluation The NRC staff evaluated the WBN ECCS performance by reviewing the results of the large- and small-break LOCA analyses performed by TVA at 3,479.8 megawatts thermal (MWt) (including a 0.5-percent uncertainty) and a peak linear heat generation rate of 13.89 kilowatts per foot for WBN Unit 2, as documented in FSAR Sections 15.3.1 and 15.4.1, and as supplemented by TVAs letter to the NRC, Watts Bar Nuclear Plant (WBN) Unit 2Final Safety Analysis Report (FSAR)Response to Requests for Additional Information, dated November 9, 2010 (ADAMS Accession No. ML103200146). The staff also reviewed the results of the post-LOCA long-term cooling analyses to verify that the plant EOPs can properly deal with and control the buildup of boric acid accumulation in the RCS following both large- and small-break LOCAs. The EOPs specify the latest time at which hot leg injection must be initiated to prevent further buildup following a LOCA.

Large-Break Loss-of-Coolant Accident TVA described its thermal analysis method for the large-break LOCA in FSAR Section 15.4.1.1.2. It performed the large-break LOCA analysis using the ASTRUM methodology documented in NRC-approved topical report, WCAP-16009-P-A, Realistic Large Break LOCA Evaluation Methodology Using Automated Statistical Treatment of Uncertainty Method (ASTRUM), issued January 2005. WCAP-12945-P-A, Code Qualification Document for Best Estimate Loss of Coolant Accident Analysis, issued March 1998, and WCAP-16009 describe the application of the WCOBRA/TRAC code to the large-break LOCA ASTRUM methodology. The ASTRUM methodology replaces the response surface technique with a statistical sampling where the uncertainty parameters are simultaneously sampled for each case.

The ASTRUM evaluation identified the limiting large-break LOCA as a cold leg split break with an area of 1.8138 square feet. This limiting break PCT corresponds to a bounding estimate value of 1,552 degrees F, which is well below the limit of 2,200 degrees F in 10 CFR 50.46(b)(1). FSAR Section 15.4.1.1.6 states that the limiting PCT corresponds to a bounding estimate of the 95th percentile at the 95-percent confidence level (95/95).

The 95/95 peak local oxidation was calculated to be 1.04 percent, while corewide oxidation was calculated to be much less than 0.1 percent. These results are well within the limits of 10 CFR 50.46 and are acceptable to the staff.

The analysis results for the limiting large-break LOCA show the downcomer and core average channel liquid levels decreasing from 350 to 400 seconds after the break opens. The end time of the limiting large-break LOCA is 400 seconds. Although the PCT has been reduced to near fluid saturation temperature levels of 250 degrees F at 400 seconds, the analysis should be continued until the liquid inventories in the core display a steadily increasing trend. In this 15-43

condition, assurance is provided to demonstrate that the core two-phase level will remain above the top of the core and uncovery will not develop later in the event, so that core cladding temperatures can be maintained near the fluid saturation temperature. TVAs analysis stated that core temperatures can be maintained at acceptably low levels, so long-term cooling is assured, but this was not verified for the limiting large-break LOCA. Therefore, the staff requested that TVA extend the limiting large-break LOCA analysis in time to show that the liquid mass and, hence, two-phase level (quench), is increasing in time before termination of the analysis. In its response to the staff by a letter dated May 13, 2011, TVA extended the analysis out to 800 seconds, at which time the mass in the core displayed an increasing trend for the last 200 seconds. Therefore, extending the analysis beyond 400 seconds showed a steadily increasing fluid inventory in the core and downcomer regions and demonstrated that the core remains covered with a two-phase mixture and can be cooled for an indefinite period of time for the limiting break.

The staff requested that TVA provide a time step sensitivity study for the limiting break displaying downcomer boiling. In response to the staff by letter dated May 13, 2011, TVA performed analyses to show the change in PCT for the worst downcomer boiling case over the range 0.1 to 1.0 millisecond (msec) to be less than 50 degrees F. TVAs original analysis used a maximum time step of 0.3 msec. The smaller time steps did not affect downcomer boiling, since the downcomer reached saturation, producing the limiting PCT for the downcomer boiling case with the larger time step. Condensation was found to have a small effect, since the downcomer was saturated during the event after the accumulators emptied. The staff requested that TVA provide an analysis of downcomer boiling calculated using lateral k-factors based on the formulas in Idelchiks Handbook of Hydraulic Resistance to investigate the impact of downcomer boiling on the PCT. In its response to the staff by a letter dated May 13, 2011, use of the Idelchik lateral k-factors joining the downcomer azimuthal downcomer cells reduced the PCT for the worst downcomer boiling case. The reference calculations used a zero lateral k-factor. The use of zero lateral k-factors in the downcomer increased the emergency core cooling bypass effects and fluid level swell, increasing the loss of liquid from the downcomer out the break in the cold leg. These sensitivity studies showed that the WCOBRA/TRAC code produces a lower inventory in the downcomer with zero lateral losses, which enhances downcomer boiling following emptying of the accumulators and thereby produces a higher PCT for the worst downcomer boiling case. Such analyses are necessary to ensure that the case with lateral k-factors included does not enhance downcomer boiling caused by the more restricted radial mixing (which could enhance boiling) imposed by the higher resistance, which could be more limiting than the increased emergency core cooling bypass effect with no losses included in the lateral direction. The staff concluded that TVAs analysis was acceptable, since the PCT criterion of 10 CFR 50.46 are satisfied.

Small-Break Loss-of-Coolant Accident FSAR Section 15.3.1.2 discusses TVAs evaluation of small-break LOCAs, which includes an analysis of the 2-, 3-, 4-, 6-, and 8.75-inch diameter breaks in the cold leg at the reactor coolant discharge leg. TVA found that the worst break was the 4-inch break with a PCT of 1,183.9 degrees F. These analyses assumed the break was located in the limiting location, which is on the bottom of the cold leg at the RCP discharge. TVA used the NRC-approved NOTRUMP digital computer code to perform the small-break LOCA spectrum analysis.

While integer break size evaluations are too coarse to identify the most limiting small break, the very low temperature of the limiting break used by TVA demonstrates considerable margin relative to the criterion limit of 2,200 degrees F. Thus, the staff concludes that additional 15-44

analyses are not required to more accurately characterize the small-break spectrum. The staff concludes that TVAs small-break LOCA analysis is acceptable, since it demonstrates a large margin to the limit of 2,200 degrees F in 10 CFR 50.46.

Post-LOCA Long-Term Cooling Large- and Small-Break Behavior In Enclosure 4 to its letter dated November 9, 2010, TVA provided an analysis of small-break post-LOCA long-term cooling. As documented in Enclosure 4, the NRC previously approved the methodology TVA used in its analysis. The assessment covers the full spectrum of break sizes, from the double-ended guillotine break down to and including the 0.005 square foot cold leg break in the reactor coolant discharge leg. TVAs analysis demonstrated control of boric acid precipitation for small-break LOCAs. Of particular importance to TVAs analysis is the EOP action to initiate a cooldown for small breaks no later than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> following the LOCA. This will ensure that small breaks, which may not allow sufficient hot and cold leg injection to establish a flushing flow, will refill with injection and reestablish single phase natural circulation that will remove the boric acid buildup during the early portion of the small-break LOCA. Based on its review of the information provided by TVA, the staff concludes that TVAs methods and analysis of small-break LOCA boric acid control are acceptable.

The NRC staff also performed audit calculations that confirmed the precipitation timing of approximately 4.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> for the limiting large-break LOCA, which compare well with TVAs analysis results of 4.90 hours0.00104 days <br />0.025 hours <br />1.488095e-4 weeks <br />3.4245e-5 months <br />.

The boric acid precipitation analysis made the following major assumptions:

• core power3,469 MWt (plus 0.06-percent uncertainty)

• decay heat standard1971 ANS decay heat standard (1.2 multiplier)

• mixing volume50 percent of the lower plenum plus the core

• concentration of refueling water storage tank3,300 ppm

• limiting axial power shapebottom peaked axial power distribution The staff model includes the impact of the loop resistance on the mixing volume, which slowly increases with time. The loop resistance included a locked rotor k-factor for the RCPs. The void distribution was determined using a drift-flux methodology to model the axial gradient in void in the core region. The staff drift-flux model was validated against separate effects two-phase level swell and bundle uncovery heatup test data (GE level swell, thermal-hydraulic test facility, G-2 level swell and uncovery data, Achilles level swell data, and THETIS void data).

The staff questioned TVAs analysis assumption that 100 percent of the core-generated steam exiting the break was condensed and returned to the sump to reduce the sump boric acid concentration. The staff did not agree that all of the core-generated steam exiting the break would be condensed during recirculation. In its response to the staff by a letter dated July 18, 2011, TVA performed an additional analysis with zero-percent condensation. This reduced the precipitation time from 4.90 hours0.00104 days <br />0.025 hours <br />1.488095e-4 weeks <br />3.4245e-5 months <br /> to 3.96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />, since the sump liquid concentration was no longer diluted with condensed vapor from the break. The staff analysis confirmed this subsequent calculation. The staff considers the analysis with zero-percent steam condensation efficiency from the break (which results in no long-term dilution of the sump concentration) to be the analysis of record. This 3.96-hour precipitation time provides 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of 15-45

margin for the EOP switch time for hot leg injection, which is 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Therefore, the NRC staff finds this analysis acceptable.

In its letter dated July 18, 2011, TVA also documented its conclusion that entrainment of the hot side injection would not occur after 63 minutes, using the Ishii-Grolmes entrainment correlation.

This correlation applies to conditions where the liquid does not occupy a significant volume in the piping, and viscosity does not dominate (the liquid phase is in the turbulent regime). While the correlation is similar to the Wallis-Steen correlation, use of the Ishii-Grolmes correlation produces a much earlier entrainment time than that for the Wallis-Steen correlation. Based on these calculations, hot and cold side injections are not initiated during the period of time entrainment could preclude injection into the hot legs. The NRC staff concludes that this analysis is acceptable, since the earliest switch time is 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> following opening of the break.

Failure of Bottom Mounted Instrument Tubes WBN Unit 2 has BMI tube penetrations into the bottom of the lower head of the reactor vessel.

The staff asked TVA, in RAI 15.3.1-2h, to evaluate the failure of one of the instrument tubes. In to its letter dated November 9, 2010, TVA stated the following:

[A] joint effort between the WOG [Westinghouse Owners Group], B&W Owners Group (BWOG) and MRP (Materials Reliability Program (EPRI)) was developed to provide this response. The effort culminated in the development of internal documentation which supports the various conclusions reached in regards to these issues. A meeting to present the WOG and BWOG results to the NRC was held on September 30 of 2005. A summary of the observed LOCA response is provided below:

• Different plant groups demonstrate similar responses to the BMI small LOCA event. Evaluated thermal hydraulic analysis cases representative of WBN Unit 2 show that a BMI tube break of approximately 1.25 inches equivalent diameter can be withstood under timely operator action (45 minutes) to depressurize without core uncovery.

TVA provided no comparison of key ECCS parameters and core power/RCS volume to show that WBN Unit 2 falls within the analysis limits of this generic analysis of a single failed tube.

The staff questioned the applicability of the generic analysis to WBN Unit 2, since there was no comparison of key ECCS parameters to show that WBN Unit 2 falls within the analysis limits of this generic analysis of a single failed tube. In its response to the staff by letter dated July 18, 2011, TVA provided a comparison of key parameters for WBN Unit 2 with the generic plant analysis. The WBN Unit 2 power level, high-pressure SI capacity, PORV, and steam dump capacities, which affect cooldown capability, are equal to or bounded by the generic calculation. The EOP instructions also reflect the analysis timing and equipment capacities contained in the generic analysis for the failure of an instrument tube. As such, the staff agrees that the generic analysis of an instrument tube failure applies to the WBN nuclear steam supply system (NSSS).

Conclusion The NRC staff reviewed the large-break LOCA, small-break LOCA, and boric acid precipitation analyses performed by TVA for Watts Bar Unit 2 and concluded that the analyses demonstrate 15-46

acceptable ECCS performance. Evaluation of boric acid precipitation timing for all break sizes demonstrates that prevention of precipitation is assured, and the EOPs reflect the analysis timing for operator action to align the ECCS for hot and cold side injection to preclude the precipitation. Based on these results, the staff concludes that, for WBN Unit 2 at the power level of 3,479.8 MWt (including a 0.5-percent uncertainty) and a peak linear heat generation rate of 13.89 kilowatt per foot, acceptable ECCS performance is assured for all break sizes and locations. Therefore, the staff concludes that TVA demonstrates compliance for WBN Unit 2 with the requirements set forth in 10 CFR 50.46; 10 CFR Part 50, Appendix K; and GDC 4, 27, and 35.

References

1. Idelchik, I.E., Handbook of Hydraulic Resistance, Third Edition, ICRC Begell House, 1994.

2. Ishii, M., Grolmes, M.A., Inception Criteria for Droplet Entrainment in Two-Phase Concurrent Film Flow, AIChE Journal, Vol. 21, No. 2, pp. 308-319, 1975.

3. Wallis, G.B., One-Dimensional Two-Phase Flow, pp. 390-393, 1969.

15.3.2 Steamline Break FSAR Section 15.4.2.1, Major Rupture of a Main Steam Line, describes the results of TVAs analysis of a rupture of the main steamline. The steam release from a main steam piping rupture will result in an increase in steam flow, a reduction of coolant temperature and pressure, and an increase in core reactivity. The core reactivity increase may cause a power level increase and a decrease in shutdown margin. Reactor protection and safety systems are actuated to mitigate the transient.

Regulatory Evaluation In its review, the NRC staff referred to the guidance in SRP Section 15.1.5, Steam System Piping Failures Inside and Outside of Containment (PWR), Revision 3. The NRC staff's review covered (1) postulated initial core and reactor conditions, (2) methods of thermal and hydraulic analyses, (3) the sequence of events, (4) assumed responses of the reactor coolant and auxiliary systems, (5) functional and operational characteristics of the RPS, (6) operator actions, (7) a core power excursion caused by power demand created by excessive steam flow, (8) variables influencing neutronics, and (9) the results of the transient analyses.

The NRC staff based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 27, insofar as it requires that the reactivity control systems be designed to have a combined capability, in conjunction with poison addition by the ECCS, of reliably controlling reactivity changes to ensure that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained

• GDC 28, insofar as it requires that the reactivity control systems be designed to ensure that the effects of postulated reactivity accidents can neither result in damage to the RCPB greater than limited local yielding, nor sufficiently disturb the core, its support structures, or other reactor vessel internals to impair significantly the capability to cool the core 15-47

• GDC 31, Fracture Prevention of Reactor Coolant Pressure Boundary, insofar as it requires that the RCPB be designed with sufficient margin to ensure that, under specified conditions, it will behave in a nonbrittle manner and that the probability of a rapidly propagating fracture is minimized

• GDC 35, insofar as it requires that a system to provide abundant emergency core cooling shall be provided Technical Evaluation Steam System Piping Failures at Hot Zero Power The major steamline break (MSLB) is the most limiting cooldown transient. It is analyzed at HZP conditions, assuming there is no decay heat present. Decay heat would slow the cooldown and the associated reactivity excursion and ultimately reduce the peak power level that is attained, should the cooldown lead to a post-trip return to criticality.

The largest possible effective steamline break size is 1.388 square feet, the area of the flow restrictors situated in the steam exit nozzles of the WBN Unit 2 preheat-type SGs. TVA analyzed cases assuming that offsite power is, and is not, available, and that there are no plugged tubes in the SGs (to maximize the core cooldown rate).

TVA used the LOFTRAN computer code (WCAP-7907-P-A) to simulate the NSSS response to the HZP MSLB transient and to provide dynamic core conditions to the VIPRE thermal-hydraulic code (NP-2511-CCM-A, VIPRE-01: A Thermal Hydraulic Code for Reactor Cores). The VIPRE code applied the W-3 correlation to calculate the minimum DNBR reached for each of analyzed MSLB transients. The NRC staff previously reviewed and approved these computer models and methods for licensing applications, including analyses of the MSLB.

HZP conditions were modeled with an available shutdown margin of 1.6-percent k/k (reactivity). All control rod assemblies were assumed to be inserted, except the most reactive control rod assembly, which was assumed to be stuck in its fully withdrawn position. In the event of a return to criticality, the highest hot channel factors would be found in the region of this stuck control rod assembly. Table 15.3.2-1 summarizes the results of TVAs MSLB analyses from WBN Unit 2 FSAR Chapter 15.

Table 15.3.2-1 MSLB Analyses Results Offsite power Offsite power Event available not available Steam line ruptures 0.0 sec 0.0 sec Low steam line pressure is reached 0.7 sec 0.7 sec Pressurizer empties 11.0 sec 12.0 sec Core returns to critical 44.0 sec 58.0 sec ECCS boron reaches the core 34.0 sec 46.0 sec Accumulator delivery begins 54.0 sec n/a Peak power (%) is reached 57.4 sec 135.0 sec (1.6 %) (3.0 %)

15-48

The NRC staff had two major concerns with these results: (1) the peak post-trip power level, 1.6 percent, is much lower than that seen in MSLB analyses for other Westinghouse four-loop plants, and (2) the peak post-trip power level in the case without offsite power available is higher than that of the case with offsite power available.

Peak Post-trip Power Level Lower than Other Similar Plants The WBN Unit 2 peak post-trip power levels are significantly lower than the peak post-trip power levels that have ever been reported, by any applicant, for the same size steamline break occurring in any of the Westinghouse-designed four-loop plants. In TVAs letter to the staff dated May 13, 2011, and during the NRC staff audits at the Westinghouse corporate office in Rockville, MD, on March 15, 2011 (ADAMS Accession No. ML111030624), and June 28, 2011, Westinghouse made qualitative arguments to show that the differences result from changes in reactivity coefficients and shutdown margin that have occurred in past years. To narrow the discussion to a single, relevant example, the staff noted that the current licensing basis for Unit 1 is the reference basis for the review and licensing of Unit 2 (see SRM-SECY-07-0096 (ADAMS Accession No. ML072060688)). The staff asked TVA to explain why the peak post-trip power level of WBN Unit 2 (1.6 percent) would be less than half the peak post-trip power level of WBN Unit 1 (4.4 percent). Westinghouse stated that the WBN Unit 2 analyses are a copy of the WBN Unit 1 analyses of record before WBN Unit 1 had implemented a measurement uncertainty recapture (MUR) power uprating and had SG replacements. The WBN Unit 1 analyses of record had been based upon a more conservative value for the Doppler temperature coefficient. Westinghouse also attributed the relatively low WBN Unit 2 peak power to a relatively high shutdown margin, 1.6 percent, as compared to the shutdown margins of most of the other four-loop plants (e.g., 1.3 percent).

Westinghouse agreed to perform a step-by-step deconstruction of the WBN Unit 2 MSLB analyses (i.e., the original WBN Unit 1 MSLB analyses) to identify the individual contribution of each of the differences between the two plant analyses and ultimately reproduce the current WBN Unit 1 MSLB peak post-trip power level (4.4 percent). A series of WBN Unit 2 steamline break analyses were performed during the NRC audit on June 28, 2011, in which key input parameters were changed, one by one, in the WBN Unit 2 model, until it matched the WBN Unit 1 model. The change in peak power level was noted for each of the parameter changes.

Some parameter changes caused the resulting power level to increase (e.g., Doppler temperature coefficient), and others caused the power level to decrease (e.g., SG replacement, secondary side mass). The last of this series of cases produced a peak power level of 4.3 percent. The staff concluded that this result was essentially the same as the WBN Unit 1 result, 4.4 percent. Table 15.3.2-2 lists the results of the analysis series.

15-49

Table 15.3.2-2 Input Parameter Effects on WBN Unit 2 MSLB Peak Power Peak Time power (sec)

WBN Unit 2 MSLB, with offsite power 1.6% 56.2 Doppler temperature coefficient 7.9% 56.2 Heat transfer coefficients of the replacement steam generators (RSGs) 6.5% 62.4 Increased secondary mass of RSGs (30,000 lbm per steam generator) 6.0% 67.8 Primary side pressure drops, volumes and SG initial conditions related to RSGs 5.0% 66.0 Accumulator B (1900 ppm to 2400 ppm) and updated accumulator resistances 4.8% 65.4 MUR 4.9% 67.8 Reactor coolant pump heat addition 4.3% 65.8 All other differences 4.4% 65.6 The largest effect is from Doppler temperature feedback. After the core returns to criticality, the increase in fuel temperature tends to retard the reactivity excursion caused by the moderator cooldown. A highly negative Doppler temperature coefficient, which is typical of EOL conditions, was used for the WBN Unit 2 MSLB analyses. A less negative (i.e., a more conservative value) was used for the WBN Unit 1 MSLB analyses. The difference accounted for an increase in the peak post-trip power level from 1.6 to 7.9 percent. Both values are considered to be conservative for MSLB analyses.

Peak Post-trip Power Level Without Offsite Power Higher Than With Offsite Power In WCAP-9226-P-A, Revision 1, Reactor Core Response to Excessive Secondary Steam Releases, approved February 1998 (ADAMS Accession No. ML093630006), Westinghouse concluded that, typically, the MSLB with offsite power is more severe than the MSLB without offsite power. This is based upon sensitivity analyses showing that both the core power and core flow are lower for the case without offsite power. The WBN Unit 2 steamline break analysis results indicate the reverse. The case without offsite power attains a post-trip peak power level that is higher than that attained in the case with offsite power. Nevertheless, TVA stated that the case with offsite power is the limiting case. The NRC discussed this question with Westinghouse and TVA staff at both NRC audits (April 27, 2011, and June 28, 2011).

Westinghouse had relied upon other studies based, in part, on open-channel core models that accounted for the added cooling effect of cross flow into the hot channel, to discount the effect of the observation in WCAP-9226 that an MSLB without offsite power produces a lower post-trip peak power level than the case with offsite power.

During the NRC staffs review of WCAP-9226, the staff asked Westinghouse about the effect of open-channel flow during a steamline break. Westinghouse responded as follows:

Westinghouse recognizes the existence of cross flow phenomena during steamline break conditions and has considered their effect on the results of the analysis. We have concluded that:

1. For steamline break with offsite power available (full reactor coolant flow),

the closed channel model is very accurate.

2. Using DNBR as a basis, the conclusion stated in WCAP-9226 Section 3.1.1.14 concerning the steamline break without offsite power 15-50

available, i.e., low RCS flow, can be substantiated with an open channel model, where the effects of cross flow is [sic] considered.

The use of closed-channel calculations for the more limiting full flow cases will continue to be the basis for Westinghouse licensing calculations.

During the NRC audit on June 28, 2011, the staff asked to see the studies that support Westinghouses conclusion regarding open-channel flow. The staff questioned some aspects of these studies (e.g., the range of the DNB correlation that was used), concluded that the Westinghouse conclusion was not well documented, and noted that the open-channel analyses appeared to be a departure from the WCAP-9226 methods.

In response, Westinghouse performed a new steamline break analysis, with a more conservative Doppler feedback coefficient to produce a higher post-trip power level for the case with offsite power. This makes the WBN Unit 2 results consistent with all other Westinghouse plants, and with the WCAP-9226 sensitivity studies, and is therefore acceptable to the staff for WBN Unit 2.

Table 15.3.2-3 summarizes the results of the Westinghouse reanalysis of the WBN Unit 2 MSLB.

Table 15.3.2-3 Reanalysis of WBN Unit 2 MSLB Offsite power Offsite power Event available not available Steam line ruptures 0.0 sec 0.0 sec Low steam line pressure is reached 0.7 sec 0.7 sec Pressurizer empties 11.0 sec 12.2 sec Core returns to critical 30.0 sec 38.4 sec ECCS boron reaches the core 33.6 sec 46.2 sec Accumulator delivery begins 54.4 sec n/a Peak power (%) is reached 56.8 sec 121.8 sec (7.9%) (5.1%)

In both cases, the SI from ECCS and steamline isolation are actuated by the low steamline pressure signal. The low steamline pressure condition is a direct result of the steam blowdown caused by a large steamline break. Although the SI signal is generated early in the transient (less than 1 second), borated SI water does not reach the core until at least half a minute later, because of the time needed to start the pumps and to sweep the clean water that is normally resident in the SI lines into the RCS.

The reanalysis results are consistent with the approved methodology of WCAP-9226, in that both the core power and core flow are lower for the case without offsite power. The post-trip peak power level is also closer to the range of post-trip peak power levels seen in MSLB analysis results in other Westinghouse four-loop plants. The reanalysis results also make more sense with respect to the sequence of events: the core returns to critical, boron enters the core, and the peak power level is reached. Previously, the order of events was: boron enters the core, the core returns to critical, and the peak power level is reached. The revised order of events implies that boron will have a greater effect on core reactivity. The reanalysis provides the expected result: the case in which offsite power is assumed to be available is the more 15-51

severe case, since the presence of forced RCS flow aids the core cooldown. Since the reanalysis results are consistent with the expected results from the approved methodology of WCAP-9226-P-A and analyses of similar plants, the results are acceptable to the staff for WBN Unit 2.

Steam System Piping Failures at Hot Full Power The purpose of the HFP MSLB (or pretrip MSLB) analysis is to demonstrate that the core is protected (i.e., the linear heat generation rate does not exceed the safety limit) before and immediately following a reactor trip. After reactor trip, the HZP MSLB (above) analyses are applied to demonstrate that the minimum DNBR remains higher than the safety limit.

The licensing basis of WBN Unit 1, which is the reference licensing basis for Unit 2, includes only the HZP MSLB analyses. The RPS will provide an automatic reactor trip, using the OPT logic, to prevent the linear heat generation rate from exceeding the safety limit. The setpoints (i.e., the equation constants and dynamic compensation coefficients) for the OPT function are determined in accordance with accepted methods in WCAP-8745-P-A, Design Bases for the Thermal Overpower T and Overtemperature T Trip Functions, approved September 1986 (ADAMS Accession No. ML073521507). The staff has previously approved the analysis for WBN Unit 1, assuming that the OPT setpoints are properly determined, such that the OPT function will provide adequate protection during an HFP MSLB event. Since the analysis was previously approved for WBN Unit 1, it is also acceptable for Unit 2, on the same basis.

Conclusion The NRC staff reviewed TVAs analysis of the MSLB for WBN Unit 2, focusing on the Westinghouse MSLB methodology (WCAP-9226-P-A) and on the need to document the subsequent changes to the methodology. TVAs analysis, with respect to the WBN Unit 2 MSLB analysis, mutatis mutandis, is consistent with the approved, generic methodology (WCAP-9226).

The NRC staff concludes that TVA performed its analyses using acceptable analytical models and that it has demonstrated that the reactor protection and safety systems will meet the requirements of GDC 27, 28, 31, and 35.

References

1. WCAP-7907-P-A (proprietary) and WCAP-7907-A (non-proprietary), T.W.T. Burnett, et al.,

LOFTRAN Code Description, April 1984.

2. NP-2511-CCM-A, C.W. Stewart, et al., VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores, Volumes 1-3 (Revision 3, August 1989), Volume 4 (April 1987), Electric Power Research Institute.

3. Letter from J. Poole (NRC) to A. Bhatnagar (TVA), Watts Bar Nuclear Plant, Unit 2Audit Report of Westinghouse Documents Relating to Final Safety Analysis Report Accident Analyses (TAC No. ME4620), April 27, 2011. (ADAMS Accession No. ML111030624)

4. NRC Audit Report dated August 9, 2011. (ADAMS Accession No. ML112170214; not publicly available) 15-52

5. WCAP-9226-P-A, S.D. Hollingsworth and D.C. Wood, Revision 1, Reactor Core Response to Excessive Secondary Steam Releases, Original VersionJanuary 1978, Approved VersionFebruary 1998. (ADAMS Accession No. ML093630006)

6. WCAP-8745-P-A, Design Bases for the Thermal Overpower T and Overtemperature T Trip Functions, Original VersionMarch 1977, Approved VersionSeptember 1986.

(ADAMS Accession No. ML073521507) 15.3.3 Feedwater System Pipe Breaks Inside and Outside Containment FSAR Section 15.4.2.2, Major Rupture of a Main Feedwater Pipe, describes the results of TVAs analysis of feedwater system pipe breaks inside and outside containment. A major feedwater line rupture is defined as a break in a feedwater pipe large enough to prevent the addition of sufficient feedwater to the SGs to maintain shell-side fluid inventory in the SGs. If the break is postulated in a feedline between the check valve and the SG, fluid from the SG may also be discharged through the break. Further, a break in this location could preclude the subsequent addition of AFW to the affected SG. Depending upon the size and location of the break and the plant operating conditions at the time, the break could cause either an RCS cooldown (by excessive energy discharge through the break) or an RCS heatup (by reducing feedwater flow to the affected SG). In both cases, the RPS and safety systems actuate to mitigate the transient.

Regulatory Evaluation In its review, the NRC staff referred to the guidance in SRP Section 15.2.8, Revision 2, Feedwater System Pipe Break Inside and Outside Containment (PWR). The NRC staffs review covered (1) postulated initial core and reactor conditions, (2) the methods of thermal and hydraulic analyses, (3) the sequence of events, (4) the assumed response of the reactor coolant and auxiliary systems, (5) the functional and operational characteristics of the RPS, (6) operator actions, and (7) the results of the transient analyses. The NRC staff based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 27, insofar as it requires that the reactivity control systems be designed to have a combined capability, in conjunction with poison addition by the ECCS, of reliably controlling reactivity changes to ensure that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained

• GDC 28, insofar as it requires that the reactivity control systems be designed to ensure that the effects of postulated reactivity accidents can neither result in damage to the RCPB greater than limited local yielding, nor sufficiently disturb the core, its support structures, or other reactor vessel internals to impair significantly the capability to cool the core

• GDC 31, insofar as it requires that the RCPB be designed with sufficient margin to ensure that, under specified conditions, it will behave in a nonbrittle manner and the probability of a rapidly propagating fracture is minimized

• GDC 35, insofar as it requires that a system to provide abundant emergency core cooling shall be provided 15-53

The feedwater line break (FLB) event is classified as a Condition IV accident (limiting fault).

Condition IV accidents are not expected to take place during the lifetime of the plant, but they are postulated because they could lead to a release of significant amounts of radioactive material.

Some limiting Condition IV events, the design-basis accidents (DBAs), are used to determine the performance requirements of safety-related systems that are relied upon to mitigate the consequences of Condition IV events.

In response to a staff question (RAI 15.3.3-1), TVA provided, in its letter dated November 9, 2010 (ADAMS Accession No. ML103200146), the following acceptance criteria for the FLB analysis:

1. Maximum pressures do not exceed those specified for service limit D, as defined in the ASME Nuclear Power Plant Components Code, Section III.

2. The core remains in place and geometrically intact, with no loss of core cooling capability because

a. the DNB ratio is such that there is a 95-percent probability that the limiting fuel rod does not go through DNB, with a 95-percent confidence level.

b. the core remains covered with water.

3. Any activity release must be such that the calculated doses at the site boundary are within the guidelines of 10 CFR Part 100.

To ensure that these criteria are met, TVA stated the following:

To conservatively assure meeting these basic criteria, the criterion established is that no boiling occurs in the primary coolant system following a feedline rupture prior to the time that heat removal capability of the steam generators being fed auxiliary feedwater exceeds the core heat generation assuming prudent operator actions.

Technical Evaluation FSAR Section 15.4.2.2 describes the FLB analysis as one of two major secondary system pipe rupture scenarios. Unlike the steamline break (described in FSAR Section 15.4.2.1), the break flow from an FLB is mostly water, and its effect upon the RCS is an undercooling of the core.

The RCS temperature and pressure increase and reach elevated levels until all the decay heat can be removed by the AFW system. Thus, the operation and performance of the AFW system, relative to the generation of decay heat, determine when the FLB event is effectively ended. As referenced in the FSAR, TVA calculates decay heat using the model in ANSI/ANS-5.1-1979, American National Standard for Decay Heat Power in Light Water Reactors, issued August 1979, which is approved by the NRC staff, with a factor of 2 (standard deviations) added for uncertainty.

As described by TVA in the FSAR, an analysis of this event demonstrates the ability of the AFW system to remove core decay heat and thereby ensure that the core remains in a coolable 15-54

geometry. It is inferred that the core remains covered with water (and coolable) by showing that the hot and cold leg temperatures remain subcooled until the AFW system heat removal rate exceeds the core heat generation rate (mainly from decay heat). The NRC staffs review focused on the NSSSs response to the FLB event to determine that there is reasonable assurance that the AFW system, in combination with the RPS and safety systems, has adequate capacity to remove decay heat to prevent overpressurization of the RCS and to prevent uncovery of the core.

The AFW system in WBN Unit 2, as in other Westinghouse four-loop plants, comprises two MDAFWPs and one steam TDAFWP. Each MDAFWP feeds two SGs, and the TDAFWP feeds all four SGs. TVA determined that the worst single failure in the AFW system is the failure of one MDAFWP to start.

If the TDAFWP were assumed to fail, then two nonfaulted SGs would receive AFW flow from one MDAFWP (about 410 gallons per minute (gpm)). The other MDAFWP (that is connected to the faulted SG) would deliver AFW flow to the faulted SG and one of the nonfaulted SGs in about equal proportions, since, before steamline isolation, all SGs would be depressurizing at about the same rate. After steamline isolation, all of the AFW flow from this MDAFWP would flow to the FLB. This would continue until the faulted SG pressure drops below 360 pounds per square inch, gauge (psig). Then the AFW line to the faulted SG is automatically restricted, and this allows some AFW flow (60 gpm) to the intact SG.

If the MDAFWP that is connected to the two intact SGs were assumed to fail, then the other MDAFWP would deliver all its AFW flow to the break, until the faulted SG pressure drops below 360 psig and the AFW line to the faulted SG is automatically restricted. Then the MDAFWP would feed about 60 gpm to one intact SG. The TDAFWP is assumed to be manually started 12 minutes after the low-low SG level signal is generated. After (manual) isolation of the faulted SG, TVA assumed that the AFW system is configured to route AFW flow from the TDAFWP to all the intact SGs and AFW flow from the operating MDAFWP to its intact SG.

Therefore, failure of one MDAFWP would result in the delivery of less AFW flow, in the first 12 minutes of the FLB event, to the intact SGs than would failure of the TDAFWP. As a result, it is conservative to assume the failure of the MDAFWP that is connected to the two nonfaulted SGs. After 12 minutes, the analysis assumes that AFW flow to the faulted SG is manually terminated and that AFW flow is delivered to the nonfaulted SGs. TVA verified the time to recognize and perform the required operator actions using its event response procedures and plant simulator exercises.

TVA used the LOFTRAN computer code to analyze the FLB event. The analyses model a simultaneous loss of main feedwater to all SGs and subsequent reverse blowdown of the faulted SG. By letter dated July 29, 1983, the NRC staff previously reviewed and approved the LOFTRAN FLB methodology provided in topical report WCAP-7907-P-A. TVA analyzed two FLB cases: one with offsite power, and one without offsite power. Both analyses considered the double-ended pipe break of the feedwater line.

The double-ended pipe break of the feedwater line corresponds to an effective break size of 0.223 square feet, which is based on the design of the preheater SG and its associated feed flow restrictor. In its letter dated November 9, 2010, TVA stated that selection of the largest break size is consistent with the findings of a Westinghouse study of spectrum of FLB sizes, as documented in Section 5.C.15 of WCAP-9230, Report on the Consequences of a Postulated Main Feedline Rupture (Proprietary).

15-55

The FLB event can generate a harsh environment in the vicinity of the SG water level sensing reference legs, resulting in false high readings that can delay or prevent a reactor trip on an SG low water level. In FLB analyses, the low-low SG water level setpoint, used for a reactor trip and actuation of the AFW system, is assumed to be 0 percent narrow range span (NRS). In response to a staff question (RAI 15.3.3-4), TVA explained, in its letter dated November 9, 2010, that this assumption applies to FLB events outside containment; however, for FLB events inside containment (which can produce a harsh environment), the reactor trip and SI signals will be generated sooner, by a high containment pressure condition. Therefore, TVA concluded that FLB analyses that rely upon the SG low-low water level trip (when the SG is at 0-percent NRS) apply to analyses of FLB events occurring outside containment, as well as bound analyses of FLB events occurring inside containment. TVA stated the following:

The FSAR analysis which credits the Low-Low steam generator level reactor trip signal is retained as the analysis for the feedwater line break outside containment and as a bounding analysis for the inside containment break event.

The NRC reviewed this and approved this design as part of the WBN Unit 1 initial license. The Unit 2 design is the same as Unit 1.

TVA analyzed two FLB cases, one with and one without offsite power. FSAR Table 15.4-9 summarizes the sequence of events for both cases. The assumed LOOP degrades the primary-to-secondary heat transfer rate, caused by the loss of forced reactor coolant flow, and reduces the amount of heat to be transferred, since there is no heat added to the RCS from the RCPs. Consequently, the SGs depressurize more slowly in the FLB case that includes the LOOP assumption. According to Table 15.4-9, the low steamline pressure setpoint would be reached about a minute later in the FLB case without offsite power than in the FLB case with offsite power. The FSAR transient plots are of very poor quality but are sufficient to indicate that saturation conditions are not reached in the intact RCS loops in either FLB case within the 12-minute operator intervention time.

The plots also indicate that the pressurizer PORVs open and limit the RCS pressure to the PORV opening setpoint. Therefore, the peak RCS pressure is well below the RCS pressure safety limit. The PORVs are assumed to operate in the FLB analysis, because limiting the pressurization also limits the RCS hot leg saturation temperature, which is used to indicate whether reactor coolant saturation conditions are reached. If the PORVs were assumed to be unavailable, the PSVs, which are larger and more numerous, would keep the peak RCS pressure to within the RCS pressure safety limit.

The FLB analyses demonstrate that saturation conditions are not reached in the intact RCS loops within the 12-minute operator intervention time. This indicates that the core will remain covered. Therefore, the NRC staff concludes that TVA has provided reasonable assurance that all of the acceptance criteria are met (e.g., the core does not uncover, and the RCS does not overpressurize).

Based on its review, the NRC staff further concludes that TVA demonstrated that the RPS and safety systems will continue to ensure that the ability to insert control rods is maintained, the RCPB pressure limits will not be exceeded, the RCPB will behave in a nonbrittle manner, the probability of a propagating fracture of the RCPB is minimized, and abundant core cooling will be provided; therefore, WBN Unit 2 meets the regulatory requirements with respect to FLB events.

15-56

Conclusion The NRC staff reviewed TVAs analyses of FLB and concludes that it used acceptable analytical models and that it has demonstrated that the RPS and safety systems will ensure that the ability to insert control rods is maintained, the RCPB pressure limits will not be exceeded, the RCPB will behave in a nonbrittle manner, the probability of a propagating fracture of the RCPB is minimized, and abundant core cooling will be provided. Based on its review, the NRC staff concludes that WBN Unit 2 meets the requirements of GDC 27, 28, 31, and 35. Therefore, the NRC staff concludes that TVAs evaluation is acceptable with respect to feedwater system pipe breaks.

15.3.4/15.3.5 Reactor Coolant Pump Rotor Seizure/ Reactor Coolant Pump Shaft Break Section 15.4.4, Single Reactor Coolant Pump Locked Rotor, of the FSAR for WBN Unit 2 describes the results of TVAs analysis of RCP rotor seizure and shaft break.

The events postulated are an instantaneous seizure of the rotor or break of the shaft of an RCP.

Flow through the affected loop is rapidly reduced, leading to a reactor and turbine trip. The sudden decrease in core coolant flow while the reactor is at power results in a degradation of core heat transfer, which could result in fuel damage. The initial rate of reduction of coolant flow is greater for the rotor seizure event. However, the shaft break event permits a greater reverse flow through the affected loop later during the transient and, therefore, results in a lower core flow rate at that time. In both cases, RPS and safety systems are actuated to mitigate the transient.

For WBN Unit 2, TVA postulates an instantaneous rotor seizure with the seized rotor free to counterrotate, which combines the detrimental flow effects of both postulated events into a single transient analysis.

Regulatory Evaluation In its review, the NRC staff referred to the guidance in SRP Section 15.3.3-15.3.4, Revision 3, Reactor Coolant Pump Rotor Seizure and Reactor Coolant Pump Shaft Break. The NRC staffs review covered (1) the postulated initial and long-term core and reactor conditions, (2) the methods of thermal and hydraulic analyses, (3) the sequence of events, (4) the assumed reactions of reactor system components, (5) the functional and operational characteristics of the RPS, (6) operator actions, and (7) the results of the transient analyses. The NRC staff based its acceptance criteria, in part, on the following regulatory requirements:

• GDC 27, insofar as it requires that the reactivity control systems be designed to have a combined capability, in conjunction with poison addition by the ECCS, of reliably controlling reactivity changes to ensure that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained

• GDC 28, insofar as it requires that the reactivity control systems be designed to ensure that the effects of postulated reactivity accidents can neither result in damage to the RCPB greater than limited local yielding, nor sufficiently disturb the core, its support structures, or other reactor vessel internals to impair significantly the capability to cool the core 15-57

• GDC 31, insofar as it requires that the RCPB be designed with sufficient margin to ensure that, under specified conditions, it will behave in a nonbrittle manner and the probability of a rapidly propagating fracture is minimized Technical Evaluation The postulated RCP rotor seizure and shaft break is a Condition IV accident (limiting event). It addresses the instantaneous seizure of an RCP rotor or the breaking of an RCP shaft.

In response to a staff question (RAI 15.0.0-1.b), TVA explained, in its letter dated December 10, 2010 (ADAMS Accession No. ML103480708), that the following Condition IV event acceptance criteria applied to its accident analysis:

(1) RCS and MSS pressures should be below the faulted condition stress limits for very low probability events (e.g., locked rotor).

(2) Coolable core geometry is ensured by showing that the PCT and maximum oxidation level for the hot spot are below 2,700 degrees F and 16 percent by weight, respectively.

(3) Activity release is such that the calculated doses meet 10 CFR Part 100 guidelines.

TVA analyzed the RCP rotor seizure and shaft break transient using the LOFTRAN (WCAP-7907-P-A) and FACTRAN (WCAP-7908-A) computer codes. The LOFTRAN computer code was used to calculate the transient RCS loop and core flows, to determine the time of reactor trip based upon the calculated RCS flows, and to calculate the nuclear power transient and the primary-system pressure transient. The FACTRAN code was used to analyze the thermal behavior of the fuel located at the core hot spot, using core flow and nuclear power data calculated by LOFTRAN. The VIPRE-01 code (WCAP-14565-P-A) was used to calculate the fuel assumed to fail as a result of DNB, in accordance with the RTDP (WCAP-11397-P-A).

TVA noted that the consequences of the locked rotor accident are very similar to those of an RCP shaft break. The RCP shaft break, however, would possibly leave the impeller free to spin in the reverse direction, which would reduce core flow as compared to the locked rotor scenario.

The presence of reverse flow, depicted in the transient plots, indicates that the shaft break was modeled in the postulated locked rotor accident analyses. In response to a staff question (RAI 15.3.4-2), TVA stated, in its letter dated November 9, 2010, that the locked rotor or shaft break is modeled by conservatively simulating the rotor as locked for forward flow and free-spinning for reverse flow.

In response to a staff question (RAI 15.0.0-1.b), TVA stated, in its letter dated December 10, 2010, that the percent rods-in-DNB is calculated for each core reload and is verified to be less than the limit value of 13 percent. This is the method that TVA will use to demonstrate, on a cycle-specific basis, that the radiological consequences of the event remain acceptable. Although TVA did not describe the analytic method used for this evaluation, FSAR Table 15.1-2 lists the VIPRE-01 code as that used for thermal-hydraulic calculations for the RCP locked rotor and shaft break accidents.

Although in response to a staff question (RAI 15.3.4-1), TVA stated, in its letter dated November 9, 2010, that it does not intend to analyze the radiological consequences of the locked rotor and shaft break events, the NRC staff concluded that TVAs response to RAI 15.0.0-1.b, in its letter dated December 10, 2010, is acceptable, because it provided 15-58

sufficient information for the staff to conclude that the radiological consequences of the events were acceptable.

For the fuel coolable geometry and peak pressure analysis, TVA assumed that DNB occurs at the onset of the transient and evaluated the consequences with respect to the fuel rod thermal transient. TVA provided results, repeated below, for the analysis of the hot spot condition that represents the upper limit with respect to clad temperature and zirconium water reaction.

To determine the peak pressure, TVA biased the initial pressure to a value that was 70 psi higher than the nominal pressure, to account for errors in the pressurizer pressure measurement and control channels. The NRC staff concludes that this bias is conservative, because the transient itself is tripped on the loss of flow, meaning that the pressurization has no direct tie to the reactor trip. Therefore, the higher initial pressure provides a direct bias on the result. Assuming a high pressure is also conservative because DNB is assumed at the beginning of the analysis.

The postulated RCP rotor seizure or shaft break leads to a reactor trip on low flow, but the accident does not demand or require operation of any of the engineered safety features. In response to a staff question (RAI 15.3.4-3), in its letter dated November 9, 2010, TVA stated that it conservatively assumed a consequential LOOP occurs, which causes a coastdown of the remaining RCP. The staff concludes that this has little effect on the accident sequence, because the reactor trip quickly reduces reactor power.

The results of TVAs analysis, as provided in FSAR Table 15.4-10 and in its letter dated December 10, 2010, in response to RAI 15.0.0-1.b, demonstrate that the acceptance criteria are satisfied.

Table 15.1 Summary of Results for Locked Rotor Transients Results for RCP Locked Rotor and Shaft Break Result Limit PCT at Core Hot Spot (°F) 1,852 2,700 Maximum Zirconium-Water Reaction at Core Hot Spot (wt. %) 0.36 16 Maximum RCS Pressure (psia) 2,672 2,764 Rods in DNB (%) <13 13 The NRC staff reviewed TVAs analyses of the locked rotor and pump shaft break events and concluded that TVA acceptably applied approved analytical models. The staff concluded that WBN Unit 2 will meet the regulatory requirements applicable to the RCP locked rotor and shaft break accidents; therefore, the WBN Unit 2 FSAR is acceptable with respect to the postulated RCP locked rotor and shaft break accidents.

Conclusion Based on its review of TVAs analyses of the RCP rotor seizure and RCP shaft break, the NRC staff concludes that TVAs analyses adequately model the operation of WBN Unit 2 at the proposed power level and were performed using acceptable analytical models. The NRC staff further concludes that TVA has demonstrated that (1) the RPS will continue to ensure that the ability to insert control rods is maintained, (2) the RCPB pressure limits will not be exceeded, (3) the RCPB will behave in a nonbrittle manner, (4) the probability of a propagating fracture of the RCPB is minimized, and (5) adequate core cooling will be provided. Therefore, the NRC 15-59

staff concludes that WBN Unit 2 will continue to meet the requirements of GDC 27, 28, and 31 during its proposed operation, and the FSAR is acceptable with respect to the analysis of events caused by a sudden decrease in core coolant flow.

15.3.6 Anticipated Transients Without Scram An anticipated transient without scram (ATWS) is an AOO as defined in Appendix A to 10 CFR Part 50, followed by the failure of the reactor trip portion of the protection system specified in GDC 20. Since protection systems (e.g., the reactor trip system) must satisfy the single-failure criterion, multiple failures or a common-mode failure must cause the assumed failure of the reactor trip. The probability of an AOO, in coincidence with multiple failures or a common-mode failure, is much lower than the probability of any of the other events that are evaluated under SRP Chapter 15. Therefore, an ATWS event cannot be classified as either an AOO or a DBA.

The failure of the reactor to shut down during certain transients can lead to unacceptable RCS pressures, fuel conditions, and containment conditions. Typical AOOs that may result in unacceptable conditions following a PWR scram failure are loss of feedwater, loss of load, turbine trip, inadvertent control rod withdrawal, loss of ac power, and loss of condenser vacuum.

The staff used the guidance of SRP Section 15.8, Revision 2, Anticipated Transients Without Scram, in its evaluation of an ATWS at WBN Unit 2 and also referred to the original guidance of WASH-1270, Technical Report on Anticipated Transients Without Scram for Water-Cooled Power Reactors, issued September 1973.

Regulatory Evaluation The final ATWS rule (10 CFR 50.62, Requirements for Reduction of Risk from Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants) became effective on July 26, 1984. This rule requires specific plant design changes, intended to reduce the expected frequency and consequences of ATWS events. The basis for the ATWS rule is provided in SECY-83-293, Amendments to 10 CFR 50 Related to Anticipated Transients Without Scram (ATWS) Events, dated July 19, 1983. The ATWS rule requires the operators of PWRs to install ATWS mitigation system actuation circuitry (AMSAC). TVA is subject to the following requirement of 10 CFR 50.62(c)(1) for WBN Unit 2:

Each pressurized water reactor must have equipment from sensor output to final actuation device, that is diverse from the reactor trip system, to automatically initiate the auxiliary (or emergency) feedwater system and initiate a turbine trip under conditions indicative of an ATWS. This equipment must be designed to perform its function in a reliable manner and be independent (from sensor output to the final actuation device) from the existing reactor trip system.

The ATWS rule requires the installation of other hardware, as well, but for Westinghouse-designed PWRs, it requires only the AMSAC. By the time the ATWS rule was promulgated, Westinghouse had shown, through a series of generic analyses (Topical Report WCAP-8330, Westinghouse Anticipated Transients Without Trip Analysis, issued August 1974; and NS-TMA-2182, ATWS Submittal, letter from T.M. Anderson (Westinghouse) to S.H. Hanauer (NRC), dated December 30, 1979), that the loss of feedwater and the loss of load ATWS events would not be expected to produce RCS pressure levels that are high enough to challenge the integrity of the RCS, provided that the AFW system is operated and the turbine is tripped in a timely manner. AMSAC is designed to initiate these vital functions, independent 15-60

of the reactor trip system, which is postulated to be incapacitated by a common-mode failure.

Consequently, the ATWS rule requires only the AMSAC to be installed in Westinghouse-designed PWRs.

In addition to the ATWS rule, the NRC staff based its acceptance criteria, in part, on the following regulatory requirements:

• 10 CFR 50.46, insofar as it establishes standards for calculating ECCS performance and acceptance criteria for that calculated performance, including PCT, maximum cladding oxidation, and coolable geometry

• GDC 14, Reactor Coolant Pressure Boundary, insofar as it requires that the RCPB have an extremely low probability of abnormal leakage, of rapidly propagating failure, and of gross rupture

• GDC 16, Containment Design, insofar as it requires that containment design conditions important to safety not be exceeded for as long as postulated accident conditions require

• GDC 35, insofar as it requires that the clad metal-water reaction be limited to negligible amounts

• GDC 38, Containment Heat Removal, insofar as it requires the containment heat removal system to reduce rapidly the containment pressure and temperature following any LOCA and maintain them at acceptably low levels

• GDC 50, Containment Design Basis, insofar as it requires that the containment structure and its heat removal system be designed so that the containment structure can accommodate, without exceeding the design leakage rate and with sufficient margin, the calculated pressure and temperature conditions resulting from any LOCA The NRC staffs review was conducted to ensure that (1) the above requirements are met, and (2) the setpoints for the AMSAC effectively enable it to fulfill its function in providing protection against the effects of an ATWS. The NRC staff also verified that the consequences of an ATWS are acceptable. The principal acceptance criterion is that the peak primary system pressure should not exceed the ASME Code Service Level C limit of the weakest component in the RCS (3,200 psig). The peak pressure, attained during an ATWS, is primarily a function of the moderator temperature coefficient (MTC) and the primary system relief capacity. The NRC reviewed TVAs ATWS analyses for (1) the limiting event determination, (2) the sequence of events, (3) the analytical model and its applicability, (4) the values of parameters used in the analytical model, and (5) the results of the analyses. In applications where TVA cited generic vendor ATWS analyses, the NRC staff reviewed TVAs justification for applying the cited generic vendor analyses to WBN Unit 2.

Technical Evaluation In 1974, Westinghouse, the designer and supplier of the WBN Unit 2 reactor, published WCAP-8330, which reported the results of a series of generic ATWS analyses, showing that plants of the WBN Unit 2 design could meet the staffs acceptance criteria for ATWS events.

The staffs ATWS analysis results (NUREG/CR-0460, Anticipated Transients Without Scram for Light Water Reactors, issued April 1978) were comparable to the Westinghouse results. In its 15-61

letter of December 30, 1979, Westinghouse submitted updated analyses, which also yielded acceptable results comparable to the NRC results.

In 1984, the NRC issued 10 CFR 50.62 (the ATWS rule). In 1989, the staff evaluated TVAs AMSAC design for WBN Unit 2 and concluded that it meets the equipment requirements of the ATWS rule (Letter from S.C. Black (NRC) to O.D. Kingsley (TVA), Safety Evaluation on the ATWS Rule (10 CFR 50.62) Units 1 and 2, dated December 28, 1989).

Chapter 15 of the WBN Unit 2 FSAR does not report any plant-specific ATWS analyses.

Instead, TVA relies upon the results of Westinghouses generic ATWS analyses (WCAP-8330 and Westinghouse letter dated December 30, 1979), in conjunction with its NRC-accepted AMSAC design, which is described in FSAR Section 7.7.1.12, Anticipated Transient Without Scram Mitigation System Actuation Circuitry (AMSAC), to show that the WBN Unit 2 plant complies with the ATWS rule.

Since the NRC has accepted TVAs AMSAC design, the staff focused its review on the ATWS analysis basis that supports the ATWS rule and the AMSAC functions it requires, and on determining how it is applicable to WBN Unit 2. In particular, the staffs review focused on the applicability of Westinghouses generic ATWS analyses (WCAP-8330 and Westinghouse letter dated December 30, 1979) to the WBN Unit 2 plant design, as described by TVA in the FSAR.

Westinghouses generic ATWS analyses addressed two-loop, three-loop, and four-loop Westinghouse PWR plant configurations with the various SG models that were in use in 1979.

The WBN Unit 2 design is bounded by the analyses of four-loop PWRs equipped with preheat-type SGs (Westinghouse Model D SGs).

Since a reactor trip would not occur during an ATWS, the core is made subcritical by the plants inherent reactivity feedback design feature, which is required by GDC 11, Reactor Inherent Protection. Specifically, a loss of load or a loss of feedwater ATWS would cause the core to heat up, and the negative MTC would insert negative reactivity. Consequently, the core would become subcritical, and the power level would decrease. The AMSAC would actuate a turbine trip and start the AFW system. The turbine trip promotes the core heatup that causes the MTC to insert negative reactivity, and the AFW system removes residual and decay heat later in the ATWS, which limits the RCS pressurization.

The core MTC is the principal design feature that mitigates an ATWS event. It is conservative to assume a relatively less negative value for the MTC (i.e., a value that would be measured early in core life). The ATWS analyses (Westinghouse letter dated December 30, 1979) are based on an MTC that is less negative than the MTC values that would occur over the latter 95 percent of core life (commonly referred to as the 95-percent MTC). Thus, the 99-percent MTC would be less negative than the 95-percent MTC, which would lead to higher RCS pressures during an ATWS. The 95-percent MTC value that is assumed in the generic ATWS analyses is -8 pcm/°F. The 99-percent MTC, also considered in the Westinghouse letter dated December 30, 1979, is -7 pcm/°F. The WBN Unit 2 MTC for Cycle 1, shown in FSAR Figure 4.3-33, is -8 pcm/°F, which is more negative.

Other factors such as the following can influence the course of an ATWS event:

• nominal power 15-62

• SG design, since the reduction in shell side inventory and heat transfer rate determine the core heatup rate

• pressure relief capacity (i.e., pressurizer PORVs and safety valves)

• AFW flow capacity

• pressurizer volume, since a smaller pressurizer will fill sooner and cause water to be relieved through the PORVs and safety valves sooner (water relief being less efficient in limiting RCS pressure than steam relief)

• RCS volume (actually, the ratio of power level to RCS volume)

Table 15.3.6-1 lists several design and operating parameters important to ATWS to facilitate a comparison of the WBN Unit 2 design to the corresponding reference design used in the generic ATWS analyses (Westinghouse letter dated December 30, 1979).

Table 15.3.6-1 Comparison of ATWS ParametersGeneric Design versus WBN Unit 2 Four-Loop WBN Model D SG Unit 2 Reactor Core Heat Output, MWt 3,427 7 3,411 Moderator Temperature Coefficient 95 % 95 %

System Pressure, Nominal, psia 2,250 2,250 Total RCS Volume, including pressurizer and surge line, ft3 11,939 12,145 Total Pressurizer Volume, ft3 1,800 1,800 Total Thermal Design Flow Rate, gpm 377,600 372,400 Pressurizer Power-Operated Relief Valvessteam flow 2 at 210,000 2 at 210,000 capacity, lbs/hr at 2,350 psia (each) (each)

Pressurizer Safety Valvessteam flow capacity, lbs/hr at 3 at 420,000 3 at 420,000 2,500 psia (each) (each)

Nominal Inlet Temperature, °F 558.3 559.0 Average Temperature Rise in Vessel, °F 60.5 58.4 Average Temperature in Vessel, °F 588.5 588.2 Nominal Outlet Temperature, °F 618.8 617.4 Steam Generator Type D D Nominal Steam Pressure, psia 986 910 Nominal Feedwater Temperature, °F 439.8 438.4 Nominal Steam Flow, 106 lbs/hr 15.11 15.08 Nominal Steam Generator Shell Side Inventory, lbs/SG 107,000 ~102,000 Auxiliary Feedwater Flow Capacity, gpm 1,760 1,690 7

Table 3-1-b (Westinghouse letter dated December 30, 1979) indicates 3,427 MWt. Subtract 16 MWt (RCP heat) to match the WBN Unit 2 core power (3,411 MWt).

15-63

The table indicates that WBN Unit 2 is within the design envelope of the Westinghouse generic ATWS analyses. The results of these generic analyses indicate that the peak RCS pressure, predicted for ATWS events in Westinghouse four-loop plants equipped with Model D SGs, is 2,780 psia, well below the ASME Service Level C limit of the weakest component in the RCS (3,200 psig). The WBN Unit 2 AFW flow capacity is 4 percent lower than the AFW flow capacity of the four-loop reference plant. The staff considers this to be acceptable, since the generic ATWS analysis results, in the Westinghouse letter dated December 30, 1979, show that, when AFW flow is reduced by half, the peak RCS pressure rose only slightly. This is expected, since the principal function of AFW is post-ATWS decay heat removal.

The NRC staff concludes that WBN Unit 2 meets the AMSAC requirements and lies within the analysis basis of the ATWS rule. The staff expects that WBN Unit 2 will continue to remain within the class of generic ATWS analyses in future cycles, as long as the 95-percent MTC is

-8 pcm/°F or more negative. The generic ATWS analyses show that the peak RCS pressure does not exceed the ASME Service Level C limit of the weakest component in the RCS (3,200 psig). Therefore, RCS integrity would not be breached and the requirements of 10 CFR 50.46 and GDC 14 would be satisfied.

Some ATWS events could lead to fuel damage. These events were analyzed (WCAP-8330) before the ATWS rule was established, and the results were acceptable with respect to fuel damage. Thus, the requirements of GDC 35 are met.

The generic ATWS analyses also included an analysis of an RCS depressurization ATWS (i.e., the spurious opening of a pressurizer relief valve). This analysis showed that the containment pressurization would not be as high as one that would result from a LOCA or steamline break. Therefore, the WBN Unit 2 ATWS event would not violate the requirements of GDC 16, 38, or 50.

Conclusion The NRC staff has reviewed the information provided by TVA related to ATWS and concludes that TVA has demonstrated that the AMSAC will meet the requirements of 10 CFR 50.62.

Additionally, TVA has demonstrated that the peak RCS pressure following an ATWS event will not exceed the ASME Service Level C acceptance limit (3,200 psig). Therefore, the staff concludes that TVAs analysis of ATWS for WBN Unit 2 is acceptable.

15.5 NUREG-0737 Items 15.5.1 Thermal-Mechanical Report (II.K.2.13)

Item II.K.2.13 in NUREG-0737, Clarification of TMI Action Plan Requirements, issued November 1980, requires a detailed analysis of the thermal-mechanical conditions in the reactor vessel during recovery from small breaks with an extended loss of all feedwater. The NRC staff reviewed the NUREG-0737 item in the safety evaluation report (SER) and in SSER 4, issued March 1985, and concluded that it was resolved for WBN.

As stated in the SER, In a submittal dated September 14, 1981, [TVA] committed to the Westinghouse Owners Group generic resolution of this issue. As stated in SSER 4, The staff has completed its review of the WOG submittal for this item, and has concluded that there is 15-64

reasonable assurance that vessel integrity will be maintained for this type of event. Review of this item will continue under Unresolved Safety Issue (USI) A-49, Pressurized Thermal Shock.

The NRC resolved USI A-49 by issuing 10 CFR 50.61, Fracture Toughness Requirements for Protection Against Pressurized Thermal Shock Events. The NRC staff provided regulatory guidance on the issue in Regulatory Guide 1.99, Radiation Embrittlement of Reactor Vessel Materials, and GL 88-11, NRC Position on Radiation Embrittlement of Reactor Vessel Materials and Its Impact on Plant Operations, dated July 12, 1988; and GL 92-01, Reactor Vessel Structural Integrity, Revision 1. The USI was resolved for WBN by a letter from S. Black (NRC) to O.D. Kingsley (TVA) dated June 29, 1989 (ADAMS Accession No. ML082320531), as further documented in SSER 11, Section 5.3.1, Reactor Vessel Materials, issued April 1993, and SSER 14, Section 5.3.1, issued December 1994, which specifically addressed Appendix G, Fracture Toughness Requirements, to 10 CFR Part 50 and GL 92-01. The staff concludes that there are no changes to the acceptance criteria and resolution for WBN Unit 2 from that previously approved and implemented for Unit 1, as documented in the SER and its supplements.

15.5.2 Voiding in the Reactor Coolant System during Transients (II.K.2.17)

NUREG-0737, Item II.K.2.1, requires TVA to analyze the potential for voiding in the RCS during anticipated transients. The NRC staff reviewed the NUREG-0737 item in the SER and in SSER 4.

A generic study by WOG addressed the issue of voiding in the RCS. The study discussed the potential for void formation in the Westinghouse-designed NSSS during natural circulation cooldown or depressurization transients. Void formation could occur in the upper head region of the reactor vessel. This region is cooled by water that is diverted from the vessel inlet to the upper head. The water temperature in the upper head region of the reactor vessel is lower than the hot leg temperature but higher than the cold leg temperature. Void formation can be attributed to an RCS depressurization to a pressure that is lower than the saturation pressure, or to a rise in temperature that is higher than the saturation temperature. The heatup scenario would likely be unacceptable in an anticipated transient. The generic study indicated that void formation is considered in the analyses of anticipated transients and does not result in unacceptable consequences.

The issue of void formation in the upper head region of the reactor vessel during natural circulation cooldown is the subject of NRC GL 81-21, Natural Circulation Cooldown, dated May 5, 1981. Void formation can be reduced by controlling the rates of cooldown and depressurization. During natural circulation, cooldown of the upper head region is dependent on the rate of heat transfer to the containment atmosphere, aided by control rod drive mechanism fans and by the use of soak periods.

As documented in SSER 4, The staff has reviewed and approved the [WOG] study and has determined that no further action needs to be taken by [TVA]. The staff concludes that there are no changes to the acceptance criteria and resolution for WBN Unit 2 from those previously approved and implemented for Unit 1, as documented in the SER and in SSER 4.

15-65

15.5.4 Automatic Trip of Reactor Coolant Pumps (II.K.3.5)

NUREG-0737, Item II.K.3.5, requires that the RCPs be tripped automatically in case of a small-break LOCA. TVA was asked to consider other solutions to the small-break LOCA problem. The NRC staff reviewed the NUREG-0737 item in the SER and in SSER 4.

As noted in Section 15.5.4 of the SER, in its letter to the NRC dated September 14, 1981 (ADAMS Accession No. ML073521447), TVA referenced the WOG generic resolution of this issue, which was progressing on a schedule consistent with the intent of NUREG-0737 requirements.

As documented in SSER 4, the NRC, in sending GL 83-10c, Resolution of TMI Action Item II.K.3.5., Automatic Trip of Reactor Coolant Pumps, dated February 8, 1983, to TVA (1) reaffirmed the conformance of small-break LOCA evaluation models with Appendix K to 10 CFR Part 50 for the case of limited RCP operation after a reactor trip and (2) approved the use of these models for determining the preferred RCP trip strategy (automatic trip, manual trip, or no trip). By letter dated April 22, 1983 (ADAMS Accession No. ML073530315), TVA responded to GL 83-10c. By letter dated June 8, 1990 (ADAMS Accession No. ML073541207),

the NRC staff informed TVA that its WBN response to TMI Action Item II.K.3.5 was acceptable.

The staff confirmed, in SSER 16, dated September 1995, that TMI Action Item II.K.3.5 is closed for WBN. The staff concludes that there are no changes to the acceptance criteria and resolution for WBN Unit 2 from those previously approved and implemented for Unit 1, as documented in the SER and its supplements.

15-66

APPENDIX A CHRONOLOGY OF RADIOLOGICAL REVIEW OF WATTS BAR NUCLEAR PLANT, UNIT 2, OPERATING LICENSE REVIEW Public correspondence exchanged between the NRC and TVA during the review of the operating license application for Watts Bar Nuclear Plant (WBN), Units 1 and 2, is available through the NRCs Agencywide Documents Access and Management System (ADAMS) or the Public Document Room (PDR). This correspondence includes that occurring subsequent to TVAs letter notifying the NRC of its decision to reactivate construction of WBN Unit 2, which had been in a deferred status under the Commissions Policy Statement on Deferred Plants.

Web-based ADAMS (WBA) is the latest interface to ADAMS. This search engine enables searching the ADAMS repository of official agency records (Publicly Available Records System (PARS) and Public Legacy libraries) for publicly available regulatory guides, NUREG-series reports, inspection reports, Commission documents, correspondence, and other regulatory and technical documents written by NRC staff, contractors, and licensees. WBA permits full-text searching and enables users to view document images, download files, and print locally. New documents become accessible on the day they are published, and are released periodically throughout the day. ADAMS documents are provided in Adobe Portable Document Format (PDF).

The NRC PDR reference staff is available to assist with ADAMS. Contact information for the PDR staff is on the NRC Web site at http://www.nrc.gov/reading-rm/contact-pdr.html.

A-1

APPENDIX E PRINCIPAL CONTRIBUTORS TO SSER 24 R. Alvarado, NRR/DE/EICB G. Cheruvenki, NRR/DCI/CVIB V. Goel, NRR/DE/EEEB J. Green, NSIR/DSP/CSIRB D. Hoang, NRR/DE/EMCB F. Lyon, NRR/DORL/LPWB G. Matharu, NRR/DE/EEEB M. McConnell, NRR/DE/EEEB P. Milano, NRR/DORL/LPWB S. Miranda, NRR/DSS/SRXB M. Panicker, NRR/DSS/SNPB R. Pedersen, NRR/DIRS/IHPB P. Pederson, NSIR/DSP/CSIRB J. Poole, NRR/DORL/LPWB L. Raghavan, NRR/DORL/LPWB D. Rahn, NRR/DE/EICB E. Smith, NRR/DSS/SBPB L. Ward, NRR/DSS/SNPB E-1

APPENDIX HH WATTS BAR UNIT 2 ACTION ITEMS TABLE This table provides a status of required action items associated of all open items, confirmatory issues, and proposed license conditions that the staff has identified. Unless otherwise noted, the item references are to sections of this SSER.

Item Type Action Required Lead Status (1) CI Review evaluations and corrective actions NRR Open associated with a power assisted cable pull. (NRC safety evaluation dated August 31, 2009, ADAMS Accession No. ML092151155)

(2) CI Conduct appropriate inspection activities to verify RII Open cable lengths used in calculations and analysis match as-installed configuration. (NRC safety evaluation dated August 31, 2009, ADAMS Accession No. ML092151155)

(3) CI Confirm TVA submitted update to FSAR section NRR Closed 8.3.1.4.1. (NRC safety evaluation dated August 31, 2009, ADAMS Accession No. ML092151155)

Closed in SSER 24, Section 8.1.

(4) CI Conduct appropriate inspection activities to verify RII Open that TVAs maximum SWBP criteria for signal level and coaxial cables do not exceed the cable manufacturers maximum SWBP criteria. (NRC safety evaluation dated August 31, 2009, ADAMS Accession No. ML092151155)

(5) CI Verify timely submittal of pre-startup core map and NRR Open perform technical review. (TVA letter dated September 7, 2007, ADAMS Accession No. ML072570676)

(6) CI Verify implementation of TSTF-449. (TVA letter NRR Open dated September 7, 2007, ADAMS Accession No. ML072570676)

(7) CI Verify commitment completion and review electrical RII Open design calculations. (TVA letter dated October 9, 1990, ADAMS Accession No. ML073551056)

(8) CI TVA should provide a pre-startup map to the NRC NRR Open staff indicating the rodded fuel assemblies and a projected end of cycle burnup of each rodded assembly for the initial fuel cycle 6-months prior to fuel load. (NRC safety evaluation dated May 3, 2010, ADAMS Accession No. ML101200035)

(9) CI Confirm that education and experience of RII Open management and principal supervisory positions down through the shift supervisory level conform to Regulatory Guide 1.8. (SSER 22, Section 13.1.3)

HH-1

(10) CI Confirm that TVA has an adequate number of RII Open licensed and non-licensed operators in the training pipeline to support the preoperational test program, fuel loading, and dual unit operation. (SSER 22, Section 13.1.3)

(11) CI The plant administrative procedures should clearly RII Open state that, when the Assistant Shift Engineer assumes his duties as Fire Brigade Leader, his control room duties are temporarily assumed by the Shift Supervisor (Shift Engineer), or by another SRO, if one is available. The plant administrative procedures should clearly describe this transfer of control room duties. (SSER 22, Section 13.1.3)

(12) TVAs implementation of NGDC PP-20 and EDCR NRR Open Appendix J is subject to future NRC audit and inspection. (SSER 22, Section 25.9)

(13) TVA is expected to submit an IST program and NRR Open specific relief requests for WBN Unit 2 nine months before the projected date of OL issuance. (SSER 22, Section 3.9.6)

(14) TVA stated that the Unit 2 PTLR is included in the NRR Open Unit 2 System Description for the Reactor Coolant System (WBN2-68-4001), which will be revised to reflect required revisions to the PTLR by September 17, 2010. (SSER 22, Section 5.3.1)

(15) TVA should confirm to the NRC staff the completion NRR Closed of Primary Stress Corrosion Cracking (PWSCC) mitigation activities on the Alloy 600 dissimilar metal butt welds (DMBWs) in the primary loop piping.

(SSER 22, Section 3.6.3) Closed in SSER 24, Section 3.6.3.

(16) Based on the uniqueness of EQ, the NRC staff must RII/NRR Open perform a detailed inspection and evaluation prior to fuel load to determine how the WBN Unit 2 EQ program complies with the requirements of 10 CFR 50.49. (SSER 22, Section 3.11.2)

(17) The NRC staff should verify the accuracy of the RII/NRR Open WBN Unit 2 EQ list prior to fuel load. (SSER 22, Section 3.11.2.1)

(18) Based on the extensive layup period of equipment RII/NRR Closed within WBN Unit 2, the NRC staff must review, prior to fuel load, the assumptions used by TVA to re-establish a baseline for the qualified life of equipment. The purpose of the staffs review is to ensure that TVA has addressed the effects of environmental conditions on equipment during the layup period. (SSER 22, Section 3.11.2.2) Closed in Inspection Report 0500391/2011604, dated June 29, 2011, ADAMS Accession No. ML111810890.

HH-2

(19) The NRC staff should complete its review of TVAs RII/NRR Closed EQ Program procedures for WBN Unit 2 prior to fuel load. (SSER 22, Section 3.11.2.2.1) Closed in Inspection Report 0500391/2011604, dated June 29, 2011, ADAMS Accession No. ML111810890.

(20) CI Resolve whether or not routine maintenance RII/NRR Closed activities should result in increasing the EQ of the 6.9 kV motors to Category I status in accordance with 10 CFR 50.49. (SSER 22, Section 3.11.2.2.1; SSER 24, Section 8.1) Closed in Inspection Report 0500391/2011605, dated August 5, 2011, ADAMS Accession No. ML112201418.

(21) The NRC staff should confirm that the Electrical RII/NRR Open Penetration Assemblies (EPAs) are installed in the tested configuration, and that the feedthrough module is manufactured by the same company and is consistent with the EQ test report for the EPA.

(SSER 22, Section 3.11.2.2.1)

(22) TVA must clarify its use of the term equivalent NRR Closed (e.g., identical, similar) regarding the replacement terminal blocks to the NRC staff. If the blocks are similar, then a similarity analysis should be completed and presented to the NRC for review.

(SSER 22, Section 3.11.2.2.1) Closed in SSER 24, Section 8.1.

(23) CI Resolve whether or not TVAs reasoning for not NRR Open upgrading the MSIV solenoid valves to Category I is a sound reason to the contrary, as specified in 10 CFR 50.49(l). (SSER 22, Section 3.11.2.2.1; SSER 24, Section 8.1)

(24) The NRC staff requires supporting documentation NRR Closed from TVA to justify its establishment of a mild environment threshold for total integrated dose of less than 1x103 rads for electronic components such as semiconductors or electronic components containing organic material. (SSER 22, Section 3.11.2.2.1) Closed in SSER 24, Section 8.1.

(25) Prior to the issuance of an operating license, TVA is NRR Open required to provide satisfactory documentation that it has obtained the maximum secondary liability insurance coverage pursuant to 10 CFR 140.11(a)(4), and not less than the amount required by 10 CFR 50.54(w) with respect to property insurance, and the NRC staff has reviewed and approved the documentation. (SSER 22, Section 22.3)

(26) For the scenario with an accident in one unit and NRR Open concurrent shutdown of the second unit without offsite power, TVA stated that Unit 2 pre-operational testing will validate the diesel response to HH-3

sequencing of loads on the Unit 2 emergency diesel generators (EDGs). The NRC staff will evaluate the status of this issue and will update the status of the EDG load response in a future SSER. (SSER 22, Section 8.1)

(27) TVA should provide a summary of margin studies NRR Closed based on scenarios described in Section 8.1 for CSSTs A, B, C, and D. (SSER 22, Section 8.2.2)

Closed in SSER 24, Section 8.1.

(28) TVA should provide to the NRC staff a detailed NRR Closed discussion showing that the load tap changer is able to maintain the 6.9 kV bus voltage control band given the normal and post-contingency transmission operating voltage band, bounding voltage drop on the grid, and plant conditions. (SSER 22, Section 8.2.2) Closed in SSER 24, Section 8.1.

(29) TVA should provide information about the operating NRR Closed characteristics of the offsite power supply at the Watts Bar Hydro Plant (for dual-unit operation),

including the operating voltage range, postcontingency voltage drops (including bounding values and post-unit trip values), and operating frequency range. (SSER 22, Section 8.2.2)

(corrected version of Open Item 29 from SSER 22 Appendix HH) Closed in SSER 24, Section 8.1.

(30) TVA should confirm that all other safety-related RII/NRR Open equipment (in addition to the Class 1E motors) will have adequate starting and running voltage at the most limiting safety related components (such as motor operated valves, contactors, solenoid valves or relays) at the degraded voltage relay setpoint dropout setting. TVA should also confirm that the final Technical Specifications are properly derived from these analytical values for the degraded voltage settings. (SSER 22, Section 8.3.1.2)

(31) TVA should clarify the loading sequence as NRR Closed explained in its letter dated December 6, 2010 to the staff. TVA should clarify whether the existing statements in FSAR regarding automatic sequencing logic are correct. If the FSAR description is correct, TVA should explain how the EDG and logic sequencing circuitry will respond to a LOCA followed by a LOOP scenario. (SSER 22, Section 8.3.1.11) (corrected version of Open Item 31 from SSER 22 Appendix HH) Closed in SSER 24, Section 8.1 (32) TVA should provide to the NRC staff the details of NRR Open the administrative limits of EDG voltage and speed range, and the basis for its conclusion that the impact is negligible, and describe how it accounts HH-4

for the administrative limits in the Technical Specification surveillance requirements for EDG voltage and frequency. (SSER 22, Section 8.3.1.14)

(33) CI TVA stated in Attachment 9 of its letter dated July RII/NRR Open 31, 2010, that certain design change notices (DCNs) are required or anticipated for completion of WBN Unit 2, and that these DCNs were unverified assumptions used in its analysis of the 125 Vdc vital battery system. Verification of completion of these DCNs to the NRC staff is necessary prior to issuance of the operating license. (SSER 22, Section 8.3.2.3; SSER 24, Section 8.1)

(34) CI TVA stated that the method of compliance with NRR Closed Phase I guidelines would be substantially similar to the current Unit 1 program and that a new Section 3.12 will be added to the Unit 2 FSAR that will be materially equivalent to Section 3.12 of the current Unit 1 FSAR. (SSER 22, Section 9.1.4) Closed in SSER 24, Section 9.1.4.

(35) TVA should provide information to the NRC staff NRR Open that the CCS will produce feedwater purity in accordance with BTP MTEB 5-3 or, alternatively, provide justification for producing feedwater purity to another acceptable standard. (SSER 22, Section 10.4.6)

(36) TVA should provide information to the NRC staff to NRR Closed enable verification that the SGBS meets the requirements and guidance specified in the SER or provide justification that the SGBS meets other standards that demonstrate conformance to GDC 1 and GDC 14. (SSER 22, Section 10.4.8) Closed in SSER 24, Section 10.4.8.

(37) CI The NRC staff will review the combined WBN Unit 1 NSIR Open and 2 Appendix C prior to issuance of the Unit 2 OL to confirm (1) that the proposed Unit 2 changes were incorporated into Appendix C, and (2) that changes made to Appendix C for Unit 1 since Revision 92 and the changes made to the NP-REP since Revision 92 do not affect the bases of the staffs findings in this SER supplement. (SSER 22, Section 13.3.2)

(38) CI The NRC staff will confirm the availability and RII/NSIR Open operability of the ERDS for Unit 2 prior to issuance of the Unit 2 OL. (SSER 22, Section 13.3.2.6)

(39) CI The NRC staff will confirm the adequacy of the RII/NSIR Open communications capability to support dual unit operations prior to issuance of the Unit 2 OL. (SSER 22, Section 13.3.2.6)

HH-5

(40) CI The NRC staff will confirm the adequacy of the RII/NSIR Open emergency facilities and equipment to support dual unit operations prior to issuance of the Unit 2 OL.

(SSER 22, Section 13.3.2.8)

(41) CI TVA committed to (1) update plant data displays as RII/NSIR Open necessary to include Unit 2, and (2) to update dose assessment models to provide capabilities for assessing releases from both WBN units. The NRC staff will confirm the adequacy of these items prior to issuance of the Unit 2 OL. (SSER 22, Section 13.3.2.9)

(42) CI The NRC staff will confirm the adequacy of the RII/NSIR Open accident assessment capabilities to support dual unit operations prior to issuance of the Unit 2 OL.

(SSER 22, Section 13.3.2.9)

(43) CI Section V of Appendix E to 10 CFR Part 50 requires NSIR Open TVA to submit its detailed implementing procedures for its emergency plan no less than 180 days before the scheduled issuance of an operating license.

Completion of this requirement will be confirmed by the NRC staff prior to the issuance of an operating license. (SSER 22, Section 13.3.2.18)

(44) TVA should provide additional information to clarify NRR Open how the initial and irradiated RTNDT was determined. (SSER 22, Section 5.3.1)

(45) CI TVA stated in its response to RAI 5.3.2-2, dated NRR Open July 31, 2010, that the PTLR would be revised to incorporate the COMS arming temperature. (SSER 22, Section 5.3.2)

(46) CI The LTOP lift settings were not included in the NRR Open PTLR, but were provided in TVAs response to RAI 5.3.2-2 in its letter dated July 31, 2010. TVA stated in its RAI response that the PTLR would be revised to incorporate the LTOP lift settings into the PTLR.

(SSER 22, Section 5.3.2)

(47) The NRC staff noted that TVAs changes to NRR Open Section 6.2.6 in FSAR Amendment 97, regarding the implementation of Option B of Appendix J, were incomplete, because several statements remained regarding performing water-sealed valve leakage tests as specified in 10 CFR [Part] 50, Appendix J.

With the adoption of Option B, the specified testing requirements are no longer applicable; Option A to Appendix J retains these requirements. The NRC discussed this discrepancy with TVA in a telephone conference on September 28, 2010. TVA stated that it would remove the inaccurate reference to Appendix J for specific water testing requirements in a future FSAR amendment. (SSER 22, Section 6.2.6)

HH-6

(48) CI The NRC staff should verify that its conclusions in NRR Open the review of FSAR Section 15.4.1 do not affect the conclusions of the staff regarding the acceptability of Section 6.5.3. (SSER 22, Section 6.5.3)

(49) CI The NRC staff was unable to determine how TVA RII Open linked the training qualification requirements of ANSI N45.2-1971 to TVA Procedure TI-119.

Therefore, the implementation of training and qualification for inspectors will be the subject of future NRC staff inspections. (NRC letter dated July 2, 2010, ADAMS Accession No. ML101720050)

(50) CI TVA stated that about 5 percent of the anchor bolts RII Open for safety-related pipe supports do not have quality control documentation, because the pull tests have not yet been performed. Since the documentation is still under development, the NRC staff will conduct inspections to follow-up on the adequate implementation of this construction refurbishment program requirement. (NRC letter dated July 2, 2010, ADAMS Accession No. ML101720050)

(51) CI The implementation of TVA Procedure TI-119 will RII Open be the subject of NRC follow-up inspection to determine if the construction refurbishment program requirements are being adequately implemented.

(NRC letter dated July 2, 2010, ADAMS Accession No. ML101720050)

(52) Not used.

through (58)

(59) The staffs evaluation of the compatibility of the ESF NRR Open system materials with containment sprays and core cooling water in the event of a LOCA is incomplete pending resolution of GSI-191 for WBN Unit 2.

(SSER 23, Section 6.1.1.4)

(60) CI TVA should amend the FSAR description of the NRR Open design and operation of the spent fuel pool cooling and cleanup system in FSAR Section 9.1.3 as proposed in its December 21, 2010, letter to the NRC. (SSER 23, Section 9.1.3)

(61) TVA should provide information to the NRC staff to NRR Open demonstrate that PAD 4.0 can conservatively calculate the fuel temperature and other impacted variables, such as stored energy, given the lack of a fuel thermal conductivity degradation model. (SSER 23, Section 4.2.2)

(62) CI Confirm TVAs change to FSAR Section 10.4.9 to NRR Closed reflect its intention to operate with each CST isolated from the other. (SSER 23, Section 10.4.9)

Closed in SSER 24, Section 10.4.9.

HH-7

(63) CI TVA should confirm to the NRC staff that testing RII Open prior to Unit 2 fuel load has demonstrated that two-way communications is impossible with the Eagle 21 communications interface. (SSER 23, Section 7.2.1.1)

(64) CI TVA stated that, Post modification testing will be RII Open performed to verify that the design change corrects the Eagle 21, Rack 2 RTD accuracy issue prior to WBN Unit 2 fuel load. This issue is open pending NRC staff review of the testing results. (SSER 23, Section 7.2.1.1)

(65) TVA should provide justification to the staff NRR Open regarding why different revisions of WCAP-13869 are referenced in WBN Unit 1 and Unit 2. (SSER 23, Section 7.2.1.1)

(66) CI TVA should clarify FSAR Section 9.2.5 to add the NRR Open capability of the UHS to bring the nonaccident unit to cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. (SSER 23, Section 9.2.5)

(67) CI TVA should confirm, and the NRC staff should RII Open verify, that the component cooling booster pumps for Unit 2 are above PMF level. (SSER 23, Section 9.2.2)

(68) Not used.

(69) CI The WBN Unit 2 RCS vent system is acceptable, RII Open pending verification that the RCS vent system is installed. (SSER 23, Section 5.4.5)

(70) TVA should provide the revised WBN Unit 2 PSI NRR Open program ASME Class 1, 2, and 3 Supports Summary Tables, to include numbers of components so that the NRC staff can verify that the numbers meet the reference ASME Code. (Section 3.2.3 of Appendix Z of SSER 23)

(71) By letter dated April 21, 2011 (ADAMS Accession NRR Open No. ML111110513), TVA withdrew its commitment to replace the Unit 2 clevis insert bolts. TVA should provide further justification for the decision to not replace the bolts to the NRC staff. (SSER 23, Section 3.9.5)

(72) The NRC staff should complete its review and NRR Open evaluation of the additional information provided by TVA regarding the ICC instrumentation. (SSER 23, Section 4.4.8)

(73) CI The NRC staff will inspect to confirm that TVA has RII Open completed the WBN Unit 2 EOPs prior to fuel load.

(SSER 23, Section 7.5.3)

HH-8

(74) CI The NRC staff will verify installation of the acoustic- RII Open monitoring system for the power-operated relief valve (PORV) position indication in WBN Unit 2 before fuel load. (SSER 23, Section 7.8.1)

(75) CI The NRC staff will verify that the test procedures RII Open and qualification testing for auxiliary feedwater initiation and control and flow indication are completed in WBN Unit 2 before fuel load. (SSER 23, Section 7.8.2)

(76) CI The NRC staff will verify that the derivative time RII Open constant is set to zero in WBN Unit 2 before fuel load. (SSER 23, Section 7.8.3)

(77) It is unclear to the NRC staff which software V&V NRR Open documents are applicable to the HRCAR monitors.

TVA should clarify which software V&V documents are applicable, in order for the staff to complete its evaluation. (SSER 23, Section 7.5.2.3)

(78) TVA intends to issue a revised calculation reflecting NRR Open that the TID in the control room is less than 1x103 rads, which will be evaluated by the NRC staff.

(SSER 23, Section 7.5.2.3)

(79) TVA should perform a radiated susceptibility survey, NRR Open after the installation of the hardware but prior to the RM-1000 being placed in service, to establish the need for exclusion distance for the HRCAR monitors while using handheld portable devices (e.g., walkie-talkie) in the control room, as documented in Attachment 23 to TVAs letter dated February 25, 2011, and item number 355 of TVAs letter dated April 15, 2011. (SSER 23, Section 7.5.2.3)

(80) TVA should provide clarification to the staff on how NRR Open TVA Standard Specification SS-E18-14.1 meets the guidance of RG 1.180, and should address any deviations from the guidance of the RG. (SSER 23, Section 7.5.2.3)

(81) The extent to which TVAs supplier, General NRR Open Atomics (GA), complies with EPRI TR-106439 and the methods that GA used for its commercial dedication process should be provided by TVA to the NRC staff for review. (SSER 23, Section 7.5.2.3)

(82) The staff concluded that the information provided by NRR Closed TVA pertaining to the in-containment LPMS equipment qualification for vibration was incomplete.

TVA should provide (item number 362 of ADAMS Accession No. ML111050009), documentation that demonstrates the LPMS in-containment equipment has been qualified to remain functional in its normal operating vibration environment, per RG 1.133, HH-9

Revision 1. (SSER 23, Section 7.6.1) Closed in SSER 24, Section 7.6.1.4.5.

(83) CI TVA should confirm to the NRC staff the completion NRR Open of the data storm test on the DCS. (SSER 23, Section 7.7.1.4)

(84) Not used.

through (89)

(90) CI The NRC staff should verify that the ERCW dual RII/NRR Open unit flow balance confirms that the ERCW pumps meet all specified performance requirements and have sufficient capability to supply all required ERCW normal and accident flows for dual unit operation and accident response, in order to verify that the ERCW pumps meet GDC 5 requirements for two-unit operation. (SSER 23, Section 9.2.1)

(91) TVA should update the FSAR with information NRR Open describing how WBN Unit 2 meets GDC 5, assuming the worst case single failure and a LOOP, as provided in TVAs letter dated April 13, 2011.

(SSER 23, Section 9.2.1)

(92) Not used.

(93) TVA should confirm to the staff that testing of the RII Open Eagle 21 system has sufficiently demonstrated that two-way communication to the ICS is precluded with the described configurations. (SSER 23, Section 7.9.3.2)

(94) TVA should provide to the staff either information NRR Open that demonstrates that the WBN Unit 2 Common Q PAMS meets the applicable requirements in IEEE Std. 603-1991, or justification for why the Common Q PAMS should not meet those requirements.

(SSER 23, Section 7.5.2.2.3)

(95) TVA should update FSAR Table 7.1-1, Watts Bar NRR Open Nuclear Plant NRC Regulatory Guide Conformance, to reference IEEE Std. 603-1991 for the WBN Unit 2 Common Q PAMS. (SSER 23, Section 7.5.2.2.3)

(96) TVA should (1) update FSAR Table 7.1-1 to include NRR Open RG 1.100, Revision 3, for the Common Q PAMS, or (2) demonstrate that the Common Q PAMS is in conformance with RG 1.100, Revision 1, or provide justification for not conforming. (SSER 23, Section 7.5.2.2.3)

(97) TVA should demonstrate that the WBN Unit 2 NRR Open Common Q PAMS is in conformance with RG 1.153, Revision 1, or provide justification for not HH-10

conforming. (SSER 23, Section 7.5.2.2.3)

(98) TVA should demonstrate that the WBN Unit 2 NRR Open Common Q PAMS is in conformance with RG 1.152, Revision 2, or provide justification for not conforming. (SSER 23, Section 7.5.2.2.3)

(99) TVA should update FSAR Table 7.1-1 to reference NRR Open IEEE 7-4.3.2-2003 as being applicable to the WBN Unit 2 Common Q PAMS. (SSER 23, Section 7.5.2.2.3)

(100) TVA should update FSAR Table 7.1-1 to reference NRR Open RG 1.168, Revision 1; IEEE 1012-1998; and IEEE 1028-1997 as being applicable to the WBN Unit 2 Common Q PAMS. (SSER 23, Section 7.5.2.2.3)

(101) TVA should demonstrate that the WBN Unit 2 NRR Open Common Q PAMS application software is in conformance with RG 1.168, Revision 1, or provide justification for not conforming. (SSER 23, Section 7.5.2.2.3)

(102) TVA should update FSAR Table 7.1-1 to reference NRR Open RG 1.209 and IEEE Std. 323-2003 as being applicable to the WBN Unit 2 Common Q PAMS.

(SSER 23, Section 7.5.2.2.3)

(103) TVA should demonstrate that the WBN Unit 2 NRR Open Common Q PAMS conforms to RG 1.209 and IEEE Std. 323-2003, or provide justification for not conforming. (SSER 23, Section 7.5.2.2.3)

(104) CI The NRC staff will review the WEC self assessment NRR Open to verify that it the WBN Unit 2 PAMS is compliant to the V&V requirements in the SPM or that deviations from the requirements are adequately justified.

(SSER 23, Section 7.5.2.2.3.4.2)

(105) TVA should produce an acceptable description of NRR Open how the WBN Unit 2 Common Q PAMS SysRS and SRS implement the design basis requirements of IEEE Std. 603-1991 Clause 4. (SSER 23, Section 7.5.2.2.3.4.3.1)

(106) TVA should produce a final WBN Unit 2 Common Q NRR Open PAMS SRS that is independently reviewed. (SSER 23, Section 7.5.2.2.3.4.3.1)

(107) CI TVA should provide to the NRC staff documentation NRR Open to confirm that the final WBN Unit 2 Common Q PAMS SDDs that are independently reviewed.

(SSER 23, Section 7.5.2.2.3.4.3.2)

(108) TVA should demonstrate to the NRC staff that there NRR Open are no synergistic effects between temperature and humidity for the Common Q PAMS equipment.

(SSER 23, Section 7.5.2.2.3.5.2)

HH-11

(109) TVA should demonstrate to the NRC staff NRR Open acceptable data storm testing of the Common Q PAMS. (SSER 23, Section 7.5.2.2.3.7.1.8)

(110) TVA should provide information to the NRC staff NRR Open describing how the WBN Unit 2 Common Q PAMS design supports periodic testing of the RVLIS function. (SSER 23, Section 7.5.2.2.3.9.2.6)

(111) TVA should confirm to the staff that there are no NRR Open changes required to the technical specifications as a result of the modification installing the Common Q PAMS. If any changes to the technical specifications are required, TVA should provide the changes to the NRC staff for review. (SSER 23, Section 7.5.2.2.3.11)

(112) CI TVA should provide an update to the FSAR NRR Open reflecting the radiation protection design features descriptive information provided in its letter dated October 4, 2010. (SSER 24, Section 12.4)

(113) CI TVA should provide an update to the FSAR NRR Open reflecting the justification for the periodicity of the COT frequency for WBN non-safety related area radiation monitors. (SSER 24, Section 12.4)

(114) CI TVA should update the FSAR to reflect that WBN NRR Open meets the radiation monitoring requirements of 10 CFR 50.68. (SSER 24, Section 12.4)

(115) CI TVA should update the FSAR to reflect the NRR Open information regarding design changes to be implemented to lower radiation levels as provided in its letter the NRC dated June 3, 2010. (SSER 24, Section 12.5)

(116) CI TVA should update the FSAR to reflect the NRR Open qualification standards of the RPM as provided in its letter to the NRC dated October 4, 2010. (SSER 24, Section 12.6)

(117) CI TVA should update the FSAR to reflect the NRR Open calculational basis for access to vital areas as provided in its letter dated February 25, 2011.

(SSER 24, Section 12.7.1)

(118) TVA should provide to the NRC staff a description of NRR Open how the other vanadium detectors within the IITA would be operable following the failure of an SPND.

(SSER 24, Section 7.7.1.9.2)

(119) TVA should submit WNA-CN-00157-WBT, Revision NRR Open 0, to the NRC by letter. The NRC staff should confirm by review of WNA-CN-00157-WBT, Revision 0, that no credible source of faulting can negatively impact the CETs or PAMS train. (SSER 24, Section 7.7.1.9.5)

HH-12

(120) TVA should confirm to the NRC staff that the NRR Open maximum over-voltage or surge voltage that could affect the system is 264 VAC, assuming that the power supply cable to the SPS cabinet is not routed with other cables greater than 264 VAC. (SSER 24, Section 7.7.1.9.5)

(121) TVA should submit the results to the NRC staff of a NRR Open 600 VDC dielectric strength test performed on the IITA assembly. (SSER 24, Section 7.7.1.9.5)

(122) TVA should confirm to the NRC staff that different NRR Open divisions of safety power are supplied to the IIS SPS cabinets, with the power cables routed in separate shielded conduits. (SSER 24, Section 7.7.1.9.5)

(123) TVA should provide an explanation to the NRC staff NRR Open of how the system will assign a data quality value to notify the power distribution calculation software to disregard data from a failed SPND. (SSER 24, Section 7.7.1.9.5)

(124) While the BEACON datalink on the Application NRR Open server can connect to either BEACON machine, only BEACON A is used for communication. TVA should clarify to the NRC staff whether automatic switchover to the other server is not permitted.

(SSER 24, Section 7.7.1.9.5)

(125) TVA should provide clarification to the NRC staff of NRR Open the type of connector used with the MI cable in Unit 2, and which EQ test is applicable. (SSER 24, Section 7.7.1.9.5)

(126) To enable the NRC staff to evaluate and review the NRR Open IITA environmental qualification, TVA should provide the summary report of the environmental qualification for the IITA. (SSER 24, Section 7.7.1.9.5)

(127) TVA should provide a summary to the NRC staff of NRR Open the electro-magnetic interference/radio-frequency interference (EMI/RFI) testing for the MI cable electro-magnetic compatibility (EMC) qualification test results. (SSER 24, Section 7.7.1.9.5)

(128) TVA should submit the seismic qualification test NRR Open report procedures and results for the SPS cabinets to the NRC staff for review. (SSER 24, Section 7.7.1.9.5)

(129) TVA should verify to the NRC staff resolution of the NRR Open open item in WNA-CN-00157-WBT for the Quint power supply (to be installed in the SPS cabinet) to undergo EMC testing of 4 kV to validate the assumptions made in the Westinghouse analysis.

(SSER 24, Section 7.7.1.9.5)

HH-13

(130) TVA should provide a summary to the NRC staff of NRR Open the EMC qualification test results of the SPS cabinets. (SSER 24, Section 7.7.1.9.5)

(131) TVA should review the EOP action level setpoint to NRR Open account for the difference between core exit temperature readings for Unit 1 and Unit 2 and confirm the EOP action level setpoint to the NRC staff. (SSER 24, Section 7.7.1.9.5)

(132) TVA must provide the NRC staff with analyses of NRR Open the boron dilution event that meet the criteria of SRP Section 15.4.6, including a description of the methods and procedures used by the operators to identify the dilution path(s) and terminate the dilution, in order for the staff to determine that the analyses comply with GDC 10. (SSER 24, Section 15.2.4.4)

(133) In order to confirm the stability analysis of the sand NRR Open baskets used by TVA in the WBN Unit 2 licensing basis, TVA will perform either a hydrology analysis without crediting the use of the sand baskets at the Fort Loudoun dam for the seismic dam failure and flood combination, or TVA will perform a seismic test of the sand baskets, as stated in TVAs letter dated April 20, 2011. TVA will report the results of this analysis or test to the NRC by October 31, 2011. (SSER 24, Section 2.4.10)

(134) TVA should provide to the NRC staff supporting NRR Open technical justification for the statements in Amendment 104 of FSAR Section 2.4.4.1, Dam Failure Permutations, page 2.4-32 (in the section Multiple Failures) that, Fort Loudoun, Tellico, and Watts Bar have previously been judged not to fail for the OBE (0.09 g). Postulation of Tellico failure in this combination has not been evaluated but is bounded by the SSE failure of Norris, Cherokee, Douglas and Tellico. (SSER 24, Section 2.4.10)

(135) TVA has not provided the analysis required by 10 NRR Open CFR Part 50, Appendix I, subsection II.D. TVA must demonstrate with a cost-benefit analysis that a sufficient reduction in the collective dose to the public within a 50-mile radius would not be achieved by reasonable changes to the design of the WBN gaseous effluent processing systems. (SSER 24, Section 11.3)

CI - Confirmatory Issue HH-14

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, DC 20555-0001 OFFICIAL BUSINESS

NUREG-0847 Safety Evaluation Report Related to the Operation of September 2011 Supplement 24 Watts Bar Nuclear Plant, Unit 2