Text

Safety Evaluation Regarding Implementation of Mitigation Strategies and Reliable Spent Fuel Pool Instrument Related to Orders EA-12-049 and EA-12-051
	ML17129A037
Person / Time
Site:	Duane Arnold
Issue date:	05/26/2017
From:	Boska J; Japan Lessons-Learned Division
To:	Dean Curtland; NextEra Energy Duane Arnold
	Paige J, NRR/JLD, 415-1474
References
	CAC MF1000, CAC MF1001, EA-12-049, EA-12-051
	Download: ML17129A037 (69)
	v • d • e

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON , D.C. 20555-0001 May 26, 2017 Mr. Dean Curtland Site Director NextEra Energy Duane Arnold Energy Center 3277 DAEC Road Palo, IA 52324-9785

SUBJECT:

DUANE ARNOLD ENERGY CENTER - SAFETY EVALUATION REGARDING IMPLEMENTATION OF MITIGATING STRATEGIES AND RELIABLE SPENT FUEL POOL INSTRUMENTATION RELATED TO ORDERS EA-12-049 AND EA-12-051 (CAC NOS. MF1000 AND MF1001)

Dear Mr. Curtland :

On March 12, 2012, the U.S. Nuclear Regulatory Commission (NRC) issued Order EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond Design-Basis External Events" and Order EA-12-051 , "Order to Modify Licenses With Regard To Reliable Spent Fuel Pool Instrumentation ," (Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML12054A736 and ML12054A679, respectively). The orders require holders of operating reactor licenses and construction permits issued under Title 1O of the Code of Federal Regulations Part 50 to modify the plants to provide additional capabilities and defense-in-depth for responding to beyond-design-basis external events, and to submit for review Overall Integrated Plans (OIPs) that describe how compliance with the requirements of Attachment 2 of each order will be achieved.

By letter dated February 28, 2013 (ADAMS Accession No. ML13063A148), NextEra Energy Duane Arnold , LLC (NextEra, the licensee) submitted its OIP for Duane Arnold Energy Center (Duane Arnold) in response to Order EA-12-049. At six month intervals following the submittal of its OIP, the licensee submitted reports on its progress in complying with Order EA-12-049.

These reports were required by the order, and are listed in the attached safety evaluation. By letter dated August 28, 2013 (ADAMS Accession No. ML13234A503), the NRC notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-049 in accordance with NRC Office of Nuclear Reactor Regulation (NRR) Office Instruction LIC-111 , "Regulatory Audits" (ADAMS Accession No. ML082900195). By letters dated February 21 , 2014 (ADAMS Accession No. ML14007A676) , and August 29, 2016 (ADAMS Accession No. ML16217A157), the NRC issued an Interim Staff Evaluation (ISE) and audit report, respectively, on the licensee's progress. By letter dated December 7, 2016 (ADAMS Accession No. ML16347A010), NextEra submitted a compliance letter and Final Integrated Plan (FIP) in response to Order EA-12-049. The compliance letter stated that the licensee had achieved full compliance with Order EA-12-049.

By letter dated February 28, 2013 (ADAMS Accession No. ML13063A014), NextEra submitted its 01 P for Duane Arnold in response to Order EA-12-051 . At six month intervals following the submittal of the OIP, the licensee submitted reports on its progress in complying with Order EA-

D. Curtland 12-051 . These reports were required by the order, and are listed in the attached safety evaluation. By letters dated November 26, 2013 (ADAMS Accession No. ML13323B443), and August 29, 2016 (ADAMS Accession No. ML16217A157), the NRC staff issued an ISE and audit report, respectively, on the licensee's progress. By letter dated March 26, 2014 (ADAMS Accession No. ML14083A620), the NRC notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-051 in accordance with NRC NRR Office Instruction LIC-111 , similar to the process used for Order EA-12-049. By letter dated December 8, 2016 (ADAMS Accession No. ML17130A796), NextEra submitted a compliance letter in response to Order EA-12-051. The compliance letter stated that the licensee had achieved full compliance with Order EA-12-051.

The enclosed safety evaluation provides the results of the NRC staff's review of NextEra's strategies for Duane Arnold . The intent of the safety evaluation is to inform NextEra on whether or not its integrated plans, if implemented as described, appear to adequately address the requirements of Orders EA-12-049 and EA-12-051. The staff will evaluate implementation of the plans through inspection, using Temporary Instruction 2515-191 , "Implementation of Mitigation Strategies and Spent Fuel Pool Instrumentation Orders and Emergency Preparedness Communications/Staffing/ Multi-Unit Dose Assessment Plans" (ADAMS Accession No. ML15257A188). This inspection will be conducted in accordance with the NRC's inspection schedule for the plant.

If you have any questions, please contact Jason Paige, Orders Management Branch, Duane Arnold Project Manager, at 301-415-1474 or at Jason.Paige@nrc.gov.

Sincerely, Ll-LC?~

~n *P ._~oska, Acting Chief Orders Management Branch Japan Lessons-Learned Division Office of Nuclear Reactor Regulation Docket No.: 50-331

Enclosure:

Safety Evaluation cc w/encl: Distribution via Listserv

TABLE OF CONTENTS

1.0 INTRODUCTION

2.0 REGULATORY EVALUATION

2.1 Order EA-12-049 2.2 Order EA-12-051

3.0 TECHNICAL EVALUATION

OF ORDER EA-12-049 3.1 Overall Mitigation Strategy 3.2 Reactor Core Cooling Strategies 3.2.1 Core Cooling Strategy and RPV Makeup 3.2.1 .1 Phase 1 3.2.1.2 Phase 2 3.2.1.3 Phase 3 3.2.2 Variations to Core Cooling Strategy for Flooding Event 3.2.3 Staff Evaluations 3.2.3.1 Availability of Structures, Systems, and Components 3.2.3.1 .1 Plant SSCs 3.2.3.1.2 Plant Instrumentation 3.2.3.2 Thermal-Hydraulic Analyses 3.2.3.3 Recirculation Pump Seals 3.2.3.4 Shutdown Margin Analyses 3.2.3.5 FLEX Pumps and Water Supplies 3.2.3.6 Electrical Analyses 3.2.4 Conclusions 3.3 Spent Fuel Pool Cooling Strategies 3.3.1 Phase 1 3.3.2 Phase 2 3.3.3 Phase 3 3.3.4 Staff Evaluations 3.3.4.1 Availability of Structures, Systems, and Components 3.3.4.1.1 Plant SSCs 3.3.4.1 .2 Plant Instrumentation 3.3.4.2 Thermal-Hydraulic Analyses 3.3.4.3 FLEX Pumps and Water Supplies 3.3.4.4 Electrical Analyses 3.3.5 Conclusions 3.4 Containment Function Strategies 3.4.1 Phase 1 3.4.2 Phase 2 3.4.3 Phase 3 3.4.4 Staff Evaluations 3.4.4.1 Availability of Structures, Systems, and Components

3.4.4.1.1 Plant SSCs 3.4.4.1 .2 Plant Instrumentation 3.4.4.2 Thermal-Hydraulic Analyses 3.4.4.3 FLEX Pumps and Water Supplies 3.4.4.4 Electrical Analyses 3.4.5 Conclusions 3.5 Characterization of External Hazards 3.5.1 Seismic 3.5.2 Flooding 3.5.3 High Winds 3.5.4 Snow, Ice, and Extreme Cold 3.5.5 Extreme Heat 3.5.6 Conclusions 3.6 Planned Protection of FLEX Equipment 3.6.1 Protection from External Hazards 3.6.1.1 Seismic 3.6.1.2 Flooding 3.6.1.3 High Winds 3.6.1.4 Snow, Ice, Extreme Cold , and Extreme Heat 3.6.1.5 Conclusions 3.6.2 Availability of FLEX Equipment 3.7 Planned Deployment of FLEX Equipment 3.7.1 Means of Deployment 3.7.2 Deployment Strategies 3.7.3 FLEX Connection Points 3.7.3.1 Mechanical Connection Points 3.7.3.2 Electrical Connection Points 3.7.4 Accessibility and Lighting 3.7.5 Access to Protected and Vital Areas 3.7.6 Fueling of FLEX Equipment 3.7.7 Conclusions 3.8 Considerations in Using Offsite Resources 3.8.1 Duane Arnold SAFER Plan 3.8.2 Staging Areas 3.8.3 Conclusions 3.9 Habitability and Operations 3.9.1 Equipment Operating Conditions 3.9.1.1 Loss of Ventilation and Cooling 3.9.1.2 Loss of Heating 3.9.1.3 Hydrogen Gas Accumulation in Vital Battery Rooms 3.9.2 Personnel Habitability 3.9.2.1 Main Control Room 3.9.2.2 Spent Fuel Pool Area 3.9.3 Conclusions

3.10 Water Sources 3.10.1 Reactor Pressure Vessel Make-Up 3.10.2 Spent Fuel Pool Make-Up 3.10.3 Containment Cooling 3.10.4 Conclusions 3.11 Shutdown and Refueling Analyses 3.12 Procedures and Training 3.12.1 Procedures 3.12.2 Training 3.12.3 Conclusions 3.13 Maintenance and Testing of FLEX Equipment 3.14 Conclusions for Order EA-12-049

4.0 TECHNICAL EVALUATION

OF ORDER EA-12-051 4.1 Levels of Required Monitoring 4.2 Evaluation of Design Features 4.2.1 Design Features: Instruments 4.2.2 Design Features: Arrangement 4.2.3 Design Features: Mounting 4.2.4 Design Features: Qualification 4.2.4.1 Augmented Quality Process 4.2.4.2 Instrument Channel Reliability 4.2.5 Design Features: Independence 4.2.6 Design Features: Power Supplies 4.2.7 Design Features: Accuracy 4.2.8 Design Features: Testing 4.2.9 Design Features: Display 4.3 Evaluation of Programmatic Controls 4.3.1 Programmatic Controls: Training 4.3.2 Programmatic Controls: Procedures 4.3.3 Programmatic Controls: Testing and Calibration 4.4 Conclusions for Order EA-12-051

5.0 CONCLUSION

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO ORDERS EA-12-049 AND EA-12-051 NEXTERA ENERGY DUANE ARNOLD, LLC DUANE ARNOLD ENERGY CENTER DOCKET NO. 50-331

1.0 INTRODUCTION

The earthquake and tsunami at the Fukushima Dai-ichi nuclear power plant in March 2011 highlighted the possibility that extreme natural phenomena could challenge the prevention ,

mitigation and emergency preparedness defense-in-depth layers already in place in nuclear power plants in the United States. At Fukushima, limitations in time and unpredictable conditions associated with the accident significantly challenged attempts by the responders to preclude core damage and containment failure. During the events in Fukushima, the challenges faced by the operators were beyond any faced previously at a commercial nuclear reactor and beyond the anticipated design-basis of the plants. The U.S. Nuclear Regulatory Commission (NRC) determined that additional requirements needed to be imposed at U.S. commercial power reactors to mitigate such beyond-design-basis external events (BDBEEs).

On March 12, 2012, the NRC issued Order EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events" (Agencywide Documents Access and Management System (ADAMS) Accession No. ML12054A736). This order directed licensees to develop, implement, and maintain guidance and strategies to maintain or restore core cooling , containment, and spent fuel pool (SFP) cooling capabilities in the event of a BDBEE. Order EA-12-049 applies to all power reactor licensees and all holders of construction permits for power reactors.

On March 12, 2012, the NRC also issued Order EA-12-051 , "Order Modifying Licenses With Regard to Reliable Spent Fuel Pool Instrumentation" (ADAMS Accession No. ML12054A679).

This order directed licensees to install reliable SFP level instrumentation (SFPLI) with a primary channel and a backup channel , and with independent power supplies that are independent of the plant alternating cu rrent (ac) and direct current (de) power distribution systems. Order EA-12-051 applies to all power reactor licensees and all holders of construction permits for power reactors.

2.0 REGULATORY EVALUATION

Following the events at the Fukushima Dai-ichi nuclear power plant on March 11 , 2011 , the NRC established a senior-level agency task force referred to as the Near-Term Task Force (NTTF} . The NTTF was tasked with conducting a systematic and methodical review of the NRC regulations and processes and determining if the agency should make additional improvements Enclosure

to these programs in light of the events at Fukushima Dai-ichi. As a result of this review, the NTTF developed a comprehensive set of recommendations, documented in SECY-11-0093, "Near-Term Report and Recommendations for Agency Actions Following the Events in Japan ,"

dated July 12, 2011 (ADAMS Accession No. ML11186A950). Following interactions with stakeholders, these recommendations were enhanced by the NRC staff and presented to the Commission.

On February 17, 2012, the NRC staff provided SECY-12-0025, "Proposed Orders and Requests for Information in Response to Lessons Learned from Japan's March 11 , 2011 , Great Tohoku Earthquake and Tsunami ," (ADAMS Accession No. ML12039A103) to the Commission . This paper included a proposal to order licensees to implement enhanced BDBEE mitigation strategies. As directed by the Commission in staff requirements memorandum (SRM)-SECY-12-0025 (ADAMS Accession No. ML120690347), the NRC staff issued Orders EA-12-049 and EA-12-051.

2.1 Order EA-12-049 Order EA-12-049, Attachment 2 (ADAMS Accession No. ML12054A736), requires that operating power reactor licensees and construction permit holders use a three-phase approach for mitigating BDBEEs. The initial phase requires the use of installed equipment and resources to maintain or restore core cooling , containment and SFP cooling capabilities. The transition phase requires providing sufficient, portable, onsite equipment and consumables to maintain or restore these functions until they can be accomplished with resources brought from off site. The final phase requires obtaining sufficient offsite resources to sustain those functions indefinitely.

Specific requirements of the order are listed below:

1) Licensees or construction permit (CP) holders shall develop, implement, and maintain guidance and strategies to maintain or restore core cooling ,

containment, and SFP cooling capabilities following a beyond-design-basis external event.

2) These strategies must be capable of mitigating a simultaneous loss of all alternating current (ac) power and loss of normal access to the ultimate heat sink

[UHS] and have adequate capacity to address challenges to core cooling ,

containment, and SFP cooling capabilities at all units on a site subject to th is Order.

3) Licensees or CP holders must provide reasonable protection for the associated equipment from external events. Such protection must demonstrate that there is adequate capacity to address challenges to core cooling , containment, and SFP cooling capabilities at all units on a site subject to this Order.

4) Licensees or CP holders must be capable of implementing the strategies in all modes of operation.

5) Full compliance shall include procedures, guidance, training , and acquisition ,

staging , or installing of equipment needed for the strategies.

On December 10, 2015, following submittals and discussions in public meetings with NRC staff, the Nuclear Energy Institute (NEI) submitted document NEI 12-06, Revision 2, "Diverse and Flexible Coping Strategies (FLEX) Implementation Guide," (ADAMS Accession No.

ML16005A625) to the NRC to provide revised specifications for an industry-developed methodology for the development, implementation, and maintenance of guidance and strategies in response to the Mitigation Strategies order. The NRC staff reviewed NEI 12-06, Revision 2, and on January 22, 2016, issued Japan Lessons-Learned Division (JLD) Interim Staff Guidance (ISG) JLD-ISG-2012-01, Revision 1, "Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events" (ADAMS Accession No. ML15357A163), endorsing NEI 12-06, Revision 2, with exceptions, additions, and clarifications, as an acceptable means of meeting the requirements of Order EA-12-049, and published a notice of its availability in the Federal Register (81 FR 10283).

2.2 Order EA-12-051 Order EA-12-051, Attachment 2 (ADAMS Accession No. ML12054A679), requires that operating power reactor licensees and construction permit holders install reliable SFPLI.

Specific requirements of the order are listed below:

All licensees identified in Attachment 1 to the order shall have a reliable indication of the water level in associated spent fuel storage pools capable of supporting identification of the following pool water level conditions by trained personnel: (1) level that is adequate to support operation of the normal fuel pool cooling system, (2) level that is adequate to provide substantial radiation shielding for a person standing on the spent fuel pool operating deck, and (3) level where fuel remains covered and actions to implement make-up water addition should no longer be deferred.

1. The spent fuel pool level instrumentation shall include the following design features:

1.1 Instruments

The instrumentation shall consist of a permanent, fixed primary instrument channel and a backup instrument channel. The backup instrument channel may be fixed or portable. Portable instruments shall have capabilities that enhance the ability of trained personnel to monitor spent fuel pool water level under conditions that restrict direct personnel access to the pool, such as partial structural damage, high radiation levels, or heat and humidity from a boiling pool.

1.2 Arrangement

The spent fuel pool level instrument channels shall be arranged in a manner that provides reasonable protection of the level indication function against missiles that may result from damage to the structure over the spent fuel pool. This protection may be provided by locating the primary instrument channel and fixed portions of the backup instrument channel, if applicable, to maintain instrument channel separation within the spent fuel pool area, and to utilize inherent shielding from missiles provided by existing recesses and corners in the spent fuel pool structure.

1.3 Mounting

Installed instrument channel equipment within the spent fuel pool shall be mounted to retain its design configuration during and following the maximum seismic ground motion considered in the design of the spent fuel pool structure.

1.4 Qualification

The primary and backup instrument channels shall be reliable at temperature , humidity, and radiation levels consistent with the spent fuel pool water at saturation conditions for an extended period.

This reliability shall be established through use of an augmented quality assurance process (e.g., a process similar to that applied to the site fire protection program).

1.5 Independence

The primary instrument channel shall be independent of the backup instrument channel.

1.6 Power supplies: Permanently installed instrumentation channels shall each be powered by a separate power supply. Permanently installed and portable instrumentation channels shall provide for power connections from sources independent of the plant ac and de power distribution systems, such as portable generators or replaceable batteries. Onsite generators used as an alternate power source and replaceable batteries used for instrument channel power shall have sufficient capacity to maintain the level indication function until offsite resource availability is reasonably assured.

1.7 Accuracy

The instrument channels shall maintain their designed accuracy following a power interruption or change in power source without recalibration .

1.8 Testing

The instrument channel design shall provide for routine testing and calibration .

1.9 Display

Trained personnel shall be able to monitor the spent fuel pool water level from the control room , alternate shutdown panel, or other appropriate and accessible location. The display shall provide on-demand or continuous indication of spent fuel pool water level.

2. The spent fuel pool instrumentation shall be maintained available and reliable through appropriate development and implementation of the following programs:

2.1 Training

Personnel shall be trained in the use and the provision of alternate power to the primary and backup instrument channels .

2.2 Procedures

Procedures shall be established and maintained for the testing, calibration, and use of the primary and backup spent fuel pool instrument channels.

2.3 Testing and Calibration: Processes shall be established and maintained for scheduling and implementing necessary testing and calibration of the primary and backup spent fuel pool level instrument channels to maintain the instrument channels at the design accuracy.

On August 24, 2012, following several NEI submittals and discussions in public meetings with NRG staff, the NEI submitted document NEI 12-02, "Industry Guidance for Compliance With NRG Order EA-12-051 , To Modify Licenses With Regard to Reliable Spent Fuel Pool

Instrumentation," Revision 1 (ADAMS Accession No. ML12240A307) to the NRG to provide specifications for an industry-developed methodology for compliance with Order EA-12-051 . On August 29, 2012, the NRG staff issued its final version of JLD-ISG-2012-03, "Compliance with Order EA-12-051 , Reliable Spent Fuel Pool Instrumentation" (ADAMS Accession No. ML12221A339), endorsing NEI 12-02, Revision 1, as an acceptable means of meeting the requirements of Order EA-12-051 with certain clarifications and exceptions, and published a notice of its availability in the Federal Register (77 FR 55232).

3.0 TECHNICAL EVALUATION

OF ORDER EA-12-049 By letter dated February 28, 2013 (ADAMS Accession No. ML13063A148), NextEra Energy Duane Arnold , LLC (NextEra, the licensee) submitted its OIP for Duane Arnold Energy Center (Duane Arnold , DAEC) in response to Order EA-12-049. By letters dated August 27, 2013 (ADAMS Accession No. ML13242A007), February 24, 2014 (ADAMS Accession No. ML14063A065), August 25, 2014 (ADAMS Accession No. ML14239A493), February 19, 2015 (ADAMS Accession No. ML15054A006), August 14, 2015 (ADAMS Accession No. ML15246A409), February 29, 2016 (ADAMS Accession No. ML16064A023), and August 31 ,

2016 (ADAMS Accession No. ML16246A009), the licensee submitted six-month updates to the OIP. By letter dated August 28, 2013 (ADAMS Accession No. ML13234A503), the NRG notified all licensees and construction permit holders that the staff is conducting audits of their responses to Order EA-12-049 in accordance with NRG Office of Nuclear Reactor Regulation (NRR) Office Instruction LIC-111 , "Regulatory Audits" (ADAMS Accession No. ML082900195).

By letters dated February 21 , 2014 (ADAMS Accession No. ML14007A676), and August 29, 2016 (ADAMS Accession No. ML16217A157), the NRG issued an Interim Staff Evaluation (ISE) and an audit report on the licensee's progress. By letter dated December 7, 2016 (ADAMS Accession No. ML16347A010) , the licensee reported that full compliance with the requirements of Order EA-12-049 was achieved , and submitted a Final Integrated Plan (FIP).

3.1 Overall Mitigation Strategy to Order EA-12-049 describes the three-phase approach required for mitigating BDBEEs in order to maintain or restore core cooling , containment, and SFP cooling capabilities.

The phases consist of an initial phase {Phase 1) using installed equipment and resources, followed by a transition phase {Phase 2) in which portable onsite equipment is placed in service, and a final phase (Phase 3) in which offsite resources may be placed in service. The timing of when to transition to the next phase is determined by plant-specific analyses.

While the initiating event is undefined, it is assumed to result in an extended loss of ac power (ELAP) with a loss of normal access to the UHS. Thus, the ELAP with loss of normal access to the UHS is used as a surrogate for a BDBEE. The initial conditions and assumptions for the analyses are stated in NEI 12-06, Section 3.2.1, and include the following :

1. The reactor is assumed to have safely shut down with all rods inserted (subcritical).

2. The de power supplied by the plant batteries is initially available, as is the ac power from inverters supplied by those batteries; however, over time the batteries may be depleted.

3. There is no core damage initially.

4. There is no assumption of any concurrent event.

5. Because the loss of ac power presupposes random failures of safety-related equipment (emergency power sources) , there is no requirement to consider further random failures.

Duane Arnold is a General Electric boiling-water reactor (BWR) Model 4 with a Mark I containment. The licensee's three-phase approach to mitigate a postulated ELAP event, as described in the FIP, is summarized below. The approach is somewhat different if the plant receives warning of a pending flood, but the initial actions are similar.

At the onset of an ELAP the reactor is assumed to trip from full power. The main condenser is unavailable due to the loss of circulating water. Decay heat is removed when the safety relief valves (SRVs) open on high pressure and dump steam from the reactor pressure vessel (RPV) to the suppression pool located in the containment. Makeup to the RPV is provided by the reactor core isolation cooling (RCIC) turbine-driven pump. Because the condensate storage tank (CST) is not robust, the licensee's mitigating strategy assumes that the RCIC pump suction realigns to the suppression pool. Within 30 minutes after initiation of the event, the operators take manual control of the SRVs to perform a controlled cooldown and depressurization of the reactor. The cooldown of the primary system is stopped when reactor pressure reaches a control band of 150 pounds per square inch gauge (psig) to 200 psig to ensure sufficient steam pressure to operate the RCIC pump. When the suppression pool heats up to a predetermined setpoint, the vent to atmosphere is opened to mitigate the temperature rise and allow the RCIC system to continue to function. The RPV makeup will continue to be provided from the RCIC system until the gradual reduction in RPV pressure resulting from diminishing decay heat requires a transition to Phase 2 methods. The RCIC injection source will be maintained for as long as possible, since it is a closed loop system using relatively clean suppression pool water.

When the RCIC system is no longer available, the preferred RPV makeup supply in Phase 2 comes from one of two diesel-driven FLEX pumps. The suction source for the FLEX pump will be the circulating water pit or the condenser hotwell. The circulating water pit is robust, however, the condenser hotwell is located inside the non-seismic section of the turbine building.

Water in the circulating water pit is provided from the Cedar River via the river water supply system. The FLEX pump will discharge to the RPV via FLEX connection points on the 'A' residual heat removal (RHR) loop (primary) or the condensate service water system , which will allow injection to either the 'A' or 'B' RHR loop.

The Duane Arnold reactor has a Mark I containment which is inerted with nitrogen at power.

The licensee performed a containment evaluation and determined that opening the suppression pool vent to atmosphere will allow containment temperature and pressure to stay within acceptable levels until equipment from the National Strategic Alliance for FLEX Emergency Response (SAFER) Response Center (NSRC) can be set up for cooling of the suppression pool. Venting is expected to be required at roughly 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months into the event.

Duane Arnold has a SFP in its reactor building. To maintain SFP cooling capabilities, the licensee stated that the required action is to establish the water injection lineup before the environment on the SFP operating deck degrades due to boiling in the pool so that personnel can access the refuel floor to accomplish the coping strategies. The pool will initially heat up due to the unavailability of the normal cooling system. The licensee has calculated that, depending on the spent fuel loading in the pool, boiling could start as soon as 4.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months (full core offload) after the start of the ELAP. The pool water level would drop to the top of the fuel racks in approximately 45 hours5.208333e-4 days 0.0125 hours 7.440476e-5 weeks 1.71225e-5 months (full core offload) . The licensee determined that habitability on the pool operating deck area could become compromised after the ELAP, so valve lineups and hose deployments are planned prior to the pool area becoming uninhabitable. In addition, a vent hatch was installed above the SFP to facilitate natural ventilation of the reactor building with a loss of ac power. The vent can be pneumatically operated from a remote location within the reactor building using a portable pneumatic supply and would not require access to the

refueling floor. To supplement the vent above the SFP, various doors of the reactor building can be opened to allow a chimney effect with warmer air/steam rising to the roof vent to minimize the impact on the reactor building environment.

To makeup to the SFP, the licensee has a primary and alternate strategy to account for the condition of the pool. If the refuel floor is accessible and habitable, the primary SFP strategy is to connect FLEX hoses to a diesel-powered FLEX pump. Make-up to the SFP can be provided directly to the pool via hoses on the refueling deck or via the RHR system, which does not require access to the SFP area. In addition , as a backup to the SFP makeup strategy, the licensee explained that it has the capability to provide SFP spray of greater than 200 gallons per minute (gpm) by using portable spray nozzles on the refueling floor.

The operators will perform de bus load stripping within the initial 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months following event initiation to ensure safety-related battery life is extended up to 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months . Following de load stripping and prior to battery depletion , one 405-kilowatt (kW) , 480 volt alternating current (Vac) generator will be deployed from an emergency response storage building. These portable generators will be used to repower essential battery chargers within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months of ELAP initiation ,

as well as repowering the hardened containment vent system (HCVS) uninterruptable power supply.

In addition, an NSRC will provide high capacity pumps and large turbine-driven diesel generators (DGs), which could be used to restore an RHR cooling train to cool the cores in the long-term . There are two NSRCs in the United States.

Below are specific details on the licensee's strategies to restore or maintain core cooling ,

containment, and SFP cooling capabilities in the event of a BDBEE, and the results of the staff's review of these strategies. The NRC staff evaluated the licensee's strategies against the endorsed NEI 12-06, Revision 2, guidance.

3.2 Reactor Core Cooling Strategies Order EA-12-049 requires licensees to maintain or restore cooling to the reactor core in the event of an ELAP concurrent with a loss of normal access to the UHS. Although the ELAP results in an immediate trip of the reactor, sufficient core cooling must be provided to account for fission product decay and other sources of residual heat. Consistent with endorsed guidance from NEI 12-06, Phase 1 of the licensee's core cooling strategy credits installed equipment (other than that presumed lost to the ELAP with loss of normal access to the UHS) that is robust in accordance with the guidance in NEI 12-06. In Phase 2, robust installed equipment is supplemented by onsite FLEX equipment, which is used to cool the core either directly (e.g., pumps and hoses) or indirectly (e.g. , FLEX electrical generators and cables repowering robust installed equipment) . The equipment available onsite for Phases 1 and 2 is further supplemented in Phase 3 by equipment transported from the NSRCs.

As reviewed in this section , the licensee's core cooling analysis for the ELAP with loss of normal access to the UHS event presumes that, per endorsed guidance from NEI 12-06, the unit would have been operating at full power prior to the event. Therefore , the suppression pool may be credited as the heat sink for core cooling during the ELAP with loss of normal access to the UHS event. Maintenance of sufficient RPV inventory, despite steam release from the SRVs and ongoing system leakage expected under ELAP conditions , is accomplished through a combination of installed systems and FLEX equipment. The specific means used by the licensee to accomplish adequate core cooling are discussed in further detail below. The

licensee's strategy for ensuring compliance with Order EA-12-049 for conditions where the unit is shut down or being refueled is reviewed separately in Section 3.11 of this evaluation.

3.2.1 Core Cooling Strategy and RPV Makeup 3.2.1. 1 Phase 1 Per the Duane Arnold FIP, the initial injection of cooling water into the RPV will be accomplished through the RCIC system. The RCIC system suction is initially lined up to the CSTs and will pump water into the core from the CSTs automatically. The CSTs are not protected against windborne missile hazards, and thus cannot be credited to be available in all FLEX scenarios. If the CSTs are not available, RCIC suction will automatically transfer to the suppression pool.

The suppression pool is fully protected from all external hazards and is the credited source of water for this event. The suction swap-over function is fully protected from external hazards.

The RCIC pump is powered by a turbine using steam from the RPV and is robust for the hazards considered in the ELAP evaluation . Both the RCIC and high pressure coolant injection (HPCI) pumps are designed to automatically start following the ELAP event. Following the initial restoration of RPV water level operators will secure the HPCI system. In the event that RCIC does not automatically start, procedural guidance directs the operators to manually start the pump. The RCIC discharges into the RPV head cooling spray nozzle. RCIC system valves are powered by the 125 volt direct current (Vdc) bus and are used to control the cooling flow to the RPV, balancing it with the outflow of steam through the SRVs to the suppression pool in order to maintain the RPV level within its desired control band .

Pressure control of the RPV is accomplished using the SRVs, which are powered by redundant logic off of the 125 Vdc buses. At approximately 30 minutes into the event, operators will initiate actions to release steam through the SRVs to reduce pressure and temperature in the RPV .

RPV pressure is reduced at a rate less than the technical specification (TS) limit of 100 degrees Fahrenheit (°F) per hour. After cooldown , the reactor pressure is maintained between 150 and 200 psig to maintain adequate steam supply for continued operation of either the RCIC or HPCI system .

At approximately 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the start of the ELAP, SRV steam release and RCIC pump exhaust will have caused suppression pool temperature to reach 250° F based on thermal calculations . Although industry operating experience indicates that the RCIC system will remain functional at temperatures higher than this , for the purposes of this plan the licensee assumes that temperatures in excess of 250° F will require transitioning to Phase 2 actions. To preserve the functionality of RCIC , at approximately 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the initiation of the ELAP, procedure SEP 301.3, "Torus Vent Via Hardpipe Vent," provides operator guidance for use of the HCVS, including rupturing the HCVS rupture disk, to vent the torus to ensure containment design pressure is not challenged and to limit suppression pool temperature rise. The vent system requires no ac power for operation during the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of the event and is supplied with adequate air pressure for at least 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of operation. The licensee's FIP indicates that RCIC can provide adequate core cooling for at least 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months into the ELAP event during Phase 1.

3.2.1.2 Phase 2 Duane Arnold core cooling transitions from Phase 1 to Phase 2 at about 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months from the start of the ELAP or when RCIC failure is assumed due to the suppression pool temperature reaching 250° F. For the Phase 2 core cooling strategy, the licensee relies on FLEX

components that primarily consist of one of two DGs (480 Vac, 405 kW) and one of two diesel-driven FLEX pumps (1000 gpm at 400 feet (ft.) head). All FLEX equipment is stored in two redundant FLEX storage buildings (i.e., north and south emergency storage buildings). The suction source tor the FLEX pump will be the circulating water pit or the condenser hotwell. The circulating water pit is robust and contains 515,683 gallons of fresh water. The condenser hotwell is located inside the non-seismic section of the turbine building and contains 544,861 gallons of demineralized water.

Water in the circulating water pit is provided from the Cedar River via the river water supply system. The river water supply system provides tor rough filtration of the incoming river water.

The licensee expects that settling will also occur resulting in further separation of fine sol ids from the water in the circulating water pit. Once raw water from the pit has been used to provide for RPV makeup, operators will establish a higher water level control band to ensure top down cooling so that core blockage will not result in a loss of cooling within the core. The FLEX pump will discharge to the RPV via FLEX connection points on the 'A' AHR loop (primary) or the condensate service water system , which will allow injection to either the 'A' or 'B' AHR loop.

3.2.1.3 Phase 3 The Phase 3 strategy includes the use of equipment from the NSRC. The plant plans to continue the use of Phase 2 equipment or replace as necessary. Water level in the circulating water pit will decrease during Phase 2. The NSRC supplied equipment will be used to provide makeup to the circulating water pit tor infinite core cooling from the Cedar River. Water will be pumped from the river to the circulating water pit using the NSRC makeup pump equipped with two floating suction strainers. The licensee anticipates that a beyond design basis event could result in significant debris in the Cedar River. The suction strainers will provide continued coarse filtration of this debris. The NSRC supplied equipment will consist of a medium flow pump, a high flow pump, an RPV makeup pump, a high pressure injection pump, a 4160 V generator and a 4160 V distribution system .

3.2.2 Variations to Core Cooling Strategy tor Flooding Event In its FIP, the licensee stated that the reevaluated potential flood hazard is not bounded by the existing design bases flood at the site. The licensee developed a time line tor the mitigation strategy during the progression of a flood ing event. The FLEX equipment located in the north emergency response building is above the maximum postulated flood height. However, the south emergency storage building is below the maximum postulated flood height. Several days of warning time will be available to move the FLEX portable equipment from the south emergency response building to the turbine building before the flood water will reach the plant grade. Flood protection structures are designed to minimize the in-leakage of flood water and abnormal operating procedure (AOP) 902 provides the plant operators direction tor responding to flood warning , monitoring flood projections, and deploying flood protection features. The licensee's core cooling and makeup strategy implementation remains essentially the same tor a flooding event. The only major difference is that the flooding strategy uses a FLEX connection tor the FLEX pump suction in the flood protected area of the turbine building for suction from the main condenser hotwell. Effects of onsite flooding are discussed in Section 3.5.2 of this evaluation .

3.2.3 Staff Evaluations 3.2.3.1 Availability of Structures, Systems. and Components (SSCs)

Guidance document NEI 12-06 provides guidance that the baseline assumptions have been established on the presumption that other than the loss of the ac power sources and normal access to the UHS, installed equipment that is designed to be robust with respect to design basis external events is assumed to be fully available. Installed equipment that is not robust is assumed to be unavailable. Below are the baseline assumptions for the availability of SSCs for core cooling during an ELAP caused by a BDBEE.

3.2.3.1.1 Plant SSCs Reactor Core Isolation Cooling The RCIC system , which is located in the reactor building , provides the primary means for reactor vessel inventory control during Phase 1. The licensee explained that the RCIC system relies on 125 Vdc for control power, which remains available throughout the ELAP event.

Updated Final Safety Analysis Report (UFSAR) Table 3.2-1 and Table 3.2-3 indicates that the RCIC system and the reactor building are seismic Category I, respectively. In the UFSAR ,

Section 3.5.2 indicates that the reactor building is protected from externally generated missiles.

The normal water source for the RCIC system are the CSTs, and the suppression pool provides an alternate water source. The licensee confirmed that the equipment required to transfer the suction path from the CSTs to the suppression pool is protected from external hazards as defined in NEI 12-06. Based on the location and design of the RCIC pump and system , the NRC staff concludes that this system is robust and should be available during an ELAP event consistent with NEI 12-06, Section 3.2.1.3. During the audit, the NRC staff noted that consistent with the baseline capability in NEI 12-06, Table C-1 , the licensee has procedural guidance for local manual initiation of RCIC .

High Pressure Coolant Injection The HPCI system , which is located in the reactor building , serves as a backup in the event the RCIC system is unavailable at any time during the ELAP event. The licensee explained that the HPCI system relies on 250 Vdc for control power, which remains available throughout the ELAP event. In the UFSAR, Table 3.2-1 and Table 3.2-3 indicates that the HPCI system and the reactor building are seismic Category I, respectively. In the UFSAR , Section 3.5.2 indicates that the reactor building is protected from externally generated missiles. Based on the location and design of the HPCI pump and system , the NRC staff concludes that this system is robust and should be available during an ELAP event consistent with NEI 12-06, Section 3.2.1.3.

Safety Relief Valves The SRVs, which are housed in the drywell , control reactor pressure within specified limits during the initial response to a loss of ac power. Furthermore, the SRVs are needed to allow the transition to Phase 2 of core cooling by sufficiently depressurizing the reactor to allow the portable FLEX pump to inject water to the RPV. The licensee explained that the SRVs are powered by 125 Vdc, which remains available throughout the ELAP event. In the UFSAR ,

Table 3.2-1 and Table 3.2-3 indicates that the SRVs and the drywell are seismic Category I, respectively. Based on the design and location of the SRVs, the NRC staff concludes that this

system is robust and should be available during an ELAP event consistent with NEI 12-06, Section 3.2.1.3.

3.2.3.1.2 Plant Instrumentation The licensee's plan is to monitor instrumentation in the control room and by alternate means, if necessary, to support the FLEX cooling strategy. The instrumentation is powered by the station batteries and should be available for indefinite coping via battery chargers powered by the FLEX DGs. A more detailed evaluation of the instrumentation power supply is contained in Section 3.2.2.6 of this evaluation .

As described in the Duane Arnold FIP, the following instrumentation will be relied upon to support the FLEX core cooling and inventory control strategy:

RPV level (flood up and fuel zone)

RPV pressure

Torus water level

Torus temperature

Torus pressure

Drywell pressure

Drywell temperature These instruments are monitored from the control room and are accessible to the operators throughout the event. The instrumentation identified by the licensee to support its core cooling strategy appears to be consistent with the recommendations specified in the endorsed guidance of NEI 12-06.

In its FIP, the licensee stated that the instrumentation is normally powered by station batteries.

Following the initiation of the ELAP event, the battery power is extended by performing a load shed to maintain the availability of critical instruments. Charging of the batteries will be initiated within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months of the ELAP event by means of a FLEX portable 480 Vac DG ,*which will provide power to the battery chargers. The FLEX generators will continue to provide power throughout the duration of the event. Additional backup generators will be available from the NSRC during Phase 3. Therefore , based upon the information provided by the licensee, the NRC staff understands that the critical instruments should be available continuously throughout the ELAP event.

In accordance with NEI 12-06 Section 5.3.3.1, guidelines for obtaining critical parameters locally are provided in procedures. The Duane Arnold guide, SAMP 727, "FLEX Local Instrument Readings ," provides guidance on the use of portable instruments to take critical readings when no instrument de power is available. Some critical parameters in the procedure include reactor level and pressure, torus water level and temperature, drywell temperature, and drywell pressure. The SFP level instruments are discussed in Section 4.0 of this evaluation.

3.2.3.2 Thermal-Hydraulic Analyses The licensee based its mitigating strategy for reactor core cooling in part on thermal-hydraulic analysis performed using Version 4 of the Modular Accident Analysis Program (MAAP).

Because the thermal-hydraulic analysis for the reactor core and containment during an ELAP event are closely intertwined, as is typical of BWRs, the licensee has addressed both in a

single, coupled calculation . This dependency notwithstanding, the NRC staff's discussion in this section of the safety evaluation solely focuses on the licensee's analysis of reactor core cooling.

The review of the licensee's analysis of containment thermal-hydraulic behavior is provided in Section 3.4.4.2 of this evaluation.

The MAAP code is an industry-developed, general-purpose thermal-hydraulic computer code that has been used to simulate the progression of a variety of light-water reactor accident sequences, including severe accidents such as the Fukushima Dai-ichi event. Initial code development began in the early 1980s, with the objective of supporting an improved understanding of and predictive capability for severe accidents involving core overheating and degradation in the wake of the accident at Three Mile Island Nuclear Station , Unit 2. Currently, maintenance and development of the code is carried out under the direction of the Electric Power Research Institute (EPRI) .

To provide analytical justification for their mitigating strategies in response to Order EA-12-049, a number of licensees for BWRs and pressurized-water reactors (PWRs) completed analysis of the ELAP event using MAAP4. Although MAAP4 and predecessor code versions have been used by industry for a range of applications, such as the analysis of severe accident scenarios and probabilistic risk analysis (PRA) evaluations, the NRC staff had not previously examined the code's technical adequacy for performing best-estimate simulations of the ELAP event. In particular, due to the breadth and complexity of the physical phenomena within the code's calculation domain, as well as its intended capability for rapidly simulating a variety of accident scenarios to support PRA evaluations, the NRC staff observed that the MAAP code makes use of a number of simplified correlations and approximations that should be evaluated for their applicability to the ELAP event. Therefore , in support of the reviews of licensees' strategies for ELAP mitigation , the NRC staff audited the capability of the MAAP4 code for performing thermal-hydraulic analysis of the ELAP event for both BWRs and PWRs. The NRC staff's audit review involved a limited review of key code models, as well as confirmatory analysis with the TRACE code to obtain an independent assessment of the predictions of the MAAP4 code.

To support the NRC staff's review of the use of MAAP4 for ELAP analyses, in June 2013, EPRI issued a technical report entitled "Use of Modular Accident Analysis Program (MAAP) in Support of Post-Fukushima Applications." The document provided general information concerning the code and its development, as well as an overview of its physical models, modeling guidelines, validation, and quality assurance procedures.

Based on the NRC staff's review of EPRl 's June 2013 technical report, as supplemented by further discussion with the code vendor, audit review of key sections of the MAAP code documentation , and confirmation of acceptable agreement with NRC staff simulations using the TRACE code , the NRC staff concluded that, under certain conditions , the MAAP4 code may be used for best-estimate prediction of the ELAP event sequence for BWRs.

The NRC staff issued an endorsement letter dated October 3, 2013, which documented these conclusions *and identified specific limitations that BWR licensees should address to justify the applicability of simulations using the MAAP4 code for demonstrating that the requirements of Order EA-12-049 have been satisfied.

During the Duane Arnold audit review, the NRC staff verified that the licensee's MAAP4 calculation , along with an associated addendum , addressed the limitations from the NRC staff's endorsement letter. The licensee utilized the generic roadmap and response template that had been developed by EPRI to support consistency in individual licensee's responses to the

limitations from the endorsement letter. In particular, based upon a review of the MAAP4 calculation documentation, the staff concluded that appropriate inputs and modeling options had been selected for the code parameters expected to have dominant influence for the ELAP event. The NRC staff further observed that the limitations imposed in the endorsement letter, particularly those concerning the RPV collapsed liquid level being maintained above the reactor core and the primary system cooldown rate being maintained within TS limits, were satisfied.

Specifically, the licensee's analysis calculated that Duane Arnold would maintain the collapsed liquid level in the reactor vessel above the top of the active fuel region throughout the analyzed ELAP event. The licensee calculated that the minimum RPV water level above the top of active fuel is approximately 6.46 ft. and occurs during the initial RPV depressurization. By maintaining the reactor core fully covered with water, adequate core cooling is assured for this event.

Additionally, Duane Arnold's fulfillment of the endorsement letter condition regarding the primary system cooldown rate signifies that thermally induced volumetric contraction and other changes in primary system thermal-hydraulic conditions should proceed relatively slowly with time, which supports the NRC staff's confidence in the predictions of the MAAP4 code. Furthermore, the licensee should be capable of maintaining the entire reactor core submerged throughout the ELAP event, consistent with the staff's expectation that the licensee's flow capacity for primary makeup (i.e. , installed RCIC pump and, subsequently, FLEX pumps) should be sufficient to support adequate heat removal from the reactor core during the analyzed ELAP event, including potential losses due to expected primary leakage.

Therefore, based on the evaluation above, the NRC staff concludes that the licensee's analytical approach should appropriately determine the sequence of events for reactor core cooling , including time-sensitive operator actions, and evaluate the required equipment to mitigate the analyzed ELAP event, including pump sizing and cooling water capacity.

3.2.3.3 Recirculation Pump Seals An ELAP event would result in the interruption of cooling to the recirculation pump seals, potentially resulting in increased leakage due to the distortion or failure of the seals, elastomeric 0-rings, or other components. Sufficient primary make-up must be provided to offset recirculation pump seal leakage and other expected sources of primary leakage, in addition to removing decay heat from the reactor core.

The licensee's MAAP calculations for Duane Arnold assumed a total leakage rate at normal RPV operating pressure of 36 gpm. This leakage rate includes 18 gpm per recirculation pump.

The licensee stated that based on operating experience unidentified leakage was minimal. The licensee conducted a sensitivity calculation which assumed an additional primary system leakage rate equal to the TS Limiting Condition for Operation 3.4.4 limit of 25 gpm and determined that the effect on the plant response was negligible.

During the audit, the NRC staff discussed recirculation pump seal leakage with the licensee and requested that the licensee justify the applicability of the assumed leakage rate to the ELAP event. In its FIP, the licensee stated that the seal leakage rate and total RCS leakage rate will be proportional to the RPV pressure. Based on DAEC analysis the limiting flow rate for the FLEX pump occurred at a discharge pressure of 1000 psig. At this pressure the FLEX pump is able to provide 300 gpm at a time when core cooling required a minimum flow rate of 115 gpm (7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after event initiation). This required flow considers the flow required to replace evaporative losses as well as leakage losses. Further depressurization would result in a reduction in the leakage loss term .

Considering the above factors, the NRC staff concludes that the leakage rate of 18 gpm for each of the two recirculation pumps is reasonable based on the evaluation performed for NRC Generic Letter 91-07. Gross seal failures are not anticipated to occur during the postulated ELAP event. As is typical of the majority of U.S. BWRs, Duane Arnold has an installed steam-driven pump (i.e. , RCIC) capable of injecting into the primary system at a flow rate well in excess of the primary system leakage rate expected during an ELAP event, and the other pumps used for core cooling in its FLEX strategy have a similar functional capability. As discussed below, the FLEX pump is capable of injecting at a rate that maintains adequate margin.

Based upon the discussion above, the NRC staff concludes that the recirculation pump seal leakage rates assumed in the licensee's thermal-hydraulic analysis may be applied to the beyond-design basis ELAP event for the site.

3.2.3.4 Shutdown Margin Analyses As described in Duane Arnold's UFSAR, the control rods provide adequate shutdown margin under all anticipated plant conditions, with the assumption that the highest-worth control rod remains fully withdrawn. Duane Arnold TS Section 1.1 Definitions, further clarifies that shutdown margin is to be calculated for a cold , xenon-free condition to ensure that the most reactive core conditions are bounded.

Based on the NRC staff's audit review, the licensee's ELAP mitigating strategy maintains the reactor within the envelope of conditions analyzed by the licensee's existing shutdown margin calculation. Furthermore, the existing calculation is conservative because the guidance in NEI 12-06 permits analyses of the beyond-design-basis ELAP event to assume that all control rods fully insert into the reactor core.

Therefore, based on the evaluation above, the NRC staff concludes that the sequence of events in the proposed mitigating strategy should result in acceptable shutdown margin for the analyzed ELAP event.

3.2.3.5 FLEX Pumps and Water Supplies In the FIP, Section 3.2.4.7 states that the decay heat in the reactor will vary based on time after reactor shutdown and the make-up requirement will change based on the decay heat. The NRC staff noted that based on the licensee's FIP and sequence of events, the licensee assumes failure of the RCIC pump occurs when suppression pool temperature reaches 250 °F, which is projected to occur at approximately 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the initiating event. The FLEX pump will then be used to continue providing makeup to the RPV and support the core cooling function in place of the RCIC system . The licensee explained that based on its MAAP thermal hydraulic analysis the expected make-up flow requirement to the RPV is approximately 115 gpm during Phase 2.

During its audit, the NRC staff reviewed the licensee's hydraulic analysis and noted that the licensee conservatively used 300 gpm as the required FLEX pump flow rate to ensure margin with the flow rate needed to remove decay heat from the reactor. The licensee's calculation determined that for a river water temperature of 39 °F, the FLEX pump can provide a flow rate of 493 gpm with a net positive suction head available (NPSHa) of 6.053 ft. In addition , for a river water temperature of 100 °F, the FLEX pump can provide a flow rate of 491.2 gpm with a NPSHa of 5.016 ft. In both scenarios, the flowrate provided by the FLEX pump significantly

exceeds the acceptance criteria in the calculation (i.e. , 300 gpm) and the necessary flow rate to remove decay heat (i.e ., approximately 115 gpm). Furthermore, the staff noted that the NPSHa in both scenarios exceeds the NSPHa tor the pump. The licensee explained in its FIP that the FLEX pump provides substantial margin and would allow operators the flexibility to utilize the pump intermittently, if desired, and will also allow diversion of flow to the SFP, if desired.

Two FLEX pumps are located onsite with one pump stored in each of the emergency response storage buildings. In the FIP, Attachment D describes the hydraulic performance criteria (e.g. ,

flow rate , discharge pressure) for the FLEX pump. Specifically, the pump is diesel-driven and rated at 1000 gpm at 400-toot head. The NRC staff noted that the performance criteria of the FLEX pumps supplied by the NSRC tor Phase 3, as described in FIP Table 5, would allow the NSRC pumps to fulfill the mission of the onsite FLEX pump. The NRC staff confirmed that the flow rates and pressures evaluated in the hydraulic analyses were reflected in the FIP tor the respective RPV makeup strategy based upon the above FLEX pumps being diesel-driven and respective FLEX connections being made as directed by the FLEX support guidelines (FSGs).

During the onsite audit, the NRC staff conducted a walk down of the hose deployment routes for the above FLEX pumps to confirm the evaluations of the pump staging locations, hose distance runs , and connection points as described in the above hydraulic analyses and FIP.

Based on the staff's review of the FLEX pumping capabilities, as described in the above hydraulic analyses and the FIP, the licensee has demonstrated that its FLEX pump should perform as intended to support RPV makeup and core cooling during an ELAP event, consistent with NEI 12-06, Section 11 .2.

3.2.3.6 Electrical Analyses The licensee's electrical strategies provide power to the equipment and instrumentation used to mitigate the ELAP. The electrical strategies described in the FIP are practically identical tor maintaining or restoring core cooling, containment, and SFP cooling, except as noted in Sections 3.3.4.4 and 3.4.4.4 of this evaluation.

The NRC staff reviewed the licensee's FIP, conceptual electrical single-line diagrams, and the summary of calculations tor sizing the FLEX generators and station batteries. The NRC staff also reviewed the licensee's evaluations that addressed the effects of temperature on the electrical equipment credited in the FIP as a result of the loss of heating, ventilation , and air conditioning caused by the event.

According to the licensee's FIP, operators would declare an ELAP following a loss of offsite power, emergency diesel generators (EDGs), and any ac source. The plants indefinite coping capability is attained through the implementation of pre-determined FLEX strategies that are focused on maintaining or restoring key plant safety functions. A safety function-based approach provides consistency with , and allows coordination with, existing plant AOPs. The FLEX strategies are implemented in support of AOPs using FSGs.

During the first phase of the ELAP event, Duane Arnold would rely on the Class 1E station batteries to provide power to key instrumentation for monitoring parameters and power to controls for SSCs used to maintain the key safety functions (reactor core cooling, RCS inventory control, and containment integrity). The Duane Arnold Class 1E station batteries and associated de distribution systems are located in a safety-related structure (control building) designed to meet all applicable design-basis external hazards. The licensee's procedure AOP 301.1 , "Station Blackout," Revision 61 , directs operators to conserve de power during the event

by stripping non-essential loads. Operators will strip or shed unnecessary loads to extend battery life until backup power (Phase 2) is available. The plant operators would commence load shedding after approximately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and complete load shedding within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months from the onset of an ELAP event.

Duane Arnold has two Class 1E 125 Vdc station batteries (101 and 102) and one Class 1E 250 Vdc battery (104). The Class 1E station batteries were manufactured by C&D Technologies.

The Class 1E station batteries are model LCR-17 with a capacity of 1200 ampere-hours at an 8-hour discharge rate to 1.75 V per cell. The licensee noted and the NRC staff confirmed that batteries 102 and 104 (HPCI) capacity could be extended up to 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months with shedding of non-essential loads. While the capacity of battery 101 (RCIC) could be extended up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months with shedding of non-essential loads.

The NEI white paper, "EA-12-049 Mitigating Strategies Resolution of Extended Battery Duty Cycles Generic Concern" (ADAMS Accession No. ML13241A186), provides guidance for calculating extended duty cycles of batteries (i.e. , beyond 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ) and was endorsed by the NRC (ADAMS Accession No. ML13241A188). In addition to the white paper, the NRC sponsored testing at Brookhaven National Laboratory that resulted in the issuance of NUREG/CR-7188, Testing to Evaluate Extended battery Operation in Nuclear Power Plants," in May of 2015. The testing provided additional validation that the NEI white paper method was technically acceptable. The NRC staff reviewed the licensee's battery calculations and confirmed that they had followed the guidance in the NEI white paper.

The NRC staff reviewed the licensee's de coping calculations E08-007, "250 VDC System Battery Sizing, Voltage Drop, Short Circuit, Coordination, and Charger Sizing," Revision 0, and E08-008, "125 VDC System Battery Sizing, Voltage Drop, Short Circuit, Coordination, and Charger Sizing," Revision 1, which verified the capability of the de system to supply power to the required loads during the first phase of the Duane Arnold FLEX mitigation strategy plan for an ELAP event. The licensee's evaluation identified the required loads and their associated ratings (ampere (A) and minimum required voltage) and the non-essential loads that would be shed within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to ensure battery operation for at least 1O and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

Based on the staff's review of the licensee's analysis and procedures, the battery vendor's capacity and discharge rates for the Class 1E station batteries, the NRC staff concludes that the Duane Arnold de systems appear to have adequate capacity and capability to power the loads required to mitigate the consequences during Phase 1 of an ELAP event provided that necessary load shedding is completed within the times assumed in the licensee's analysis.

The licensee's Phase 2 strategy includes repowering 480 Vac buses approximately 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after initiation of an ELAP event. The licensee's strategy relies on a portable 405 kilowatt (kW) 480 Vac FLEX DG and as a defense-in-depth contingency a portable 6 kW 220/120 Vac generator (in case ac power supplied by the 125 Vdc system through the inverters is lost). The licensee has a total of two portable 480 Vac FLEX DGs and six 6 kW 220/120 Vac generators.

One 480 Vac FLEX DG and three 6 kW 220/120 Vac generators are stored in each emergency response storage building. A 480 Vac FLEX DG would provide power to two 125 Vdc battery chargers, one 250 Vdc battery charger, and the standby liquid control (SBLC) pump (if necessary). The 220/120 Vac FLEX generator would supply power to instruments on either Panel 1Y11 or Panel 1Y21.

The NRC staff reviewed the licensee's engineering change EC-280490, "Design Change Package Form," Revision 0, and calculations CAL-E08-004, "Main AC Electrical Distribution

Analysis," Revision 2, and CAL-E08-010, "Analysis of the 120 VAC Division I and II Instrument AC Electrical Power Distribution System and Uninterruptable AC Systems," Revision 0, conceptual single line diagrams, and the separation and isolation of the FLEX DGs from the EDGs. Based on the NRC staff's review, the required loads for the Phase 2, 405 kW, FLEX DG is approximately 186 kW . Therefore , one 405 kW FLEX DG is adequate to support the electrical loads required for the licensee's Phase 2 strategy. The required loads for the Phase 2, 6 kW 220/120 Vac generator is approximately 1.8 kW for Panel 1Y11 or 1.5 kW for Panel 1Y21 , depending on which panel is selected. Therefore , one 6 kW FLEX generator is adequate to support the electrical loads required for the licensee's Phase 2 strategy.

If the "N" FLEX 480 Vac DG or 220/120 Vac generators become unavailable or are out of service for maintenance, the other ("N+ 1") FLEX 480 Vac DG or 220/120 Vac generators would be deployed to continue to support the required loads. The "N+1 " FLEX 480 Vac DG or 220/120 Vac generators are identical to the "N" FLEX 480 Vac DG or 220/120 Vac generators, thus ensuring electrical compatibility and sufficient electrical capacity in an instance where substitution is required . Since the "N+1 " FLEX 480 Vac DG or 220/120 Vac generators are identical and interchangeable with the "N" FLEX 480 Vac DG or 220/120 Vac generators, the NRC staff concludes that the licensee appears to have met the provisions of NEI 12-06 for spare equipment capability regarding the Phase 2 FLEX generators.

For Phase 3, the licensee plans to continue the Phase 2 coping strategy with additional assistance provided from offsite equipment/resources. The offsite resources that will be provided by an NSRC includes two 1-megawatt (MW) 4160 Vac Combustion Turbine Generators {CTGs) , one 1100 kW 480 Vac CTG, and distribution panels (including cables and connectors). Each portable 4160 Vac CTG is capable of supplying approximately 1 MW , but two CT Gs could be operated in parallel to provide a total of approximately 2 MW. Licensee procedure SAMP 733, "FLEX NSRC Phase 3 Equipment Staging and Operation," Revision 0, provides direction for transitioning to Phase 3 electrical equipment. The procedure provides direction for staging locations as well as operational guidance for phase rotation checks required for both 480 Vac and 4160 Vac CTG connections to Duane Arnold plant equipment.

The Phase 3 4160 Vac CTGs would provide power to operate the component cooling water system to provide long-term core cooling. Since a specific use and loads on the NSRC-supplied 4160 Vac CTGs are not specifically prescribed, the licensee noted in the FIP that a potential representative case would be the restoration of shutdown cooling. In this case , the required loads to establish shutdown cooling would be approximately 1050 kW total for one RHR pump, one RHR service water pump, and one emergency service water pump. Based on the additional margin available with the 4160 Vac CTGs and the availability of the larger capacity 480 Vac CTG to back up a Phase 2 FLEX DG , the NRC staff concludes that the 4160 Vac and 480 Vac CTGs being supplied from an NSRC appear to have sufficient capacity and capability to supply the required loads.

3.2.4 Conclusions Based on this evaluation , the NRC staff concludes that the licensee has developed guidance that should maintain or restore core cooling and RCS inventory during an ELAP event consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01 , and should adequately address the requirements of the order.

3.3 Spent Fuel Pool Cooling Strategies In NEI 12-06, Table 3-1 and Appendix C summarize an approach consisting of two separate capabilities for the SFP cooling strategies. This approach uses a portable injection source to provide the capability for 1) makeup via hoses on the refueling floor capable of exceeding the boil-off rate for the design-basis heat load; and 2) makeup via connection to SFP cooling piping or other alternate location capable of exceeding the boil-off rate for the design-basis heat load.

However, in JLD-ISG-2012-01 , Revision 1, the NRC staff did not fully accept this approach, and added another requirement to either have the capability to provide spray flow to the SFP, or complete an SFP integrity evaluation , which demonstrates that a seismic event would have a very low probability of inducing a crack in the SFP or its piping systems so that spray would not be needed to cool the spent fuel. The evaluation must use the reevaluated seismic hazard described in Section 3.5.1 below if it is higher than the site's current safe shutdown earthquake (SSE). During the event, the licensee selects the SFP makeup method to use based on plant conditions. This approach also requires a strategy to mitigate the effects of steam from the SFP, such as venting.

As described in NEI 12-06, Section 3.2.1.7, and JLD-ISG-2012-01 , Section 2.1, strategies that must be completed within a certain period of time should be identified and a basis that the time can be reasonably met should be provided . In NEI 12-06, Section 3 provides the performance attributes, general criteria, and baseline assumptions to be used in developing the technical basis for the time constraints. Since the event is beyond-design-basis, the analysis used to provide the technical basis for time constraints for the mitigation strategies may use nominal initial values (without uncertainties) for plant parameters, and best-estimate physics data. All equipment used for consequence mitigation may be assumed to operate at nominal setpoints and capacities. In NEI 12-06, Section 3.2.1.2 describes the initial plant conditions for the at-power mode of operation; Section 3.2.1.3 describes the initial conditions ; and Section 3.2.1.6 describes SFP initial conditions.

In NEI 12-06, Section 3.2.1.1 provides the acceptance criterion for the analyses serving as the technical basis for establishing the time constraints for the baseline coping capabilities to maintain SFP cooling . This criterion is keeping the fuel in the SFP covered with water.

The ELAP causes a loss of cooling in the SFP. As a result, the pool water will heat up and eventually boil off. The licensee's response is to provide makeup water. The timing of operator actions and the required makeup rates depend on the decay heat level of the fuel assemblies in the SFP. The sections below address the response during operating, pre-fuel transfer or post-fuel transfer operations. The effects of an ELAP with full core offload to the SFP is addressed in Section 3.11 . The licensee has decided to provide the spray flow described in JLD-ISG-2012-01 .

3.3.1 Phase 1 In the FIP, Section 3.3.1 states that during normal plant operation , the thermal mass of the SFP is typically sufficient to accommodate the decay heat from the stored spent fuel for days without a significant loss of inventory from evaporation or boiling. The licensee explained that to minimize the heat-up of the reactor building and the accumulation of moisture, supplemental ventilation will be established by opening reactor building doors and a vent above the SFP prior to the onset of boiling. The NRC staff noted that the licensee has the ability to monitor SFP water level using reliable SFPLI installed per Order EA-12-051 .

3.3.2 Phase 2 In the FIP, Section 3.3.2 states that prior to evaporation or boiling reducing the inventory of the SFP water to the top of the stored fuel, a portable diesel-driven FLEX pump will transfer water from the circulating water storage pit to the SFP. Make-up to the SFP can be provided directly to the pool via hoses on the refueling deck or via the RHR system, which does not require access to the SFP area. In addition , as a backup to the SFP makeup strategy, the licensee explained that it has the capability to provide SFP spray of greater than 200 gpm by using portable spray nozzles on the refueling floor.

3.3.3 Phase 3 In the FIP, Section 3.3.3 states that no additional capabilities are required under Phase 3 other than replenishing the water inventory in the circulating water storage pit and providing additional diesel fuel oil for the portable equipment for indefinite operation. Specifically, when the circulating water storage pit is depleted the transition to Phase 3 is needed, which involves pumping water from the Cedar River to the circulating water storage pit with equipment provided by the NSRC.

3.3.4 Staff Evaluations 3.3.4.1 Availability of Structures, Systems, and Components 3.3.4.1.1 Plant SSCs Condition 6 of NEI 12-06, Section 3.2.1.3, states that permanent plant equipment contained in structures with designs that are robust with respect to seismic events, floods , and high winds ,

and associated missiles, are available. In addition, Section 3.2.1.6 states that the initial SFP conditions are: 1) all boundaries of the SFP are intact, including the liner, gates, transfer canals ,

etc., 2) although sloshing may occur during a seismic event, the initial loss of SFP inventory does not preclude access to the refueling deck around the pool and 3) SFP cooling system is intact, including attached piping.

The NRG staff reviewed the UFSAR and the licensee's calculation on habitability on the SFP refuel floor. This calculation and the FIP indicate that boiling can begin as early as 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months during a full core offload to several days during a normal , non-outage situation. During its audit, the NRG staff noted that the licensee's procedures for deploying hoses to the SFP refuel floor provide cautions to the operators regarding environmental and radiological conditions in the reactor building being potentially hazardous. In addition , this procedure identifies the time to SFP boiling , which is based on heat load and initial SFP temperature, which aids the operators in determining when hoses must be deployed to the SFP before it becomes uninhabitable.

As described in the licensee's FIP, the licensee's Phase 1 SFP cooling strategy does not require any operator actions. The NRG staff noted that the licensee's sequence of events timeline in the FIP indicates that operators will open the SFP refuel floor vent hatch to establish passive ventilation between 4 to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months from event initiation. The licensee explained that establishing the ventilation path can be accomplished outside of the refuel area, in an area which will remain habitable for personnel entry. The NRG staff also noted that the time to establish the vent path varies based on the time to boil in the SFP.

The licensee's Phase 2 and Phase 3 SFP cooling strategy involves the use of the FLEX pump or NSRC supplied pump for Phase 3, with suction from the circulating water storage pit or the condenser hotwell during a flooding event to supply water to the SFP. The NRC staff's evaluation of the robustness and availability of FLEX connections points for the FLEX pump is discussed in Section 3.7.3.1 below. Furthermore, the NRC staff's evaluation of the robustness and availability of the UHS for an ELAP event is discussed in Section 3.10.3 below.

3.3.4.1.2 Plant Instrumentation In its FIP, the licensee stated that the instrumentation for SFP level will meet the requirements of Order EA-12-051. Furthermore, the licensee stated that these instruments will have initial local battery power with the capability to be powered from the FLEX DGs. The NRC staff's review of the SFPLI, including the primary and back-up channels, the display to monitor the SFP water level and environmental qualifications to operate reliably for an extended period are discussed in Section 4 of this evaluation.

3.3.4.2 Thermal-Hydraulic Analyses In the FIP, Section 3.3.4.2 states that under typical operating conditions a loss of SFP cooling would result in a very slow heat up of the pool (typically a few degrees per hour) with little resulting loss of inventory. In NEI 12-06, Section 3.2.1.6 states, in part, that the SFP heat load is the maximum design-basis heat load for the plant. In the UFSAR, Section 9.1.2.3.2 indicates that with a full core off load and maximum design-basis heat load in the SFP a make-up flow rate of approximately 53 GPM to the SFP would be required to commence after approximately 4.9 hours1.041667e-4 days 0.0025 hours 1.488095e-5 weeks 3.4245e-6 months of the loss of cooling. The licensee explained that an analysis is performed each operating cycle to determine the time available prior to the SFP temperature reaching 200 °F using the actual amount of spent fuel present during the cycle. This information is then included in existing plant procedures to provide operators with more accurate information regarding the time to boil. During its audit, the NRC staff noted that the licensee's procedure identified the time for the SFP to reach 200 °F after a loss of cooling based on variables such as, days after shutdown and initial SFP temperature, and identified the decay heat and heat up rate in the SFP.

The NRC staff concludes that the licensee conservatively determined that a SFP makeup flow rate of at least 53 gpm , which would be necessary during a full core offload, will maintain adequate SFP level for an ELAP event occurring during non-outage, normal power operation.

In addition , consistent with the guidance in NEI 12-06, Section 3.2.1.6, the NRC staff concludes that the licensee has considered the maximum design-basis SFP heat load. Furthermore, the NRC staff concludes that the licensee's procedure more accurately identifies the time to boil in the SFP using cycle specific data, which will ensure that FLEX actions during an ELAP event are properly prioritized.

3.3.4.3 FLEX Pumps and Water Supplies In NEI 12-06, Table C-3 states, in part, that the baseline capabilities for SFP cooling include makeup via hoses on refuel floor at a minimum makeup rate capable of exceeding the boil-off rate. In addition , JLD-ISG-2012-01, Revision 1, states, in part, that the spray capability via portable monitor nozzles from the refueling floor using a portable pump at a minimum of 200 gpm per unit to the pool or 250 gpm per unit if overspray occurs is a baseline capability in addition to those identified in NEI 12-06, Table C-3.

In the FIP, Section 3.3.4.3 states that the portable diesel-driven FLEX pump is capable of providing 500 gpm of makeup/spray to the SFP as documented in its hydraulic analysis. The NRC staff noted that this amount of makeup/spray is substantially more than the required makeup rate of 53 gpm during the worst-case scenario of a full-core offload. The licensee indicated that a single FLEX pump supports providing makeup to the RPV and SFP. Also, the staff noted that separate hydraulic analyses were performed to demonstrate the FLEX pump's capability to provide the necessary makeup to the RPV and to the SFP; however, these analyses did not demonstrate the ability of the FLEX pump to support both functions simultaneously.

Since makeup to the SFP is not required until 45 hours5.208333e-4 days 0.0125 hours 7.440476e-5 weeks 1.71225e-5 months for a full-core offload and many days later for normal operating conditions, the NRC staff concluded that additional equipment from the NSRC will be available to support RPV and SFP makeup simultaneously or the on-site FLEX pump can used in a batch feed manner to support both functions. However, the NRC staff recognized that spray to the SFP would be required much earlier in the ELAP event if there were a leak in the SFP that rapidly lowers the water level below the level of the fuel assemblies; thus , the FLEX pump may be required to support RPV makeup and SFP spray simultaneously (e.g., before arrival of the NSRC equipment).

During its audit, the staff reviewed the licensee's hydraulic calculations associated with the capability of the FLEX pump to support SFP spray. These calculations determined that the FLEX pump is capable of providing spray flow of 200 gpm while simultaneously supporting RPV make-up. In addition, during its audit, the licensee provided the spray nozzle test results that confirmed that 200 gpm of discharged spray flow can be delivered to the SFP to achieve full coverage of the pool. The staff noted that this volume of spray flow is consistent with the recommendation of JLD ISG-2012-01 , Revision 1, to provide a minimum of 200 gpm per unit to the pool .

Two FLEX pumps are located onsite with one pump stored in each of the emergency response storage buildings. FIP Attachment D describes the hydraulic performance criteria (e.g. , flow rate , discharge pressure) for the FLEX pump. Specifically, the pump is diesel-driven and rated at 1000 gpm at 400-foot head. The NRC staff noted that the performance criteria of the FLEX pumps supplied from an NSRC for Phase 3, as described in FIP Table 5, would allow the NSRC pumps to fulfill the mission of the onsite FLEX pump if the onsite FLEX pump were to fail.

3.3.4.4 Electrical Analyses The licensee's mitigating strategies for the SFP do not rely on electrical power except for power to SFPLI. The licensee's Phase 1 electrical SFP cooling strategy is to monitor SFP level using installed instrumentation (the capability of this instrumentation is described in other areas of this evaluation). The Duane Arnold SFPLI is normally powered from ac supplied by the 125 Vdc Class 1E station batteries via the vital inverters. If that power source is lost, the instruments will be available during Phase 1 by their dedicated batteries that could provide power to the instrumentation for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , if necessary.

The licensee's Phase 2 and 3 electrical SFP cooling strategy is to continue monitoring SFP level using installed instrumentation . As described and reviewed in Section 3.2.3.6 above, the licensee could utilize the 480 Vac FLEX DGs to provide power via the Class 1Ede distribution system to ensure indefinite SFP level monitoring capability.

3.3.5 Conclusions Based on this evaluation, the NRC staff concludes that the licensee has developed guidance that if implemented appropriately should maintain or restore SFP cooling following an ELAP consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01, and should adequately address the requirements of the order.

3.4 Containment Function Strategies The industry guidance document, NEI 12-06, Table 3-1 , provides some examples of acceptable approaches for demonstrating the baseline capability of the containment strategies to effectively maintain containment functions during all phases of an ELAP event. One such approach is for a licensee to perform an analysis demonstrating that containment pressure control is not challenged.

The licensee performed a containment evaluation, ERIN Engineering Report, "Evaluation Report of DAEC Capabilities to Respond to Extended Loss of Offsite Power (ELAP)," which was based on the boundary conditions described in Section 2 of NEI 12-06. The calculation analyzed the strategy of automatic containment isolation, monitoring containment parameters, and venting the torus at a pressure of 53 psig. The licensee concluded that the containment parameters of pressure and temperature remain well below the respective UFSAR Section 6.2 design limits of 56 psig and 281 °F for greater than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . From its review of the evaluation, the NRC staff noted that the required actions to maintain containment integrity and required instrumentation functions have been developed, and are summarized below.

3.4.1 Phase 1 The Phase 1 response to a loss of all ac power is automatic primary containment isolation.

Operators will monitor key containment parameters. If needed, at a primary containment pressure of 53 psig, the torus will be vented using the HCVS as directed by EOP 2, "Primary Containment Control" and SEP 301.3, Torus Vent VIA Hardpipe Vent." However, as stated above, to preserve RCIC, procedural guidance will direct operators to open the containment vent at approximately 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the initiation of the ELAP to reduce the heatup rate in containment.

The HCVS can be operated from the main control room after opening nitrogen supply valves in the essential switchgear room. The HCVS can be operated without ac power.

3.4.2 Phase 2 Phase 2 continues the Phase 1 strategy of monitoring containment parameters and venting using the HCVS. The FLEX portable generator is relied on to repower the HCVS uninterruptable power supply. Pneumatic supply can be maintained by replacing portable nitrogen bottles.

3.4.3 Phase 3 The Duane Arnold Phase 3 strategy is the continuance of the Phase 1 strategy of monitoring containment parameters and venting the torus through the HCVS.

Duane Arnold does not have a specific Phase 3 strategy for directly maintaining containment integrity. However, Duane Arnold will receive equipment from the NSRC, including two 4160 Vac CTGs, a 480 Vac CTG, and a high volume, low pressure pump. The 480 Vac CTG is intended as a back up to the onsite FLEX 480 Vac DG. Procedure SAMP 733, "FLEX NSRC Phase 3 Equipment Staging and Operation ," indicates that the 4160 Vac generators will be used to repower an essential bus. The 4160 Vac essential electrical bus can be used to power safety systems for plant cooling or containment cooling. The NSRC pump will be used to replenish water inventories used for core cooling.

3.4.4 Staff Evaluations 3.4.4.1 Availability of Structures. Systems. and Components Guidance document NEI 12-06 baseline assumptions have been established on the presumption that other than the loss of the ac power sources and normal access to the UHS, installed equipment that is designed to be robust with respect to design-basis external events is assumed to be fully available. Installed equipment that is not robust is assumed to be unavailable. Below are the baseline assumptions for the availability of SSCs for maintaining containment functions during an ELAP.

3.4.4.1.1 Plant SSCs Primary Containment The primary containment system consists of a drywall (130,000 ft 3 free volume) , a pressure suppression chamber (155,570 ft 3) that stores a large volume of water (58,000 ft 3 minimum) , a connecting vent system between the drywall and the water pool , isolation valves, containment cooling systems, and other service equipment. The design pressure and temperature for the drywall and for the suppression pool are 56 psig and 281 °F, respectively. A seismic Category 1 reactor building encloses the reactor and the primary containment. The reactor building provides secondary containment when the primary containment is in service.

Hardened Containment Vent System (HCVS)

The HCVS is designed to meet the requirements of NRC Order EA-13-109. HCVS has the capacity to vent the steam/energy equivalent to one percent of licensed thermal power. The suppression pool and HCVS together are able to absorb and reject decay heat, such that following a reactor shutdown from full power containment pressure will be maintained below the primary containment design pressure (56 psig).

Pneumatic Supply Analyses The FLEX containment strategies rely on the HCVS components installed under NRC Order EA-13-109, which have pneumatic supplies sufficient for a minimum of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The HCVS pneumatic design assumes the need for periodic purging of the vent line to mitigate the presence of hydrogen from fuel failures. For FLEX strategies, it is assumed that no fuel failures occur and operating procedures would not utilize the purge function. As a result, the pneumatic supply is substantially oversized to maintain system operation without purging. If replenishment of the nitrogen supply is needed, procedural guidance (SEP 301 .3, Torus Vent via Hard Pipe Vent) is provided for use of portable nitrogen bottles as defense-in-depth for the containment function.

3.4.4.1.2 Plant Instrumentation In NEI 12-06, Table 3-1 specifies that containment pressure, suppression pool level, and suppression pool temperature are key containment parameters which should be monitored by repowering the appropriate instruments. The licensee's FIP states that control room instrumentation would be available due to the coping capability of the station batteries and associated inverters in Phase 1, or the portable DGs deployed in Phase 2. If no ac or de power was available, the FIP states that key credited plant parameters, including these containment parameters, would be available using alternate methods. These alternate methods are provided in procedure SAMP 727, "FLEX Local Instrument Readings."

3.4.4.2 Thermal-Hydraulic Analyses ERIN Engineering performed a thermal hydraulic evaluation for NextEra which is documented in an engineering report "Evaluation Report of DAEC Capabilities to Respond to Extended Loss of Offsite Power (ELAP) ." This evaluation included an analysis using MAAP4 code of the primary containment response during an ELAP. The calculation assumed torus venting to occur when the containment pressure exceeds the rupture disk setpoint at the primary containment pressure limit (PCPL). A separate analysis was performed assuming anticipatory venting to maximize the RCIC pump availability. Since torus venting via the HCVS occurs when the rupture disk bursts at 53 psig , containment pressure will not exceed the 56 psig design limit. If anticipatory venting is used, containment temperature and pressure remain well below design limits.

3.4.4.3 FLEX Pumps and Water Supplies In the FIP, Sections 3.4.4.1.1 and 3.4.4.3 indicate that no water source other than the suppression pool along with water injected to the reactor vessel from the circulating water storage pit are relied upon to maintain the containment integrity. The staff's review of the FLEX pump and the robustness of the associated water sources is documented in Sections 3.2 and 3.3, respectively, of this evaluation . The NRC staff's review of the licensee's ability to maintain containment integrity are documented in Sections 3.4.4.1.1 and 3.4.4.1.2 of this evaluation.

3.4.4.4 Electrical Analyses The licensee performed a containment evaluation based on the boundary conditions described in Section 2 of NEI 12-06. Based on the results of its evaluation, the licensee developed required actions to ensure maintenance of containment integrity and required instrumentation continues to function. With an ELAP initiated while Duane Arnold is in Modes 1-4, containment cooling would be lost for an extended period of time. Therefore , containment temperature and pressure will slowly increase.

The licensee's Phase 1 coping strategy for containment involves initiating and verifying containment isolation following an ELAP. According to the licensee's FIP, the containment isolation can be completed without ac power. Phase 1 includes monitoring containment temperature and pressure using installed equipment. The licensee's strategy to repower instrumentation using the Class 1E station batteries for Phase 1 is identical to what was described in Section 3.2.3.6 of this evaluation and appears to be adequate to ensure continued containment monitoring.

The licensee's Phase 2 coping strategy is to continue the Phase 1 coping strategy and monitoring containment temperature and pressure using installed instrumentation . The

licensee's strategy to repower instrumentation using the 480 Vac, 405 kW , FLEX DGs is identical to what was described in Section 3.2.3.6 of this evaluation and appears to be adequately sized to ensure continued containment monitoring.

The containment instruments are normally powered by the Class 1E station batteries via inverters. The Class 1E station batteries should remain functional and continue supplying power to these instruments, as they will not be load shed. If for any reason this power supply is lost, the licensee developed a defense-in-depth plan to repower either division of instrument power at a location downstream of the inverters closer to the installed instruments at either instrument ac distribution panel 1Y11 or 1Y21 (SAMP 725, "FLEX Alternate Power to Instrument AC ," Revision 0) . Either division is capable of providing adequate indications for operational decision-making. Additionally, procedures are in place for operators to use either local indications or portable instruments to take readings on applicable critical instruments with no ac power available to the instruments (SAMP 727, "FLEX Local Instrument Readings," Revision 0) .

As containment temperatures and pressures slowly increase it will become necessary to open the HCVS suppression pool vent as directed by EOP 2, "Primary Containment Control ,"

Revision 18 and SEP 301.3, "Torus Vent Via Hard Pipe Vent," Revision 9. The electrical portion of the HCVS includes a 125 Vdc battery, battery charger, and a 125 Vdc panel that are installed in the battery corridor of the control building . The HCVS 125 Vdc uninterruptible power supply provides power to the HCVS instruments, two primary containment isolation valves control and position indicating circuits , and HCVS purge control and indicating circuit. The input power for the HCVS 125 Vdc uninterruptible power supply will be provided by the 480 Vac FLEX DG . The HCVS does not rely on any ac power in the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and has sufficient pneumatic supplies to perform its function for a minimum of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months including purge cycles not required for FLEX strategies. After 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the plant operators would repower the HCVS uninterruptable power supply with the 480 Vac FLEX DG . Procedure SAMP 732, "FLEX Repowering the Containment Hard Pipe Vent UPS," Revision 0, provides guidance connecting the HCVS battery charger to the 480 Vac FLEX DG. The NRC staff reviewed the licensee's HCVS evaluation (Engineering Change 281991 , "Reliable Hardened Containment Vent System," Revision 18) and the licensee's sizing calculation (CAL-E08-004, Revision 2) for the Phase 2 FLEX DGs. Based on its review, the NRC staff concludes that the HCVS batteries and Phase 2 480 Vac FLEX DGs appear to have adequate capacity to supply the required loads to maintain or restore containment.

The licensee's Phase 3 coping strategy includes actions to reduce containment temperature and pressure utilizing existing plant systems restored by off-site equipment and resources . The licensee's strategy is to use the 4160 Vac CTGs to repower the containment air cooler (CAC) fans to restore and maintain containment cooling . The NRC staff reviewed licensee EER 600990890 and concludes that the 4160 Vac CTGs appear to have sufficient capacity and capability to supply the CAC fans, required instruments, and additional loads.

Based on its review, the NRC staff concludes that the electrical equipment available onsite (e.g .,

480 Vac FLEX DGs) supplemented with the equipment that will be supplied from an NSRC (e.g., 4160 Vac CTGs) , should provide sufficient capacity and capability to supply the required loads to reduce containment temperature and pressure, if necessary, to ensure that the key components including required instruments remain functional.

3.4.5 Conclusions Based on this evaluation , the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain or restore containment functions following an ELAP event consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01 , and should adequately address the requirements of the order.

3.5 Characterization of External Hazards Sections 4 through 9 of NEI 12-06 provide the methodology to identify and characterize the applicable BDBEEs for each site. In addition , NEI 12-06 provides a process to identify potential complicating factors for the protection and deployment of equipment needed for mitigation of applicable site-specific external hazards leading to an ELAP and loss of normal access to the UHS.

Characterization of the applicable hazards for a specific site includes the identification of realistic timelines for the hazard, characterization of the functional threats due to the hazard ,

development of a strategy for responding to events with warning , and development of a strategy for responding to events without warning.

The licensee reviewed the plant site against NEI 12-06 and determined that FLEX equipment should be protected from the following hazards: seismic; external flooding ; severe storms with high winds; snow, ice and extreme cold ; and extreme high temperatures.

References to external hazards within the licensee's mitigating strategies and this safety evaluation are consistent with the guidance in NEl-12-06 and the related NRC endorsement of NEI 12-06 in JLD-ISG-2012-01 . Guidance document NEI 12-06 directed licensees to proceed with evaluating external hazards based on currently available information. For most licensees, this meant that the OIP used the current design basis information for hazard evaluation.

Coincident with the issuance of Order EA-12-049, on March 12, 2012, the NRC staff issued a Request for Information pursuant to Title 1O of the Code of Federal Regulations Part 50, Section 50.54(f) (ADAMS Accession No. ML12053A340) (hereafter referred to as the 50.54(f) letter) ,

which requested that licensees reevaluate the seismic and flooding hazards at their sites using updated hazard information and current regulatory guidance and methodologies. Due to the time needed to reevaluate the hazards, and for the NRC to review and approve them , the reevaluated hazards were generally not available until after the mitigation strategies had been developed. The NRC staff has developed a proposed rule, titled "Mitigation of Beyond-Design-Basis Events," hereafter called the MBDBE rule , which was published for comment in the Federal Register on November 13, 2015 ( November 13, 2015, 80 FR70610). The proposed MBDBE rule would make the intent of Orders EA-12-049 and EA-12-051 generically applicable to all present and future power reactor licensees, while also requiring that licensees consider the reevaluated hazard information developed in response to the 50.54(f) letter.

The NRC staff requested Commission guidance related to the relationship between the reevaluated flooding hazards provided in response to the 50.54(f) letter and the requirements for Order EA-12-049 and the MBDBE rulemaking (see COMSECY-14-0037, Integration of Mitigating Strategies for Beyond-Design-Basis External Events and the Reevaluation of Flooding Hazards" (ADAMS Accession No. ML14309A256). The Commission provided guidance in an SRM to COMSECY-14-0037 (ADAMS Accession No. ML15089A236).

The Commission approved the staff's recommendations that licensees would need to address the reevaluated flooding hazards within their mitigating strategies for BDBEEs, and that licensees may need to address some specific flooding scenarios that could significantly impact the power plant site by developing scenario-specific mitigating strategies, possibly including unconventional measures, to prevent fuel damage in reactor cores or SFPs. The NRC staff did not request that the Commission consider making a requirement for mitigating strategies capable of addressing the reevaluated flooding hazards be immediately imposed, and the Commission did not require immediate imposition. In a letter to licensees dated September 1, 2015 (ADAMS Accession No. ML15174A257), the NRC staff informed the licensees that the implementation of mitigation strategies should continue as described in licensee's OIPs, and that the NRC safety evaluations and inspections related to Order EA-12-049 will rely on the guidance provided in JLD-ISG-2012-01 , Revision 0, and the related industry guidance in NEI 12-06, Revision 0. The hazard reevaluations may also identify issues to be entered into the licensee's corrective action program consistent with the OIPs submitted in accordance with Order EA-12-049.

As discussed above, licensees are reevaluating the site seismic and flood hazards as requested in the NRC's 50.54(f) letter. After the NRC staff approves the reevaluated hazards, licensees will use this information to perform flood and seismic mitigating strategies assessments (MSAs) per the guidance in NEI 12-06, Revision 2, Appendices G and H (ADAMS Accession No. ML16005A625). The NRC staff endorsed Revision 2 of NEI 12-06 in JLD-ISG-2012-01 ,

Revision 1 (ADAMS Accession No. ML15357A163). The licensee's MSAs will evaluate the mitigating strategies described in this safety evaluation using the revised seismic and flooding hazards information and, if necessary, make changes to the strategies or equipment. Licensees will submit the MSAs for NRC staff review.

The licensee developed its OIP for mitigation strategies by considering the guidance in NEI 12-06 and the site's design-basis hazards. Therefore , this safety evaluation makes a determination based on the licensee's OIP and FIP. The characterization of the applicable external hazards for the plant site is discussed below.

3.5.1 Seismic In its FIP, the licensee described the current design basis seismic hazard, the SSE. As described in UFSAR Section 2.5, the SSE seismic criteria for the peak ground accelerations for structures on bedrock is listed as 0.12g and for structures supported on soil is listed as 0.18g for use in the response spectra. It should be noted that the actual seismic hazard involves a spectral graph of the acceleration versus the frequency of the motion . Peak acceleration in a certain frequency range , such as the numbers above, is often used as a shortened way to describe the hazard.

As the licensee's seismic reevaluation activities are completed , the licensee is expected to assess the mitigation strategies to ensure they can be implemented under the reevaluated hazard conditions as will potentially be required by the proposed MBDBE rulemaking . The licensee has appropriately screened in this external hazard and identified the hazard levels to be evaluated .

3.5.2 Flooding In its FIP, the licensee stated that Duane Arnold is located on the Cedar River in Iowa.

Therefore , the site is susceptible to flooding from the Cedar River as a result of maximum

precipitation. However, due to Duane Arnold's inland location far from large bodies of water, the site is not susceptible to flooding due to hurricane storm surges, seiches, or tsunamis. As described in UFSAR Section 3.4, the design-basis flood level is 764.1 feet (ft.). This section of the UFSAR states that the facility was designed to resist flood waters to an elevation of 767 ft. in order to allow for wave action .

As the licensee's flooding reevaluation activities are completed , the licensee is expected to assess the mitigation strategies to ensure they can be implemented under the reevaluated hazard conditions as will potentially be required by the proposed MBDBE rulemaking. The licensee has appropriately screened in this external hazard and identified the hazard levels to be evaluated.

3.5.3 High Winds In NEI 12-06, Section 7 provides the NRG-endorsed screening process for evaluation of high wind hazards. This screening process considers the hazard due to hurricanes and tornadoes.

The screening for high wind hazards associated with hurricanes should be accomplished by comparing the site location to NEI 12-06, Figure 7-1 (Figure 3-1 of U.S. NRG, "Technical Basis for Regulatory Guidance on Design Basis Hurricane Wind Speeds for Nuclear Power Plants,"

NUREG/CR-7005, December, 2009); if the resulting frequency of recurrence of hurricanes with wind speeds in excess of 130 mph exceeds 1E-6 per year, the site should address hazards due to extreme high winds associated with hurricanes using the current licensing basis for hurricanes.

The screening for high wind hazard associated with tornadoes should be accomplished by comparing the site location to NEI 12-06, Figure 7-2, from U.S. NRG, "Tornado Climatology of the Contiguous United States," NUREG/CR-4461 , Revision 2, February 2007; if the recommended tornado design wind speed for a 1E-6/year probability exceeds 130 mph, the site should address hazards due to extreme high winds associated with tornadoes using the current licensing basis for tornados or Regulatory Guide 1. 76, Revision 1.

In its FIP, regarding the determination of applicable extreme external hazards, the licensee stated that the site is located at 42° 6' 2" North latitude and 91 ° 46' 36" West longitude.

Regarding hurricanes, the site is beyond the range of high winds from a hurricane per NEI 12-06 Figure 7-1 ; therefore , a hurricane hazard is not applicable and need not be addressed.

However, in NEI 12-06 Figure 7-2, Recommended Tornado Design Wind Speeds for the 1E-6/year Probability Level indicates that the site is in a region where the tornado design wind speed exceeds 130 mph. Therefore , the plant screens in for an assessment for high winds and tornados, including missiles produced by these events.

Therefore , high-wind hazards are applicable to the plant site. The licensee has appropriately screened in the high wind hazard and characterized the hazard in terms of wind velocities and wind-borne missiles.

3.5.4 Snow. Ice. and Extreme Cold As discussed in NEI 12-06, Section 8.2.1, all sites should consider the temperature ranges and weather conditions for their site in storing and deploying FLEX equipment consistent with normal design practices. All sites outside of Southern California, Arizona, the Gulf Coast and Florida are expected to address deployment for conditions of snow, ice , and extreme cold .

All sites located north of the 35th Parallel should provide the capability to address extreme snowfall with snow removal equipment. Finally, all sites except for those within Level 1 and 2 of the maximum ice storm severity map contained in Figure 8-2 should address the impact of ice storms.

In its FIP, regarding the determination of applicable extreme external hazards, the licensee stated that the site is located at 42° 6' 2" North latitude and 91 ° 46' 36" West longitude. In addition , the site is located within the region characterized by EPRI as ice severity Level 5 (NEI 12-06, Figure 8-2, Maximum Ice Storm Severity Maps) . Consequently, the site is subject to severe icing conditions that could cause severe damage to electrical transmission lines. The licensee concludes that the plant screens in for an assessment for snow, ice, and extreme cold hazard .

In summary, based on the available local data and Figures 8-1 and 8-2 of NEI 12-06, the plant site does experience significant amounts of snow, ice, and extreme cold temperatures; therefore, the hazard is screened in. The licensee has appropriately screened in the hazard and characterized the hazard in terms of expected temperatures.

3.5.5 Extreme Heat In the section of its FIP regarding the determination of applicable extreme external hazards, the licensee stated that, as per NEI 12-06 Section 9.2, all sites are required to consider the impact of extreme high temperatures. Summers at the site may bring periods of extremely hot weather over 100 °F. Specifically, UFSAR Section 2.3 describes an observed temperature maximum extreme of 11 O °F. Therefore, the plant site screens in for an assessment for extreme high temperature hazard.

In summary, based on the available local data and the guidance in Section 9 of NEI 12-06, the plant site does experience extreme high temperatures . The licensee has appropriately screened in the high temperature hazard and characterized the hazard in terms of expected temperatures .

3.5.6 Conclusions Based on the evaluation above, the NRC staff concludes that the licensee has developed a characterization of external hazards that appears to be consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01 , and should adequately address the requirements of the order in regard to the characterization of external hazards.

3.6 Planned Protection of FLEX Equipment 3.6.1 Protection from External Hazards In its FIP, the licensee stated that Duane Arnold has two dedicated buildings for storing FLEX portable equipment (i.e. , north and south emergency storage buildings). The storage buildings were constructed to meet ASCE 7-10 standards for seismic, wind and snow/ice. Each building contains one complete set of FLEX portable equipment to satisfy the "N+ 1" criteria defined in NEI 12-06. Below are additional details on how FLEX equipment is protected from each of the applicable external hazards.

3.6.1.1 Seismic As stated above, the Duane Arnold storage buildings were constructed to meet American Society of Civil Engineers (ASCE) 7-10 standards for seismic, wind and snow/ice. However, due to the low seismic loads in Duane Arnold's geographical location, the wind loads are larger and the most limiting, and therefore , the controlling factor in the design of the storage facilities.

As a result, the Duane Arnold FLEX equipment is protected from loads associated with a seismic event. In addition, the licensee stated in its FIP that the equipment stored in the buildings is tied-down or adequately spaced to avoid interaction during a seismic event.

3.6.1 .2 Flooding In its FIP, the licensee stated that the north equipment storage building location is above the elevation where a flooding potential would exist. The south equipment storage building is located below the elevation where flooding could affect the building, however, sufficient warning time of several days is available to relocate FLEX equipment to a flood protected location inside the turbine building in the event it was needed after flood water reached plant grade in accordance with the licensee's abnormal operating procedure for flooding 3.6.1.3 High Winds As stated above, wind loads in the Duane Arnold geographical location are the controlling factor in the design of the FLEX storage facilities. Therefore , the storage buildings are designed to meet the most severe conditions of load combinations as set by the ASCE 7-10 for Duane Arnold's specific area. In addition , the storage buildings are located approximately 3500 ft.

apart, which exceeds the minimum separation of 1200 ft. defined for reasonable protection in NEI FAQ [frequently asked question] 2013-01 , to minimize the potential for a single tornado to damage all FLEX equipment. The licensee performed an evaluation to confirm that the probability of a single tornado striking both storage buildings was acceptably low to ensure that at least one set of FLEX equipment would remain deployable. The evaluation utilized data from NUREG/CR-4461 for tornado strike frequencies as well as path , width and length data for the Duane Arnold geographic location.

3.6.1.4 Snow. Ice. Extreme Cold and Extreme Heat In its FIP, the licensee stated that the heating and ventilation design of the storage buildings ensures normal storage temperature conditions suitable for long-term equipment reliability.

With the heating and ventilation system, temperatures internal to the building will be maintained between 50° F and 100° F. In addition, the licensee stated that FLEX equipment is protected from severe temperatures. Regarding ice, abnormal operating procedure 903 provides direction for managing potential winter weather events.

3.6.1.5 Conclusions Based on this evaluation , the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should protect the FLEX equipment during a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01 , and should adequately address the requirements of the order.

3.6.2 Availability of FLEX Equipment Section 3.2.2.16 of NEI 12-06 states, in part, that in order to assure reliability and availability of the FLEX equipment, the site should have sufficient equipment to address all functions at all units on-site, plus one additional spare (i.e., an N+1 capability, where "N" is the number of units on site). It is also acceptable to have a single resource that is sized to support the required functions for multiple units at a site (e.g., a single pump capable of all water supply functions for a dual unit site). In this case, the N+1 could simply involve a second pump of equivalent capability. In addition, it is also acceptable to have multiple strategies to accomplish a function, in which case the equipment associated with each strategy does not require an additional spare.

Based on the number of portable FLEX pumps, FLEX DGs, and support equipment identified in the FIP and during the audit review, the NRG staff concludes that, if implemented appropriately, the licensee's FLEX strategies include a sufficient number of portable FLEX pumps, FLEX DGs, and equipment for RPV makeup and core cooling, SFP makeup, and maintaining containment consistent with the N+ 1 recommendation in Section 3.2.2.16 of NEI 12-06.

3.7 Planned Deployment of FLEX Equipment The licensee stated in its FIP that at least two paths are available from each FLEX storage building to the deployment location to minimize the potential challenge from debris sources.

These haul paths have been reviewed for potential soil liquefaction and improvements to the transport paths were completed to ensure a seismic event would be unlikely to impair the transportation of the equipment.

3.7.1 Means of Deployment The deployment of onsite FLEX equipment to implement coping strategies beyond the initial plant capabilities (Phase 1) requires that pathways between the FLEX storage buildings and various deployment locations be clear of debris resulting from seismic, high wind, or flooding events. In its FIP, the licensee stated that the stored FLEX equipment includes vehicles equipped with four wheel drive, tire chain options, and snow blades, which will ensure reliable towing/transport of the FLEX equipment from the storage locations to the deployment areas.

Under normal circumstances, the licensee may need to open doors and gates that rely on electric power for opening and/or locking mechanisms. However, the licensee indicated in its FIP that access to the FLEX equipment and transport to the deployment locations do not require ac power. If a specific area needs accessing, doors and gates can be unlocked using keys available to response personnel and manually opened for personnel and equipment access.

The licensee has contingencies for access upon loss of all ac/dc power as part of the security plan. Access to the owner-controlled area, the plant protected area, and areas within the plant structures will be controlled under this access contingency.

As stated above, the licensee has identified at least two paths from each FLEX storage building to the deployment location to minimize the potential challenge from debris sources. After the onset of an ELAP, the licensee will complete an initial assessment of damage caused by the external hazard to allow the selection of which set of FLEX equipment to utilize and the most readily available transport path. However, high winds can cause debris from distant sources to interfere with planned haul paths. Therefore, tow vehicles and debris removal equipment is stored in each storage building, which protects the equipment from severe storm and high wind

hazards such that the equipment remains functional and deployable to clear obstructions from the pathway between the storage locations and its deployment location(s).

Phase 3 of the FLEX strategies involves the receipt of equipment from offsite sources including the NSRC and various commodities such as fuel and supplies. Transportation of this equipment can be through airlift or via ground transportation. Debris removal for the pathway between the site and the two NSRC receiving locations for Duane Arnold and from the various plant access routes may be required. The same debris removal equipment used for on-site pathways will be used to support debris removal to facilitate road access to the site.

3.7.2 Deployment Strategies In its FIP, the licensee stated that the soil conditions of the haul paths were evaluated for potential soil liquefaction. The licensee determined that soil liquefaction will not preclude FLEX strategy implementation. In addition, improvements were made to the transport paths to ensure a seismic event would be unlikely to impair the paths. The NRC staff walked down and reviewed the licensee's travel paths during the onsite audit to verify the licensee's conclusions and the NRC staff believes that liquefaction should not inhibit the necessary equipment deployment after an earthquake.

For the RCS cooling and SFP makeup strategies, the licensee will deploy a portable diesel-driven FLEX pump to transfer water from the circu19.ting water pit to the reactor and SFP via hoses connecting to the AHR system or directly to the SFP. In a flood condition , the portable diesel-driven FLEX pump is staged in the south turbine building rail bay with a suction source from the main condenser hotwell. The staging location of the FLEX pump will be selected based on the damage assessment to ensure that the hose runs can reach connection points, and in the case of flooding events, that the portable equipment is protected from impending flood waters.

For the electrical strategy, the licensee will deploy a FLEX 480 Vac DG into the protected area.

As mentioned above, the staging location of the generator will be selected based on the damage assessment to ensure that the cable runs can reach connection points, and in the case of flooding events, that the portable equipment is protected from impending flood waters.

For flooding events, the licensee indicated that procedures provide operators direction for responding to flood warnings, monitoring flood projections, and deploying flood protection features. Specifically, if flood waters are projected to reach plant grade, FLEX equipment required for Phase 2 will be pre-staged in the turbine building , including routing hose and electrical connections inside the flood protected buildings, prior to the flood water reaching plant grade. In addition, the diesel engines exhaust will be routed using portable exhaust pipes, if required.

3.7.3 Connection Points 3.7.3.1 Mechanical Connection Points Reactor Pressure Vessel Make-up - Primary and Alternate Injection Points In the FIP, Section 3.7.2 indicates that the mechanical connection points for the FLEX pump is located in robust structures protected from external hazards and that access to FLEX connection points is entirely through seismic Class 1 structures with the exception of the turbine

building , which is seismically robust per UFSAR Section 3.8.4.3.3. Specifically, the primary RPV injection point is located in the southeast corner room of the reactor building and will inject into AHR Loop A (Low Pressure Coolant Injection (LPCI) injection line) . The alternate RPV injection point is also located in the torus room of the reactor building and will inject into the condensate service crosstie to AHR Loops A and B (LPCI injection lines). In the UFSAR, Table 3.2-1 and Table 3.2-3 indicates that the AHR system and reactor building , respectively, are seismic Category I. Furthermore, the primary and alternate connections points are located within the reactor building , which is protected from externally generated missiles (UFSAR Section 3.5.2). Given the design and location of the primary and alternate connection points, the NRG staff concludes that at least one of the connection points should be available to support RPV makeup via a portable pump during an ELAP caused by an external event, consistent with NEI 12-06 Section 3.2.2.17.

Spent Fuel Pool Make-up - Primary and Alternate Injection Points In NEI 12-06, Table C-3 , states, in part, that the baseline capabilities for SFP cooling include makeup via hoses on the refueling floor and makeup via connection to SFP cooling piping or other alternate locations. Guidance document JLD-ISG-2012-01 , Revision 1, states, in part, that spray capability via portable monitor nozzles from the refueling floor using a portable pump is a baseline capability in addition to those identified in NEI 12-06, Table C-3.

In the FIP, Section 3.3.2 indicates that procedures direct operators to provide make-up to the SFP directly to the pool via hoses or a connection point on the AHR system , which does not require access to the refueling floor. In the FIP, Attachment J indicates that the primary connection point for makeup to the SFP is via hoses on the refueling floor. During the audit, the NRG staff noted that procedural guidance is provided to the operators to either attach the discharge ends of the two 2.5" hoses to spray nozzles aimed over the SFP or secure the FLEX hoses to direct makeup into the SFP using hose restraints or tie-down ropes. As previously discussed, the AHR system is seismic Category I and housed in a Class 1 structure , which is protected from applicable external hazards as defined in NEI 12-06. Furthermore, discharge hoses from the FLEX pump are routed through the turbine building , which is seismically robust per UFSAR Section 3.8.4.3.3, and the reactor building to the refuel floor.

Given the design and location of the primary and alternate connection points , as described in the above paragraphs , the NRG staff concludes that at least one of the connection points should be available to support SFP make-up/spray, via the portable FLEX pump during an ELAP caused by an external event, consistent with NEI 12-06, Section 3.2.2. The licensee's FLEX strategy includes the baseline capabilities to provide make-up and spray to the SFP from the refuel floor and make-up to the SFP without accessing the refuel floor consistent with NEI 12-06, Table C-3, and JLD-ISG-2012-01 , Revision 1.

3.7.3.2 Electrical Connection Points Electrical connection points are only applicable for Phases 2 and 3 of the licensee's mitigation strategies for a BDBEE.

During Phase 2, the licensee's strategy is to supply power to equipment required to maintain or restore core cooling, containment, and SFP cooling using a combination of permanently installed and portable components.

The electrical connection points for FLEX equipment are located in robust structures protected from the site applicable external hazards. The staging location of the FLEX DGs will be selected based on the licensee's damage assessment to ensure cables can reach connection points and in the case of flooding events that the portable equipment is protected from impending flood waters.

The primary staging location for the FLEX 480 Vac DG is outside of the north turbine building roll-up door for non-flood conditions. During a flood, the FLEX DG will be staged inside the roll-up door. The portable cable trailer associated with the FLEX DG will be staged inside of the roll-up door in either scenario. The alternate staging area is north of the administration building.

The 480 Vac FLEX DGs at Duane Arnold have cabling and connectors that are all 3-phase.

From the primary location, cables would be routed from the FLEX 480 Vac DG through the turbine building to essential switchgear rooms 1A3 and then to 1A4. When staged in the alternate staging area, the cables will be routed into the administration building through the north double doors through the battery room corridor and then through 1A4 switchgear room and finally into 1A3 switchgear room .

Procedure SAMP 722, "FLEX Re-powering Battery Chargers for FLEX 480 Volt Generator,"

Revision 0, provides guidance for energizing the Class 1E battery chargers. These connections include: 1D1 O Division 1 125 Vdc Panel Distribution via 1D12 Division 1 125 Vdc charger, 1D20 Division 2 125 Vdc Panel Distribution via 1D120 Division 1/2 125 Vdc charger, and 1D40 250 Vdc Distribution Panel via 1D43 Division 1 250 Vdc charger. Procedure SAMP 723, "FLEX Re-powering MCC 1B32 From 480VAC FLEX DG ," Revision 0, provides guidance for supplying power to MCC 1B32 1N1241.

The licensee performed acceptance testing for the installed FLEX connectors that verified proper termination at each connector and that the phase rotation matched the existing plant configuration .

Installed plant equipment is protected from faults in portable FLEX equipment by the FLEX DG output breakers. Additionally, the equipment being fed have installed breakers that will isolate the FLEX DG that is feeding under fault conditions. The 480 Vac FLEX DGs each have a generator fault detection system that will trip its output breaker under generator fault conditions.

The procedural guidance for use of the FLEX DGs would ensure the normal supplies to these electrical equipment/buses are isolated prior to supplying the load by emergency FLEX power (SAMP 722 and SAMP 723).

For Phase 3, the licensee will receive two 1 MW 4160 Vac CTGs and one 1100 kW 480 Vac CTG from an NSRC. SAMP 733 provides guidance on deploying and connecting the Phase 3 CTGs. The 4160 Vac CTGs will be staged in the yard south of the reactor building near the standby transformer. Procedure SAMP 733 directs connection of the 4160 Vac CTGs to the standby transformer secondary or the essential bus feeder lines; this would supply power to one or both essential 4160 Vac buses (1 A3 or 1A4). If needed as a replacement for the Phase 2 480 Vac FLEX DGs, the 480 Vac CTG could be deployed to the same staging location as the Phase 2 FLEX 480 Vac DGs. Procedure SAMP 733 includes steps to verify proper phase rotation prior to energizing plant equipment.

Based on its review of single line electrical diagrams and station procedures, the NRC staff concludes that the licensee's approach should provide the necessary protection and diversity of the power supply pathways and separation and isolation of the FLEX DGs from the Class 1E

EDGs. In addition, procedures are available to direct operators on how to align , connect, and protect associated systems and components.

3.7.4 Accessibility and Lighting During the onsite audit, the licensee stated that the potential impairments to required access are: 1) doors and gates, and 2) site debris blocking personnel or equipment access. The coping strategy to maintain site accessibility through doors and gates is applicable to all phases of the FLEX coping strategies, and is immediately required as part of the immediate activities required during Phase 1. Doors and gates serve a variety of barrier functions on the site. One primary function is security and is discussed below. However, other barrier functions include fire , flood ,

radiation , ventilation , tornado , and high energy line break. As barriers, these doors and gates are typically administratively controlled to maintain their function as barriers during normal operations.

The licensee noted that following an BDBEE and subsequent ELAP event, FLEX coping strategies require the routing of hoses and cables to be run through various barriers in order to connect beyond-design-basis (BOB) equipment to station fluid and electric systems or require the ability to provide ventilation. For this reason , certain barriers (gates and doors) will be opened and remain open. This deviation of normal administrative controls is acknowledged and is acceptable during the implementation of FLEX coping strategies. The ability to open doors for ingress and egress, ventilation , or temporary cables/hoses routing is necessary to implement the FLEX coping strategies.

In its FIP, the licensee described that the control building has safe shutdown battery operated lighting, which will provide 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months of operation after an ELAP. Procedures are available to restore some normal control room lighting by re-energizing the 480 Vac MCC 1B32 which feeds an essential lighting panel supplying the control room lights. In addition , portable lighting and lighting on FLEX tow vehicles are provided in each FLEX emergency response storage building.

Backup lighting options for FLEX deployment are included in SAMP 724.

3.7.5 Access to Protected and Vital Areas During the audit process, the licensee provided information describing that access to protected areas will not be hindered. The licensee has contingencies in place to provide access to areas required for the ELAP response if the normal access control systems are without power.

3.7.6 Fueling of FLEX Equipment In the FIP, Section 3.7.4 states that fuel consumption rates for its portable FLEX equipment has been evaluated and that intermittent use or partial loading of FLEX equipment may reduce actual total fuel consumption. The licensee explained that with portable FLEX equipment operating at full load the fuel oil that will be consumed at a rate of 38.3 gallons per hour. The staff concludes that it is a conservative assumption that the diesel-driven FLEX equipment will be operated continuously at full load because it would be expected that as the reactor is cooled down the demand on the equipment would decrease. The licensee explained that the main fuel oil storage tank will be used to support refueling operations. In the UFSAR, Table 3.2-1 and UFSAR Section 9.5.4.2 state that this tank is seismic Category I and is a 40,000 gallon safety-related underground diesel-oil storage tank, respectively. The NRG staff noted that the available protected fuel oil located onsite will provide greater than 30 days of continuous full load operation of the FLEX equipment. Based on the design (per UFSAR Sections 3 and 9) , the

location (i.e., underground) and its safety-related classification , the NRC staff concludes that the main fuel oil storage tank is robust and the fuel oil contents should be available to support the licensee's FLEX strategies during an ELAP event. Furthermore, based on the conservative fuel oil consumption rates and the protected fuel oil volume onsite, the NRC staff concludes that the fuel oil contents should be available to support the licensee's FLEX strategies during an ELAP event and that the quantity available is sufficient to support FLEX until offsite resources can provide fuel oil replenishment to the site.

The staff noted that the FLEX pump and FLEX generator will be deployed and begin operating approximately 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after the initiating event and do not require an initial fill since the equipment will normally be stored with fuel in the integral tanks. With the FLEX equ ipment stored with fuel in the integral tanks it provides additional time tor operators to deploy necessary equipment to begin refueling operations tor FLEX. Based on the sequence of events and staffing studies, the licensee will begin refueling activities 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months after the initiating event. The licensee explained that one portable transfueler (total of 2) will be stored in each of the FLEX storage buildings with approximately 900 gallons of fuel on-board and is equipped with a gasoline powered and a de powered onboard transfer pump, and fuel transfer hoses and nozzles to accomplish the refueling operations. Based on the available protected equipment to support refueling activities, the available run-time and fuel oil consumption rate for each piece of FLEX equipment, the NRC staff concludes that the diesel-powered FLEX equipment can be adequately refueled to ensure uninterrupted operation to support the licensee's FLEX strategies.

The licensee confirmed that the fuel that is stored in the onboard portable equipment and in the FLEX transfuelers will be tested periodically to verify fuel quality. Furthermore, the fuel in the transfueler will utilize additives that help maintain fuel quality. In the FIP, Section 3.12.4 explains that the FLEX equipment will be maintained with preventive maintenance and testing based on the generic EPRI industry program tor maintenance and testing of FLEX equipment, which has been incorporated in NextEra fleet procedures and site-specific preventive maintenance tasks. Technical Specification Section 5.5.9 establishes a testing program to test both new fuel oil and stored fuel oil in the safety-related fuel oil storage tanks, which include sampling, testing, and acceptance criteria in accordance with applicable ASTM standards.

Based on the controls established in the TSs and site-specific tasks to periodically test fuel oil in the FLEX equipment, the NRC staff concludes that the licensee has addressed management of fuel oil quality in the fuel oil storage tanks, portable FLEX equipment and transfuelers to ensure FLEX equipment will be supplied with quality fuel oil during an ELAP event.

3.7.7 Conclusions Based on this evaluation , the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should allow deploying the FLEX equipment following a BDBEE consistent with NEI 12-06 guidance as endorsed by JLD-ISG-2012-01 , and should adequately address the requirements of the order.

3.8 Considerations in Using Offsite Resources 3.8.1 Duane Arnold SAFER Plan The industry has collectively established the needed off-site capabilities to support FLEX Phase 3 equipment needs via the SAFER Team . The SAFER team consists of the Pooled Equipment Inventory Company (PEICo) and AREVA Inc. and provides FLEX Phase 3

management and deployment plans through contractual agreements with every commercial nuclear operating company in the United States.

There are two NSRCs, located near Memphis, Tennessee and Phoenix, Arizona, established to support nuclear power plants in the event of a BDBEE. Each NSRC holds five sets of equipment, four of which will be able to be fully deployed to the plant when requested. The fifth set allows removal of equipment from availability to conduct maintenance cycles. In addition ,

the plant's FLEX equipment hose and cable end fittings are standardized with the equipment supplied from the NSRC.

By letter dated September 26, 2014 (ADAMS Accession No. ML14265A107), the NRG staff issued its assessment of the NSRCs established in response to Order EA-12-049. In its assessment, the NRG staff concluded that SAFER has procured equipment, implemented appropriate processes to maintain the equipment, and developed plans to deliver the equipment needed to support site responses to BDBEEs, consistent with NEI 12-06 guidance; therefore, the staff concluded in its assessment that licensees can reference the SAFER program and implement their SAFER response plans to meet the Phase 3 requirements of Order EA-12-049.

The NRG staff noted that the licensee's SAFER Response Plan contains (1) SAFER control center procedures, (2) NSRC procedures, (3) logistics and transportation procedures, (4) staging area procedures, which include travel routes between staging areas to the site, (5) guidance for site interface procedure development, and (6) a listing of site-specific equipment (generic and non-generic) to be deployed for FLEX Phase 3.

3.8.2 Staging Areas In general, up to four staging areas for NSRC supplied Phase 3 equipment are identified in the SAFER Plans for each reactor site. These are a Primary (Area C) and an Alternate (Area D), if available, which are offsite areas (within about 25 miles of the plant) utilized for receipt of ground transported or airlifted equipment from the NSRCs. From Staging Areas C and/or D, the SAFER team will transport the Phase 3 equipment to the on-site Staging Area B for interim staging prior to it being transported to the final location in the plant (Staging Area A) for use in Phase 3. For Duane Arnold , Alternate Staging Area Dis the Iowa City Airport. Staging Area C is the Eastern Iowa Airport. Staging Area B is the North FLEX storage building. Staging Area A is the final deployment location at the site.

Use of helicopters to transport equipment from Staging Area C to Staging Area B is recognized as a potential need within the Duane Arnold SAFER Plan.

3.8.3 Conclusions Based on this evaluation, the NRG staff concludes that the licensee has developed guidance that, if implemented appropriately, should allow utilization of offsite resources following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01 , and should adequately address the requirements of the order.

3.9 Habitability and Operations 3.9.1 Equipment Operating Conditions 3.9.1.1 Loss of Ventilation and Cooling Following a BDBEE and subsequent ELAP event at Duane Arnold , ventilation that provides cooling to occupied areas and areas containing required equipment will be lost. The primary concern with regard to ventilation is the heat buildup that occurs with the loss of forced ventilation in areas that continue to have heat loads.

The licensee developed calculation CAL-M06-007, "Room Heatup Analysis for DAEC During Station Blackout," Revision 1, to determine temperatures in select areas during a station blackout (SBO) event. This analysis models an SBO event for a 24-hour period. The calculation was performed using the GOTHIC computer model. The key areas identified for all phases of execution of the FLEX strategy activities are the control room , RCIC room , HPCI room , Class 1E battery and switchgear rooms, areas containing instrumentation required for FLEX, and primary containment.

Control Room The licensee's analysis (CAL-M06-007) assumed SBO heat loads and operator actions to open control room doors within 60 minutes (AOP 301.1) following the start of an ELAP event. No supplemental forced cooling is assumed. The licensee's analysis concluded that the peak temperature in the control room would reach 120° F after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (with doors opened and natural circulation established).

Based on the licensee's analysis and the availability of procedures to maintain temperatures below 120° F (the temperature limit, as identified in NUMARC-87-00, "Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," Revision 1, for electronic equipment to be able to survive indefinitely), the NRC staff concludes that the electrical equipment in the control room will not be adversely impacted by the loss of ventilation as a result of an ELAP event. The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allows time for the licensee to establish alternative cooling .

RCIC Pump Room In the FIP, Section 3.9.1 states an existing calculation was developed to determine temperatures in select areas during a SBO event. This calculation was performed using the GOTHIC computer model and analyzed the expected temperature response during a SBO event for a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period; therefore, it was used as the basis for the FLEX response during an ELAP event. The analysis indicates that the peak temperature in the RCIC room reaches 125 °F after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , and assumes the RCIC room door remains closed throughout this time period . The licensee explained that the RCIC pump is designed to operate satisfactorily in accident mode with temperatures up to 148 °F. The NRC staff noted that based on the licensee's FIP and sequence of events, the licensee assumes failure of RCIC pump occurs when suppression pool temperature reaches 250 °F, which is projected to occur at approximately 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the initiating event. The licensee plans to use the portable diesel-driven FLEX pump to continue providing makeup to the RPV and support the core cooling function in place of the RCIC system.

Based on the expected temperature response in the RCIC room and the required mission time of 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months for the RCIC pump, the NRC staff concludes that the equipment should perform its required functions at the expected temperatures in the RCIC room as a result of loss of ventilation during an ELAP event and that no additional temperature monitoring or ventilation actions are required to maintain acceptable limits.

During the audit, the licensee confirmed that the portable FLEX equipment was procured to operate during extreme maximum temperatures and will be self-cooled so that supplemental ventilation will not be required.

HPCI Pump Room The licensee would utilize the HPCI pump as an alternate FLEX strategy if the RCIC pump were unavailable. The licensee's analysis (CAL-M06-007) indicated that the peak temperature in the HPCI room would reach 138 °F 60 minutes after the onset of an ELAP event. The licensee's FLEX strategy includes actions to open the HPCI room doors within 60 minutes (AOP 301 .1).

After an initial temperature drop resulting from opening the doors, the analysis shows that the room temperature will increase gradually, reaching a maximum of 137 °F in 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The Duane Arnold FLEX strategy would utilize the HPCI pump for less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the onset of an ELAP event. The maximum allowable temperature in the HPCI pump room is 148 °F.

Based on temperatures remaining below the design limits for the expected duration (i.e. , less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) , the NRC staff concludes that the electrical equipment in the HPCI pump room should not be adversely impacted by the loss of ventilation as a result of an ELAP event.

Class 1 E Battery Rooms and Switchgear Rooms Temperature conditions in the Duane Arnold control building following a station blackout/ELAP event are included in CAL-M06-007. The Class 1E battery room and switchgear room control volumes are included in the calculation. To manage temperature conditions in the rooms following a station blackout/ELAP event, AOP 301 .1 requires the battery room and switchgear room doors to be opened within 60 minutes following the onset of an ELAP.

Following an ELAP event, heat loads in the battery and switchgear rooms would be reduced due to the loss of ac power. Inverters supplying instrument ac power from the Class 1E batteries are located in the switchgear rooms and would contribute to the heat load, however, as a result of de load shed activities, the heat load would be operating at a substantially reduced load (22.7% of maximum) . Due to the design of the control building and initial room temperatures, room temperature profiles should be similar to that of the control room . Control room temperature following a station blackout/ELAP is approximately 120 °F after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

FLEX procedures (AOP 301.1 , SAMP 724, SAMP 726) identify a 120° F temperature limit for the battery and switchgear rooms and the compensatory ventilation actions (open doors, restart normal system ventilation fans in Phase 2, and/or stage temporary fans) to maintain the battery and switchgear room temperatures below 120 °F.

The Duane Arnold Class 1E station batteries were manufactured by C&D Technologies. The qualification testing performed by C&D Technologies demonstrated the ability of the batteries to perform under elevated operating temperature environments. The testing results indicate that the battery cells will perform as required in excess of 200 days under an estimated 122 °F.

The elevated temperature also has an impact by increasing the charging current required to maintain the float charging voltage set by the battery charger. The elevated charging current will in turn increase cell water loss through an increase in gassing . Based on this , periodic water addition may be required or the float charging voltage reduced per the guidance contained in the C&D Technologies vendor manual.

Based on the licensee's analysis and the availability of procedures to maintain temperatures below 120 °F (the temperature limit, as identified in NUMARC-87-00, "Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," Revision 1, for electronic equipment to be able to survive indefinitely and a temperature that is below the battery manufacturer limits) , the NRC staff concludes that the electrical equipment in the Class 1E battery and switchgear rooms should not be adversely impacted by the loss of ventilation as a result of an ELAP event.

Areas with FLEX Instrumentation The licensee's analysis of the reactor building general area environmental conditions during an ELAP including SFP conditions is provided in EVAL-16-M18, "Reactor Building Environmental Analysis for FLEX," Dated April 21 , 2016. In the analysis, the licensee evaluated installed instrumentation located in these areas to confirm instrument performance would be acceptable for the environmental conditions expected during an ELAP. The instruments that operators would use to monitor primary containment during an ELAP event are listed in procedure SAMP 727. Most of the equipment listed in SAMP 727 are located in the control room but the information is fed from devices in the plant, which are sub components. These devices are used to monitor primary containment during an ELAP event. The only devices that were considered are the ones on elevations: torus, 757'-6", 786' and 855'. Listed in SAMP 727 are TR 4383A, TR 4383B and TIA-4386. These components are all either in the control building or inside of the drywell and are therefore not compared to the EVAL-16-M18.

Torus Room - The licensee's analysis showed that the maximum temperature in the torus room reaches approximately 195 °F at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Instruments located in the torus room relied on for the licensee's FLEX strategies include the torus level transmitters.

RB [Reactor Building] Elevation 757 - The licensee's analysis showed that the reactor building elevation 757 maximum temperature reaches approximately 125 °F at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The temperature rise from 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is essentially constant at 1 °F/hour.

Instrumentation relied on for the licensee's FLEX strategies located in this area includes:

RPV level, torus temperature, and RPV pressure.

RB Elevation 786 - Reactor building at elevation 786 maximum temperature reaches approximately 115 °F at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Instrumentation located in this area includes: drywell pressure, RPV pressure, and RPV level.

The licensee's 24-hour temperature profile for the required instrumentation listed above shows that temperatures will remain below the continuous temperature limits. With the exception of 3 devices, all required instruments (and sub components) have at least 22 percent of margin in their maximum continuous temperature versus the expected temperatures during an ELAP.

Therefore, with a gradual increase in temperature over time the devices are expected to remain below limits for at least 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

Three devices are close to their continuous temperature limit. One instrument (LT4396A) has approximately 2.5 percent of margin , however, three other components provide the same information and those devices have temperature limits in excess of the 24-hour temperature profile. The other two instruments (PT4395A and PT4395) have a normal operating temperature limit of 180 °F, but also have a design-basis accident limit of 250 °F. The licensee indicated that PT 4395A and B were not procured to be environmentally qualified (EQ) per the requirements in 10 CFR 50.49, however, devices of the same model have been qualified. The EQ report for this model shows that they were tested at 221 °F for approximately 400 hours0.00463 days 0.111 hours 6.613757e-4 weeks 1.522e-4 months .

This test demonstrates that the instruments should be able to function in the expected environmental conditions during an ELAP for at least 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Based on this information , the NRC staff concludes that adequate margin and defense-in-depth should exist to ensure that instruments required to monitor primary containment remain functional prior to receiving resources from offsite (approximately 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after the onset of an ELAP event).

The NRC staff further concludes that it is reasonable to expect that the licensee could utilize the offsite resources to reduce or maintain temperatures within the above mentioned areas to ensure that required instruments survive indefinitely.

Primary Containment The licensee performed a plant specific evaluation of FLEX strategies that is documented in ERIN Engineering Report, "Evaluation Report of DAEC Capabilities to Respond to Extended Loss of AC Power (ELAP), " Revision 2. This evaluation included primary containment environmental conditions that would be expected during an ELAP event. The evaluation identified a 340 °F acceptance criteria for the drywell. The results of the licensee's analysis indicate that the maximum temperature in the drywell would be approximately 270 °F during an ELAP event. The licensee's qualification for the SRV solenoids documents that they are qualified to operate in an environment with a temperature of 355 °F at 62 psig for 155 days.

Duane Arnold will receive offsite resources and equipment from an NSRC within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after the onset of an ELAP event. The NRC staff concludes that it is reasonable to expect that the licensee could utilize these resources to reduce or maintain temperatures within primary containment to ensure that required electrical equipment survives indefinitely.

Based on temperatures remaining below the design limits of equipment and the availability of offsite resources after 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , the NRC staff concludes that the electrical equipment in the primary containment should not be adversely impacted by the loss of ventilation as a result of an ELAP event.

3.9.1.2 Loss of Heating For cold external conditions , Duane Arnold does not expect equipment located inside the reactor building to be adversely affected due to the large thermal mass and presence of decay heat. Installed plant systems credited for FLEX with the exception of the CSTs have installed heat tracing for the purpose of freeze protection. If the CSTs are unavailable, the suppression pool will be the credited source.

In the FIP, Section 3.9.2 states that the Phase 2 onsite portable equipment is stored in the climate-controlled FLEX storage buildings, which are designed to maintain the storage area temperatures between 50° F and 100° F over the full range of external temperature. In response to an ELAP event, the equipment deployed outdoors would be subjected to environmental temperature extremes and is capable of operating outdoors in the expected

conditions ; thus, heat tracing and freeze protection is not provided or required for this equipment. The staff noted that the portable FLEX pump may be staged east of the pumphouse, during non-flood events, taking suction from the circulating water storage pit and discharging via hoses to the turbine building and reactor building southeast corner room. The licensee explained in its FIP that the FLEX pump is equipped with a minimum flow line that ensures constant flow. In addition , procedural guidance is available that governs operation of the FLEX pump to ensure that the pump and attached piping are drained when in standby condition. Based on the procedural guidance for operating the FLEX pump, the NRC staff concludes that it is reasonable that extreme low temperatures will not impact the pump's ability to provide sufficient makeup to the RPV and SFP.

The Duane Arnold Class 1E station battery rooms are located inside the control building and would not be exposed to extreme low temperatures. At the onset of the event, the Class 1E battery rooms would be at their normal operating temperature and the temperature of the electrolyte in the cells would build up due to the heat generated by the batteries discharging and during recharging . Temperatures in the battery and switchgear rooms are not expected to be sensitive to extreme cold conditions due to their location in the control building, the concrete walls isolating the rooms from the outdoors, and lack of forced outdoor air ventilation during early phases of the ELAP event.

The Duane Arnold battery sizing calculations assume a minimum battery temperature of 65 °F to determine de system performance. Accordingly, the licensee's FLEX procedures include directions to monitor and maintain the battery and switchgear rooms above 65 °F for the duration of the ELAP event (SAMP 726). Procedure SAMP 724 provides guidance for staging portable heaters as needed .

3.9.1.3 Hydrogen Gas Control in Vital Battery Rooms An additional ventilation concern that is applicable during Phases 2 and 3 is the potential buildup of hydrogen in the battery rooms as a result of loss of ventilation during an ELAP event.

Off-gassing of hydrogen from batteries is only a concern when the batteries are charging . Once the battery chargers are energized, the licensee's calculation CAL-MOS-003, "Battery Room Hydrogen Gas Buildup," Revision 0, indicates that it would take 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months before hydrogen concentration would reach 4 percent in the battery rooms with the doors closed. The licensee's procedure (AOP 301.1) directs the opening of battery room doors to allow ventilation into the corridor separating the battery room from the turbine building. The large volume of the turbine building and inherent leakage of this structure will preclude significant hydrogen concentration .

In addition, FLEX procedures (SAMP 724, SAMP 726) include compensatory ventilation actions (restart normal system ventilation fans in Phase 2 and/or stage temporary fans) to maintain the battery and switchgear room temperatures below 120 °F. These actions would also help reduce hydrogen concentration in the Class 1E battery rooms .

Based on its review of the licensee's battery room ventilation strategy, the NRC staff concludes that hydrogen accumulation in the Duane Arnold vital battery rooms should not reach the combustibility limit for hydrogen (4 percent) during an ELAP event.

3.9.2 Personnel Habitability 3.9.2.1 Main Control Room In the FIP, Section 3.9.1 states that temperature conditions in the main control room during an ELAP event were assessed by reviewing an analysis performed for a SBO event. The licensee explained that this existing analysis conservatively assumes SBO heat loads and that operators are procedurally directed to open control room doors within 60 minutes following the start of the event. One of the scenarios from the analysis concluded that the peak temperature in the control room is 120 °F after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (this is for the case with doors open for natural circulation and no supplemental forced cooling is assumed) . For extended periods, temperature conditions in the control room are more limiting for plant operators than for control room equipment. The recommended upper temperature limit for the control room is 11 O °F for operator access (the temperature limit, as identified in NUMARC-87-00, "Guidelines and Technical Bases for NU MARC Initiatives Addressing Station Blackout at Light Water Reactors," Revision 1, for control room habitability). The licensee explained that FLEX procedures (AOP 301.1; SAMP 724, "FLEX Damage Assessment and Portable Equipment Deployment"; and SAMP 726, "FLEX Adverse Environmental Conditions Guideline") identify this temperature limit and direct operators to establish compensatory ventilation actions (e.g. , restart normal system ventilation fans in Phase 2 or stage temporary fans) to maintain control room temperatures below 110 °F.

In addition , the licensee explained that the toolbox options such as portable lighting, personal protective equipment, stay times , drinking water, and ventilation/heating options are made available for operators to manage these conditions to the extent practical.

Based on expected temperature response in the main control room , the procedural guidance to monitor the main control room temperature and take compensatory actions to lower temperatures, if necessary, and the availability of toolbox options to increase operator habitability, the NRC staff concludes that the FLEX strategies appear to be consistent with NEI 12-06, Section 3.2.2.11 such that station personnel can safely enter and occupy the main control room and perform the necessary actions during an ELAP event.

3.9.2.2 Spent Fuel Pool Area In the FIP, Section 3.9.3 states that an engineering evaluation was developed to determine the effects of SFP boiling on personnel access to the reactor building. The evaluation concluded that the reactor building refuel floor will not be habitable once the pool is boiling and that actions to stage equipment for SFP makeup (nozzle, hose) will need to be performed prior to the onset of boiling in the SFP. The licensee explained that an analysis is performed each operating cycle to provide operators with cycle specific information on the time available prior to the SFP temperature reaching 200 °F using the actual spent fuel present during the cycle , which is ultimately included in the abnormal operating procedure for loss of fuel pool cooling/inventory, and allows operators to appropriately prioritize actions associated with the SFP.

In the FIP, Section 3.3.4.1.1 states that a vent hatch was installed above the SFP to facilitate natural ventilation of the reactor building with a loss of ac power. The licensee explained that the vent can be pneumatically operated from a remote location within the reactor building using a portable pneumatic supply and would not require access to the refueling floor. To supplement the vent above the SFP, the licensee explained that various doors of the reactor building can be opened to allow a chimney effect with warmer air/steam rising to the roof vent to minimize the impact on the reactor building environment.

Based on information on the time to boil in the SFP within the licensee's abnormal operating procedures and the newly installed vent hatch in the reactor building , the NRC staff concludes that the FLEX strategies appear to be consistent with NEI 12-06, Section 3.2.2.11 such that station personnel can safely enter the reactor building refuel floor and perform the necessary actions during an ELAP event.

3.9.3 Conclusions The NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain or restore equipment and personnel habitability conditions following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01 , and should adequately address the requirements of the order.

3.1 O Water Sources 3.10.1 RPV Make-Up Phase 1 During Phase 1, the credited water source for core cooling is the safety-related suppression pool. The CSTs are the preferred source due to high water quality and low temperature; however, they are not fully protected from tornado missiles. In the UFSAR, Section 6.2.1.1 .2.3 states that the suppression pool serves both as a heat sink for postulated transients and accidents and as a source of water for the emergency core cooling systems. In the UFSAR ,

Table 3.2-3 states that the suppression pool is a seismic Category I structure that is located in the reactor building, which is also a seismic Category I structure protected from wind-borne missiles. Consistent with NEI 12-06 Section 3.2.2.5 the NRC staff concludes that the suppression pool is a robust structure and adequate water source with respect to seismic, high wind and flooding external hazards that should be available during an ELAP to support the FLEX mitigation strategy.

Phase 2 During Phase 2 without external river flood events, the FLEX strategies relies on the FLEX pump to take suction from the below grade circulating water storage pit, which is located adjacent to the safety-related essential service water storage pit. The licensee explained that for structures defined as partially seismic Category I and partially non-seismic, those portions of non-seismic structures housing seismic Category I equipment are designed in accordance with seismic Category I design criteria and the structure as a whole was investigated to ensure that damage to the non-seismic part would not endanger the area housing the seismic Category I equipment (UFSAR Section 3.8.4.3.3). Thus, the circulating water storage pit is considered robust with respect to the seismic hazard. The licensee stated that an evaluation was performed and confirmed that the circulating water piping connected to the circulating water storage pit is seismically robust. During the audit, the licensee explained that the circulating water storage pit contains approximately 550,000 gallons of water that can be used to provide suction to the FLEX pump. In the FIP, Section 3.2.4.7 indicates that the FLEX pump is not expected to be in service prior to 7.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the initiating event, at which time the reactor make-up flow requirements are approximately 115 gpm , per its MAAP Thermal Hydraulic Analysis. Based on the available amount of water in the circulating water storage pit and the make-up requirements for the RPV at the time the FLEX pump is in service, the NRC staff noted that there is a sufficient amount of water available until off-site resources arrive. Consistent with

NEI 12-06 Section 3.2.2.5, the NRC staff concludes that the circulating water storage pit is a robust structure and adequate water source with respect to seismic and high-wind external hazards that should be available during an ELAP to support the FLEX mitigation strategy until offsite resources arrive to provide additional equipment/support to obtain water from the Cedar River.

For river flooding events, the licensee explained that warning time is available and the main condenser hotwell is the credited alternate source of high quality water. In the FIP, Attachment A explains that a connection point for the portable pump suction from the hotwell is located inside the turbine building and accessible throughout an external flood event. In the UFSAR ,

Section 3.8.4.3.3 indicates that although the turbine building is classified as non-seismic, the criteria for seismic Category I structures were used for the structural design of the entire building. Furthermore, the licensee states in FIP Attachment A that the condenser hotwell is located below grade, and within substantial concrete shield walls (heater bay walls) that provide protection from high winds and wind generated missiles. The staff noted that although the main condenser hotwell is credited for the river flooding event, based on the design of the turbine building and location of the main condenser hotwells, it is reasonable that this water volume will be available to support the licensee's FLEX strategy. Consistent with NEI 12-06 Section 3.2.2.5, the NRC staff concludes that the main condenser hotwell is a robust structure and adequate water source with respect to seismic and high-wind external hazards that should be available during an ELAP to support the FLEX mitigation strategy until offsite resources arrive to provide additional equipment/support to obtain water from the Cedar River. In addition , the NRC staff noted that the licensee has greater than 4.5 days of warning time before flood levels reach plant grade, which provides sufficient time for the licensee to complete flood preparations.

Phase 3 In the FIP, Section 3.10.3 indicates that during Phase 3 for core cooling and SFP cooling , the water inventory in the circulating water storage pit must be replenished to allow indefinite coping during an ELAP event. Guidance is provided to operators for replenishing water inventory using offsite resources. Specifically, raw water from the Cedar River would be drawn by using a Phase 3 low-pressure high flow pump supplied by the NSRC, which has multiple suction connections to accommodate uninterrupted replenishment flow with two independent suction hoses with a strainer on each.

The licensee explained that raw water will be pumped from the circulating water storage pit, which will eventually be replenished from the Cedar River, and injected through a flow path via RHR and recirculation system into the reactor vessel from outside the shroud. Furthermore, with the use of raw water there may be a certain amount of small debris that could potentially clog or block the core inlet, fuel filter or bypass flow leakage holes. To address this issue the BWR owners group (BWROG) developed report TP-14-006 and provides the basis for addressing the fuel overheating from potential fuel inlet flow blockage from debris when injecting raw water. The report describes BWR core cooling capabilities with the fuel inlet fully blocked by primarily assuring that injected water reaches the inside shroud region and enters the fuel through the top of the channel. The fuel then can be adequately cooled in this manner when the inside shroud is flooded by either injecting make-up coolant inside the shroud or by maintaining the water level above the steam separator return elevation if injecting make-up in the downcomer. Based on this report, the licensee explained that its emergency operating procedures were revised to maintain a higher water level to enhance core cooling if using raw water injection by raising RPV level to a level just below the main steam line (i.e., above the top of the steam separators) to ensure core coverage by reverse core cooling (water flows from the

RPV annulus back over top of the steam separator and down to the fuel assemblies) regardless of potential fuel inlet blockage. Furthermore, the licensee explained that BWROG-TP-15-007 provides the basis for using raw water sources for RPV makeup and addresses the concern of fuel overheating from deposition of solids and debris inside the core region and on the fuel cladding . The evaluation determined that it is expected there will be a loss of core cooling capability resulting from the use of raw water injection for BDBEE conditions; however, heat transfer capability will not be degraded in the first 120 hours0.00139 days 0.0333 hours 1.984127e-4 weeks 4.566e-5 months following an ELAP event. The licensee confirmed that its site is bounded by the conditions assessed in BWROG-TP-15-007.

The NRC staff concludes that it is reasonable that even with the use of raw water for RPV make-up, the licensee has sufficient time for the emergency response organization to establish long-term alternate core cooling using offsite resources. In addition, the licensee revised its procedures to maintain higher water level in the RPV to enhance core cooling if using raw water and heat transfer capability will not have degraded within 120 hours0.00139 days 0.0333 hours 1.984127e-4 weeks 4.566e-5 months following an ELAP event.

3.10.2 Spent Fuel Pool Make-Up As discussed in Section 3.3 of this safety evaluation, the SFP does not require makeup during Phase 1. The water sources that support SFP make-up during Phase 2 and 3 are the circulating water storag9' pit, main condenser hotwell and the Cedar River. The staff's review regarding the robustness of these water sources for Phase 2 and 3 are discussed above in Section 3.10.1 of this evaluation.

3.10.3 Containment Cooling In the FIP, Sections 3.4.1 and 3.4.2 indicate that as containment temperatures and pressures slowly increase it will become necessary to open the HCVS suppression pool vent as directed by plant procedures and that no additional strategies are required for Phase 2 other than replenishing the electrical supply to repower the HCVS uninterruptable power supply. In the FIP, Sections 3.4.4.1.1 and 3.4.4.3 indicate that no water source other than the suppression pool along with water injected in the reactor vessel from the circulating water storage pit are relied upon to maintain the containment parameters within limits. The NRC staff's review of the licensee's ability to maintain containment parameters are documented above in Sections 3.4.4.1.1 and 3.4.4.1.2 of this evaluation .

3.10.4 Conclusions Based on the evaluation above, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain satisfactory water sources following a BDBEE consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01 , and shoul? adequately address the requirements of the order.

3.11 Shutdown and Refueling Analyses Order EA-12-049 requires that licensees must be capable of implementing the mitigation strategies in all modes. In general , the discussion above focuses on an ELAP occurring during power operations. This is appropriate, as plants typically operate at power for 90 percent or more of the year. When the ELAP occurs with the plant at power, the mitigation strategy initially focuses on the use of the steam-driven RCIC pump to provide the water initially needed for decay heat removal. If the plant has been shut down and all or most of the fuel has been removed from the RPV and placed in the SFP, there may be a shorter timeline to implement the

makeup of water to the SFP. However, this is balanced by the fact that if immediate cooling is not required for the fuel in the reactor vessel , the operators can concentrate on providing makeup to the SFP. The licensee's analysis shows that following a full core offload to the SFP, about 45 hours5.208333e-4 days 0.0125 hours 7.440476e-5 weeks 1.71225e-5 months are available to implement makeup before boil-off results in the water level in the SFP dropping far enough to uncover fuel assemblies, and the licensee has stated that they have the ability to implement makeup to the SFP within that time .

When a plant is in a shutdown mode in which steam is not available to operate a steam-powered pump such as RCIC (which .typically occurs when the RPV has been cooled below about 300 °F) , another strategy must be used for decay heat removal. The NRG-endorsed strategy is described in NEI 12-06. Section 3.2.3 provides guidance to licensees for reducing shutdown risk by incorporating FLEX equipment in the shutdown risk process and procedures.

Considerations in the shutdown risk assessment process include maintaining necessary FLEX equipment readily available and potentially pre-deploying or pre-staging equipment to support maintaining or restoring key safety functions in the event of a loss of shutdown cooling. In its FIP, the licensee stated that it would follow this guidance. During the audit process, the NRC staff observed that the licensee had made progress in implementing this guidance.

Based on the licensee's incorporation of the use of FLEX equipment in the shutdown risk process and procedures, the NRC staff concludes that the licensee has developed guidance that, if implemented appropriately, should maintain or restore core cooling , SFP cooling , and containment following a BDBEE in shutdown and refueling modes consistent with NEI 12-06 guidance, as endorsed by JLD-ISG-2012-01 , and should adequately address the requirements of the order.

3.12 Procedures and Training 3.12.1 Procedures In its FIP, the licensee stated that the operators will respond to a loss of ac power using procedure AOP 301 .1, and a loss of normal access to the ultimate heat sink without ac power using procedure AOP 410. Emergency operating procedures (EOPs) cover key plant safety response actions, however, response to external events is described in abnormal operating procedures (AOPs) for earthquake, flooding and adverse weather events. The FSGs detailing how to use portable equipment to support the higher tier procedures (e.g., AOP 301.1) are implemented at Duane Arnold via an existing category of procedures called severe accident management procedures (SAMPs). The SAMPs can be used at any time when directed by the emergency coordinator when the design bases of the plant are challenged due to external events.

The FSGs (SAMPs) were designed with regard to off-normal conditions such as reduced instrumentation , loss of normal lighting , lack of normal ventilation and hampered communications , which is consistent with the BWROG guidelines. In addition, the licensee stated that validation and verification were conducted to ensure FLEX strategies will be able to be implemented with minimal potential for personnel error. Lastly, the licensee stated that environmental factors and conditions such as inclement weather and darkness were considered for the deployment and operation of FLEX equipment. For example, human factor aids (labeling , color coding , placarding, etc.) limit the impact of darkness.

12.2 Training In its FIP, the licensee stated that initial training has been provided and periodic training will be provided to site emergency response leaders on beyond-design-basis emergency response strategies and implementing guidelines. In addition, personnel assigned to the direct execution of mitigation strategies for BDBEEs have received the necessary training to ensure familiarity with the associated tasks, instructions, and mitigating strategy time constraints. The training plan development was done in accordance with the Systematic Approach to Training (SAT).

3.12.3 Conclusions Based on the description above, the NRG staff concludes that the licensee has adequately addressed the procedures and training associated with FLEX. The procedures have been issued in accordance with NEI 12-06, Section 11.4, and a training program has been established and will be maintained in accordance with NEI 12-06, Section 11 .6.

3.13 Maintenance and Testing of FLEX Equipment As a generic issue, NEI submitted a letter dated October 3, 2013 (ADAMS Accession No. ML13276A573), which included EPRI Technical Report 3002000623, "Nuclear Maintenance Applications Center: Preventive Maintenance Basis for FLEX Equipment." In a letter dated October 7, 2013 (ADAMS Accession No. ML13276A224), the NRG endorsed the use of the EPRI report and the EPRI database as providing a useful input for licensees to use in developing their maintenance and testing programs. Preventative maintenance templates for the major FLEX equipment have also been issued.

In its FIP, the licensee stated that Duane Arnold will maintain the onsite FLEX equipment with preventive maintenance and testing based on the generic EPRI industry program for maintenance and testing of FLEX equipment, as endorsed by the NRG staff on October 7, 2013.

The generic guidance has been incorporated in NextEra fleet procedures and site specific preventive maintenance tasks are specified consistent with the EPRI guidance Based on the use of the endorsed program, which establishes and maintains a maintenance and testing program in accordance with NEI 12-06, Section 11 .5, the NRG staff concludes that the licensee appears to have adequately addressed equipment maintenance and testing activities associated with FLEX equipment.

3.14 Conclusions for Order EA-12-049 Based on the evaluations above, the NRG staff concludes that the licensee has developed guidance to maintain or restore core cooling , SFP cooling , and containment following a BDBEE which , if implemented appropriately, should adequately address the requirements of Order EA-12-049.

4.0 TECHNICAL EVALUATION

OF ORDER EA-12-051 By letter dated February 28, 2013 (ADAMS Accession No. ML13063A014), the licensee submitted its 01 P for Duane Arnold in response to Order EA-12-051 . By letter dated September 16, 2013 (ADAMS Accession No. ML13255A198), the NRC staff sent a request for additional information (RAI) to the licensee. The licensee provided a response by letter dated October 10, 2013 (ADAMS Accession No. ML13284A122). By letter dated November 26, 2013 (ADAMS Accession No. ML13323B443), the NRC staff issued an ISE and RAI to the licensee.

By letters dated August 27, 2013 (ADAMS Accession No. ML13242A008), February 24, 2014 (ADAMS Accession No. ML14063A066), August 25, 2014 (ADAMS Accession No. ML14239A494), February 16, 2015 (ADAMS Accession No. ML15050A039) , August 27, 2015 (ADAMS Accession No. ML15243A033) , February 29, 2016 (ADAMS Accession No. ML16064A022), and August 31 , 2016 (ADAMS Accession No. ML16246A009), the licensee submitted status reports for the integrated plan and the RAI in the ISE. The integrated plan describes the strategies and guidance to be implemented by the licensee for the installation of reliable SFPLI which will function following a BDBEE, including modifications necessary to support this implementation , pursuant to Order EA-12-051. By letter dated December 8, 2016 (ADAMS Accession No. ML17130A796) the licensee reported that full compliance with the requirements of Order EA-12-051 was achieved.

The licensee has installed a SFP level instrument system designed by Westinghouse , LLC . The NRC staff reviewed the vendor's SFPLI system design specifications, calculations and analyses, test plans, and test reports. The NRC staff issued an audit report on August 18, 2014 (ADAMS Accession No. ML14211A346) .

The staff performed an onsite audit to review the implementation of SFPLI related to Order EA-12-051. The scope of the audit included verification of (a) site's seismic and environmental conditions enveloped by the equipment qualifications, (b) equipment installation met the requirements and vendor's recommendations, and (c) program features met the requirements .

By letter dated August 29, 2016 (ADAMS Accession No. ML16217A157) , the NRC issued an audit report on the licensee's progress. Refer to Section 2.2 above for the regulatory background for this section.

4.1 Levels of Required Monitoring In its OIP, the licensee identified the SFP levels of monitoring as follows :

Level 1 corresponds to the 853'-8" plant elevation

Level 2 corresponds to the 841 '-5" plant elevation

Level 3 corresponds to the 831 '-5" plant elevation In its letter dated October 10, 2013, the licensee provided a sketch depicting the SFP levels of monitoring and the measurement range for the instrument channels as illustrated below in Figure 1, "Duane Arnold SFP Levels of Monitoring".

.--------------~'.:" TO ELECT ROt~l CS 11 I 11 I,.....__..___._,

r !

SEI SMIC 1 MOU /\IT ING BRACKE T OPER1Hl NG DEO: = 8 55' - 0" NOR MAL \!.'AT ER L EVEL :: 854'- (j)

NO Mt NAL TOP OF MEASUREMENT RANGE L EVEL 1 = 853'-8" lVALUE ABOVE NORMAL WtLL ---~---------- - -- - ---------------

BE E ST ABL I S HED IN DE TAILED DESIGN P HA5El SE NSOR ACTIVE MEA SURE MENT RANGE L E'IEL 2 a 941' -5 "

BOTTOM OF MEASUREMEN T Ri:i;.JGE CAPPROXINAT EL Y 6 "

BELOW LEVEL 3)

LEVEL 3 !TOP OF FUEL RA Cl~ l = 831 ' -5"

- -- ~ --- ---- - ---------- - - - -- - ----- -

Figure 1 - Duane Arnold SFP Levels of Monitoring Per NEI 12-02, Section 2.3.1, Level 1 will be the higher of two points. The first point is the water level at which suction loss occurs due to uncovering of the spent fuel cooling system inlet pipe, weir or vacuum breaker. The second point is the water level at which loss of spent fuel cooling pump NPSH occurs under saturated conditions. Duane Arnold designated Level 1 (853'-8")

based on the normal water level in the SFP. According to the licensee, this water level is above the SFP weir wall elevation that is needed to ensure adequate SFP cooling flow. Duane Arnold's Level 1 is the higher of the above two points, and therefore, appears consistent with NEI 12-02. Level 2 was identified by the licensee as elevation 841 '-5". This level is consistent with the first of the two options described in NEI 12-02 for Level 2, which is 10 ft. (+/- 1 foot) above the highest point of any fuel rack seated in the SFP. Level 3 appears to be consistent with NEI 12-02 Level 3, which is the highest point of any fuel rack seated in the SFP.

Based on the evaluation above, the NRC staff concludes that the licensee's selection of Levels 1, 2 and 3 appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2 Evaluation of Design Features Order EA-12-051 requires that the SFPLI shall include specific design features , including specifications on the instruments, arrangement, mounting, qualification , independence, power supplies, accuracy, testing , and display. Refer to Section 2.2 above for the requirements of the order in regards to the design features. Below is the NRC staff's assessment of the design features of the SFPLI.

4.2.1 Design Features: Instruments Regarding the SFP level instrument design, in its OIP, the licensee stated that the primary and backup instrument channels will consist of fixed components and that both channels will utilize guided wave radar, which functions according to the principle of time domain reflectometry. A generated pulse of electromagnetic energy travels down the probe. Upon reaching the liquid surface, the pulse is reflected and, based upon reflection times, level is inferred. Related to the SFP level instrument range, in its OIP, the licensee stated that the measured range will be continuous from the normal pool level elevation (853'-8") to the top of the spent fuel racks at elevation (831 '-5"). The NRC staff noted that the measurement range will cover Levels 1, 2, and 3, as described in Section 4.1 above.

The NRC staff concludes that the licensee's design , with respect to the number of SFP instrument channels and measurement range, appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.2 Design Features: Arrangement Regarding the SFP level instrument arrangement, in its OIP, the licensee stated that the two SFP level instrument channels will be installed in diverse locations, arranged in a manner that provides reasonable protection of the level indication function against missiles that may result from damage to the structure over the SFP. The SFP level sensors will be installed in the north side of the SFP. Sensor conditioning electronics and battery backup will be located in the control building, which is a Class 1 structure that provides protection from all external natural events as defined in NEI 12-06. In addition, the licensee stated that cabling for power supplies and indications for each channel will be routed in separate conduits from the cabling for the adjacent channel.

In its letter dated December 8, 2016, the licensee further stated that the SFP level sensors have been located in opposite corners of the pool and cable routes have been kept independent and separated by at least the shortest length of the pool (20'-0"). In the same letter, the licensee provided a sketch depicting the locations of the level sensors. The primary channel sensor is located near the southeast corner of the pool , and the secondary (backup) channel sensor is located near the northwest corner of the pool.

The NRC staff noted, with verification by walkdown during the onsite audit, that there appears to be sufficient channel separation between the primary and backup level instrument channels, sensor electronics, and routing cables to provide protection against loss of SFP level indication due to missiles that may result from damage to the structure over the SFP.

Based on the evaluation above, the NRC staff concludes that the licensee's arrangement for the SFPLI , if implemented appropriately, appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.3 Design Features: Mounting With regard to the mounting design of the SFPLI , in its OIP, the licensee stated that the mounting of the SFPLI will be seismic Class 1. In its letter dated December 8, 2016, the licensee further stated that the vendor, Westinghouse , has evaluated the structural integrity of the pool-side mounting brackets in calculation CN-PEUS-15-09, "Seismic Analysis of the SFP Primary and Backup Mounting Bracket at Duane Arnold Energy Center." Other brackets were subjected to testing. The GTSTRUDL model , used by Westinghouse to calculate the stresses in the bracket assembly, considers load combinations for the dead load, live load and seismic load on the bracket. The reactionary forces calculated from these loads become the design inputs to design the mounting bracket anchorage to the refuel floor. In addition , the licensee stated that Duane Arnold specific calculation CAL-C15-004, "Evaluation of SFPIS Mounting Bracket Anchorage ," addresses the seismic qualification of the SFPIS equipment mounting to the reactor building in the SFP. The design input uses loads taken from CN-PEUS-15-09, with an additional amplification factor for conservatism. Plate stresses, anchor forces, and welded stud forces are determined using APLAN [attachment plate analysis] for comparison to code allowables.

As for potential hydrodynamic effects on the SFP level probes, in the same letter above, the licensee stated that sloshing forces were obtained by analysis. The TID-7024, Nuclear Reactors and Earthquakes, 1963, by the US Atomic Energy Commission , approach has been used to estimate the wave height and water natural frequency. Horizontal and vertical sloshing force on the bracket components resulting from the water waves was calculated using the wave height and natural frequency. Using this methodology, sloshing forces have been calculated and added to the total reactionary forces that would be applicable for bracket anchorage design.

Reliable operation of the level measurement sensor with a submerged interconnecting cable has been demonstrated by analysis of previous Westinghouse testing of the cable , and the vendor's cable qualification . The following Westinghouse documents provide information with respect to the design criteria used, and a description of the methodology used to estimate the total loading on the device.

CN-PEUS-15 Pool-Side Bracket Seismic Analysis

WNA-TR-03149-GEN - Sloshing Analysis

EQ-QR-269, WNA-TR-03149-GEN , EQ-TP-353- Seismic Qualification of Other Components of SFPI For the mounting design of the SFP level instrument electronics, in its letter dated December 8, 2016, the licensee stated that the SFPLI system equipment (including enclosure panels, boxes, conduits , and instruments) is mounted to the reactor building and control building. Both of these buildings are classified as seismic Category 1 structures. New electronics enclosure panels are installed in the control room. Five panels are mounted to a labyrinth wall near the southwest entrance to the control room and one is mounted to the south masonry wall. The loads imposed on the 2' thick concrete wall by the enclosure weights (approximately 460 pounds total) are insignificant compared to the capacity of the wall. The south masonry wall is evaluated in a revision to calculation CAL-239-664-006, "Re-Evaluation of Wall C-665-6 A-E." Plant seismic

spectra are applied to the dead weight of the enclosure panel to determine the added loading to the wall. Existing load is considered and checked against the capacity of the wall to determine adequacy. Related to the SFP level instrument conduit supports, in the same letter above, the licensee stated that per engineering change EC 283472, all components associated with the SFPLI are required to be seismically mounted. Installation of the conduit and conduit supports is per BECH-E503, which meets the seismic requirements.

The NRC staff noted that the licensee adequately addressed the design criteria and methodology used to estimate and test the total loading on the mounting devices, including the design basis maximum seismic loads and the hydrodynamic loads that could result from pool sloshing. The site-specific seismic analyses demonstrated that the SFPLl 's mounting design is satisfactory to allow the instrument to function per design following the maximum seismic ground motion. The assumptions, analytical, and model used in the sloshing analysis for the sensor mounting bracket are adequate. The NRC staff also noted that the licensee adequately addressed the design inputs and methodology used to qualify the structural integrity of the affected plant structures.

Based on the evaluation above, the NRC staff concludes that the licensee's proposed mounting design appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.4 Design Features: Qualification 4.2.4.1 Augmented Quality Process Appendix A-1 of the guidance in NEI 12-02 describes a quality assurance process for non-safety systems and equipment that are not already covered by existing quality assurance requirements. In JLD-ISG-2012-03, the NRC staff found the use of this quality assurance process to be an acceptable means of meeting the augmented quality requirements of Order EA-12-051 .

In its OIP, the licensee stated that augmented quality requirements, similar to those applied to fire protection , will be applied to this project.

The NRC staff concludes that, if implemented appropriately, this approach appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.4.2 Instrument Channel Reliability Section 3.4 of NEI 12-02 states, in part:

The instrument channel reliability shall be demonstrated via an appropriate combination of design, analyses, operating experience, and/or testing of channel components for the following sets of parameters, as described in the paragraphs below:

conditions in the area of instrument channel component use for all instrument components,

effects of shock and vibration on instrument channel components used during any applicable event for only installed components , and

seismic effects on instrument channel components used during and following a potential seismic event for only installed components .

Equipment reliability performance testing was performed by the vendor to (1) demonstrate that the SFP instrumentation will not experience failures during BOB conditions of temperature, humidity, emissions, surge, and radiation , and (2) to verify those tests envelop the plant-specific requirements.

During the vendor audit, the NRC staff reviewed the Westinghouse SFPLl 's qualifications and testing for temperature, humidity, radiation , shock and vibration , seismic, and electromagnetic compatibility (EMC). The NRC staff further reviewed the anticipated Duane Arnold's seismic, radiation , and environmental conditions during the on-site audit. Below is the staff's assessment of the equipment reliability of Duane Arnold SFPLI .

4.2.4.2.1 Temperature, Humidity, and Radiation Regarding the BOB environmental and radiological conditions in the Duane Arnold SFP area related to the SFP level instrument qualifications, in its letter dated December 8, 2016, the licensee stated that for BOB environment, Westinghouse qualified the probe, connector, and cable located in the SFP area to the BOB environment. These components were subjected to BOB conditions of heat and humidity, thermal and radiation aging mechanisms. The testing confirmed functionality of these system components under these BOB environmental conditions.

Westinghouse performed testing to ensure aging of the components in the SFP area will not have a significant effect on the ability of the equipment to perform following a plant design basis earthquake. In addition, the licensee provided Duane Arnold's radiological and environmental conditions in the SFP area and the equipment's design limits, as described below in Table 1, "Equipment Qualifications vs . Radiological and Environmental Conditions in SFP Area."

Table 1 - Equipment Qualifications vs. Radiological and Environmental Conditions in SFP Area WEC Specified Component EQ Limits (Inside SFP) DAEC R.B. , el. 855', Refuel Floor Environmental Conditions (QUAL-SC101 Rev.16)

Description Normal BOB (Post Event) Normal Accident (Max.)

Temperature 50-140 °F 212 °F 68/110 °F 112 °F Humidity 0-95% Relative 100% Saturated 20190 % 100 %

Humidity (RH) Steam Radiation Total 1E03 Ry 1E07 Ry 3.2E03 Ry 6.4E04 R y (after Integrated (after 7 days) 30 days)

Dose (TIO}

(above pool)

Radiation TIO s 1E09 Ry (only 1E07 Ry (only N/A 1.6E06 Ry (SFP water at probes stainless probe's stainless (after 7 days) Per Level 3) steel cable and steel cable and Report SL-weight are exposed weight are exposed 012387, Rev.O}

for the period) for 7 days)

The NRC staff noted that the Westinghouse equipment's design limits envelop the Duane Arnold SFP area's expected radiological and environmental conditions.

As for the environmental and radiological conditions outside of the SFP area related to the SFP level instrument qualifications, in its letter dated December 8, 2016, the licensee stated that the components installed outside of the SFP are qualified to operate reliably per the service environmental conditions specified for a non-harsh environment. These components are the level sensor electronics, the sensor electronics enclosures and enclosure mounting brackets. In addition, the licensee provided Duane Arnold's radiological and environmental conditions outside the SFP area and the equipment's design limits, as described below in Table 2, "Equipment Qualifications vs. Radiological and Environmental Conditions outside SFP Area."

Table 2 - Equipment Qualifications vs. Radiological and Environmental Conditions outside SFP Area WEC Specified Component EQ Limits (Outside SFP) DAEC C.B. , el. 786', Control Room Environmental Conditions (QUAL-SC101 Rev.16)

Description Normal BOB (Post Event) Normal Accident (Max.)

Temperature 50-120 °F 140 °F 75 °F 75 °F Humidity 0-95% RH 0-100% (non-condensing) 50 % 50 %

0-95% (non-condensing) for Sensor Electronics Radiation Tl D ::; 1E03 Ry ::; 1E03 Ry 2.7E02 Ry 8.2EOO R y (after (after 7 days) 30 days)

The NRC staff noted that the Westinghouse equipment's design limits envelop the Duane Arnold control room 's expected radiological and environmental conditions .

The NRC staff concludes that the licensee appears to have adequately addressed the equipment reliability of SFPLI with respect to temperature , humidity arid radiation. In addition ,

the equipment qualifications appear to envelop the expected Duane Arnold's anticipated conditions of radiation , temperature , and humidity during a postulated BDBEE and post event.

The equipment environmental testing demonstrated that the SFP instrumentation should maintain its functionality under expected BOB conditions .

4.2.4.2.2 Shock and Vibration Regarding the SFP level instrument's shock and vibration qualification, in its letter dated December 8, 2016, the licensee stated that the SFPIS pool side brackets for both the primary and backup Westinghouse SFP measurement channels will be permanently installed and fixed to rigid refuel floors, which are seismic Category 1 structures. The SFPI system components, such as level sensor and its bracket, display enclosure and its bracket, were subjected to seismic testing. Results were consistent with the anticipated shock and vibration expected to be seen by permanently mounted equipment.

The NRC staff noted that the licensee appears to have adequately addressed the equipment reliability of SFPLI with respect to shock and vibration .

4.2.4.2.3 Seismic For the SFP level instrument design with respect to seismic qualification , in its letter dated December 8, 2016, the licensee stated, in part, that the SFPLI system is designed in accordance with requirements that envelope the Duane Arnold DBE [design-basis earthquake].

The OBE [operating basis earthquake] loads are obtained from Duane Arnold's response spectra and multiplied by a 2.4 factor to obtain the DBE loads in accordance with the plant design basis requirements. The following methodology was used in determining the stresses on the bracket assembly:

Frequency analysis of the structure is performed to obtain the natural frequencies of the structure for all modes of excitation.

SSE response spectra analysis is performed to obtain member stresses and support reactions .

Modal responses are combined using the Ten Percent Method per U.S. NRC Regulatory Guide 1.92, Revision 1, "Combining Modal Responses and Spatial Components in Seismic Response Analysis ." This method is endorsed by the UFSAR for Duane Arnold .

The seismic loads for each of the three directions are combined using the absolute sum method as required in Chapter 3.7 of the Duane Arnold UFSAR.

Sloshing analysis is performed to obtain water pressure resulting from a DBE event and its impact on bracket design .

The stresses resulting from seismic loads are combined with those from the dead load and the hydrodynamic loads in absolute sum. These combined stresses for each component of the structure are compared with the allowable stress values from the Duane Arnold applicable code of record .

The NRC staff noted that the licensee appears to have adequately addressed the design inputs and methodology used to design the SFP level instrument with respect to seismic qualification .

The SFP level instrument was tested to the seismic conditions that envelop the Duane Arnold expected DBE. Further seismic qualifications of the SFPLI mounting is addressed in Subsection 4.2.3, "Design Features: Mounting," of this evaluation.

4.2.4.2.4 Depending on the installation configurations, Westinghouse provided two types of SFP cable connectors , a straight connector or a 90-degree connector. Both of them originally were qualified for 15-month life. Westinghouse performed the life-upgrade tests for both straight and 90-degree cable connectors. The tests include radiation aging, thermal aging *and steam tests. While the 90-degree connector passed the initial tests, the straight connector failed the steam test due to leakage caused by the sealant around the connector. The Westinghouse solution was to encapsulate the exposed epoxy of the connector with raychem boots. The.

straight connector modification eventually passed the aging tests.

During the onsite audit, the NRC staff learned that Duane Arnold utilizes the 90-degree connectors at the SFP level probes (pool side) . Since modification is required only for the

straight connector if it is installed at the pool side, which is not applicable to Duane Arnold , the NRC staff found the design of cable connector at Duane Arnold adequate.

4.2.4.2.5 Electromagnetic Compatibility As a result of the NRC staff's evaluation of the EMC testing results during the vendor audit, the staff identified a generic open item applicable to all licensees using Westinghouse SFP level instrument to identify any additional measures, site-specific installation instructions or position taken to address the potential effect of an EMC event on the SFPI equipment. During the onsite audit, the NRC staff enquired as to an assessment of potential susceptibilities of electromagnetic interference/radio frequency interference (EMl/RFI) in the areas where the SFP instruments are located and how to mitigate those susceptibilities.

In its letter dated December 8, 2016, the licensee stated that the SFPLI electronics enclosure panels are located in the control room , a location where the enclosures are not subject to the use of hand held radios , thereby eliminating the potential for radio interference. The NRC staff concludes that the licensee appears to have adequately addressed the staff's concern with regard to electromagnetic compatibility of the SFPLI. Installing the SFP level instrument electronics in the control room will provide preventive measure for EMl/RFI susceptibilities.

In conclusion of the staff's assessment of the equipment reliability, the NRC staff concludes that the licensee's proposed instrument qualification process appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.5 Design Features: Independence Regarding the SFP level instrument channel's physical independence, in its letter dated December 8, 2016, the licensee stated that the primary and secondary instrument channels are mounted in opposite corners of the SFP to provide reasonable protection against missiles within the refuel floor area. Similarly, signal cables are routed independently and a distance of at least the shortest length of the SFP (20'-0") is maintained between signal channels within the reactor building. Independent instrument transmitters, level indicators and electronic enclosures for the two channels are mounted seismically in the control room behind the control panels. The two channels are completely independent and the transmitter and electronic enclosures are physically and spatially separated. Signal cables for each channel are routed in separate conduits and separation of these conduits are maintained.

For the SFP level instrument channel's electrical independence, in its letter dated December 8, 2016, the licensee stated that two independent power sources will be used for powering the new SFP instrumentation system. Existing branch circuit 24 in panel 1Y11 and branch circuit 23 in panel 1Y21 will be used to power the level instruments. Panels 1Y11 and 1Y21 are alternate divisions of the instrument ac power supply and the loss of one of these distribution panels will not result in the loss of both channels.

The NRC staff noted, and verified during the onsite walkdown , that the licensee appears to have adequately addressed the SFP level instrument channel independence. The instrument channels' physical separation are further discussed in Section 4.2.2, "Design Features:

Arrangement," of th is evaluation. With the licensee's proposed design, the loss of one level instrument channel would not affect the operation of the other channel under BDBEE conditions .

The staff concludes that the licensee's proposed design , with respect to instrument channel

independence, appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.6 Design Features: Power Supplies Related to the SFP level instrument power supplies, in its letter dated December 8, 2016, the licensee stated that two independent power sources will be used for powering and charging the batteries of the new SFP instrumentation system. As stated above, existing branch circuit 24 in panel 1Y11 and branch circuit 23 in panel 1Y21 will be used to power the level instruments.

Panels 1Y11 and 1Y21 are alternate divisions of the instrument ac power supply system and the loss of one of these distribution panels will not result in the loss of both channels. During a BDBEE, each channel has an independent 26-amp-hr battery system which will supply the level instrument channel with at least 3 days of power. Repowering of 1Y11 and 1Y21 via portable DGs will be included in the FLEX coping strategies.

As for the instrument battery's duty cycle , in its letter dated December 8, 2016, the licensee stated that the Westinghouse report WNA-CN-00300-GEN , "Spent Fuel Pool Instrumentation System Power Consumption Calculation ," provides the results of the calculation depicting the battery backup duty cycle. This calculation demonstrates that level indication for both channels is maintained for approximately 4.22 days after ac power to the instruments is lost. The results of the calculation demonstrate battery capacity is sufficient to maintain level indication function until offsite resources are available.

The NRC staff concludes that the licensee's proposed power supply design appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.7 Design Features: Accuracy Regarding the SFP level instrument's accuracy design , in its letter dated December 8, 2016, the licensee stated that the Westinghouse documents WNA-CN-00301 and WNA-DS-02957-GEN describe the channel accuracy under both (a) normal SFP level conditions and (b) at the BOB conditions that would be present if SFP level were at Level 2 and Level 3. Each instrument channel will be accurate to within +/-3" during normal SFP level conditions . The instrument channels will retain this accuracy after BOB conditions, in accordance with the above Westinghouse documents. This value is within the channel accuracy requirements of the Order

(+/-1 foot) . In addition , the licensee stated that the Westinghouse document WNA-TP-04709-GEN describes the methodology for routine testing/calibration verification and calibration methodology. This document also specifies the required accuracy criteria under normal operating conditions .

The NRC staff concludes that the licensee's proposed instrument accuracy appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.8 Design Features: Testing In its letter dated December 8, 2016, the licensee described the SFP level instrument's capability of periodic testing and calibration. In this letter, the licensee stated that Westinghouse calibration procedure WNA-TP-04709-GEN , functional test procedure WNA-TP-04752-GEN ,

and factory acceptance procedure WNA-TP-05246-GEN describe the capabilities and

provisions of SFPI periodic testing and calibration , including in-situ testing . Duane Arnold will utilize the Westinghouse calibration procedure for the functional check at the pool side bracket.

The NRC staff concludes that the licensee's proposed SFP instrumentation design that allows for testing and calibration , including functional test and channel check, appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.2.9 Design Features: Display Regarding the SFP level instrument display, in its letter dated December 8, 2016, the licensee stated that the primary and backup level instrument displays are located in the Southwest corner of the control room behind the control board panels. The indicators are located on the 1C985 and 1C986 electronics enclosures in the control room. Personnel will be stationed in the control room during a BDBEE such that the displays are in a habitable environment, will be readily accessible and will be monitored periodically.

The NRC staff noted that the NEI 12-02 guidance for display specifically mentions the control room as an acceptable location for SFPLI displays as it is occupied by trained personnel and promptly accessible, outside the area surrounding the SFP, inside a structure providing protection against adverse weather, and outside of any very high radiation areas or locked high radiation area during normal operation.

The NRC staff concludes that the licensee's proposed location and design of the SFPLI displays appear to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.3 Evaluation of Programmatic Controls Order EA-12-051 specified that the SFPI shall be maintained available and reliable through appropriate development and implementation programmatic controls , including training ,

procedures, and testing and calibration. Below is the NRC staff's assessment of the programmatic controls for the SFPI.

4.3.1 Programmatic Controls: Training In its OIP, the licensee stated that SAT will be used to identify the population to be trained and to determine both the initial and continuing elements of the required training. Training will be completed prior to placing the instrumentation in service.

Guidance document NEI 12-02 specifies that the SAT process can be used to identify the population to be trained , and also to determine both the initial and continuing elements of the required training. The NRC staff concludes that the licensee's plan to train personnel in the operation , maintenance, calibration , and surveillance of the SFPLI , including the approach to identify the population to be trained , appears to be consistent with NEI 12-02 guidance, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.3.2 Programmatic Controls: Procedures Regarding Duane Arnold procedures related to the SFPLI , in its letter dated December 8, 2016, the licensee stated that the modification review process was used to ensure all necessary

procedures were developed for maintaining and operating the installed SFP level instruments.

These procedures were developed in accordance with the NextEra procedural control process.

The objectives of each procedural area are described below:

Inspection, Calibration, and Testing - Guidance on the performance of periodic inspections, as well as calibration and testing, to ensure that each SFP channel is operating and indicating level within its design accuracy.

Preventative Maintenance - Guidance on scheduling of, and performing, appropriate preventative maintenance activities necessary to maintain the instruments in a reliable condition.

Maintenance - To specify troubleshooting and repair activities necessary to address system malfunctions.

Programmatic controls - Guidance on actions to be taken if one or more channels are out of service.

System Operations - To provide instructions for operation and use of the system by plant staff.

Response to inadequate levels - Action to be taken on observations of levels below normal level have been addressed in site off normal procedures and/or FLEX support guidelines.

In addition, the licensee listed the following procedures related to the SFPLI system that have been developed:

01317.1 , 120 VAC Instrument Control Power System - Normal operating procedure for the SFPLI

STP 3.0.0-01 , Instrument Checks - Includes SFPLI channel check

1.Ll-W120-001, FLEX-Fuel Pool Level Instrument Loop Calibration - Includes calibration verification and battery replacement activities

AOP 317, Loss of 120 VAC Instrument Control Power - Abnormal operating procedure for the SFPLI power supply

SAMP 722, FLEX Repowering Battery Chargers from FLEX 480 VAC DG -

Repowering the battery chargers will allow the Instrument ac panels to be repowered

SAMP 723, FLEX Repowering MCC 1832 from a FLEX 480 VAC Portable Diesel Generator - Repowering 1832 allows Instrument ac panel 1Y11 to be repowered (for one of the SFPLI channels)

SAMP 725, FLEX Alternate Power to Instrument AC - Repowers instrument ac panels

The NRC staff noted that the licensee appears to have adequately addressed the SFP level instrument procedure requirements. The procedures were established for the testing ,

surveillance, cal ibration, operation , and abnormal responses for the primary and backup SFP level instrument channels. The NRC staff concludes that the licensee's proposed procedures appear to be consistent with NEI 12-02, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.3.3 Programmatic Controls: Testing and Calibration In its letter dated December 8, 2016, the licensee described testing and calibration programs for the SFPLI. In th is letter, the licensee stated that SFPI channel/equipment maintenance/preventative maintenance and testing program requirements to ensure design and system readiness were established in accordance with NextEra's processes and procedures.

The design modification process considered the vendor recommendations to ensure that appropriate regular testing , channel checks, functional tests , periodic calibration , and maintenance are performed .

Additionally, in the same letter above, the licensee described the testing program for the SFP level instrument functional check, channel check, and periodic calibration as below:

Functional Check - Duane Arnold will utilize the Westinghouse calibration procedure for the functional check at the pool side bracket. Functional checks will be performed per Westinghouse calibration procedure WNATP-04709-GEN and Duane Arnold procedure l.Ll-W120-001 at the Westinghouse recommended frequency.

Channel Check - The level displayed by the channels will be verified per the Duane Arnold surveillance test procedure (STP} 3.0.0-1 , "Instrument Checks," as recommended by Westinghouse vendor technical manual WNA-G0-00127-GEN . If the level is not within the required accuracy per Westinghouse recommended tolerance in WNA-TP-04709-GEN , channel calibration will be performed.

Periodic Calibration - Tests will be performed per Westinghouse calibration procedure WNA-TP-04709-GEN at the Westinghouse recommended frequency.

Regarding Duane Arnold's preventive maintenance program related to the SFPLI , in its letter dated December 8, 2016, the licensee stated that Duane Arnold has developed preventive maintenance tasks for the SFPI per Westinghouse recommendation identified in the technical manual WNA-G0-00127-GEN. These tasks ensures that the channels are fully conditioned to accurately and reliably perform their functions when needed. Duane Arnold procedure 1. Ll-W120-001 , "FLEX - Fuel Pool Level Instrument Loop Calibration ," provides instructions, steps, and data necessary to perform a calibration verification . This procedure is normally performed within 60 days of a planned refueling outage, but it is not required to be performed more than once in a 12-month period. The procedure also provides guidance on battery replacement activities. The battery replacement interval is every 36 months or 3 years.

As for the compensatory measures for the SFP level instrument channel(s) out-of-service, in its letter dated December 8, 2016, the licensee stated that fleet procedure EN-AA-110, "Diverse and Flexible Coping Strategies (FLEX) Program," includes compensatory actions in the event that SFPLI instrumentation is out-of-service. These compensatory measures are implemented per site administrative control procedure FLEX-AB-100- 1000, "Guidance for FLEX Equipment

When it is Unavailable," as shown below in Table 3, "Compensatory Measures for SFP Level Instrument Channel(s) Out-of-Service."

Table 3 - Compensatory Measures for SFP Level Instrument Channel(s) Out-of-Service CONDITION REQUIRED ACTION COMPLETION TIME A One Spent Fuel A1 Initiate actions to restore 90 days Level Instrument channel to an Available status Unavailable AND A2 Implement actions in Immediately accordance with Note 2 B Both Spent Fuel 81 Initiate actions to restore at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Level Instruments least one channel to an Unavailable Available status AND A2 Implement actions in Immediately accordance with Note 3 Note:

1. Separate condition entry is allowed for each Fuel Pool Level Channel.

2. Initiate an evaluation in accordance with the Corrective Action Program. The evaluation shall determine compensatory actions if a second channel becomes Unavailable. The evaluation shall include a planned schedule for restoring the instrument channel(s) to Available status.

3. Initiate compensatory actions for monitoring wide-range SFP level within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Initiate an evaluation in accordance with the Corrective Action Program. The evaluation shall document compensatory actions taken or planned to be taken to implement an alternate method of monitoring and schedule required actions for restoring the instrumentation channel(s) to Available status.

The NRC staff noted that the licensee appears to have adequately addressed testing and calibration programs to maintain the SFP instrument channels at the design accuracy. The licensee testing and calibration plan appears to be consistent with the vendor recommendations. Additionally, compensatory actions for instrument channel(s) out-of-service appear to be consistent with guidance in NEI 12-02. The staff concludes that the licensee's proposed testing and calibration program appears to be consistent with NEI 12-02, as endorsed by JLD-ISG-2012-03, and should adequately address the requirements of the order.

4.4 Conclusions for Order EA-12-051 In its letter dated December 8, 2016 (ADAMS Accession No. ML17130A796), the licensee stated that they would meet the requirements of Order EA-12-051 by following the guidelines of

NEI 12-02, as endorsed by JLD-ISG-2012-03. In the evaluation above, the NRC staff concludes that, if implemented appropriately, the licensee has conformed to the guidance in NEI 12-02, as endorsed by JLD-ISG-2012-03. In addition, the NRC staff concludes that if the SFPLI is installed at Duane Arnold according to the licensee's proposed design, it should adequately address the requirements of Order EA-12-051 .

5.0 CONCLUSION

In August 2013 the NRC staff started audits of the licensee's progress on Orders EA-12-049 and EA-12-051 . The NRC staff conducted an onsite audit in June 2016 (ADAMS Accession No. ML16217A157). The licensee reached its final compliance date on December 8, 2016, and has declared that Duane Arnold is in compliance with the orders. The purpose of this safety evaluation is to document the strategies and implementation features that the licensee has committed to. Based on the evaluations above, the NRC staff concludes that the licensee has developed guidance and proposed designs that if implemented appropriately should adequately address the requirements of Orders EA-12-049 and EA-12-051 . The NRC staff will conduct an onsite inspection to verify that the licensee has implemented the strategies and equipment to demonstrate compliance with the orders.

Principal Contributors: J. Miller M. McConnell B. Heida

0. Yee K. Nguyen J. Paige Date: May 26, 2017

D. Curtland DUANE ARNOLD ENERGY CENTER - SAFETY EVALUATION REGARDING IMPLEMENTATION OF MITIGATING STRATEGIES AND RELIABLE SPENT FUEL POOL INSTRUMENTATION RELATED TO ORDERS EA-12-049 AND EA-12-051 DATED MAY 26, 2017 DISTAi BUTION:

PUBLIC RidsRgn3MailCenter Resource JOMB R/F SBailey, NRR/JLD RidsNrrDorlLpl3 Resource JBoska, NRR/JLD RidsNrrPMDuaneArnold Resource RidsAcrsAcnw_MailCTR Resource RidsNrrLASLent Resource ADAMS Accession No. ML17129A037 *via email OFFICE NRR/JLD/JOMB/PM NRR/JLD/LA NRR/JLD/JERB/BC* NRR/JLD/JOMB/BC(A)

NAME JPaige Slent SBailey JBoska DATE 5/11 /17 5/ 10/17 5/ 18/17 5/26/17 OFFICIAL AGENCY RECORD

v t e Letter Sequence Approval
CAC:MF1000, (Approved, Closed) CAC:MF1001, (Approved, Closed)
Initiation Request Acceptance... Administration Questions Answers Results Approval Other: ML16217A157, NG-12-0426, NextEra Energy Duane Arnold, Llc'S Initial Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-0, NG-13-0084, NextEra Energy Duane Arnold, Llc'S, Overall Integrated Plan in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-1, NG-13-0324, First Six-Month Status Report in Response to Letter Dated March 12, 2012 Commission Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Instrumentation, NG-13-0328, First Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order No. EA-12-049), NG-14-0061, NextEra Energy Duane Arnold Energy Center, Llc'S Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Orde, NG-14-0068, NextEra Energy Duane Arnold Energy Center, Llc'S Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Reliable Spent Fuel Pool Instrumentation (Order Number EA-12-051), NG-14-0200, Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events (Order Number EA-12-049), NG-14-0203, NextEra Energy Duane Arnold Energy Center, Llc'S Six Month Status Report in Response to March 12, 2012 Commission Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation (Order No. EA-12-051), NG-15-0027, Six Month Status Report in Response to March 12, 2012 Commission Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation (Order Number EA-12-051), NG-15-0032, NextEra Energy Duane Arnold Energy Center, Llc'S Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard Response to March 12, 2012 Commission Order Modifying Licenses with Regard Events (Orde, NG-15-0260, NextEra Energy Duane Arnold Energy Center, Llc'S Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events..., NG-15-0280, Six Month Status Report in Response to March 12, 2012 Commission Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation (Order Number EA-12-051), NG-16-0047, NextEra Energy Duane Arnold Energy Center, LLC Six Month Status Report in Response to March 12, 2012 Commission Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation, NG-16-0049, NextEra Energy Duane Arnold Energy Center, LLC Six Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, NG-16-0168, Six Month Status Report in Response to 03/12/2012 Commission Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation, NG-16-0169, Duane Arnold, Six-Month Status Report in Response to March 12, 2012 Commission Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, NG-16-0217, Notification of Full Compliance with Order EA-12-049 Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events and Submittal of Final Integrated Plan, NG-16-0228, Final Compliance with EA-12-051 Order to Modify Licenses with Regard to Reliable Spent Fuel Pool Instrumentation
MONTHYEAR2015-08-14 [Table View]

ML17129A037

Text

SUBJECT:

Dear Mr. Curtland :

Enclosure:

1.0 INTRODUCTION

2.0 REGULATORY EVALUATION

3.0 TECHNICAL EVALUATION

4.0 TECHNICAL EVALUATION

5.0 CONCLUSION

1.0 INTRODUCTION

2.0 REGULATORY EVALUATION

1.1 Instruments

1.2 Arrangement

1.3 Mounting

1.4 Qualification

1.5 Independence

1.7 Accuracy

1.8 Testing

1.9 Display

2.1 Training

2.2 Procedures

3.0 TECHNICAL EVALUATION

4.0 TECHNICAL EVALUATION

5.0 CONCLUSION

Navigation menu

Search