ML17264A031

Draft Response to Task Interface Agreement 2014-05 to Licensee Oconee Design Analysis for Single Failure/Integration of Class 1E Direct Current Control Cabling in Raceways with High Energy Power Cabling

ML17264A031
Person / Time
Site:	Oconee
Issue date:	09/29/2017
From:	Eric Benner Special Projects and Process Branch
To:	Gody A NRC/RGN-II
Johnston J, 415-1349
Shared Package
ML17264A030	List: ML17264A031 ML17264A032
References
CAC MF4626, CAC MF4627, CAC MF4628
Download: ML17264A031 (69)

Text

Revised Draft September 2017 MEMORANDUM TO: Anthony T. Gody, Director Division of Reactor Safety Region II FROM: Eric J. Benner, Deputy Director Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

SUBJECT:

OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3 - FINAL RESPONSE TO TASK INTERFACE AGREEMENT 2014-05, DESIGN ANALYSIS FOR SINGLE FAILURE AND THE INTEGRATION OF CLASS 1E DIRECT CURRENT CONTROL CABLING IN RACEWAYS WITH HIGH ENERGY POWER CABLING (CAC NOS. MF4626, MF4627, AND MF4628)

By memorandum dated October 16, 2014 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML14290A136), U.S. Nuclear Regulatory Commission (NRC)

Region II requested assistance from the Office of Nuclear Reactor Regulation (NRR) to provide answers to several questions related to the compliance of cable configuration in certain recently installed underground raceways at Oconee Nuclear Station, Units 1, 2, and 3 (ONS), with the ONS licensing basis, design basis, and NRC regulations and requirements. These questions were specifically related to trench 3 and Protected Service Water Modifications discussed in Unresolved Item 05000269/2014007-05, 05000270/2014007-05, 05000287/2014007-05, Potential Unanalyzed Condition Associated with Emergency Power System.

By letters dated May 11 and August 7, 2015 (ADAMS Accession Nos. ML15139A049 and ML15224A370, respectively), Duke Energy Carolinas, LLC (Duke Energy, the licensee),

voluntarily submitted supplemental information to the NRC on the issues associated with Task Interface Agreement (TIA) 2014-05. In addition, in accordance with the NRR TIA Office Instruction, COM-106, Revision 5, Control of Task Interface Agreements (ADAMS Accession No. ML15219A174), on August 2, 2016, the NRC provided the licensee with the draft TIA 2014-05 response (ADAMS Accession No. ML16214A003) for a fact check. The licensees letter dated August 15, 2016, provided its response (ADAMS Accession No. ML16231A451).

Developing a response to this TIA was extremely challenging for many reasons. These include (1) the licensees challenges in accurately maintaining licensing basis documentation that contributed to a lack of specificity in ONSs licensing basis as it pertains to this issue; (2) challenges in establishing a clear regulatory position on the applicability on what constitutes single failure for the modification that was the source of the TIA; (3) efforts to address the CONTACT: Jeanne D. Johnston, NRR/DORL 301-415-1349

A. Gody supplemental information submitted by Duke Energy related to the substantial number of issues raised in the TIA; and (4) determining what constitutes a credible event as it pertains to this cable configuration.

The NRC staff has completed its review of the licensees response dated August 15, 2016, and made a number of clarifying changes in response to the licensees fact check. However, the NRCs overall conclusions in the draft TIA response remain relatively unchanged. The staffs resolution to these comments is provided as an attachment to the enclosed final TIA response.

The NRC staff concludes that the ONS as-modified design does not comply with the licensing bases as it pertains to placing safety related cables in close proximity to high energy non-safety related energy sources in trench 3 and Protected Service Water Modifications discussed in Unresolved Item 05000269/2014007-05, 05000270/2014007-05, 05000287/2014007-05, Potential Unanalyzed Condition Associated with Emergency Power System. Furthermore, the staff is concerned that these modifications may have introduced potential failure modes that were not adequately analyzed. It is recognized by the NRC staff that the licensee has taken a number of actions to address the concerns raised in the TIA. The NRC staff has not yet assessed these actions. However, this TIA response is an important document as it clarifies but does not change the staffs position related to several key aspects of the licensing bases for ONS Units 1, 2, and 3.

Enclosure:

TIA 2014-05 Final Response

FINAL RESPONSE TO TASK INTERFACE AGREEMENT 2014-05, DESIGN BASES AND LICENSING BASIS FOR UNDERGROUND CABLE CONFIGURATIONS DUKE ENERGY CAROLINAS, LLC OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3 DOCKET NOS. 50-269, 50-270, AND 50-287

1.0 INTRODUCTION

By memorandum dated October 16, 2014 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML14290A136), the U.S. Nuclear Regulatory Commission (NRC) Region II office requested the Office of Nuclear Reactor Regulation (NRR) to provide answers to the following Task Interface Agreement (TIA) questions regarding the licensing basis, design basis, and NRC regulations and requirements of the Oconee Nuclear Station (ONS), Units 1, 2, and 3, underground cable configurations, with emphasis on the following subjects:

1. What are the ONS licensing bases, design bases, and NRC regulations and requirements for analyzing electrical failure vulnerabilities (single failure or otherwise) between medium voltage [alternating current (AC)]

power and low voltage [direct current (DC)] circuits, as presented in this TIA?

2. Within [ONSs] licensing basis:

a. Are medium voltage power cables that are intended to provide emergency power to the [reactor protection system/engineered safeguards protection system (RPS/ESPS)] equipment, as well as provide the motive force to the actuated ESPS equipment during a chapter 15 event within the scope of [Institute of Electrical and Electronics Engineers (IEEE) Standard] IEEE-279-1971?

• Must such power cables be considered under Section 3 Design Basis item 7 for transient conditions?

• Must potential multiphase short circuits or ground faults from such power cables be considered under Section 3, Design Basis item 8 for unusual events, etc.?

Enclosure

b. Do 3-phase medium voltage power cables, intended to provide Class 1E[1]

emergency power to the RPS/ESPS equipment, represent interconnecting signal or power cables, as discussed in 4.2 of IEEE-279?

c. Can the timing of electrical failures assumed in analyses be limited to reduce the consequential damage as described in the single failure memo to file (internal memo to file)?

• How is single failure timing applied to the commercial Fant power feeders and the QA-1 power feeders from the [Keowee Hydro Unit generators (KHUs)] to the [protected service water (PSW)] different than the Class 1E power feeders to the CT-4 transformer?

d. Can ONS staff make any distinctions between passive and active electrical single failures as described in the single failure memo to file?

e. Is the ONS staff required to analyze for combinations of multi-phase short circuits, as well as ground faults within trench 3 in order to be compliant with the regulations and/or the current licensing basis for ONS?

f. Is the licensee required to analyze for consequential damage from electrical failures to the adjacent Class 1E safety systems?

• Is the licensee required to assume that AC circuits could short to DC circuits?

• If so, are the installed ONS 125 [Volts direct current (Vdc)] protective devices sufficient to mitigate the effects of AC voltages ranging from 2.5 [kiloVolt alternating current (kVac)] to 13.8kVac to prevent these voltages from propagating throughout the DC systems?

g. Are all commercial, non-quality related (i.e., not QA-1 or QA-5) electrical components assumed to fail in the most limiting way possible?

• Does the failure of one of these commercial components represent a single failure in the context of the ONS licensing basis?

h. Can unrestrained cable whip in trench 3 be assumed to cause cable damage leading to secondary short circuits that could cause damage to the DC systems; should these effects of cable whip be analyzed?

1 Class 1E - The safety classification of the electric equipment and systems that are essential to emergency reactor shutdown, containment isolation, reactor core cooling, and containment and reactor heat removal, or are otherwise essential in preventing significant release of radioactive material to the environment. Note: For the purposes of this TIA, the terms Class 1E and safety related are interchangeable.

i. Are overload currents as well as short circuit currents required to be evaluated to determine the most limiting results from electrical faults and component failures?

• Do the results of such an analysis influence the required component separation to meet regulatory requirements and the ONS licensing basis?

j. Can cable shielding or armor prevent short circuits or limit faulted currents and voltages?

• Can the two wraps of bronze shielding tape in the licensees current power cable configuration be considered equivalent to the steel interlocked armored cable described in the test report MCM-1354.00-0029.001?

• Are the results of test report MCM-1354.00-0029.001 sufficient to demonstrate that electrical faults cannot propagate from one cable to another as described in the single failure [design basis document (DBD)], Section 3.3.6.1?

k. Does the interconnected nature of the Class 1E DC systems in the ONS KHU start panels, and the Keowee hydro-station KHU start panels present vulnerabilities where DC to DC interactions could disable the Keowee emergency power systems?

2.0 BACKGROUND

COMPONENT DESIGN BASIS IINSPECTION FINDINGS On June 27, 2014, Region II documented the results of a Component Design Basis Inspection (CDBI) at ONS (Inspection Report 05000269/2014007; 05000270/2014007; 05000287/2014007) (ADAMS Accession No. ML14178A535). In that report, the CDBI team identified an unresolved item involving cable configurations in certain underground cable raceways that may not comply with the ONS licensing basis, design basis, and NRC regulations and requirements. Specifically, the CDBI team identified that in certain underground raceways, the licensee had implemented plant modifications to install Class 1E and non-Class 1E DC protection and control circuits adjacent to high-energy medium-voltage AC power cables. The circuits in question are coupled with and interrelated with the KHU emergency power, PSW, ESPS, RPS, and the KHU supervisory control systems. The CDBI team was concerned that the licensee did not appropriately consider all of the electrical system design requirements for vulnerabilities such as single failures, consequential failures, common cause failures, and circuit protection from short circuits and ground faults when implementing plant modifications to their onsite power systems. The licensee determined that it could perform the plant modifications under the provisions of Title 10 of the Code of Federal Regulations (10 CFR) 50.59, Changes, tests and experiments, and thus those parts of the plant modifications were not evaluated or approved by the NRC staff. This is noted explicitly in Amendment Nos. 386, 388, and 387 dated August 13, 2014, for ONS, Units 1, 2, and 3 (ADAMS Accession No. ML14206A790).

The CDBI team reviewed the electrical cable configurations (including power, protection, and control circuits) between the 87,500 KVA KHUs and the ONS emergency power transformer CT-4, between the KHUs and the PSW switchgear, and between the 100 kVac Fant line from alternate power system switchyard and the PSW switchgear. The CDBI team observed that there is one 4,000-foot-long raceway, identified as Trench #3, between the Keowee Hydro Station (KHS) and transformer CT-4 at ONS, and a new PSW raceway that extends another 2,000 feet past CT-4 and around the ONS site to the new PSW building, thus connecting each system through underground interconnected raceways. The CDBI team identified that these raceways contained 13.8-kVac power cabling, 4.16-kVac power cabling, Class 1E 125-Vdc cabling, and associated non-Class 1E 125-Vdc cabling adjacent to one another, in close proximity, along the entire route of raceways. The as-installed configuration contained Class 1E and non-Class 1E power cables mixing with protection and control cables of onsite power systems.

The CDBI team identified that the KHU 13.8-kVac power system was installed with a high impedance grounded system, which limits ground fault currents to approximately 17.5 amps.

However, the commercial 13.8-kVac power feeders from the Fant line between the alternate power system switchyard and the PSW switchgear, located in the PSW raceway, were not protected against potentially catastrophic faults generated from the Fant 13.8-kVac line power feeders. The CDBI team identified that most of the Class 1E and associated non-Class 1E 125-Vdc cabling was connected directly or indirectly to the Class 1E DC busses at ONS and KHS. The DC system protective devices are not designed to mitigate the effects from medium voltage AC power short-circuiting to the 125-Vdc circuits.

Based on its review of the ONS licensing basis, the CDBI team could not determine the separation requirements for medium-voltage power cables, control cables, and safety-related and non-safety related cables in common raceways.

In addition, the CDBI team was concerned that a multi-phase power cable short circuit or a phase-to-ground power cable fault in the Fant line power feeders could result in:

• A release of energy sufficient to damage or destroy adjacent cables in the affected raceway;

• A medium voltage pulse resulting from the short circuit in the raceway and transmitted through the Class 1E and/or non-Class 1E 125-Vdc cables could damage and potentially destroy Class 1E components and systems at both ONS and KHU; and

• Cable forces and resulting whiplash could result in consequential damage to adjacent cables in the affected raceway, and possible consequential short circuits and circuit interconnections The licensing basis of ONS assumes a limiting single failure in the safety related systems.

Non-safety related systems are not credited in accident analysis unless they are uniquely identified for specific events. The CDBI team postulated that, upon a limiting single failure such as a three-phase power cable fault in the13.8-kVac or 4.16-kVac safety system or a single line to ground fault on the 13.8-kVac Fant line, the Class 1E and associated non-Class 1E DC protection and control cables could transmit the medium voltages throughout the control systems and damage connected components and equipment. The CDBI team noted that since the 13.8-kVac Fant line is non-Class 1E, a worst-case fault on the

non-safety-related Fant line source that is routed with the Class 1E power system could be postulated in addition to a single failure in the Class 1E system, consistent with NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition (SRP) Section 8.2, Offsite Power System, and IEEE Standard 379-2000.2 The CDBI team reviewed the ONS single-line power feeder diagrams, control wiring interconnection diagrams, and control system elementary diagrams and observed that clear electrical pathways exist that could transmit the voltages from the above mentioned failures to the three ONS 125-Vdc safety systems, to the Keowee 125-Vdc safety systems, and to the PSW 125-Vdc systems. The CDBI team was concerned that this damage and the resulting consequences could potentially impact most of the systems connected to the Class 1E 125-Vdc instrumentation and control power panel boards 1DIA, 1DIB, 2DIA, 2DIB, 3DIA, and 3DIB, and the associated batteries.

The DC power panel boards supply power to important components and safety systems such as the controls and lockouts for the alternate emergency power source through CT-5 transformer, the digital reactor protection system which includes reactor trip and engineered safeguards control, circuits for plant isolation from all offsite power, connections to the control room operator panel boards, boron dilution controls, excore nuclear instrumentation, and component cooling water controls. Any exposure of faulted medium-voltage AC to the digital protection and control systems, direct or indirect, could potentially permanently disable them. In addition, the CDBI team noted that abnormal operating procedure AP/0/A/2000/002, Keowee Hydro Station - Emergency Start, Revision 15, step 5.15, directs the operators to realign the redundant KHU from the overhead path to the underground path if overhead path equipment experiences a trip. The CDBI team was concerned that this procedural step could cause further damage to any undamaged components from a fault or short circuit in the underground raceways.

Additionally, the CDBI team postulated failures where DC to DC electrical interactions could disable the emergency power system because of interconnections between the two KHUs and the three ONS units. The three ONS units consolidated their ESPS emergency power starting system wiring into two ESPS start trains (A and B). Each ESPS train must be able to start both KHUs, and the supervisory controls for each KHU must enable and operate the same KHU start circuits, governors, and field controls as the ESPS trains. All of these circuits are interconnected at KHS and between KHS and ONS. The operators flexibility to choose the available paths to feed the plant safety busses could therefore become inoperable from a single failure.

ONS Licensing Basis - CDBI Teams Observation The CDBI team noted that the ONS staff considered the licensing basis applicable to electrical single failures as documented in an ONS internal memo to file written on January 12, 1993. The CDBI team noted that the memo was erroneously dated January 12, 1992. This memorandum was neither docketed nor evaluated by the NRC staff. It also does not appear that this memorandum was treated by the licensee as documentation which the NRC requires to be retained in order to demonstrate compliance with the NRCs requirements (as evidenced by its status as an internal memo to file). Finally, the information in the ONS internal memo to file was not ultimately reflected in any NRC-controlled documentation such as the final safety analysis report (FSAR) or technical specifications. For these reasons, the 2

Institute of Electrical and Electronics Engineers, IEEE Std. 379-2000, IEEE Standard Application of the Single-Failure Criterion to Nuclear Power Generating Station Safety Systems, Piscataway, NJ.

CDBI team determined that it is not part of the ONS licensing basis. In the ONS internal memo to file, the licensee stated, in part, that:

This document establishes that the Oconee licensing basis only requires consideration of single failures immediately on demand for emergency power1; Section I below details licensing basis issues. Correspondence and numerous reports have been reviewed to identify the licensing basis for Oconee with regard to the timing of single failures. This review indicates that nothing within the Oconee licensing basis specifically requires consideration of single failures at times other than immediately on demand (vs T = 0, or coincident with the event).

1 The licensing basis review focused on single failure issues related to emergency power. Expanding the scope to include all mechanical systems will require further review.

Note 3 of the ONS internal memo to file states, in part, that:

10 CFR [Part 50], Appendix A, the General Design Criteria [(GDCs)], is interpreted by the NRC staff in SECY 77-439[3] to require that there be no distinction between active and passive failures for electrical equipment. The GDCs are not part of the Oconee licensing basis. Therefore, for Oconee, a distinction can be made between active and passive failures.

Section I, LICENSING BASIS, of the ONS internal memo to file, under Subsection I.A, Discussion, states, in part, that:

This FSAR Revision as well as previous and subsequent revisions did include several system single failure analyses. Review of these analyses shows that each single failure evaluated occurred immediately on demand4.

Note 4 of the ONS internal memo to file states:

This conclusion is simply based on the fact that had the analyses considered single failures occurring at any time other than immediately on demand, the results would have been unacceptable.

Subsection I.B, Relevant Guidance not within the Oconee Licensing Basis, of the ONS internal memo to file, under SECY-77-439, Single Failure Criterion, states:

The staff states that a single failure evaluation proceeds on the proposition that single failures can occur at any time. The Oconee position is in direct contradiction to this portion of the guidance. However, the SECY paper concludes that the single failure criterion has served well in its use as a licensing review tool to assure reliable systems as one element of the defense in depth approach to reactor safety.

3 U.S. Nuclear Regulatory Commission, SECY-77-439, Single Failure Criterion, dated August 17, 1977 (ADAMS Accession No. ML060260236).

Section III, CONCLUSIONS, of the ONS internal memo to file, states, in part, that:

It is clear that there is no requirement within the Oconee licensing basis to analyze for smart single failures.

The CDBI team reviewed licensing and regulatory documents such as the ONS GDC or principal design criteria requirements, technical specifications, generic communications, regulatory guides, Standard Review Plan, Branch Technical Positions, and IEEE Std. 279-1971 to verify the technical basis of the ONS internal memo to file on single failure criteria. The CDBI team could not substantiate any assumptions or basis of the position taken by the licensee. The licensee could not identify any communication from the NRC staff approving the contents of the ONS internal memo to file such that the licensee could establish the timing of postulated electrical failures, make distinctions between passive and active electrical failures, and also limit the magnitude and potential damage that could occur from electrical failures. The CDBI team could not find the term smart single failures, as described in the internal memo to file, in any part of the ONS licensing basis. The CDBI team identified that ONS GDC 39 specified active component failures, one in each of the onsite and offsite power systems concurrently, but IEEE Std. 279-1971 specified single failures and did not distinguish between active or passive components.

The CDBI team noted that a letter from Duke Power Company to the NRC, dated May 13, 1976 (ADAMS Accession No. ML16030B569), stated that the ONS onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE Std. 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations. These systems are limited to IEEE Std. 279-1971, Section 1, Scope, which states, in part, that the protection system encompasses all electric and mechanical devices and circuitry (from sensors to actuation device input terminals) involved in generating those signals associated with the protective function. Of all the standards and NRC reports the licensee evaluated in the prompt determinations of operability, IEEE Std. 279-1971 was the only licensing basis document evaluated for electrical single-failure-proof design. However, the licensee did not appear to consider the example in the note of IEEE Std. 279-1971, Section 4.2, Single Failure Criterion, describing the shorting of electrical power cables as a single failure as applicable.

The updated FSAR (UFSAR) Section 8.3.1.2, Analysis, for onsite AC Power Systems stated that the basic design criterion for the electrical portion of the emergency electric power system of a nuclear unit, including the generating sources, distribution system, and controls is that a single failure of any component, passive or active, will not preclude the system from supplying emergency power when required. Based on the above, the CDBI team could not verify that the installed cable configurations in trench 3 and the PSW raceway were acceptable. During the inspection, the licensee indicated that the bronze tape shield on medium-voltage cables was equivalent to interlocked armor cable. The CDBI team could not find any technical basis for the equivalency that the licensee was crediting in the single failure DBD test report MCM-1354.00-0029.001. Therefore, the CDBI team was concerned that the licensees analyses appeared to be non-conservative. The analyses appeared to inappropriately establish the timing of electrical failures to instances that could limit the magnitude of potential damages. The CDBI team could not conclude that safe shutdown capability was maintained after an electrical single failure of the underground cabling systems between ONS, the KHS,

and PSW building. The CDBI team reviewed the following regulatory requirements to evaluate the design of the cabling systems:

• Technical Specification (TS) 3.8.1, Electrical Power Systems: AC Sources -

Operating

• TS 3.3.21, Emergency Power Switching Logic Keowee Emergency Start Function

• Atomic Energy Commission (AEC) GDCs 19, 20, 21, 22, 23, 24, 31, and 39

• Paragraph (h)(2), Protection systems, of 10 CFR 50.55a, Codes and standards

• 10 CFR 50.59(c), Changes, tests and experiments

• 10 CFR Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, Criterion III, Design Control ONS Design Basis - CDBI Teams Observation The CDBI team noted several concerns in the ONS design basis criteria applicable to electrical single failures documented in design basis specification OSS-0254.00-00-4013, Rev. 4, Design Basis Specification for the Oconee Single Failure Criterion, Rev. 4 (the single failure DBD).

Specifically, Section 3.2.1.3, Single Failure Licensing Basis for Electrical Systems, referenced the internal memo to file as the definitive document outlining the ONS licensing basis for single failure timing. The DBD, stated, in part, that Per Reference 4.3.1.1, single failures in electrical systems shall only be postulated to occur on initial demand (i.e., failure is coincident with the time the component is initially required to perform its design function in response to an event), and that the criteria in [10 CFR Part 50] Appendix A are not part of Oconees licensing basis, and a distinction between active and passive failures is made for Oconee electrical systems (see Reference 4.3.1.1). Section 3.3.6.1, Cabling, of the DBD references cable testing that was performed by the licensee in 1977 and was documented in MCM-1354.00-0029.001, which determined that cable faults in armored multi-conductor cabling could not propagate to adjacent cabling. The DBD stated, in part, that: [a]rmored electrical cabling will not be subject to a single failure in one cable propagating to another cable; and that

[t]his exception is only applicable to armored cables. The CDBI team was concerned that the DBD referenced the internal memo to file to justify the limited evaluations of single failures based on specific timing and distinguished between active and passive failures as previously discussed. The CDBI team was concerned that the licensees design philosophy for plant modifications appeared to incorporate the internal memo to file into plant design specifications and procedures. In addition, the CDBI team could not verify that the referenced cable test report, MCM-1354.00-0029.001, supported the claim that armored electrical cabling will not be subject to a single failure in one cable propagating to another cable. The CDBI team noted that ONS was using this test report to envelope the configuration of both the safety and non-safety related 13.8-kVac power cables. The licensee asserted that two wraps of 10 mil bronze shielding tape was equivalent to the armor described in the test report.

The CDBI teams specific concern was that the testing did not envelope the cable designs in the underground raceways. The test report indicated that the testing was limited to 6.9-kVac power cables with steel interlocked armor that were drilled and vented. In addition, only two phases were shorted instead of three phases in the test, which limited the energy released from the cables. In AC circuits, three-phase short circuits provide the maximum energy

released in arc flashes and maximum electromagnetic forces. The CDBI team noted that a high impedance ground scheme, such as the one on the KHUs, was not simulated during these tests. A high impedance grounded system would contribute to the magnitude of energy release during AC arc flashes. The CDBI team could not verify from its review of the test report that two layers of 10 mil bronze tape was equivalent to the steel interlocked armor subjected to the test conditions. In addition, the CDBI team could not verify that the tests supported the licensees conclusion that armored cables (steel interlocked or otherwise) would prevent the propagation of electrical failures between cables.

Licensees Actions - CDBI Teams Review To address the CDBI teams concerns, ONS prepared three problem investigation program documents (O-14-02965, O-14-03190, and O-14-05125) and performed prompt determinations of operability for each problem investigation program. In addition, on March 23, 2014, the licensee reported these conditions to the NRC under 10 CFR 50.72(b)(3)(ii) in Licensee Event Report 269/2014-01, Rev. 0 (ADAMS Accession No. ML14149A476). The licensees current position is that electrical failures addressed as single failures cannot occur at any time, but must only occur explicitly at the actuation of a device to provide its safety function.

Additionally, ONS staff stated that short circuits between shielded power cables are not credible events and thus do not have to be postulated. The licensee stated that it has properly routed the Class 1E and associated non-Class 1E DC protection and control circuits with the high-energy 13.8-kVac cables and that this configuration does not compromise the single-failure-proof design of the emergency power system or the Class 1E protection system.

Also, the licensee concluded that offsite commercial grade electrical protective equipment (relays, circuit breakers, lightning arrestors, etc.) is adequate to assure the protection of the adjacent Class 1E and associated non-Class 1E DC protection and control circuits.

In letters dated May 11, 2015 (ADAMS Accession No. ML15139A049) and August 7, 2015 (ADAMS Accession No. ML15224A370), the licensee provided additional information on the issues associated with TIA 2014-05. This information reiterated the licensing basis of the plant for NRR review of TIA 2014-05 and provided information related to cable testing performed to evaluate the physical strength of the cables installed in the trench associated with Keowee power system. In addition, the letters provided information such as types of cables installed at ONS, separation criteria related to heat dissipation, overfill of cable trays, types of faults that can be postulated concurrent with design basis events, and the excess margin in design of power cables in trench 3. ONS has also provided risk-informed analysis information for external fire events. The Region II staff reviewed the information provided in the letters and determined that the additional information did not contain any new details on the adequacy of the design and installation of cables in trench 3. Based on the review, the Region II staff recommended that the TIA questions remain unchanged. The NRR staff considered all of the licensees supplemental information in its technical evaluations of Region II TIA questions.

3.0 EVALUATION The NRR staff reviewed the licensing and design bases history of the ONS single failure criterion for analyzing electrical failure vulnerabilities between medium-voltage AC power systems and low voltage DC circuits. This review involved examination of NRC correspondence with the licensee, safety evaluations for license amendments, the CDBI inspection report,

Oconee UFSAR Section 8.0, and the licensees letters dated May 11, and August 7, 2015, and August 15, 2016.

History of ONS Licensing Basis for Electric Power Systems and Associated Interfacing Systems The Duke Power Company, by application dated November 28, 1966, and as subsequently amended, requested a license to construct and operate three pressurized-water reactors, identified as Units 1, 2, and 3 in Oconee County, South Carolina. In supplement 1 to the Oconee construction application dated April 1, 1967 prior to the issuance of construction permits November 6, 1967, Oconee stated conformance to the Proposed IEEE Criteria for Nuclear Power Plant Protection Systems, see ADAMS Accession No. ML15215A125. This standard was issued as IEEE Std. 279-1968. The AEC reported the results of its review prior to construction in a safety evaluation dated August 4, 1967 (ADAMS Accession No. ML15212A648). On June 2, 1969, Duke Power filed the FSAR required by 10 CFR 50.34(b) for each unit. The AEC regulatory staffs review of the FSAR, as amended, considered all three ONS units. However, Unit 1 was the only unit whose state of completion warranted issuance of an operating license at that time and the safety evaluation report (SER) for Unit 1 was published on December 29, 1970 (ADAMS Accession No. ML12276A270).

Section 8.0, Instrumentation, Control, and Power Systems, of the SER states, in part, that

[t]he adequacy of the reactor protection system instrumentation for Oconee Unit 1 was evaluated by comparison with the Commissions Proposed General Design Criteria published July 11, 1967 [(32 FR 10213)], and the proposed IEEE Criteria for Nuclear Power Plant Protection Systems (IEEE Std. 279) dated August 28, 1968. Since the original regulatory staffs review of ONS, Unit 1, a supplemental review of the plant emergency core cooling systems (ECCS) was performed in accordance with the criteria described in an Interim Policy Statement issued on June 25, 1971, and published in the Federal Register on June 29, 1971 (36 FR 12247). The safety evaluation based upon this review was issued on March 24, 1972, as Supplement No. 1 to the SER for ONS, Unit 1 (ADAMS Accession No. ML13179A044). On July 6, 1973, the AEC staff issued the SER for ONS, Units 2 and 3 (ADAMS Accession No. ML12276A272). The safety evaluation and conclusions presented in Supplement No. 1 are applicable to ONS, Units 2 and 3. The staffs safety review with respect to issuing operating licenses for Units 2 and 3 was based on the applicants FSAR (Amendment 7) and subsequent Amendments 8 through 41 inclusive (Amendments 1 through 6 were related to the construction permit review).

ONS AEC GDC and UFSAR Section 1.3, Principal Design Criteria, of the ONS FSAR dated August 11, 1970, states: The principal design criteria for Oconee Units 1, 2, and 3 were developed in consideration of the 70 General Design Criteria for Nuclear Power Plant Construction Permits proposed by the AEC in a proposed rule-making published for 10 CFR 50 in the Federal Register of July 11, 1967

[32 FR 10213].

• The following are the applicable AEC proposed principal design criteria (32 FR 10213; July 11, 1967):

Introduction. Every applicant for a construction permit is required by the provisions of § 50.34 to Include the principal design criteria for the proposed facility in the application. These General Design Criteria are intended to be used as guidance in establishing the principal design criteria for a nuclear power plant.

The General Design Criteria reflect the predominating experience with water

power reactors as designed and located to date, but their applicability is not limited to these reactors. They are considered generally applicable to all power reactors.

Under the Commissions regulations, an applicant must provide assurance that its principal design criteria encompass all those facility design features required in the interest of public health and safety. There may be some reactor cases for which fulfillment of some of the General Design Criteria may not be necessary or appropriate. There will be other cases in which these criteria are insufficient, and additional criteria must be identified and satisfied by the design in the interest of public safety. It is expected that additional criteria will be needed particularly for unusual sites and environmental conditions, and for new and advanced types of reactors. Within this context, the General Design Criteria should be used as a reference allowing additions or deletions as an individual case may warrant.

Departures from the General Design Criteria should be justified.

The criteria are designated as General Design Criteria for Nuclear Power Plant Construction Permits to emphasize the key role they assume at this stage of the licensing process. The criteria have been categorized as Category A or Category B. Experience has shown that more definitive information is needed at the construction permit stage for the items listed in Category A than those in Category B.

I. OVERALL PLANT REQUIREMENTS Criterion 1-Quality Standards (Category A). Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be identified and then designed, fabricated, and erected to quality standards that reflect the importance of the safety function to be performed. Where generally recognized codes or standards on design, materials, fabrication, and inspection are used, they shall be identified. Where adherence to such codes or standards does not suffice to assure a quality product in keeping with the safety function, they shall be supplemented or modified as necessary. Quality assurance programs, test procedures, and inspection acceptance levels to be used shall be identified. A showing of sufficiency and applicability of codes, standards, quality assurance programs, test procedures, and inspection acceptance levels used is required.

Criterion 20-Protection Systems Redundancy and Independence (Category B).

Redundancy and independence designed into protection systems shall be sufficient to assure that no single failure or removal from service of any component or channel of a system will result in loss of the protection function.

The redundancy provided shall include, as a minimum, two channels of protection for each protection function to be served. Different principles shall be used where necessary to achieve true independence of redundant instrumentation components.

Criterion 21-Single Failure Definition (Category B). Multiple failures resulting from a single event shall be treated as a single failure.

Criterion 22-Separation of Protection and Control Instrumentation Systems (Category B). Protection systems shall be separated from control instrumentation systems to the extent that failure or removal from service of any control instrumentation system component or channel, or of those common to control instrumentation and protection circuitry, leaves intact a system satisfying all requirements for the protection channels.

Criterion 23-Protection Against Multiple Disability for Protection Systems (Category B). The effects of adverse conditions to which redundant channels or protection systems might be exposed in common, either under normal conditions or those of an accident, shall not result in loss of the protection function.

Criterion 24-Emergency Power for Protection Systems (Category B). In the event of loss of all offsite power, sufficient alternate sources of power shall be provided to permit the required functioning of the protection systems.

Criterion 39-Emergency Power for Engineered Safety Features (Category A).

Alternate power systems shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning required of the engineered safety features. As a minimum, the onsite power system and the offsite power system shall each, independently, provide this capacity assuming a failure of a single active component in each power system.

• UFSAR Principal Design Criteria:

The following ONS UFSAR sections set forth the relevant ONS design criteria and the principal design criteria that apply to electric power systems, which were derived from the AECs proposed 1967 GDC:

UFSAR Section 3.1.19, Criterion 19, Protection Systems Reliability (Category B)

Protective Systems shall be designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

Discussion The Protective Systems design meets this criterion by specific instrument location, component redundancy, and in-service testing capability. The major design criteria stated below have been applied to the design of the instrumentation.

1. No single component failure shall prevent the protective systems from fulfilling their protective function when action is required.

2. No single component failure shall initiate unnecessary protective system action, provided implementation does not conflict with the criterion above.

Test connections and capabilities are built into the protective systems to provide for:

1. Pre-operational testing to give assurance that the protective systems can fulfill their required functions.

2. On-line testing to assure availability and operability (Section 7.1.2.1).

UFSAR Section 3.1.20, Criterion 20, Protection Systems Redundancy and Independence (Category B)

Redundancy and independence designed into Protective Systems shall be sufficient to assure that no single failure or removal from service of any component or channel of a system will result in loss of the protective function. The redundancy provided shall include, as a minimum, two channels of protection for each protective function to be served. Different principles shall be used where necessary to achieve true independence of redundant instrumentation components.

Discussion Reactor protection is by four channels with 2/4 coincidence, and engineered safeguards features are by three channels with 2/3 coincidence. All Protective System functions are implemented by redundant sensors, instrument strings, logic, and action devices that combine to form the protective channels. Redundant protective channels and their associated elements are electrically independent and packaged to provide physical separation.

For Unit(s) with the digital RPS/ESPS not installed, the Reactor Protective System will initiate a trip of the protective channel involved when modules or equipment are removed (Section 7.1.2.1).

For Unit(s) with the digital RPS/ESPS installed, the Reactor Protective System will determine action to be taken based on the type of module removed. These actions could range from indication of trouble within the system to a protective channel trip.

UFSAR Section 3.1.21, Criterion 21, Single Failure Definition (Category B)

Multiple failures resulting from a single event shall be treated as a single failure.

Discussion The Protective Systems meet this criterion in that the instrumentation is designed so that a single event cannot result in

multiple failures that would prevent the required protective action (Section 7.3).

UFSAR Section 3.1.22, Criterion 22, Separation of Protection and Control Instrumentation Systems (Category B)

Protective Systems shall be separated from control instrumentation systems to the extent that failure or removal from service of any control instrumentation system component or channel, or of those common to control instrumentation and protective circuitry, leaves intact a system satisfying all requirements for the protective channels.

Discussion The Protective Systems input channels are electrically and physically independent. Shared instrumentation for protective and control functions satisfies the single failure criteria by the employment of isolation techniques to the multiple outputs of various instrument strings.

UFSAR Section 3.1.23, Criterion 23, Protection against Multiple Disability for Protection Systems (Category B)

The effects of adverse conditions to which redundant channels or Protective Systems might be exposed in common, either under normal conditions or those of an accident, shall not result in a loss of the protective function.

Discussion The Protective Systems are designed to extreme ambient conditions. The Protective Systems instrumentation will operate from 40 [degrees Fahrenheit (°F)] to 140°F and sustain the loss-of-coolant building environmental conditions, including 100 percent relative humidity, without loss of operability. Out-of-core neutron detectors, however, will withstand 90 percent relative humidity. The Protective Systems instrumentation will be subject to environmental (qualification) testing as required by the proposed IEEE Criteria for Nuclear Power Plant Protection Systems, IEEE No. 279, dated August, 1968. Protective equipment outside the Reactor Building (control room and cable room) is designed for continuous operation in an ambient temperature and relative humidity representative of loss-of-coolant accident conditions (Section 7.1.2.1). The [Teleperm XS (TXS)]

RPS / ESPS systems are also subject to IEEE Std 603-1998, IEEE Standard Criteria for Safety Systems for Nuclear Power Generating Stations.

UFSAR Section 3.1.24, Criterion 24, Emergency Power for Protection Systems (Category B)

In the event of loss of all off-site power, sufficient alternate sources of power shall be provided to permit the required functioning of the Protective Systems.

Discussion In the event of loss of all off-site power to all units at Oconee or to any unit alone, sufficient power for operation of the Protective Systems of any unit will be available from either of two on-site independent hydroelectric generators. Details of the Emergency Power Generation System are described in Section 8.3.1.1.1.

Redundant battery power is provided for vital instrumentation and control.

UFSAR Section 3.1.39, Criterion 39, Emergency Power for Engineered Safety Features (Category A)

Alternate power systems shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning required of the engineered safety features.

As a minimum, the on-site power system and the off-site power system shall each, independently, provide this capacity assuming a failure of a single active component in each power system.

Discussion The electrical systems meet the intent of the criterion as discussed in Chapter 8.

Three alternate emergency electric power supplies are provided for the station from which power to the engineered safety feature buses of each unit can be supplied. These are the 230 KV switching station with multiple off-site interconnections and two on-site independent 87,500 kVA hydroelectric generating units.

Each nuclear unit can receive emergency power from the 230 KV switching station through its start-up transformer as a preferred source. Each unit can receive emergency power from one hydroelectric generating unit through a 13.8 KV underground connection to standby transformer CT4. The other hydroelectric generating unit serves as a standby emergency power source and can supply power to each units startup transformer when required. Both on-site hydroelectric generating units will start automatically upon loss of all normal power or upon an engineered safety feature action.

Two additional sources of alternate power are available, as each nuclear unit is capable of supplying any other unit through the

230 KV switching station. In addition, a connection to the 100 KV transmission network is provided as an alternate source of emergency power whenever both hydroelectric generating units are unavailable.

UFSAR Chapter 7, Instrumentation and Control Section 7.1.1, Identification of Safety-Related Systems, states that:

The protective systems, which consist of the Reactor Protective Systems, the Engineered Safeguards System and the Automatic Feedwater Isolation System perform important control and safety functions. The protective systems extend from the sensing instruments to the final actuating devices, such as circuit breakers and pump or valve motor contactors.

Section 7.1.2.1, Design Bases, states that:

The protective systems are designed to sense plant parameters and actuate emergency actions in the event of abnormal plant parameter values. They meet the intent of the Proposed IEEE Criteria for Nuclear Power Plant Protection Systems dated August, 1968. (IEEE No. 279). The [Teleperm XS (TXS)]

RPS/ESPS also meets the intent of IEEE Std 603-1998.

Protective system equipment located in the Control Room, Cable Room, and Aux Building is designed for a mild environment, not LOCA [loss-of-coolant] conditions (i.e. 59 psig, 273°F).

Note: The UFSAR Chapter 7 identifies the Keowee Emergency Start cables, which are a subject of this TIA, as part of the ESPS. In addition, the DC circuits, which are a subject of this TIA, are electrically interconnected with the RPS and ESPS.

UFSAR Chapter 8, Electric Power Section 8.3.1.2, Analysis, states, in part, that:

The basic design criterion for the electrical portion of the emergency electric power system of a nuclear unit, including the generating sources, distribution system, and controls is that a single failure of any component, passive or active, will not preclude the system from supplying emergency power when required.

Section 8.3.1.4.6.2, Cable Separation, states, in part, that:

Control, instrumentation, and power cables are applied and routed to minimize their vulnerability to damage from any source Power and control cables for redundant auxiliaries or services are run by different routes to reduce any probability of an accident disabling more than one piece of redundant equipment.

Section 8.3.2.2, Analysis, states, in part, that:

The 125 Volt DC Instrumentation and Control Power System and the 125 Volt AC Vital Power System are designed such that upon loss of power supplies no interactions exist between Reactor Protection Systems, Engineered Safeguards Protection Systems, and control systems that would preclude these systems from performing their respective functions.

Section 8.3.2.2.2, Single Failure Analyses of the 125 Volt DC Keowee Station Power System, states:

The 125 Volt DC Keowee Station Power System is arranged such that a single fault within either units system does not preclude the other unit from performing its intended function of supplying emergency power.

UFSAR Chapter 15 Accident Analyses Section 15.14.3.3.6 ECCS Performance and Single Failure Assumption, states, in part that

[T]he ECCS configuration was analyzed with the CRAFT2-based evaluation model (Reference 1) to determine the worst single failure in addition to the assumption of the loss of offsite power for each LOCA (Reference 33). Historically, the worst single failure for a LOCA is the loss of one bus of emergency power which results in the loss of one train of HPI and one train of LPI. The failure of transformer CT-4 has been identified as a more limiting single failure for the large break LOCA. The failure of transformer CT-4 results in a longer delay until delivery of ECCS fluid to the RCS. However, two ECCS trains are available with this single failure. Reference 33 demonstrates that having two ECCS trains injecting at a later time is more limiting than having one ECCS train injecting at an earlier time. The Keowee hydro unit will start up and accelerate to full speed in 23 seconds or less (Section 6.3.3.3). The failure of transformer CT-4 results in an additional 10 second delay before power is available to the ECCS pumps. The time delay between breaker closure and valve/pump motors operating at rated voltage/speed is 5 seconds...

A SBLOCA does not progress as rapidly as a large break LOCA. Thus, for a SBLOCA, the timing of ECCS injection is not as significant as with a large break LOCA. For this reason, the worst single failure for a SBLOCA remains the loss of one bus of emergency power

Relevant ONS Licensing Actions from 1974-Onward The following sections describe the licensing basis changes submitted for NRC review and approval that affect the independence and electric separation requirements specified in the ONS UFSAR sections above for the electric power systems.

Subsequent to the issuance of the operating licenses for ONS, Appendix K to Part 50, ECCS Evaluation Models, was issued to define the Required and Acceptable Features of Evaluation Models (39 FR 1003; January 4, 1974). All licensees, including the licensee for ONS, were required to perform the evaluation. On August 5, 1974 (ADAMS Accession No. ML16030B220), Duke submitted an evaluation of ECCS cooling performance calculated in accordance with an evaluation model developed by the Babcock and Wilcox Company. On December 27, 1974, the Commission issued an Order for the Modification of the Oconee Licenses pertaining to the proposed TS which were submitted pursuant to Section 50.46 and Appendix K to 10 CFR Part 50, dated September 20, 1974, finding the licensee's ECCS evaluation deficient (ADAMS Accession Nos. ML15216A221 and ML15210A064). The order required the submission of a reanalysis in conformance with the order along with any request for authorization for any core reloading. During the subsequent reviews on April 6, 1975, the NRC staff asked Duke to describe the design of the ECCS actuation system and identify any non-conformance of this design with the single failure requirements of IEEE Std. 279-1971 (ADAMS Accession No. ML15212A336). By letter dated May 13, 1976 (ADAMS Accession No. ML16008A753), the licensee stated, in part, that:

The design of the Oconee Nuclear Station Engineered Safeguards Protective System (ESPS) is described in FSAR Section 7.1.3. The ESPS includes the Emergency Core Cooling System in addition to the Reactor Building Isolation, Spray and Cooling Systems. The system logic for the ESPS is described in FSAR Section 7.1.3.2.1, and the specific discussion for the ECCS components is provided in FSAR Section 7.1.3.2.2. The safety evaluation for the ESPS is provided in FSAR Section 7.1.3.3.

The Oconee ECCS actuation system conforms to the single failure requirements of IEEE 279-1971.

Similarly, the licensee was asked to describe the design of the onsite emergency power system, AC and DC and to identify any non-conformance of this design with the single failure requirements of IEEE Std. 279-1971. By letter dated May 13, 1976, Duke Power stated, in part, that:

The Oconee Nuclear Station onsite emergency AC power sources and distribution system are described in FSAR Section 8.2.3. The emergency power distribution through the switchboards is described in FSAR Sections 8.2.2.4, 8.2.2.5, and 8.2.2.6. The onsite emergency DC power system is described in FSAR Section 8.2.2.7. A single failure analysis of these systems is provided in Table 8.7.

The design of the Oconee onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE 279-1971.

By letter dated March 25, 1976 (ADAMS Accession No. ML011970076), the ONS licenses were amended based upon an acceptable ECCS evaluation model conforming to the requirements of

10 CFR 50.46, and the operating restrictions imposed by the Commissions December 27, 1974, Order for Modification of License were terminated. The ONS ECCS reanalysis was accepted in safety evaluation reports dated June 30, 1976, and October 22, 1976 (ADAMS Accession Nos. ML012190455 and ML012190305, respectively). As documented in letter from licensee dated May 13, 1976, the licensee stated that the Oconee ECCS actuation system conforms to the single failure requirements of IEEE Std. 279-1971. The licensee committed to all single failure requirements not limited to those in Section 4.2. Additional single failure requirements are contained in other sections of IEEE Std. 279-1971 including but not limited to Sections 4.2, 4.7, 4.11 and 4.17. Although ONSs original licensing basis included IEEE Std.

279-1968, for single failure requirements, ONS later adopted IEEE Std. 279-1971.

IEEE Standard 279-1971 provides the minimum criteria for the safety-related functional performance and reliability of protection systems for stationary land-based nuclear reactors producing steam for electric power generation. The standard provides definitions of some unique terms used, the design basis and minimum performance requirements of the protective systems. The following elements from the specific sections of the Standard are pertinent to the discussion and responses to the TIA questions.

Section 3 Design Basis details on conditions that can result in failures requiring protective function actions.

(7) the range of transient and steady-state conditions of both the energy supply and the environment (for example. voltage, frequency, temperature. humidity, pressure. vibration etc. during normal. abnormal. and accident circumstances throughout which the system must perform.

(8) the malfunctions, accidents or other unusual events (for example, fire, explosion, missile lightning. flood, earthquake. wind, etc.) which could physically damage protection system components or could cause environmental changes leading to functional degradation of system performance, and for which provisions must be incorporated to retain necessary protective action:

(9) minimum performance requirements including the following:

a) system response time:

b) system accuracies:

c) ranges (normal. abnormal. and accident conditions) of the magnitudes and rates of change of sensed variables to be accommodated until proper conclusion of the protective action is assured.

Section 4 Requirements states The nuclear power generating station protection system shall, with precision and reliability, automatically initiate appropriate protective action whenever a condition monitored by the system reaches a preset level. This requirement applies for the full range of conditions and performance enumerated in Sections 3(7). 3(8), and 3(9).

4.2 Single Failure Criterion. Any single failure within the protection system shall not prevent proper protective action at the system level when required.

NOTE: "Single failure" includes such events as the shorting or open circuiting of interconnecting signal or power cables. It also includes single credible malfunctions or events that cause a number of consequential component, module, or channel failures. For eu1mple. The overheating of an amplifier module is a single failure even though several transistor failures result. Mechanical damage to a mode switch would be a "single failure" although several channels might become involved.

The ONS Digital RPS/ESPS License Amendment Request (LAR) 2007-009, Enclosure 1, Evaluation of Proposed Change, dated January 31, 2008 (ADAMS Accession No. ML080730339), Section 3, Technical Evaluation, Subsection 3.2.1.2, Duke Design Criteria, stated, in part, that:

The new digital RPS/ESPS equipment is required to conform with both IEEE Std 279-1971 and IEEE Std 603-1991. Duke considers the 1998 revision to IEEE Std 603 more appropriate for referencing since it clarifies the application of the standard to computer-based safety system. Since the 1998 revision to IEEE Std 603 does not change any IEEE Std 603-1991 requirements, Duke has evaluated the digital RPS/ESPS for compliance to IEEE Std 603-1998.

The LAR Section 3.3.1, Single-Failure Criterion stated, in part, that:

[Regulatory Guide (RG)] 1.53, Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems, Revision 2, November 2003, indicates that conformance with the requirements of IEEE Std 379-2000, Application of the Single-Failure Criterion to Nuclear Power Generating Station Safety Systems, provides methods acceptable to the NRC staff for satisfying the NRCs regulations with respect to the application of the single-failure criterion to the electrical power, instrumentation, and control portions of nuclear power plant safety systems. The protective features of the RPS/ESPS meet the single failure criterion as contained in IEEE Std 603-1991 (and IEEE Std 603-1998) and IEEE Std 279-1971. IEEE Std 603-1991 applies only to portions of the RPS/ESPS affected by the design change. Otherwise, IEEE Std 279-1971 continues to apply. In addition, application of the single failure criterion is further delineated in IEEE Std 379-2000.

Note: ONS UFSAR Chapter 7 identifies the Keowee Emergency Start cables, which are a subject of this TIA, as part of the ESPS. In addition, the DC circuits, which are a subject of this TIA, are electrically interconnected with the RPS and ESPS.

The NRC staffs safety evaluation for LAR 2007-009 dated January 28, 2010 (ADAMS Accession No. ML100220016), Section 3.4.2.1, IEEE Std 603-1998, Clause 5.1 Single-Failure Criterion, stated, in part, that In IEEE Std. 603-1991, Clause 5.1, Single Failure, was revised (in 1998) to clarify that a single failure could occur prior to, or at any time during, the design basis event for which the safety system is required to function. This clarification is acceptable; the proposed alternative (i.e., - 1998) provides an acceptable level of quality and safety.

The NRC staffs safety evaluation for LAR 2007-009, Section 3.4.2.6.1, IEEE Std. 603-1998, Clause 5.6.1, Between Redundant Portions of a Safety System, stated, in part, that:

Based on the review document in these sections and in the paragraphs above, the NRC staff determined that there is sufficient independence between redundant portions of the digital RPS/ESPS such that the redundant portions are

independent of and physically separated and, therefore, the digital RPS/ESPS meets the requirements of Clause 5.6.1.4 The LAR Section 3.7, Failure Modes and Effects Analysis (FMEA), Subsection 3.7.1, Methodology, stated, in part, that The ONS RPS/ESPS FMEA was performed using guidance contained in RG 1.53 to verify that the design satisfies the single-failure criterion of IEEE Std 603-1998. IEEE Std 603-1998 references IEEE Std 379-1994 as providing a method acceptable to the NRC staff for satisfying the NRCs regulations with respect to the application of the single failure criterion. The ONS FMEA conforms with the specification requirements of IEEE 379-2000.

Note: The ONS RPS/ESPS FMEA states that the impact of external cables was evaluated based on the current configuration. At that time, the ESPS cables were directly buried, were not subject to failures from other cables, met the separation criteria and, therefore, cable failures of concern to this TIA were not evaluated. For the cables, the single failure requirements of IEEE Std. 279-1971 continues to apply and IEEE Std. 603-1998 applies only to portions of the RPS/ESPS affected by the digital design change including the ONS FMEA.

On August 13, 2014, the NRC issued Amendment Nos. 386, 388, and 387 for the ONS, Units 1, 2, and 3, respectively (ADAMS Accession No. ML14206A790). The amendments consisted of changes to the ONS operating licenses, TSs, and UFSAR. The amendments added a license condition and revised the TSs and UFSAR for ONS, Units 1, 2, and 3, to add the new PSW system to the plants licensing basis. Under the amendments, the PSW is an additional method of achieving and maintaining safe shutdown of the reactors in the event of a high-energy line break or a fire in the Turbine Building, which is shared by all three units.

The NRC staffs letter issuing the license amendments, and the safety evaluation supporting the amendments, stated that the staff did not review or approve the as-installed PSW electrical system cable configurations. Duke Energy made changes to the PSW electrical system configurations and installed the PSW electrical cables and power supplies under the provisions of 10 CFR 50.59; therefore, those parts of the system were not included in the scope of the NRC staffs review for these amendments.

3.1 Response to Requested Actions TIA Question 1

1. What are the ONS licensing basis, design basis, and NRC regulations and requirements for analyzing electrical failure vulnerabilities (single failure or otherwise) between medium voltage AC power and low voltage DC circuits as presented in this TIA?

4 The licensees requested change to its licensing basis was not compelled by a new or modified NRC requirement, or interpretation of an existing NRC requirement. Therefore, under the principle described in footnote 2 of the July 14, 2010, General Counsels letter to the Nuclear Energy Institute (NEI) (ADAMS Accession No. ML101960180), the NRC staff could apply new requirements to the ONS which would not be considered backfitting under 10 CFR 50.109.

Response to TIA Question 1 The ONS licenses for Units 1, 2, and 3 require Duke Energy to meet the conditions and requirements pursuant to Section 104b of the Act and 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, to possess, use, and operate the facility. Accordingly, the following requirements are applicable to ONS.

1. The regulation at 10 CFR 50.54(jj) which requires that [s]tructures, systems, and components subject to the codes and standards in 10 CFR 50.55a must be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety function to be performed.

Note: As indicated in 36 FR 11423 (June 12, 1971), quality standards means that protection systems (electrical and mechanical sensors and associated circuitry) should, as a minimum, be designed to meet the criteria developed by the Institute of Electrical and Electronics Engineers (IEEE).

2. The regulation at 10 CFR 50.55a(h)(2), Protection systems, which states, in part, that

[f]or nuclear power plants with construction permits issued before January 1, 1971, protection systems must be consistent with their licensing basis or may meet the requirements of IEEE Standard 603-1991 and the correction sheet dated January 30, 1995. Construction Permits for ONS, Units 1, 2, and 3 were issued on November 6, 1967 (ADAMS Accession Nos. ML012130043, ML011940386, and ML012190373, respectively).

3. Criterion III, Design Control, of Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, to 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, states, in part, that the design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculation methods, or by the performance of a suitable testing program.

4. The regulation at 10 CFR 50.59, Changes, tests and experiments, paragraph (c), which states, in part, that:

(1) A licensee may make changes in the facility as described in the final safety analysis report (as updated), make changes in the procedures as described in the final safety analysis report (as updated), and conduct tests or experiments

not described in the final safety analysis report (as updated) without obtaining a license amendment pursuant to Sec. 50.90 only if:

(i) A change to the technical specifications incorporated in the license is not required, and (ii) The change, test, or experiment does not meet any of the criteria in paragraph (c)(2) of this section.

(2) A licensee shall obtain a license amendment pursuant to Sec. 50.90 prior to implementing a proposed change, test, or experiment if the change, test, or experiment would:

(i) Result in more than a minimal increase in the frequency of occurrence of an accident previously evaluated in the final safety analysis report (as updated);

(ii) Result in more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component (SSC) important to safety previously evaluated in the final safety analysis report (as updated);

(iii) Result in more than a minimal increase in the consequences of an accident previously evaluated in the final safety analysis report (as updated);

(iv) Result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the final safety analysis report (as updated);

(v) Create a possibility for an accident of a different type than any previously evaluated in the final safety analysis report (as updated);

(vi) Create a possibility for a malfunction of an SSC important to safety with a different result than any previously evaluated in the final safety analysis report (as updated);

(vii) Result in a design basis limit for a fission product barrier as described in the FSAR (as updated) being exceeded or altered; or (viii) Result in a departure from a method of evaluation described in the FSAR (as updated) used in establishing the design bases or in the safety analyses.

5. 10 CFR 50.71, Maintenance of records, making of reports, Section (e) requires, in part:

Each person licensed to operate a nuclear power reactor under the provisions of § 50.21 or § 50.22, and each applicant for a combined license under part 52 of this chapter, shall update periodically, as provided in paragraphs (e) (3) and (4) of this section, the final safety analysis report (FSAR) originally submitted as part of the application for the license, to assure that the information included in the report contains the latest information developed. This submittal shall contain all the changes necessary to reflect information and analyses submitted to the Commission by the applicant or licensee or prepared by the applicant or

licensee pursuant to Commission requirement since the submittal of the original FSAR, or as appropriate, the last update to the FSAR under this section. The submittal shall include the effects1 of all changes made in the facility or procedures as described in the FSAR; all safety analyses and evaluations performed by the applicant or licensee either in support of approved license amendments or in support of conclusions that changes did not require a license amendment in accordance with

§ 50.59(c)(2) or, in the case of a license that references a certified design, in accordance with § 52.98(c) of this chapter; and all analyses of new safety issues performed by or on behalf of the applicant or licensee at Commission request. The updated information shall be appropriately located within the update to the FSAR.

(1) The licensee shall submit revisions containing updated information to the Commission, as specified in § 50.4, on a replacement-page basis that is accompanied by a list which identifies the current pages of the FSAR following page replacement.

(2) The submittal shall include (i) a certification by a duly authorized officer of the licensee that either the information accurately presents changes made since the previous submittal, necessary to reflect information and analyses submitted to the Commission or prepared pursuant to Commission requirement, or that no such changes were made; and (ii) an identification of changes made under the provisions of

§ 50.59 but not previously submitted to the Commission.

1 Effects of changes includes appropriate revisions of descriptions in the FSAR such that the FSAR (as updated) is complete and accurate.

In addition to the above, ONS licensing basis included the elements described in Section 3.0.

TIA Question 2.a

2. Within [ONSs] licensing basis:

a. Are medium voltage power cables that are intended to provide emergency power to the RPS/ESPS equipment as well as provide the motive force to the actuated ESPS equipment during a chapter 15 event within the scope of IEEE Standard 279-1971?

• Must such power cables be considered under Section 3 Design Basis item 7 for transient conditions?

• Must potential multiphase short circuits or ground faults from such power cables be considered under Section 3, Design Basis, item 8 for unusual events, etc.?

Response to TIA Question 2.a Yes. The medium-voltage safety related power cables that are intended to provide emergency power to the RPS/ESPS equipment as well as provide the motive force to the actuated ESPS

equipment during an UFSAR Chapter 15 event are within the scope of the single failure criteria of IEEE Std. 279-1971 as part of the ONS licensing basis and as described in UFSAR Chapters 8.3.1.2 and 15.14.3.3.6.

The licensees letter dated May 13, 1976, states, in part, that the design of the Oconee onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE Std.

279-1971. Consistent with IEEE Std. 279-1971, the short circuiting of safety related power cables is considered as a single failure that may occur at any time with respect to the events described in Chapter 15 of the ONS UFSAR - meaning before, during, or after an event. The medium voltage power cables at ONS are installed in the concrete raceway routed along with cables for automatic and manual controls for both KHUs and a train of ESPS cables that are electrically connected to both KHUs and all three ONS units. The NRC staff has determined that the licensee must demonstrate that any single failure within the protection system shall not prevent proper protective action at the system level when required. Based on the above standards and ONS current licensing basis, the staff has determined that the criterion established for single failure criteria in IEEE Std. 279-1971 is applicable to the safety related medium voltage power cables and cable configurations at ONS.

Response to TIA Question 2.a (first bullet)

The ONS original licensing basis includes IEEE Std. 279-1968. Section 3 Design Basis items (g) for transient conditions of IEEE 279-1968 are equivalent to Section 3 Design Basis item 7 of IEEE Std. 279-1971 for transient and steady state conditions. Therefore, the medium voltage safety related power cables must meet the requirements in IEEE Std. 279-1968, Section 3, Item (g).

Response to TIA Question 2.a (second bullet)

The ONS original licensing basis includes IEEE Std. 279-1968. Section 3 Design Basis items (h) for malfunctions, accidents, or other unusual events of IEEE Std. 279-1968 are equivalent to Section 3 Design Basis item 8 of IEEE Std. 279-1971. Therefore, the medium voltage safety related power cables must meet the requirements in IEEE Std. 279-1968, Section 3, Item (h).

Medium voltage power cables used in the context of this TIA are located in Trench #3 and Manhole #6 and identified as:

1) Safety related cables a) 13.8 kVac Emergency power from KHU to Transformer CT4 b) 4.16 kVac CX Auxiliary Power from Transformer CT4 switchgear to KHU c) 125 Vdc supervisory cables A d) 125 Vdc control and power cable for A and B trains

2) Non-safety related cables a) 13.8 kVac PSW Power Cables from KHU to Transformer CT6 and CT7 b) 13.8 kVac PSW Power Cables from Fant line The NRC staff concludes that the medium-voltage power cables that are intended to provide emergency power to the ONS, Units 1, 2, and 3 safety systems are within the scope of IEEE Std. 279-1968 and the single failure requirements of IEEE Std. 279-1971.

TIA Question 2.b Does 3-phase medium voltage power cables, intended to provide Class 1E emergency power to the RPS/ESPS equipment, represent interconnecting signal or power cables, as discussed in Section 4.2 of IEEE-279?

Response to TIA Question 2.b Yes. The single failure criteria requirement of IEEE Std. 279-1971 is part of the ONS licensing basis and is described in UFSAR Chapters 8.3.1.2. The 13.8 kVac three phase emergency power medium voltage power cables from KHU to Transformer CT4 intended to provide Class 1E emergency power to the RPS/ESPS equipment do represent interconnecting signal or power cables as discussed in Section 4.2, Single Failure Criterion, of IEEE Std. 279-1971.

The NRC staff determined that IEEE Std. 279-1971, to which the licensee is subject for the reasons discussed above, provides that the licensee should evaluate cable failures that result in the short circuiting of interconnected power cables and any resultant damage and additional failures as a single failure. The staff concludes that the evaluation of short circuits between shielded power cables are credible single failures that must be evaluated as part of the ONS design and licensing basis. This means that short circuits, three phase or otherwise, are considered credible single failures.

See the following applicable guidance and requirements.

Criterion 20, Protection Systems Redundancy and Independence, of the draft GDC proposed by the AEC on July 11, 1967 (32 FR 10213), stated that:

Redundancy and independence designed into protection systems shall be sufficient to assure that no single failure or removal from service of any component or channel of a system will result in loss of the protection function.

The redundancy provided shall include, as a minimum, two channels of protection for each protection function to be served. Different principles shall be used where necessary to achieve true independence of redundant Instrumentation components.

The NRCs position on how single failure was evaluated during the licensing of plants in the late 1960s and early 1970s was discussed in SECY-77-439, Single Failure Criterion, dated August 17, 1977, the draft GDC proposed by the AEC on July 11, 1967, and 10 CFR 50, Appendix A. As stated in paragraph 1 of SECY-77-439:

In general only those systems or components which are judged to have a credible chance of failure are assumed to fail when the Single Failure Criterion is applied. Such failures would include, for example, the failure of a valve to open or close on demand, the failure of an emergency diesel generator to start or the failure of an instrument channel to function. A single failure can also be a short circuit in an electrical bus that results in the failure of several electrically operated components to function.

Paragraph 2.B, Definition of Single Failure, of SECY-77-439 states, in part, that:

Single failure is defined in 10 CFR 50 Appendix A as follows:

A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions.

Multiple failures resulting from a single occurrence are considered to be a single failure. Fluid and electric systems are considered to be designed against an assumed single failure if neither (1) a single failure of any active component (assuming passive components function properly) nor (2) a single failure of a passive component (assuming active components function properly), results in a loss of the capability of the system to perform its safety functions.

A footnote to this definition states that single failures of passive components in electric systems should be assumed in designing against a single failure. This means that for electric systems no distinction is made between failures of active and passive components and all such failures must be considered in applying the Single Failure Criterion. For example, short circuits in electrical cables must be considered even though a short circuit could be regarded as a failure of a passive component.

Section 4.2 of IEEE Std. 279-1971 states, in part, that:

Any single failure within the protection system shall not prevent proper protective action at the system level when required.

NOTE: Single failure includes such events as the shorting or open-circuiting of interconnecting signal or power cables. It also includes single credible malfunctions or events that cause a number of consequential component, module, or channel failures.

TIA Question 2.c Can the timing of electrical failures assumed in analyses be limited to reduce the consequential damage as described in the internal memo to file?

• How is single failure timing applied to the commercial Fant power feeders and the QA-1 power feeders from the KHUs to the PSW different than the Class 1E power feeders to the CT-4 transformer?

Response to TIA Question 2.c No, the timing of electrical failures assumed in the analyses described in the internal memo to file may not be limited to reduce the consequential damage. The licensees internal memo to file is not part of ONS licensing basis and not consistent with NRC staff positions, industry standards, or regulatory requirements. The licensees interpretation of single failure as stated in the internal memo to file is contrary to industry practices, has no technical basis, is not a licensing document, and is not reviewed and approved by the NRC.

The NRC staff reviewed the licensees internal memo to file dated January 12, 1992 (Note: the memorandum was actually written on January 12, 1993), and the licensees single failure design basis document (DBD) to assess whether the statements included in these documents accurately reflected the ONS licensing basis on the timing of electrical single failures as well NRC requirements. It should be noted that the staff has neither reviewed nor approved the licensees positions established in the licensees internal memo to file document. There are no identified license amendments or modification to the licensing basis in accordance with 10 CFR 50.59 that incorporate the internal memo to file into the licensing basis.

The single failure criteria requirements of IEEE Std. 279-1971 is part of the ONS licensing basis.

The NRC staff determined that the ONS licensing basis for single failure is consistent with NRC interpretations dating back to the trial use of IEEE Std. 279-1968 which was originally incorporated into the ONS licensing basis. The single failure criterion of IEEE Std. 279-1971 was incorporated into the ONS licensing basis and later presented to the Commission in SECY-77-439, Single Failure Criterion. SECY-77-439, Single Failure Criterion, dated August 17, 1977, presented to the Commission, the NRC staffs understanding and application of the single failure criterion and how the criterion was applied up to this time. SECY-77-439 states, in part, that:

[A]pplication of the Single Failure Criterion to systems evaluation depends not only on the initiating event that invokes safety action of these systems, together with consequential failures, but also on active or passive electrical failures, which can occur independent of the event. Thus, evaluation proceeds on the proposition that single failures can occur at any time.

A single failure may be the result of events and conditions discussed in Section 3 of IEEE Std.

279-1971. Section 3.7 requires consideration of the range of transient and steady-state conditions of both the energy supply and the environment (for example, voltage, frequency, temperature, humidity, pressure, vibration, etc. during normal, abnormal and accident circumstances throughout which the system must perform. IEEE Std. 279-1971 describes that the maximum energy supply, resulting from a short circuit may not be available at the start time or demand time of a circuit. Hence, no limitations on short-circuit currents may be established by limiting the start time of a single failure. Since the failure can occur over a range of transient and steady-state conditions, it is the licensees responsibility to consider the worst-case credible single failure without constraints to the timing that yields the maximum available short circuit at the Class 1E circuits. The NRC staff notes that by postulating the single failure immediately on demand of a component to function, the licensee failed to establish the most limiting single failure that could occur at the terminations of transformer CT-4. This method of limiting short-circuit current is unacceptable because it masks the worst-case credible single failures, and there is no regulatory precedence for considering such an analysis in lieu of electrical separation.

Based on the information above, the NRC staff has determined that the licensee must consider single failures to occur at whatever time produces the most limiting conditions as described in the single failure criteria of IEEE Std. 279-1971. Additionally, the staff concluded that the licensee must also postulate the most limiting credible fault within the cabling system to envelop any other short-circuit condition. The staff concludes that the licensee is not in conformance with AEC GDC 21, which requires consideration of multiple failures resulting from a single event for designing against a single failure and the NRCs policy on single failure criteria as described in SECY-77-439, as applicable to the recently modified cable configuration.

Response TIA Question 2.c (bulleted question)

Single failure criterion is applied to only Class 1E or safety related power cables and does not apply to non-safety related Fant and the QA-1 power feeders from the KHUs to the PSW. As described in the Response to Question 2.c, the single failure in the Class 1E or safety related power cables can occur at any time during a postulated event. The single failure criteria requirement of IEEE Std. 279-1971 is part of the ONS licensing bases.

The next two paragraphs describe the configuration of the cables when ONS was originally licensed and how the licensee met the NRC requirements of IEEE Std. 279-1968 and single failure criteria requirements of IEEE Std. 279-1971 prior to a recent plant modification.

Chapter 8 of the ONS UFSAR describes that safety related 125 Vdc power and control cables and safety related 120 Vac engineered safeguards protection system (ESPS) cables for redundant trains were directly buried in ground with adequate separation between the two trains and also adequately separated from the 4.16 kVac and 13.8 kVac power cables such that a fault in one train would not adversely impact redundant trains.

The safety related 4.16 kVac and 13.8 kVac power cables were also directly buried with adequate separation between redundant trains and between medium voltage and low voltage power and control cables such that a single failure would not adversely impact redundant trains.

Since the licensing of ONS, the licensee performed a plant modification that rerouted the previously buried medium voltage safety related and low voltage safety related power and control cables and added new non-safety related power cables in a common concrete trench.

The cable rerouting was implemented under the 10 CFR 50.59 program. In addition to the rerouting of the power cables between the KHUs and the three Oconee Units, the licensee introduced a non-safety related 13.8 kVac power feeder to the PSW system in Manhole #6 for normal operation from a 100 kVac power source known as the Fant Line.

As a result of the plant modification, the rerouted cable configuration does not meet the ONS licensing basis for single failure criteria as specified in IEEE Std. 279-1971. The safety related 13.8 kVac and 4.16 kVac power cables and redundant safety related 125 Vdc power and control cables are routed in close proximity to each other in Trench #3. As a consequence, a single failure in a safety related cable in Trench #3 or Manhole #6 may disable redundant circuits for the onsite safety-related emergency power system. As a result, the rerouted cable configuration introduced a new failure mechanism.

UFSAR Section 8.3.1.4.6.2 states that control, instrumentation, and power cables are applied and routed to minimize their vulnerability to damage from any source. The introduction of the non-Class 1E PSW power cables in Manhole #6 and Trench #3 is contrary to the ONS licensing basis since failures in the PSW system cables may degrade safety related systems.

As an example, a failure of a 13.8 kVac safety related emergency power cables from KHU to Transformer CT4 caused by a 3-phase short circuit could induce a large voltage into the redundant safety related 125 Vdc power and control cables in Trench #3 causing failure of ESPS and the reactor protection systems. In addition, cable forces or whiplash resulting from this failure could result in multiple consequential failures to adjacent safety and non-safety related cables in Trench #3 disabling both safety related onsite emergency power systems for all three units.

Therefore, based on the information above, the recent plant modification of rerouting cables in Trench #3 and Manhole #6 resulted in ONS not meeting its licensing basis.

TIA Question 2.d Can ONS staff make any distinctions between passive and active electrical single failures as described in the single failure memo to file?

Response to TIA Question 2.d No. The ONS cannot distinguish between passive and active electrical single failures as described in the ONS internal memo to file because that internal memorandum is not part of the ONS UFSAR and is not part of the ONS licensing and design basis documents the NRC staff has relied upon to evaluate compliance with NRC regulations 10 CFR 50.55a(h)(2) and 10 CFR 50.54(jj). The licensees interpretation of single failure as stated in the internal memo to file is contrary to industry practices, has no technical basis, and is not a part of the ONS UFSAR or TSs.

As stated earlier, the NRCs position on the definition of single failure and how single failure was evaluated during the licensing of plants in the late 1960s and early 1970s was discussed in SECY-77-439. As noted in the response to Question 2.b, this means that for electric systems, no distinction is made between failures of active and passive components and all such failures must be considered in applying the single failure criterion.

ONS UFSAR Section 8.3.1.2, Analysis, the licensees current licensing basis, states, in part, that:

The basic design criterion for the electrical portion of the emergency electric power system of a nuclear unit, including the generating sources, distribution system, and controls is that a single failure of any component, passive or active, will not preclude the system from supplying emergency power when required.

Based on the above information, the NRC staff has determined that the internal ONS memo interpretation contradicts with single failure requirements of IEEE Std. 279-1971 and is not part of the ONS UFSAR, and licensing and design basis documents. In addition, the staff has determined that, as stated in ONS UFSAR Section 8.3.1.2, for electric systems, no distinction is made between failures of active and passive components.

TIA Question 2.e Is the ONS staff required to analyze for combinations of multi-phase short circuits as well as ground faults within trench 3 in order to be compliant with the regulations and/or the current licensing basis for ONS?

Response to TIA Question 2.e Yes. The regulations at 10 CFR 50.54 (jj) require that [s]tructures, systems, and components subject to the codes and standards in 10 CFR 50.55a must be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety function to be performed.

Section 4.2, Single Failure Criterion, of IEEE Std. 279-1971 states that Single failure includes such events as the shorting or open-circuiting of interconnecting signal or power cables. Shorting between independent interconnecting power cables is an exact parallel condition to multi-phase shorts.

The NRC staff has performed an evaluation of the physical installation of the cable and compared it to the ONS licensing basis. The staff determined that the cables in Trench #3 are intertwined and relatively close together in most of the raceway. The failure mode could be initiated due to arcing from one cable to an adjacent cable rather than the ground. This would be the more limiting fault. Duke Energy has not provided an adequate basis to conclude that multi-phase faults are non-credible in all sections of the cable runs, other than at the terminal connections. Since short circuits may occur between two-phase conductors, between all phases of a polyphase system, or between one or more phase conductors and ground, the short circuit may be solid (or bolted) or welded, in which case the short circuit is permanent and has relatively low impedance. ONSs licensing and design bases includes conformance to the single failure requirements of IEEE Std. 279-1971. The conformance to IEEE 279-1971 includes the requirements to consider the full effects and consequences from electrical single failures in the onsite power system.

Therefore, the NRC staff concludes that ONS is required to analyze for combinations of multi-phase short circuits as well as ground faults within Trench #3 to meet the single failure requirements of IEEE Std. 279-1971.

TIA Question 2.f Is the licensee required to analyze for consequential damage from electrical failures to the adjacent Class 1E safety systems?

• Is the licensee required to assume that AC circuits could short to DC circuits?

• If so, are the installed ONS 125Vdc protective devices sufficient to mitigate the effects of AC voltages ranging from 2.5kVac to 13.8kVac to prevent these voltages from propagating throughout the DC systems?

Response to TIA Question 2.f Yes. The licensee is required to analyze for consequential damages from a single electrical failure to the adjacent Class 1E safety systems to ensure that redundant safety trains are not adversely affected and it does not cause a common cause failure of a system in accordance with AEC GDC 21, 10 CFR 50.55a(h)(2), and single failure requirements included in Sections 4.2, 4.7, 4.11 and 4.17 of IEEE Std. 279-1971 in the ONS licensing basis.

Duke Energy has stated that the design of the ONS onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE Std. 279-1971. Section 4.2, Single Failure Criterion, of IEEE Std. 279-1971 states, in part, that:

Any single failure within the protection system shall not prevent proper protective action at the system level when required.

NOTE: Single failure includes such events as the shorting or open-circuiting of interconnecting signal or power cables. It also includes single credible

malfunctions or events that cause a number of consequential component, module, or channel failures.

Response to TIA Question 2.f (first and second bulleted questions)

Bullet #1:

Yes. As stated earlier, in accordance with AEC GDC 21 (as stated in the ONS UFSAR) and 10 CFR 50.55a(h)(2) (IEEE Std. 279-1968 and the single failure requirements of IEEE Std. 279-1971), the licensee is required to analyze for consequential damage from electrical failures that can affect adjacent Class 1E safety systems in Trench #3 and Manhole #6 to ensure that redundant safety trains are not adversely affected by any new failure modes, so that the consequential damage does not result in a common cause failure of a system.

Bullet #2:

No, the effects of 13.8 kVac cables to the 125 Vdc protective devices should be analyzed for consequential damage as described in NRC Response to Question 2.f above as part of the ONS licensing basis. The components designed for 125-Vdc systems in Trench #3 and Manhole #6 are not qualified to withstand the 13.8 kVac power levels or terminal voltages that could adversely impact the 125 Vdc protective devices due to certain types of failures of the collocated 13.8 kVac power cables. Operating experience (e.g., GL 2007-01) have shown that these types of failures are credible.

The licensee provided additional information in support of the TIA review by letters dated May 11, 2015, and August 7, 2015. This information reiterated the licensing basis of the plant and provided information related to cable testing performed to evaluate the physical strength of the cables installed in Trench #3 associated with Keowee power system. In addition, the letters provided information such as types of cables installed at ONS, separation criteria related to heat dissipation, overfill of cable trays, types of faults that can be postulated concurrent with design basis events, and the excess margin in design of power cables in Trench #3. The ONS has also provided risk-informed analysis information for external fire events. The Region II staff reviewed the information provided in the letters and determined that the additional information did not contain any new details on the adequacy of the design and installation of the cables in Trench #3.

The NRR staff considered all of the licensees supplemental information in its technical evaluations and was not able to identify any licensee documentation demonstrating, by analyses and tests, that the present as-built configuration has adequate physical separation and that the Class 1E system protective devices actuate prior to any consequential damage to the redundant engineered safety feature circuits. In the absence of such analysis and test data, the licensee must assume that 13.8 kVac cables could damage adjacent 125 Vdc power and control cables and other engineered safety feature circuits from a worst-case credible short circuit that would result in multiple consequential failures.

TIA Question 2.g Are all commercial, non-quality related (i.e. not QA-1 or QA-5) electrical components assumed to fail in the most limiting way possible?

• Does the failure of one of these commercial components represent a single failure, in the context of the ONS licensing basis?

Response to TIA Question 2.g Yes, only safety related or Class 1E designated components are credited to mitigate design basis events. The single failure criteria requirements of IEEE Std. 279-1971 apply to Class 1E designated components. The ONS UFSAR Chapter 15 for SSCs describes crediting Class 1E in the accident analysis assumptions. The licensee may not credit any non-safety equipment unless it is specifically evaluated and approved in the plant licensing basis. The non-safety related power cables in Trench #3 and Manhole #6 are not credited in the ONS licensing basis for mitigating design basis events. Therefore, the license must account for the impacts of worst-case credible failures of non-safety equipment on Class 1E circuits as required by IEEE Std.

279-1968, items 3(g) and 3(h)5, regarding environmental impacts and impacts of malfunctions, accidents, or other unusual events.

Response to TIA Question 2.g (bulleted question)

No. The single failure criterion requirements of IEEE Std. 279-1971 only applies to safety-related or Class 1E designated SSCs.

As an example, a failure of the non-safety related Fant line 13.8 kVac power cables is assumed to occur at any time. This failure is considered as a worse case credible fault condition. The integrity of the Class 1E systems in the common underground raceway in Trench #3 must be demonstrated by the licensee with the above failure and a single failure of the Class 1E equipment. This must not result in loss of safety function of a system or introduce a common cause failure within the electrical power system(s).

TIA Question 2.h Can unrestrained cable whip in trench 3 be assumed to cause cable damage leading to secondary short circuits that could cause damage to the DC systems and should these effects of cable whip be analyzed?

Response TIA Question 2.h Yes. The detrimental effects of cable whip for a worst case credible cable fault in Trench #3 must be analyzed in accordance with the single failure criteria requirements of IEEE Std. 279-1971, specified in response to TIA Question 1 above.

The electromagnetic forces produced by a short circuit condition can cause whipping of any of the 13.8k Vac power cables in Trench #3 and Manhole #6, which exerts significant forces on cable restraints and any adjacent cables. Hence, the electromagnetic forces generated from a 5

IEEE Std. 279-1971 Sections 3(7) and 3(8) are equivalent to IEEE Std, 279-1968 Sections 3(g) and 3(h).

postulated short circuit failure in the 13.8 kVac medium voltage power cables in Trench #3 must be considered in the analysis and demonstrated by tests to validate that there is no collateral damage to adjacent safety related 125 Vdc protection and control system cables.

TIA Question 2.i Are overload currents as well as short circuit currents required to be evaluated to determine the most limiting results from electrical faults and component failures?

• Do the results of such an analysis influence the required component separation to meet regulatory requirements and the ONS licensing basis?

Response to TIA Question 2.i No. Only the worst-case credible short circuit currents are required to be evaluated to determine the most limiting results from electrical faults and component failures. Cables are designed to operate under overload conditions without causing consequential damage to other cables. The licensee must follow the requirements for maintaining cable separation, redundancy, and independence to permit the required functioning of the engineered safety feature equipment in accordance with AEC GDCs (principal design criteria).

Response to TIA Question 2.i (bulleted question)

Yes, the results of short circuit analysis can influence the required component separation to meet regulatory requirements and the ONS licensing basis. The licensee must meet the design basis requirements specified in ONS UFSAR Section 8.3.1.4.6.2, Cable Separation, and regulatory requirements specified in AEC GDCs 22, 23, 24, and 39 and 10 CFR 50.55a(h)(2) and 10 CFR 50.54(jj) requirements.

TIA Question 2.j Can cable shielding or armor prevent short circuits or limit faulted currents and voltages?

• Can the two wraps of bronze shielding tape in the licensees current power cable configuration be considered equivalent to the steel interlocked armored cable as described in the test report MCM-1354.00-0029.001?

• Are the results of test report MCM-1354.00-0029.001 sufficient to demonstrate that electrical faults cannot propagate from one cable to another as described in the single failure DBD, Section 3.3.6.1?

Response to TIA Question 2.j No. Both cable shielding and armor cannot be credited for preventing short circuits or limiting fault currents and voltages. Cable shielding and cable armor serve different functions. A shield is employed in the subject cable design to preclude excessive voltage stress on voids between the conductor and insulation, and to confine the electric field of the cable to the insulation of the conductor or conductors.

Cable Shield and Armor in Power Cables

The following definitions were drawn from IEEE Std. 422-1986, Guide for the Design and Installation of Cable Systems in Power Generating Stations, and the Okonite Company Engineering Information (http://okonite.com/engineering/shielding.html), and in the NRC staffs experience are typical of cable manufacturers literature.

Definition of Shielding Shielding of an electric power cable is the practice of confining the electric field of the cable to the insulation of the conductor or conductors. It is accomplished by means of strand and insulation shields.

Functions of Shielding A strand shield is employed to preclude excessive voltage stress on voids between conductor and insulation. To be effective, it must adhere to or remain in intimate contact with the insulation under all conditions.

An insulation shield has a number of functions:

a) To confine the electric field within the cable.

b) To obtain symmetrical radial distribution of voltage stress within the dielectric, thereby minimizing the possibility of surface discharges by precluding excessive tangential and longitudinal stresses.

c) To protect cable connected to overhead lines or otherwise subject to induced potentials.

d) To limit radio interference.

e) To reduce the hazard of shock. If not grounded, the hazard of shock may be increased.

Definition of Armor A mechanically strong and flexible sheath of corrugated aluminum, copper, bronze or steel which can be applied over a variety of cable cores. Armor is a metal layer wrapped around the exterior of a cable to provide mechanical protection. It is primarily used in hazardous environments that require an extra layer of cable defense, or in situations where Type MC (metal clad) cable is required by the National Electric Code. The metal armor can protect the cable against falling objects, crushing, and other physical damage.

Armor vs. Shielding Although both are metal layers used in cable to provide protection, each provides a very different kind of protection. Armor, located on the outside of the cable, is a sturdy layer of metal designed to protect mechanical integrity. It protects the cable against physical hazards and prevents it from being crushed or damaged by outside forces. Shielding is incorporated in the inner layers of the cable, around the conductor. It works to minimize electromagnetic interference and prevents the cable from intercepting outside currents or signals that could damage its productivity. Whether armor and shielding are both used in a cable depends on the application for which it is being designed.

Response to TIA Question 2.j (first and second bulleted questions)

Based on the information above, the cable does not have any armor. The bronze shield is employed to preclude excessive voltage stress on voids between the conductor and insulation, and it confines the electric field of the cable to the insulation of the conductor or conductors.

The NRC staffs review of the McGuire and Catawba medium-voltage cable test report indicated that the ONS cables are not similar (6.9 kVac and 4.16 kVac versus 13.8 kVac, as well as differences in the cable design and the cable physical configuration). The staff finds that the tests performed on the McGuire/Catawba interlocked armor cables were not adequate to envelope the potential faults if high energy power cables (such as the ONS 13.8 kVac) were short circuited within underground electrical raceway systems. The cable testing performed cannot be extrapolated for use to eliminate fault propagation for ONS for the following reasons:

1. Each cable is designed differently. The results of testing on one type of cable do not necessarily determine the results for a different type and make of cable.

2. Testing was only conducted on one 600 V, one 4160 V, and one 6900 V cable. This is not a sufficient sample size to properly determine the behavior of the cables that are being tested.

3. The testing was not conducted with reducing separation criteria in mind.

The purpose was to show that fire propagation would not occur.

4. Contrary to ONSs assertions, the 6900 V test resulted in the armor around the fault area being melted and blown back. Additionally, it was noted that a loading crate 6 feet from the cable was set on fire. These

results tend to point toward a high energy arc fault occurring, which is indicative of the type of event that could result in catastrophic failure of other cabling depending upon where in the path of the high energy arc fault that the cabling is routed.

Thus, the testing documented in report MCM-1354.00-0029.001 is not applicable to the cables installed in the ONS underground raceway systems (i.e., connected between the Fant line, PSW, KHS, and ONS systems). Therefore, the licensee has not demonstrated that electrical faults will not propagate from one cable to another.

TIA Question 2.k Does the interconnected nature of the Class 1E DC systems in the ONS KHU start panels and the Keowee hydro-station KHU start panels present vulnerabilities where DC to DC interactions could disable the Keowee emergency power systems?

Response to TIA Question 2.k Yes, the Class 1E direct current systems that operate at 125 Vdc have termination clearances and cable insulation capabilities that can withstand marginally higher voltages - typically up to 250 Vdc. At KHU, the safety related DC cable and DC cable terminations in ONS KHU start panels for both trains are in close proximity. In addition, the safety and non-safety related medium-voltage power cables are in close proximity to the safety related 125 Vdc power and control cables in Trench #3 and Manhole #6. Any 13.8 kVac power cable fault could induce voltages up to 13.8 kVac in the 125 Vdc system resulting in a flash over at the terminals in the KHU panels. Hence, the interconnected nature of the ONS/KHS designs could expose the 125 Vdc power and control cables to a single point vulnerability such that a DC-to-DC short circuit at the KHU panel terminal blocks may disable both KHUs. Since the three ONS units consolidated their ESPS emergency power starting system wiring into two ESPS start trains (A and B) within KHU/ONS cabinets, all three units are potentially vulnerable to failure of an ESPS start demand for the KHUs.

Thus, the NRC staff has determined that a single failure vulnerability could exist for DC-to-DC short circuits in the KHU emergency start and switchyard isolation features because of the recent plant modification performed when rerouting the 13.8 kVac medium voltage power cables and 125 Vdc power and control cables in Trench #3.

The licensee has not demonstrated that existing routing of power and control cables, including the ESPS protection circuits to the KHU units, from each ONS unit have adequate separation, independence, and redundancy, as specified by the ONS licensing basis.

Additionally, the licensee failed to demonstrate that no potential exists to disable functional requirements of redundant Class 1E systems. In accordance with 10 CFR 50.34(b)(2), the licensee must provide a description and analysis of the SSCs in the UFSAR to include the design bases and limits on operation to show that the safety functions will be accomplished.

UFSAR Section 8.3.1.4.6.2, Cable Separation, and the ONS principal design criteria based upon the AEC GDCs 19, 20, 21, 22, 23, 24, and 39, provide descriptions for the licensees conformance to applicable requirements.

4.0 CONCLUSION

The NRC staff concludes that the 10 CFR 50.59 plant modifications made to the ONS design do not comply with the licensing bases as it pertains to placing safety related cables in close proximity to high energy non-safety related energy sources in Trench #3 and Protected Service Water Modifications discussed in Unresolved Item 05000269/2014007-05, 05000270/2014007-05, 05000287/2014007-05, Potential Unanalyzed Condition Associated with Emergency Power System. Furthermore, the staff is concerned that these modifications potentially introduced new failure modes that were not adequately analyzed.

Attachment:

NRC Staff Response to Duke Energy Fact Check Letter

NRC Staff Response to Duke Energy Carolinas, LLC August 15, 2016, Fact Check Letter In accordance with the Office of Nuclear Reactor Regulation (NRR) Office Instruction, COM-106, Revision 5, Control of Task Interface Agreements (Agencywide Documents Access and Management System (ADAMS) Accession No. ML15219A174), on August 2, 2016, the U.S. Nuclear Regulatory Commission (NRC) provided Duke Energy Carolinas, LLC (Duke Energy, the licensee),

with the draft Task Interface Agreement (TIA) 2014-05 response (ADAMS Accession No. ML16214A003) for a fact check related to an unresolved item at the Oconee Nuclear Station (ONS), Units 1, 2, and 3 involving cable configurations in certain underground cable raceways. The licensees letter dated August 15, 2016, provided its response (ADAMS Accession No. ML16231A451). The NRC staff has reviewed the licensees response and concluded that it did not identify any factual errors. However, the staff made several clarifications to the TIA Response in response to the licensees comments and observations. The following NRC staffs response is provided to document the basis for staffs conclusions concerning the licensees views pertaining to TIA response provided for the NRC Region II questions.

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response 1.0, Introduction Duke Energy did not identify any factual inaccuracies in this No NRC response required. N/A section of the draft TIA response.

Comment No. 1 2.0, Background The ONS Updated Final Safety Analysis Report (UFSAR) The language identified by this comment was in the No Section 8.3.1.4.6.2 (Ref. 1) provides the licensing basis background section of the NRCs TIA response, and Comment No. 2 cable separation requirements. It should also be pointed represents a paraphrase of the Component Design Basis out that NRR staff identified the ONS licensing basis for Inspection (CDBI) report. The TIA response did not rely upon cable separation requirements in Section 3, Staffs the paraphrased language, and instead verified the licensing Technical Evaluation, of the draft response. basis from a review of ONS licensing basis documents as described in the Evaluation section of the TIA.

Comment No. 3 This NRR statement is incorrect because the three (3) ONS The language identified by this comment was in the No units were licensed well before the issuance of the initial background section of the NRCs TIA response, and revision for Standard Review Plan (SRP), Section 8.2 represents a paraphrase of the CDBI report. The TIA (Ref. 2) and the SRP has not subsequently been added to response did not rely upon the paraphrased language, and the ONS licensing basis. Additionally, [Institute of instead verified the licensing basis from a review of ONS Electronics and Electrical Engineers (IEEE)] Standard 379 licensing basis documents as discussed in the Evaluation (Ref. 3) is not a part of the ONS licensing basis and section of the TIA.

therefore statements in this standard, that all failures must be assumed, are outside of the scope of the ONS licensing Although not specifically discussed in the Evaluation section basis. Specifically, in the absence of regulations and of the TIA, as pointed out in this comment, IEEE Std. 379 and Attachment

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response standards at the time of initial ONS licensing, Duke Energy, the referenced version of the SRP Section 8.2 is not part of with awareness by the Atomic Energy Commission (AEC), the ONS licensing basis. The TIA relied on the ONS AEC developed its own single failure criterion, using GDC; included in the UFSAR IEEE Std. 279-1968 and single correspondence from the AEC and available mechanical failure criteria requirements in IEEE Std. 279-1971 as and electrical codes at the time. In addition, ONS has not discussed in the Evaluation section.

adopted IEEE Standard 379 or the use of the NRC-referenced version of SRP 8.2 in any subsequent The NRC agrees that only credible failures need to be ONS-related licensing basis docketed correspondence. addressed. In this TIA, as discussed in the Evaluation section, the NRC believes that the failure modes in question are The NRC has been aware of the ONS approach to credible and must be considered. The NRC does not believe satisfying single failure criteria as a result of decades of that the ONS design features (bronze shielding) precludes the specific NRC review of related documents and Duke Energy failure mechanisms.

submittals to the NRC. As an example, ONS specification OSS-254.00-00-4013, Design Basis Specification for the Oconee Single Failure Criterion (Ref. 4), provides the overall site guidance on the application of the single failure criterion. The ONS licensing basis is stated in Section 3.2.1.4.1, Credible Failures, which states, Application of the single failure criterion does not require that all failures be assumed. Only those failures with a credible chance of occurring must be considered in evaluations of system design bases.... As discussed throughout this enclosure, ONS has consistently determined that certain failures, which the NRC relies on, are not credible. The staffs Technical Evaluation focused on standards and did not address the design features that preclude the failure mechanisms raised by the TIA.

Furthermore, NRR undertook a formal review of the ONS Electrical Distribution System (EDS) in August 1995. [A request for additional information (RAI)] response (Ref. 5) stated, in part, that, In general, only those systems or components with a credible chance of failure are assumed to fail. ONS is not aware of a requirement that all possible failures must be assumed. Also, components are assumed

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response to fail only in a credible failure mode. The necessity that the failure mode be credible forms the basis for ONS decisions regarding separation, which are at issue. In its final report (Ref. 6), NRR acknowledged that, Because Oconee was not licensed to 10 CFR 50, Appendix A, the plant specific single failure definition for Oconee remains valid and in effect with no additional requirements on the electrical power systems [as a result of 10 CFR 50.46 or 10 CFR 50, Appendix K]. (p. 113) Therefore, the staff erred in its reliance on IEEE-379 in making its conclusion.

This error appears in multiple locations within the document.

Comment No. 4 The wording in the May 13, 1976 (Ref. 7), letter states that Duke is correct in asserting that the 1976 Parker letter stated, Yes the Oconee onsite emergency [alternating current (AC)] The design of the Oconee onsite emergency AC and DC and [direct current (DC)] power systems conform to the power systems conforms to the single failure requirements of single failure requirements of IEEE 279-1971. The single IEEE 279-1971 (emphasis added). The NRC will correct the failure requirements are contained in Section 4.2 of that error in the TIA response; however, the staff notes that single standard. ONS did not commit to the rest of IEEE 279-1971 failure requirements are included in Sections 4.2, 4.7, 4.11, (Ref. 8) nor did it imply to do so in any subsequent and 4.17 of IEEE Std. 279-1971.

correspondence. For the TIA to now reference other sections of IEEE 279-1971 (Ref. 8) and portray them as As stated in the TIA response, the design basis of the Oconee being within the ONS licensing basis (i.e., applicable to onsite emergency AC and DC power systems requires ONS) incorrectly portrays the commitment Duke Energy conformance to the single failure requirements of IEEE Std.

made in its May 13, 1976 letter. 279-1971. Single failure requirements are specifically addressed in response to questions 2a, 2b, 2c, 2d and 2f.

The basic definition and requirement for single failure criterion in Section 4.2 of IEEE Std. 279-1971 is adequate to maintain staffs position for the responses in this TIA. However, Section 4.7 is part of the single failure criteria and helps to understand the intent of separation/isolation criterion and how to ensure that single failure vulnerabilities do not have adverse impact on related or redundant system. Section 4.7.2 elaborates on examples of credible failures and potential failures of isolation devices. Section 4.7.3 elaborates

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response on the requirements of redundant train after postulated single failure. Section 4.11 elaborates on the requirements of single failure criteria still applies while performing channel bypass or removal from operation. Section 4.17 elaborates on the requirements of single failure criteria still applies during manual initiation of a protection system.

Comment No. 5 The terms close proximity, adjacent and mixing The language identified by this comment was in the No suggest that cables were not routed in consideration of background section of the NRCs TIA response, and cable separation requirements. All cables are routed in represents a paraphrase of the CDBI report. The TIA accordance with ONS cable separation design and response did not rely upon the paraphrased language, and licensing requirements per [Updated Final Safety Analysis instead verified the licensing basis from a review of ONS Report (UFSAR)] Section 8.3.1.4.6.2 (Ref. 1) and other licensing basis documents.

station cable separation requirements (e.g., Ref. 27 and Ref. 29).

Comment No. 6 The neutral grounding transformer and resistor installed on The language identified by this comment was in the No the Keowee generators were installed to limit equipment background section of the NRCs TIA response, and damage for phase-ground faults. This is a standard power represents a paraphrase of the CDBI report. The TIA system practice and by design, will limit phase-ground fault response did not rely upon the paraphrased language, and current resulting in a decrease of energy release instead verified the licensing basis from a review of ONS magnitude. licensing basis documents.

3.0, Staffs Technical The NRR reference to UFSAR Section 8.3.1.4.6.2 is The licensees reference to the ONS licensing basis with No Evaluation incomplete in that the following pertinent information should respect to armoring is not relevant to the discussion in be included. Specifically, UFSAR Section 8.3.1.4.6.2 UFSAR 8.3.1.4.6.2 on cable separation. Armoring of cable is Comment No. 7 continues to state that it is ONS intent wherever physically a separate matter from separation of cable. The UFSAR possible to utilize metallically armored and protected cables discussion quoted by the licensee appears to be an (History of ONS systems. By this we mean the use of rigid and thin wall explanation of the meaning of cable armoring and protection licensing basis for metal conduit, metal sheathed cables (aluminum and other at ONS, and does not address whether armoring may electric power systems metals), bronze armored control cables, steel interlocked substitute for separation. Accordingly, the safety evaluation and associated armor, or metallic taped power and control cables, and report (SER) statements approving ONS cable separation interfacing systems) either interlocked armor, served wire or braided armored design and installation, which are quoted by the licensee, instrumentation cables. Cable armoring has been an cannot reasonably be read as an NRC staff approval of important design feature for satisfying cable separation criteria for substituting cable armoring in lieu of meeting criteria at ONS. Additionally, UFSAR Section 8.3.1.4.6.2 applicable separation requirements.

also states that five inches of cable tray rail to rail

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response separation is provided on installation of a cable tray. In a The staff also notes that until 2010, in this FSAR section, the January 26, 1972 letter (Ref. 10), the AEC endorsed Duke final sentence of this paragraph stated: With this type Energys proposal to revise the [final safety analysis report construction fire stops as such are not required. This (FSAR)] to show that the original cable separation criteria indicates the intent of using metallically armored and will be met including no cable tray overloading and a protected cable systems was as a fire protection feature to minimum of five inches rail-to-rail space between all vertical eliminate the use of fire stops, not for physical separation of trays. The AEC stated in the letter that we conclude that trains. This sentence was deleted by an FSAR change 09-51.

your proposal as noted above is acceptable.

The licensee referenced the AECs approval of five inches The ONS SER dated Dec. 29, 1970 (Ref. 11), (page 54, rail-to-rail space between all vertical trays. The licensee did Section 8.5, Cable and Equipment Separation and Fire not identify any part of the TIA response that is inconsistent Prevention), endorses the staffs acceptance of Oconees with the AECs approval.

cable separation design through the following statements:

We have reviewed the applicants design and provisions The licensee referred to the NRCs approval of ONS SER and installation arrangement plans relating to (1) the dated December 29, 1970. The licensee did not identify how preservation of the independence of redundant safety the portion of the NRC approval referenced by the licensee equipment by means of identification and separation, and relates to the discussion of cable separation in Section 3.0, (2) the prevention of fires spreading through derating of Staffs Technical Evaluation, on page 14 of the TIA response.

power cables and proper tray loading. We have found these design provision and installation arrangements acceptable.

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response Comment No. 8 The staffs interpretation of the ONS licensing basis with The NRC agrees that amendment Nos. 366, 368, and 367 for Yes respect to the applicability of IEEE 603 and IEEE 379 to ONS Units 1, 2, and 3 for LAR 2007-09 (ADAMS Accession (Staff discussion of systems beyond [reactor protection system/engineered No. ML100220016) incorporated IEEE Std. 603-1998 and history of ONS licensing safeguards protection system (RPS/ESPS)] is inconsistent 379-1994 as the licensing basis criteria for the single-failure basis for electric power with licensing commitments made by ONS to the NRC. The criterion, independence and separation requirements of the systems and associated ONS commitment to these standards is limited to the new portion of the RPS/ESPS affected by the design change.

interfacing systems) digital portion of the RPS/ESPS upgrade. The However, the ONS FMEA for the digital RPS/ESPS includes January 2008 [license amendment request (LAR)] (Ref. 14) consideration of impacts of cable faults on the digital stated that IEEE Standard 603-1991 applies only to RPS/ESPS circuits. These standards are part of the ONS portions of the RPS/ESPS affected by the design change. licensing basis for the FMEA for the digital components. The Furthermore, the ONS [failure modes and effects analysis TIA has been revised to clarify this position.

(FMEA)] calculation (Ref. 15) that was reviewed and referenced in the January 2010 SER (Ref. 16) for LAR 2007-09 (Ref. 14) clearly states that IEEE-Standard 603 is only applied to the digital components.

3.1, Response to As discussed in several Duke Energy Comments in this The staff disagrees with the comment. The staff has No Requested Actions enclosure, it appears the draft TIA response incorrectly performed an extensive examination of all the NRC describes the ONS licensing basis in that the draft TIA correspondence with Duke Energy, all relevant safety Comment No. 9 response does not recognize elements of the licensing evaluations for license amendments, the CDBI inspection basis and/or it incorrectly expands aspects of the licensing report, all applicable sections of the ONS UFSAR, and the (Ref: TIA Question 1) basis to systems and components beyond that which was background information provided by the CDBI inspection identified in licensee commitments. team in the TIA, including Duke Energy letters dated May 11, 2015 (ADAMS Accession No. ML15139A049), and August 7, 2015 (ADAMS Accession No. ML15224A370), and the NRC independent review teams feedback. Based on the review of these documents, the staff has correctly assessed what the ONS licensing basis is and has documented that in Section 3.0 of the draft TIA response.

Comment No. 10 Because ONS was issued construction permits on The staff agrees that the single failure criteria requirements of Yes November 6, 1967 (Ref. 17), protection systems must be IEEE Std. 279-1971 is part of the ONS licensing basis.

(Ref: TIA Question 2.a) consistent with their licensing basis in order to satisfy the requirements of 10 CFR 50.55a(h)(2). As noted in Duke IEEE Std. 279 1971 Section 4.2, Single Failure Criterion, Energy Comment #4, the only portion of IEEE states, Single failure includes such events as the shorting or Standard 279-1971 that is a part of the ONS licensing basis open-circuiting of interconnecting signal or power cables.

for the onsite AC and DC emergency power systems are

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response the single failure requirements in Section 4.2. The staff is Where shorting between independent interconnecting power incorrect in stating that Section 3, Design Basis, of the cables is an exact parallel condition to multi-phase shorts.

standard applies to the ONS power cables. Furthermore, as noted in Duke Energy Comment #8, it is also incorrect to The staff disagrees that only the single failure requirements in apply IEEE Standard 603-1991 requirements to the ONS Section 4.2 of IEEE Std. 279-1971 is part of the ONS power cables that are the subject of this TIA. licensing basis. The staff notes that single failure requirements are included in Sections 4.2, 4.7, 4.11, and 4.17 In addition, IEEE Standard 279-1971 does not include the of IEEE Std. 279-1971.

term multiphase. The Note in IEEE 279-1971 Section 4.2 references shorting or open-circuiting or interconnecting The ONS adopted IEEE 279-1968 in its entirety as its signal or power cables and credible malfunctions. A licensing basis. Section 3 Design Basis items (g) for multiphase fault can occur at either end of the subject transient conditions of IEEE 279-1968 are equivalent to cables, since that is the location where all three phases Section 3 Design Basis item 7 of IEEE 279-1971 for come together at a common connection point. transient and steady-state conditions. The ONS adopted IEEE 279-1968 in its entirety as its licensing basis. Section 3 For faults at other locations, ONS position on a shorting Design Basis items (h) for malfunctions, accidents, or other malfunction resulting in multiphase faults for the unusual events of IEEE 279-1968 are equivalent to Section 3 single-conductor medium voltage bronze tape power cables Design Basis item 8 of IEEE 279-1971.

is as follows:

As stated above for response to Comment No. 8, the staff has Each phase conductor of the subject three-phase determined that IEEE Std. 603 requirements are also 13.8 [kiloVolt (kV)] and 4.16 kV power systems is a single applicable to the ONS Units 1, 2, and 3 based on licensee discrete component. For the specific ONS cable design commitments documented in Amendment Nos. 366, 368, and and installation, a single failure (i.e. shorting malfunction) 367 for ONS, Units 1, 2, and 3, respectively, for LAR 2007-09 begins as a cable insulation failure resulting in a single (ADAMS Accession No. ML100220016). The ONS FMEA for phase-ground fault. Engineering analysis has the digital RPS/ESPS includes consideration of impacts of demonstrated that the cable bronze tape metallic shield is cable faults on the digital RPS/ESPS circuits. These capable of carrying the phase-ground fault current for the standards are part of the ONS licensing basis for the FMEA required duration to allow the protective relaying and for the digital components. References to IEEE breaker to detect and clear the fault prior to propagation to Std. 603-1998 have been clarified or removed.

a multiphase fault in other separate discrete cables.

In addition, the licensee has referenced IEEE Std. 279-1971 Cable fault testing of the ONS single conductor bronze tape stating that it does not include the term multiphase. This cable was performed in 2015. The fault testing included statement challenges the meaning of multiphase and it does purposely induced phase-ground cable faults using power not challenge factual information of the ONS licensing basis.

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response sources that emulated the ONS and Fant power systems Therefore, the staffs conclusions of Section 3.1, Response with respect to power source grounding type (solid and to Requested Actions, remain unchanged.

resistance), voltage, available phase-ground and multiphase fault currents and fault durations. The fault Regarding cable fault testing, the NRC staff observed the durations were based on relay response and breaker referenced tests and reviewed the results. The staff opening times. The results of the fault testing determined that the testing as conducted by the licensee demonstrated that a single-phase to ground fault would not produced anecdotal results that did not demonstrate the propagate to a multiphase fault. capability of the bronze tape cable to meet separation requirements for the cable design and configurations in Therefore, based on analysis that has been validated by question.

testing, ONS believes it has adequately addressed multi-phase faults on the single conductor bronze tape The testing failed to simulate the failure modes identified in design in our analyses. the TIA, or the actual power levels to which these systems and the ESPS cabling are exposed. The staff noted that the specified test criteria appear contingent on the concepts specified in the ONS internal memo to file, which then produced the observed anecdotal results:

The tests discounted multi-phase faults because the licensee believes that they are not credible. This was the subject of Question 2.e; the licensee must consider failures at any time including credible failure modes for cable short circuits and multi-phase failures are in fact credible.

The licensee used the single failure on-demand concept to reduce the fault current available to damage components.

This was the subject of Question 2.c; the licensee must consider failures at any time including credible worst-case scenarios.

The ONS report did not include the induced voltages observed on the test conductors. The observed induced voltages appeared large enough to be extremely damaging to the DC ESPS cables, which are a subject of the TIA.

Question 2.f asked about induced voltages and impressed

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response voltages. ONS must consider these voltages along with the consequential damage to adjacent Class 1E components.

The staff considered all testing and arguments presented by ONS and concluded that multi-phase short circuits were a credible failure mode that Duke must consider in the ONS design. Also, per IEEE Std. 279-1971 Section 4.2, Single Failure Criterion, the shorting or open-circuiting of interconnecting signal or power cables was identified as a credible single failure. Shorting between independent interconnecting power cables is considered a single failure by the staff and is an exact parallel condition to multi-phase shorts. (page 25 of the final TIA response; it is a single failure when two cables short together.)

Therefore, the staff concluded that the medium-voltage power cables that are intended to provide emergency power to the ONS Units 1, 2, and 3 are within the scope of IEEE Std. 279-1971 for compliance with the requirements specified in NRC regulations 10 CFR 50.55a(h)(2) and 10 CFR 50.54(jj). In addition, the staff has determined that Section 3, Design Basis, of IEEE Std. 279-1971 is applicable to the ONS power cables based on the fact that these system descriptions are detailed in the scope of IEEE Std. 279-1971. Section 3 of IEEE Std. 279-1968 is equivalent to Section 3 of IEEE Std. 279-1971.

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response Comment No. 11 The 3-phase medium voltage power cables are As stated above in Comment No. 10, the staff has determined No interconnected to RPS/ESPS equipment in the context that the medium-voltage power cables that are intended to (Ref: TIA Question 2.b) that the Keowee generator is a power source and the provide emergency power to the ONS, Units 1, 2, and 3 are interconnections are through a 13.8/4.16 kV transformer, within the scope of the single failure criteria requirements of then cabling to another 4.16 kV/600 [Volt (V)] transformer, IEEE Std. 279-1971 for compliance with the requirements then cabling to other transformers and/or battery specified in NRC regulations 10 CFR 50.55a(h)(2) and chargers/inverters to reduce the voltage down to the 10 CFR 50.54(jj).

requirements for RPS/ESPS signals. The cables associated with these voltage transformations have IEEE Std. 279-1971 Section 4.2 states, that single failures protective devices to detect and clear faults. included, single credible malfunctions or events that cause a number of consequential component, module, or channel As discussed in Duke Energy Comment #8, ONS has never failures. This statement in the standard is in direct conflict committed to conform to the requirements of IEEE Standard with the ONS comment. Therefore, the staffs conclusions of 603-1991 for the medium voltage power and control cables Section 3.1 Response to Requested Actions, response to that are the subject of this TIA question. Question 2.b remain unchanged.

The NRR Question 2.b statement also includes on page 24 Duke has stated that the interconnectivity of the three-phase (2nd paragraph) that this occurrence would be a single medium voltage cables and the lower voltage RPS/ESPS failure, not two failures as the licensee asserts. It appears signal cables exists through various transformers. The this statement is implying that ONS must consider comment states further that there are multiple protective multi-phase faults anywhere in the cable route. As devices in the circuit to detect and clear faults implying that previously stated in Duke Energy Comment #10, other than the fault consequences are minimal. The staff notes that at the cable ends, a single failure is a phase-ground fault on protective devices function AFTER a fault has occurred..

one of the single conductor cables. Therefore the Duke has not provided an adequate basis to conclude that postulated interconnection via the initial phase-ground multi-phase faults are non-credible in all sections of the cable fault propagating to a three-phase fault that results in cable runs, other than at the terminal connections.

whip bringing the faulted cables in contact with

[instrumentation and control (I&C)] cables is not credible and would require more than a single failure.

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response Comment No. 12 As previously discussed in Duke Energys May 11, 2015 The NRC staff has determined that the licensees testing and No (Ref. 18) letter to the NRC, ONS analysis supports a analyses do not demonstrate that the bronze tape shielding (Ref: TIA Question 2.b) conclusion that cable shielding provides a level of for the ONS cable design and configurations in question will protection sufficient to preclude inter-cable shorts or faults, prevent short circuits between single conductor cables.

thereby removing from credibility, short circuits between the single conductor shielded power cables as a credible single The staff has reviewed Duke Energys May 11, 2015, letter failure. and other supplemental information to the NRC and determined that it does not provide any new information that requires a change in the conclusions of the TIA response.

The staff has determined that the licensees testing described in this letter is inadequate and does not resolve any of the licensing basis questions posed by the Region II staff in the TIA. This is because the licensees test did not prove that cable design with bronze shield can withstand a worst-case credible three-phase fault or prevent consequential damages to the nearby cables as discussed in the TIA response. In addition, the licensees cable crush test did not prove that the cable can withstand or prevent a worst-case credible three-phase fault. It only proved the mechanical capability of the cable. The staff determined that the electromagnetic forces produced during short circuits would likely cause failure of the cable restraint system and could challenge the integrity of the cables along the raceway system to transformer CT4 and the manholes associated with the raceway system to the protected service water (PSW) system. Since the licensee has not fully evaluated the worst-case credible cable faults and single failures to determine the integrity of the emergency power system and other safety-related systems, the staff determined that the cited testing is insufficient to support the licensees current position described in its response.

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response Comment No. 13 The NRR statement is inaccurate because the ONS The single failure criteria of IEEE Std. 279-1971 is part of the Yes licensing basis does not limit the timing of failure to ONS licensing basis. A single failure may be the result of (Ref: TIA Question 2.c) minimize damage and all credible failures are assumed events and conditions discussed in Section 3 of IEEE (e.g., failures are assumed at initiation or time of demand Standard 279-1971. Section 3.7 requires consideration of the consistent with the ONS [current licensing basis (CLB)]). range of transient and steady-state conditions of both the ONS does not limit its considerations based on whether or energy supply and the environment (for example, voltage, not the outcome would be acceptable. frequency, temperature, humidity, pressure, vibration, etc.

during normal, abnormal and accident circumstances As communicated in Duke Energys May 11, 2015 letter to throughout which the system must perform. The maximum the NRC, the ONS emergency power system switching energy supply, resulting from a short circuit may not be logic was designed based on failures occurring on initial available at the start time or demand time of a circuit. Single demand. failures with maximum energy, as described in IEEE Std. 279-1971, may occur at any time and are applicable to the The switching logic and the associated time delays in the licensees design basis for the cable configurations in Chapter 15 accident analyses are predicated on failures question.

occurring on initial demand. This design basis has been maintained throughout ONS history. Therefore, the staffs The staff position is based on understanding the requirements assessment that ONS design basis is that single failures delineated in all sections of IEEE 279-1971 and further may occur at any time is inaccurate. As previously noted clarified by SECY-77-439 states, in part, that:

herein, the failure on-demand position was also communicated to the NRC in a March 8, 1995 letter application of the Single Failure Criterion to (Ref. 19) clarifying meeting minutes issued by the NRC in systems evaluation depends not only on the association with the Keowee Underground Breaker initiating event that invokes safety action of Modification. It is reasonable for ONS to have concluded these systems, together with consequential that the NRCs acceptance (Ref. 20) had indicated that the failures, but also on active or passive NRCs single failure concerns had satisfactorily been electrical failures, which can occur resolved. independent of the event. Thus, evaluation proceeds on the proposition that single failures can occur at any time.

Comment No. 14 See Duke Energy Comment #3 regarding the application of Although not specifically discussed in the Evaluation section Yes IEEE Standard 379-2000 requirements. of the TIA, as pointed out in Comment 3, IEEE Std. 379 is not (Ref: TIA Question 2.c) part of the ONS licensing basis. The TIA relied on the ONS AEC GDC; included in the UFSAR IEEE Std. 279-1968 and

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response single failure criteria requirements in IEEE Std. 279-1971 as discussed in the Evaluation section.

Comment No. 15 The worst case credible single failure and its associated Reference 21 (April 12, 1995, Duke letter) explains the ONS No maximum fault currents have been considered and licensing history regarding the site quality assurance program (Ref: TIA Question 2.c) evaluated in the design of ONS, which as demonstrated (QAP) and the quality assurance measures applied to throughout this enclosure, has been accepted by the NRC. mechanical piping SSCs that perform some safety functions.

This was in response to Generic Letter (GL) 83-28, Required In addition, the aforementioned NRC statement references Actions Based on Generic Implications of Salem ATWS IEEE Standard 379, which is not a part of the ONS Events, dated July 8, 1983 (ADAMS Accession licensing basis for single failure criteria. The NRR No. ML031080266). Reference 22 (NRC letter and safety statement references an NRC requirement for ONS to evaluation report dated August 3, 1995; ADAMS Legacy consider the failures of non-Class 1E cables concurrent with Accession No. 9608090111) approved Dukes approach for a a single failure of Class 1E equipment. Doing so is also graded QA classification of SSCs. The staff at the time based contrary to the ONS licensing basis. As mentioned in the the approval on the belief, as provided by ONS, that the lower May 2015 Duke Energy letter to NRC, and described in the grade SSCs were not safety-related. However, quality ONS Single Failure Criterion Design Basis Document, the assurance measures are not the issue here and the April 12 licensing basis for Oconee contains single failure submittal noted this with the statement on page 5, it is clear evaluations that make no distinction between a failure of a that some seismically designed, single failure proof systems qualified component and a failure of a non-qualified were not classified as QA-1. The issue is how the plant component. (Here non-qualified is used to represent design basis meets the single failure criteria requirements of equipment variously called control grade, non-safety, IEEE Std. 279-1971, and the PDCs applicable to the ONS non-QA-1, etc. in ONS documents). licensing basis. The April 12 letter did not justify why ONS tried to credit the failure of non-Class 1E SSCs (i.e., the Fant The relevant distinction for application of single failure line or the PSW power cables) single failure when IEEE Std.

requirements is limited to whether and how the specific 279-1971 and PDCs do not allow it. The 1995 NRC letter did system in question is committed to be designed to handle not approve such a proposal. The implication that the NRC single failures. The components of such a system may or granted ONS the discretion to credit non-Class 1E SSCs as may not be qualified, but that is not a factor for single a single failure contrary to the ONS licensing basis is failure design requirements. As presented in an April 12, unsupportable.

1995 letter to the NRC (Ref. 21), several components that are non-QA-1 but required for accident mitigation, were The ONS single failure analyses presented to the CDBI team re-designated by ONS as QA-5. This approach was found misconstrued the idea of safety-related and the idea of acceptable in an August 3, 1995 NRC letter (Ref. 22). 10 CFR 50 Appendix B quality assurance measures (which ONS identified as QA-1 in the April 12 1995 letter). The idea

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response This point is material because design criteria applied to of safety-related has at least two recognized usages plants licensed later than ONS may assume all applicable to the ONS licensing basis. The first is non-qualified SSCs (structures, systems, and comprehensive in nature (Safety-Related), as defined in components) fail, in addition to taking a single failure in a American Nuclear Society (ANS) Standard 3.2-1972, and the qualified system. Such assumptions do not align to second is specific to the SSCs that form the reactor protection Oconees licensing basis. systems (Safety-Related Class 1E), as defined in IEEE Std. 279-1971 and PDCs, which excludes such SSCs as the reactor coolant system pressure boundary piping. The functional performance requirements of the SSCs defined the usages not the quality measures applied to the SSCs. To clarify this, a discussion of the two usages follows below.

First, Safety-Related is defined in the original ONS QA plan dated 1973 (ADAMS Accession No. ML16030A215). This included all safety-related SSCs including piping and protection systems SSCs. The QA plan committed to Safety Guide 33, and hence, to ANS 3.2-1972 (American National Standards Institute (ANSI) N18.7-1972). Standard ANS 3.2-1972, Section 2, Definitions, Subsection 2.2.19, Safety Related, defined, [t]hose plant features necessary to assure the integrity of the reactor coolant pressure boundary, the capability to shut down the reactor and maintain it in a safely shut down condition, or the capability to prevent or mitigate the consequences of accidents which could result in off-site exposures comparable to the guideline exposures of AEC Regulations 10 CFR Part 100. No exceptions to the safety guide were noted in the QA plan. Amendment 2 of the QA plan dated July 21, 1975 (ADAMS Legacy Accession No. 7911250016), stated that the ONS QA plan conformed to ANSI N18.7-1972 with no exceptions.

Second, Class 1E, is specified by the IEEE Std. 100 definitions in the ONS licensing basis.

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response The IEEE standards specified that Class 1E included the electrical and mechanical SSCs pertinent to the functional performance of the reactor protection systems. Although, both IEEE standards required appropriate levels of quality assurance measures comparable to 10 CFR 50 Appendix B or ANSI NQA-1, they both separated the functional performance criteria from quality.

Comment No. 16 ONS does not distinguish between active and passive The staff agrees that the ONS licensing basis is as described No electrical single failures for the emergency power system. in UFSAR Section 8.3.1.2 and not the ONS internal memo to (Ref: TIA Question 2.d) The ONS licensing basis requires that a single failure, either file document. Specifically, the UFSAR Section 8.3.1.2 passive or active, is addressed for the emergency electric states The basic design criterion for the electrical portion of power system as noted in Oconee UFSAR Section 8.3.1.2. the emergency electric power system of a nuclear unit, including the generating sources, distribution system, and controls is that a single failure of any component, passive or active, will not preclude the system from supplying emergency power when required.

The staff also notes that the above criteria is consistent with UFSAR Section 3.1.21, Criterion 21 - Single Failure Definition (Category B), which states that [m]ultiple failures resulting from a single event shall be treated as a single failure.

Comment No. 17 All faults and their effects were considered in the design of Since the licensees evaluations and cable tests only Yes the subject cables. As stated in the Duke Energy Comment assessed a phase-ground fault on the end of a cable, the (Ref: TIA Question 2.e) #10, other than at the cable ends, a credible single cable NRC staff disagrees with the licensees statement. The failure is a phase-ground fault on one of the single licensee has not provided any documented evidence of how it conductor cables. has considered the following electrical single failures in the onsite power system: (1) phase-to-phase faults, (2) single The draft TIA response references to IEEE Standards 141 phase-to-ground fault conditions (including high impedance and 242 (Refs. 24 and 25) on phase-ground fault current faults), (3) double phase-to-ground (including high impedance are not applicable to the 13.8 kV Keowee fed power system faults), and (4) three phase-to-ground or three phase bolted since it is resistance grounded and the phase-ground fault faults (including high impedance faults). The staff position is current will be limited to about 18 Amps. provided in response to Question 2.e and the response to Comment No. 10.

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response The references to IEEE Standards 141 and 242 were removed.

Comment No. 18 As stated in Duke Energy Comment #4, ONS has not stated See discussion of history of ONS licensing basis for electric Yes that it conforms to IEEE 279-1971 and therefore, this TIA power systems and associated interfacing systems provided (Ref: TIA Question 2.f) statement (as Duke Energy has previously noted in this in Section 3.0 of the TIA response. The ONS licensing basis enclosure) is inaccurate. Furthermore, more discussion includes conformance with single failure requirements of from IEEE 603-1991 also appears in this portion of NRRs IEEE Std. 279-1971. References to IEEE Std. 603 have been draft response, which also has no applicability to the ONS clarified.

design and licensing basis for the emergency power systems as stated in Duke Energy Comment #8. Also, refer to NRC responses to Comment Nos. 4, 8, and 10.

Duke is correct in asserting that the 1976 Parker letter stated, The design of the Oconee onsite emergency AC and DC power systems conforms to the single failure requirements of IEEE 279-1971 (emphasis added). The NRC will correct the error in the TIA response; however, the staff notes that Sections 4.2, 4.7, 4.11, and 4.17 of IEEE Std. 279-1971 all address single failure, not only Section 4.2.

Comment No. 19 This statement disregards the cable crush and fault testing See the staffs responses to Comment Nos. 10 and 12, and Yes which were performed in 2015 for the ONS and therefore is the staffs discussion provided in response to TIA (Ref: TIA Question 2.f) inaccurate by omission. Question 2.j.

The results of the cable crush testing were provided to the This statement was revised to reflect that the NRC did NRC in the May 11, 2015 letter. The results of cable fault consider the testing and analyses described by Duke in its testing on the 4.16 kVac and 13.8 kVac cables were also letters dated May 11 and August 7, 2015, as stated in presented in a meeting at NRR headquarters in Section 2.0 of the draft TIA response. The fault testing December 2015. Specific answers to the staffs questions conducted by Duke in late 2015, as described in the letter regarding the cable testing were provided in Attachment 2 dated February 15, 2016, was considered by the staff, as to Duke Energys February 15, 2016 request for alternative discussed in the response to Comment No. 10.

submittal (Ref. 26). ONS concludes that the cable testing validated that the ONS emergency power cable design provides an acceptable level of quality and safety.

Comment No. 20 The NRR draft response to this question is inconsistent with Refer to the NRC response to Comment No. 15. No the ONS licensing basis. The current day version of the

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response (Ref: TIA Question 2.g) definition of safety-related or Class 1E, as presented on Page 1 of the draft TIA response aligns with the definition of a basic component in 10 CFR 21.3. 10 CFR Part 21 was issued after ONS was licensed to operate. For ONS, the term safety-related refers to those structures, systems, and components (SSCs) which have been designated QA-1, as defined in the Duke Energy QA Topical. The general criteria for identifying an SSC as QA-1 is divided into two categories: 1) SSCs that were designated QA-1 as part of the original licensing basis and 2) SSCs that Duke Energy committed to treat as QA-1 in correspondence subsequent to initial licensing. The first category is comprised of those SSCs which were deemed essential to prevent and mitigate the effects of a Large Break LOCA (LBLOCA) coincident with a Loss of Offsite Power (LOOP). As such, there exists SSCs that are deemed non-safety (i.e., not QA-1) but that are credited to prevent and/or mitigate the effects of other UFSAR Chapter 15 design basis accident, non-LBLOCA/LOOP events. Further discussion on QA-1 designation at Oconee can be found in UFSAR Section 3.1.1.1 Oconee QA-1 Program.

This licensing history has been previously reviewed and agreed upon within an August 3, 1995 safety evaluation titled Safety Evaluation by the Office of Nuclear Reactor Regulation Supplemental Response to Subpart 1 of Section 2.2.1 of Generic Letter 83-28 General Criteria for Classifying QA-1 for Structures, Systems, and Components.

The staff stated that all commercial, non-safety related (i.e., non-Class 1E) electrical components are assumed to fail in the most limiting way. Only safety-related (Class 1E) components are credited to mitigate design basis events with a single failure (see IEEE 279-1971, ONS UFSAR,

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response Chapter 15 for SSCs credited in the accident analysis assumptions). The previous statements contradict the original ONS licensing basis for both QA-1 (safety-related) components and mitigation of UFSAR Chapter 15 design basis accidents and, if they were true, then ONS would not be able to credit certain functions necessary to prevent or mitigate the effects of some design basis accidents beyond the LBLOCA/LOOP. In addition, UFSAR Section 15.1.9, Credit for Control Systems and Non-Safety Components and Systems, contains a listing of non-safety components credited in the accident analyses for mitigating design basis events. Therefore, the staffs application of current standards to the existing licensing basis constitutes a change in regulatory position.

As for application of the single failure criterion, ONS performs single failure analysis for an SSC consistent with the licensing basis of the SSC in question. For the Emergency Power System, UFSAR Section 8.3.1.2, Analysis, states, the basic design criterion for the electrical portion of the emergency electric power system of a nuclear unit, including the generating sources, distribution system, and controls is that a single failure of any component, passive or active, will not preclude the system from supplying emergency power when required. This same statement was present in FSAR Section 8.2.3.3 as part of Oconees initial licensing. The present day UFSAR and historic FSAR Chapter 8 discussion on this basic design criterion are included as part of the overall response in UFSAR Section 3.1.39 and FSAR Section 1A.39, Criterion 39 - Emergency Power for Engineered Safety Features (Category A), for Oconees accepted (by initial licensing) alternate approach to meeting the intent of the proposed [General Design Criteria (GDC)] 39. Using this criterion, ONS performs single failure analysis based upon

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response the design of the system and does not distinguish between safety-related and non-safety-related equipment.

Comment No. 21 Duke Energy did not identify any factual corrections for this Refer to the NRC response to Comment Nos. 10, 12, and 19. No section of the draft response. However, as summarized (Ref: TIA Question 2.h) below, Duke Energy maintains that the analysis provided in Duke did not identify any factual corrections to the staffs the May 11, 2015 letter to the NRC remains valid and no statements in Response 2.h, but believes the May 11, 2015, collateral damage to DC systems would occur. letter provided analyses that demonstrated that cable whip in trench 3 would not result in failure of the DC control circuits.

For three-phase faults at the cable ends with postulated electromagnetically induced cable movement in Trench 3, The staff evaluated all testing and arguments presented by the robust cable construction (as validated by crush and ONS and concluded that multi-phase short circuits were a impact testing) and cable installation design will not result in credible failure mode that Duke must consider in the ONS failure of adjacent DC and protection system cables. cable configurations in question. Also, Per IEEE Std. 279-1971 Section 4.2, Single Failure Criterion, the shorting For faults at other locations within Trench 3, as previously or open-circuiting of interconnecting signal or power cables stated in the Duke Energy Comment #10, a credible single was identified as a credible single failure. Shorting between cable failure is a phase-ground fault on one of the single independent interconnecting power cables is considered a conductor cables. Under these fault conditions, only one single failure by the staff and is an exact parallel condition to conductor has the potential to carry fault current. Since at multi-phase shorts.

least two current carrying conductors are required to develop attractive and repulsive electromagnetic forces, this scenario will not result in unrestrained cable movement.

Comment No. 22 It is Duke Energys belief that there is no regulatory link As described in the staffs response to Comment No. 21, No between the results of a short circuit analysis and the there is a regulatory link between short circuit power and (Ref: TIA Question 2.i) required cable separation to meet regulatory requirements results pertaining to the required separation.

and the ONS licensing basis.

Comment No. 23 The draft TIA response incorrectly describes the function of See responses to Comment Nos. 10 and 12 above. Yes cable insulation shielding with respect to the single (Ref: TIA Question 2.j) conductor bronze tape cables and does not acknowledge The part of the staffs TIA response referred to in Comment the dual use of bronze tape as both a metallic insulation No. 23 is a generic discussion on the functions of cable shield and armor for cable mechanical protection. Analysis shielding and armor, and is factually correct. However, the previously provided in letters to the NRC as well as the licensee contends that the response fails to address the results of extensive cable testing supports that the bronze specific design and performance of the bronze tape shielded tape shield/armor in our design provides a level of

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response protection sufficient to preclude inter-cable shorts or faults. cable used at ONS, which it contends will not experience, or Also, it should be noted that the picture shown on Page 32 can withstand, the types of failures assumed by the staff.

of the draft TIA response is incorrect since it illustrates a cable design consisting of three conductors, while the The licensee has cited three sets of tests to support its subject cables at ONS are single conductor cables. position: the McGuire and Catawba medium-voltage cable test report (addressed in the TIA response to Question 2.j);

the Oconee medium-voltage cable crush tests (conducted in early 2015, as discussed in the May 11, 2015 letter); and the Oconee fault testing (conducted in late 2015, as discussed in February 15, 2016 letter). The latter two sets of tests were not addressed in the draft TIA response.

The fault testing conducted by Duke in late 2015, as described in the letter dated February 15, 2016, was considered by the staff, as discussed in the responses to Comment Nos. 10 and 19.

Regarding cable fault testing, the NRC staff observed the referenced tests and reviewed the results. The staff determined that the testing as conducted by the licensee produced anecdotal results that did not demonstrate the capability of the bronze tape cable to meet separation requirements for the cable design and configurations in question, and did not address the other staff concerns.

The testing failed to simulate the failure modes identified in the TIA, or the actual power levels to which the licensee exposes these systems and the ESPS cabling. The staff noted that the specified test criteria appear contingent on the concepts specified in the ONS internal memo to file, which then produced the observed anecdotal results:

The tests discounted multi-phase faults because the licensee believes that they are not credible. This was the subject of Question 2.e; the licensee must consider failures at any time

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response including credible failure modes for cable short circuits and multi-phase failures are in fact credible.

The licensee used the single failure on-demand concept to reduce the fault current available to damage components.

This was the subject of Question 2.c; the licensee must consider failures at any time including credible worst-case scenarios.

The ONS report did not include the induced voltages observed on the test conductors. The observed induced voltages appeared large enough to be extremely damaging to the DC ESPS cables, which are a subject of the TIA.

Question 2.f asked about Induced voltages and impressed voltages. ONS must consider these voltages along with the consequential damage to adjacent Class 1E components.

For additional information, refer to the NRC response to Comment Nos. 12, 19, and 21.

The staff will add a figure of the ONS cable design in its response to Question 2.j.

Comment No. 24 The staffs draft TIA response incorrectly equates/combines The staff disagrees with the licensees comment. No the insulation shield with the bronze tape metallic shield (Ref: TIA Question 2.j) which is not representative of the ONS cable configuration. See responses above. The staff response is supported by The ONS single conductor bronze tape cables have three industry accepted quality standards as stated in the TIA different shields - the strand (conductor) shield, insulation response. The ONS specific definitions are not consistent shield and metallic shield. The strand shield (or conductor with any industry standards, vendor published catalog, or screen) is a semi-conducting layer extruded over the vendor design data.

conductor and its purpose is to present a smooth cylinder at the interface between the conductors and the insulation The licensee did not identify nor provide any new information.

thereby reducing and equalizing the voltage stress in an outward radial direction.

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response The section Functions of Shielding, Items a-b, do not fully describe the insulation shield components as it applies to the ONS cable design. For the ONS cable design, the insulation shield is made of two separate components with different electrical functions; a nonmetallic semiconducting (or stress relief) shield and a metallic shield. The semiconducting shield is extruded over the insulation and its purpose is similar to the strand shield. Whenever the cable is energized, voltage is present on the insulation semiconducting shield.

The metallic insulation shield is applied over the semiconducting insulation shield and is grounded. The electrical functions of the metallic shield are to protect personnel from voltage present on the semiconducting insulation shield, to provide a low resistance path to ground for cable charging current and to provide a path to ground for detection and clearing of phase-ground faults. For the ONS single-conductor power cables, the greater than standard bronze tape thickness serves an additional mechanical function as cable armor.

In the section on Armor vs. Shielding, the statement that Whether armor or shielding are both used in a cable depends on the application for which it is being designed appears to imply that using bronze tape for both shielding and armor are mutually exclusive. As discussed above, the bronze tape performs the electrical requirements for metallic shielding and based on UL 1569 testing performed in 2015, passes the crush and impact performance requirements for Metal Clad cable. As stated in the Definition of Armor section of the draft TIA response, Metal Clad cable is armored cable. Therefore, the Duke Energy cable design with bronze tape is considered armored cable.

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response Comment No. 25 As discussed in Duke Energy Comment #s 10 & 19, ONS Refer to the NRC response to Comment Nos. 10, 12, 19, and No has validated the current configuration using crush and fault 23.

(Ref: TIA Question 2.j) testing, and that the robust design of the single-conductor bronze tape cables will preclude an initial phase-ground fault from propagating from one cable to another. The staff has been made aware of the test results as provided in letters to the NRC (May 2015 and February 2016). At the 2015 fault testing at KEMA labs, Region II and NRR staff witnessed that cable faults did not propagate from one cable to another. During that testing, ONS demonstrated that electrical faults will not propagate from one cable to another.

Comment No. 26 The overall MCM-1354.00-0029.001 document contains a Dukes comments fail to justify why the different cable types No series of test reports evaluating both overload and short tested are applicable to ONS, or how armored cable that may (Ref: TIA Question 2.j) circuit conditions in power and control cables. Duke Energy provide protection against fire propagation also protects infers from the TIA statements quoted above that NRR is against electrical faults (and more specifically, how is the referencing, in particular, the August 1976 Westinghouse 13.8-kV bronze tape cable at ONS equivalent to the lower High Power Laboratory fault test report as it makes voltage, steel-interlocked armored cable at Catawba Nuclear reference to fire propagation and utilized test voltages of Station and McGuire Nuclear Station.)

600 V, 4160 V, and 6900 V). Although reference to testing for fire propagation is made within that particular In addition, refer to the NRC response to Comment Nos. 10, Westinghouse High Power Laboratory fault test report, the 12, 19, and 23.

overall purpose of the testing program was to evaluate the ability of armored cable to act as a barrier and therefore, is relevant to Dukes positions on this matter.

As stated in the Introduction section of MCM 1354.00-0029.001:

Section 8.3.1.2.7.5, Cable Application and Installation of the McGuire Nuclear Station Final Safety Analysis Report states that all wire and cables are of fire retardant construction and selected for the application. Armored cable which has been demonstrated to be an excellent barrier to

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response externally and internally generated fires is used throughout the plant. Short circuit tests have been conducted on the interlocked armor cable by Duke Power Company (Duke Energy). These tests have demonstrated its acceptability as an adequate barrier by preventing damage to adjacent cables.

This report provides the methods of approach, test data, and test results for those tests performed to demonstrate the acceptability of interlocked armor cable as an adequate barrier to internally generated faults.

Further discussion on the use and application of the testing within McGuire Nuclear Stations licensing basis was included in the Duke Energy August 7, 2015 supplemental information submittal.

As for the number and variance of tests performed, MCM 1354.00-0029.001 documents an approach of first performing exploratory tests followed by more rigorous testing. The July 24, 1975 Federal Pacific Test Lab report documents the eleven exploratory tests, all performed at a test voltage of 610 V and fault currents ranging from 23.4 [kiloamperes (kA)] to 100 kA.

The rigorous testing regimen is documented in the previously discussed August 1976 Westinghouse High Power Laboratory fault test report. The rigorous testing consisted of three tests at 6900 V and 50 kA, four tests at 4160 V and 50 kA, and three tests at 600 V and 50 kA.

Comment No. 27 Although the NRR statements on the armor of the faulted Dukes comments fail to justify why the different cable types No cable being blown back and the loading crate being set on tested are applicable to ONS, or how armored cable that may (Ref: TIA Question 2.j) fire are factual, it omits other key test results. The NRR provide protection against fire propagation also protects referenced statements are found within the 1976 against electrical faults (and more specifically, how is the

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response Westinghouse High Power Laboratory fault test report for 13.8-kV bronze tape cable at ONS equivalent to the lower test number 2-51304-B. For the sake of completeness, it voltage, steel-interlocked armored cable at Catawba Nuclear should be noted that the results of the test also concluded Station and McGuire Nuclear Station.)

the following:

In addition, refer to the NRC response to Comment Nos. 10,

• For the control cable tray directly above the faulted 12, 19, and 23.

cable, damage to control cables in this tray were limited to superficial PVC jacket damage.

• For the other cables directly adjacent to the faulted cable in the specimen middle tray, there was only superficial damage to the other cables in the specimen tray.

• For the control cable tray directly below the faulted cable, damage to control cables in this tray was limited to superficial [polyvinyl chloride (PVC)] jacket damage.

Comment No. 28 NRR conclusions based on the use of GDC (General The NRC draft TIA response refers to the AEC GDCs, which Yes Design Criteria) terminology are inaccurate since the three formed the basis for the ONS PDCs described in the UFSAR, (Ref: TIA Question 2.k) (3) Oconee Units were licensed before the GDCs were as discussed earlier in the TIA response (pages 9-13).

in-effect. ONS complies with the 70 Principal Design Although the staff may have been imprecise in its reference Criteria (PDC) that were developed for Nuclear Power Plant here, there do not appear to be any substantive differences in Construction Permits proposed by the AEC in a proposed the cited proposed AEC GDCs and the PDCs; thus, it is not rule-making published for 10 CFR Part 50 in the Federal clear what the licensee is disputing in its comment. The staff Register of July 11, 1967. has clarified the TIA response.

There are no designed interconnections between the In the TIA response, the staff specified the areas where both

[Keowee Hydro Station (KHS)] and the ONS units such that trains of DC control power could be vulnerable to short a single failure due to DC-to-DC short circuits would circuits that could disable both trains (i.e., in the Keowee credibly result in loss of both KHS units. Therefore, the Hydro Unit (KHU) start panels at Keowee and ONS; at the NRR Statement and the basis on which it is made are terminal blocks) inaccurate.

Dukes response states, in part, that:

At ONS, separation, independence and redundancy are ensured by system design and cable routing. Pertinent Cables of different safety channels or trains may be UFSAR sections and station implementation and guidance within less than five inches of each other when documents with respect to the Keowee and plant DC entering or accessing a common enclosure.

systems and cable separation are summarized below. However, mutually redundant safety cables, in any

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response Keowee has two separate and redundant 125 Volt DC transition area, shall be precluded from making systems that are arranged such that a single fault within contact with each other. Barriers shall be installed either units system does not preclude the other unit from any time the free air separation requirement cannot performing its intended function of supplying emergency be met (Ref. OSS-0218.00-00-0019, Cable and power (Ref. UFSAR Sections 8.3.2.1.3 (Ref. 1) and 8.3.2.2 Wiring Separation Criteria (Ref. 27)).

(Ref. 1)).

Section 8.3.1 of this internal Duke specification document Each unit has two independent and physically separated (OSS-0218.00-00-0019, dated July 15, 1987) states, in part, 125 Volt DC systems. The 125 Volt DC Instrumentation that:

and Control Power System is arranged such that a single fault within either system does not preclude the engineered Wiring and control devices are to be installed so as to safeguards equipment from performing their safety maximize the physical separation distance between functions (Ref. UFSAR Sections 8.3.2.1.1 (Ref. 1) and mutually redundant safety related wiring. In no case, 8.3.2.2.1 (Ref. 1)). shall mutually redundant safety related wiring or devices be in physical contact. When separation Control, instrumentation, and power cables are applied and cannot be maintained a barrier must be installed.

routed to minimize their vulnerability to damage from any source (Ref. UFSAR Sections 8.3.1.4.6.2). Cables of Duke did not provide sufficient detailed information describing different safety channels or trains may be within less than the barriers in place in the specified areas where both trains five inches of each other when entering or accessing a of DC control power are in close proximity.

common enclosure. However, mutually redundant safety cables, in any transition area, shall be precluded from making contact with each other. Barriers shall be installed any time the free air separation requirement cannot be met (Ref. OSS-0218.00-00-0019, Cable and Wiring Separation Criteria (Ref. 27)).

Therefore, there are no designed interconnections between the KHS and ONS units such that a single failure due to DC-to-DC short circuits would result in loss of both KHS units. A single failure vulnerability does not exist for DC-to-DC short circuits in the KHU start panels.

4.0, Conclusion As discussed throughout this enclosure, this NRR The staff disagrees with the licensees assertions. In No statement is inaccurate by omission since it does not response to various comments provided above, the staff has Comment No. 29 indicated that it reviewed all of the information provided by the

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response appear that NRR has considered information provided by licensee in developing its TIA responses. Since the licensee (Draft Response to Duke Energy. did not provide any new information, nor identify any factual TIA 2014-05: errors, the staff determined that the TIA responses and Conclusion) conclusions remain the same.

See the staffs responses to Comment Nos. 10 and 12, and the staffs discussion provided in response to TIA Question 2.j for additional information.

As discussed in response to comment No. 19, the NRC staff did consider the testing and analyses described by Duke in its letters dated May 11 and August 7, 2015, as stated in Section 2.0 of the draft TIA response. The fault testing conducted by Duke in late 2015, as described in the letter dated February 15, 2016, was considered by the staff, as discussed in the response to Comment No. 10.

Comment No. 30 The licensing basis single failure criterion that ONS The licensing and design bases history of the ONS single Yes conforms to for the onsite AC and DC power systems is failure criterion for analyzing electrical failure vulnerabilities (Draft Response to delineated in IEEE Standard 279-1971, Section 4.2 as well between medium voltage AC power systems and low voltage TIA 2014-05: as in UFSAR Section 8.3.1.2 (Ref. 1). ONS adheres to DC circuits is discussed in Section 3.0. The TIA response Conclusion) IEEE Standard 279-1971, Section 4.2, and UFSAR has been revised as discussed in the individual comments Section 8.3.1.2 and therefore is in conformance with its above.

licensing basis with respect to the single failure criterion. It Refer to the NRC responses to Comment Nos. 8 and 14.

is inaccurate for the NRC to use standards that are not part of the ONS licensing basis (e.g., IEEE Standards 379 and 603) as the single failure criteria for the ONS onsite AC and DC power systems.

Oconee Cable Separation - NRC Response to Duke Energy Comments on Draft Response to TIA 2014-05 Change to Draft TIA Response TIA Section/Comment No. Duke Energy Comment NRC Response Response Comment No. 31 This statement and conclusion are inaccurate because Refer to the NRC responses to Comment Nos. 10 and 12, No NRR has omitted consideration of relevant ONS and the staffs discussion in response to TIA Question 2.j.

information. Cable fault testing performed by ONS in 2015 and provided to the NRC (but not evaluated in the TIA) involved inducing a fault on a single conductor medium voltage bronze armor power cable while monitoring for any effects on adjacent power and control cables. The fault testing validates the engineering analyses which have concluded that the single conductor power cables subject to a single phase-to-ground fault will not propagate to a multi-phase fault and will not adversely interact with the low voltage control cables leading to consequential functional failures of redundant trains. The cable crush testing demonstrated that the bronze armor power cables meet the UL 1569 impact and crush test performance requirements for metal clad cable (Ref. 18).

Comment No. 32 As stated in Duke Energy Comment #s 3, 15, and 20, it Refer to the NRC responses to Comment Nos. 10 and 12, No does not appear that NRR reviewed all of the separation and the staffs discussion in response to TIA Question 2.j.

criteria in the ONS licensing basis.