RA-18-0213, Response to the Second Request for Additional Information Regarding the License Amendment Request to Revise the Licensing Bases for Protection from Tornado-Generated Missiles

Response to the Second Request for Additional Information Regarding the License Amendment Request to Revise the Licensing Bases for Protection from Tornado-Generated Missiles

ML18313A133
Person / Time
Site:	Mcguire, McGuire
Issue date:	11/01/2018
From:	Teresa Ray Duke Energy Carolinas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RA-18-0213
Download: ML18313A133 (11)

Text

Thomas D. Ray, P.E.

~* ~-,DUKE Site Vice President

~ ENERGY McGuire Nuclear Station Duke Energy MGOl VP I 12700 Hagers Ferry Road Huntersville, NC 28078 O: 980.875.4805 f: 980.875.4809 Tom.Ray@duke-energy.com November 1, 2018 10 CFR 50.90 Serial No. RA-18-0213 U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 ATTENTION: Document Control Desk Duke Energy Carolinas, LLC McGuire Nuclear Station, Units 1 and 2 Docket Nos. 50-369 and 50-370 Renewed License Nos. NPF-9 and NPF-17

Subject:

Response to the Second Request for Additional Information regarding the License Amendment Request to Revise the Licensing Bases for Protection from Tornado-Generated Missiles By letter dated December 8, 2017 (ADAMS Accession No. ML17352A404), Duke Energy requested changes to the McGuire Nuclear Station, Units 1 and 2 (McGuire) Updc:1ted Final Safety Analysis Report (UFSAR). The proposed License Amendment Request (LAR) will revise the McGuire licensing bases for protection from tornado-generated missiles.

By electronic mail from Michael Mahoney dated May 18, 2018 (ADAMS Accession No. ML18138A466), the NRC Staff issued requests for additional information(RAls) to address identified areas needed to complete the technical review of the LAR. By letter dated July 3, 2018 (ADAMS Accession No. ML181918151), Duke Energy responding to those RAls.

By electronic mail from Michael Mahoney dated October 11, 2018 (ADAMS Accession No. ML18285A081 ), the NRG Staff issued a second, follow-up request for additional information.

The NRC staffs questions and Duke Energy's responses are provided in the Attachment to this letter.

The conclusions reached in the original determination that the LAR contains No Significant Hazards Considerations and the basis for the categorical exclusion from performing an Environmental Impact Statement have not changed as a result of these responses to the second request for additional information.

Please contact Lee A. Hentz at 980-875-4187 if additional questions arise regarding this RAI /

response. } O/)

. ;Jf_/2_

www.duke-energy.com

U.S. Nuclear Regulatory Commission RA-18-0213 Page2 I i I declare under penalty of perjury that the foregoing is true and correct. Executed on November 1, 2018.

Sincerely,

~Y-Thomas D. Ray ----...,.c..-

Vice President McGuire Nuclear Station Attachment cc w/

Attachment:

C. Haney, Administrator, Region II U.S. Nuclear Regulatory Commission Marquis One Tower 245 Peachtree Center Ave., NE, Suite 1200 Atlanta, GA 30303-1257 A. Hutto, NRC Senior Resident Inspector McGuire Nuclear Station M. Mahoney, Project Manager U.S. Nuclear Regulatory Commission 11555 Rockville Pike Mail Stop 0-8 G9A Rockville, MD 20852-2738 W. L. Cox, Ill, Section Chief North Carolina Department of Environment and Natural Resources Division of Environmental Health Radiation Protection Section 1645 Mail Service Center Raleigh, NC 27699-1645

ATTACHMENT By letter dated December 8, 2017, (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17352A404, as supplemented by letter dated July 3,12018 (ADAMS Accession No. ML18191B151), Duke Energy Carolinas, LLC. (Duke, the licensee), requested changes to the McGuire Nuclear Station (McGuire), Units 1 and 2, Updated Final Safety

• Analysis Report (UFSAR). The proposed amendment will revise the McGuire licensing bases for protection from tornado-generated missiles.

The NRC staff issued requests for additional information (RAls) by email dated May 18, 2018 (ADAMS Accession No. ML18138A466), requesting additional details to address identified areas needed to complete the technical review and the licensee replied to these RAls by letter dated July 3, 2018. It is not apparent how the RAI responses have addressed or provided sufficient clarity to address the staff's RAI concerns.

The NRC regulations require nuclear power plants to be designed to withstand the effects of tornado and high-wind-generated missiles so as not to adversely impact the health and safety of the public in accordance with the requirements of General Design Criterion (GDC) 2, "Design Bases for Protection against Natural Phenomena," and GDC 4, "Environmental and Dynamic Effects Design Bases," of Appendix A, "General Design Criteria for Nuclear Power Plants," to Title 10 of the Code of Federal Regulations ( 10 CFR) Part 50, "Domestic Licensing of Production and Utilization Facilities."

Regulatory Guide (RG) 1.117, "Protection Against Extreme Wind Events and Missiles for Nuclear Power Plants," Revision 1, includes a minimum list of systems, structures, and components (SSCs), which together with their foundations and supports, should be protected from the extreme wind events, including generated missiles, without loss of capability to perform their safety functions. This list specifically refers to Control Room to be protected as follows and RG 1.117 states, in part:

7. the control room, including all equipment needed to maintain the control room within safe habitability limits for personnel and safe environmental limits for tornado- protected equipment.

TORM IS methodology is approved by NRC (ADAMS Accession No. ML080870291) to allow an alternate approach to resolve unprotected components in noncompliance with current licensing basis. In accordance with Regulatory Issue Summary (RIS) 2008-14, "Use of Tormis Computer Code for Assessment of Tornado Missile Protection," the TORM IS methodology is an NRC-approved method for addressing identified deficiencies in complying with a plant's current licensing basis for tornado missile protection. It provides licensees the option of revising the plant's licensing basis for tornado missile protection from a purely deterministic methodology to one that includes limited use of a probabilistic approach.

The NRC staff has reviewed the application and, based upon this review, determined that additional information is needed to complete our review. Please provide a response on the docket within 30 days of this correspondence.

1

ATTACHMENT Request for Additional Information CRAl)-07 In its letters dated December 8, 2017 and July 3, 2018, the licensee stated that portions of the Main Steam System are included in the TORMIS analysis. Certain structures, systems, and components (SSCs) in the Main Steam System are not fully protected against tornado-missile hazard as described in the current licensing basis. UFSAR Section 3.1 Criterion 2 states that SSCs designated Category I are designed to withstand, without loss of function, the most severe natural phenomena on record for the site with appropriate margins included in the design for uncertainties in historical data.

In response to RAI 6a, the licensee defines failure criteria specifying three of four main steam lines are required for shutting down the plant, which is used to justify the logic used in TORM IS. NRC staff questions if the licensing basis requires protection of three (of four) main steam lines against tornado missiles. It appears that the licensee is relying on the adequacy of plant response (i.e., accident mitigation) in the event of tornado missiles affecting one main steam line to determine the (Boolean) event logic in TORMIS as opposed to the approach for considering the probability of damage to unprotected SSCs as found in RIS 2008-14 and i Standard Review Plan, Section 2.2.3.

I Please demonstrate that McGuire's current licensing basis requires protection of three out of four main steam lines against tornado missiles to maintain functional capability. Alternatively, provide TORM IS results assuming any main steam line hit is considered a failure and show that the results meet the acceptance guidelines.

Duke Energy Response:

Current Licensing Basis Descriptions of the McGuire Main Steam (SM) and Main Steam Vent to Atmosphere (SV) Systems (from UFSAR Chapter 1O and Technical Specifications)

The Main Steam System delivers the generated steam from the outlet of the steam generators to the various system components throughout the Turbine Building without incurring excessive pressure losses. Main steam is conveyed by four, one per steam generator, steam lines to a steam pressure equalization and distribution header then to the turbine inlet valves. A flow restrictor is provided in each main steam line steam generator outlet nozzle to limit maximum flow and the resulting steam generator nozzle thrust loading caused by a steam line rupture.

The steam generators and all piping and valves down to and including the main steam isolation valves are Duke Safety Class B. Each of the four main steam lines has in order; one power relief valve, five safety valves, and one isolation valve, before they join in a common header.

Self-actuated safety valves (MSSVs, five per steam line) are located immediately outside the containment to assure the integrity of the Main Steam System under all conditions. These ASME Code valves are designed to relieve at a predetermined pressure with a combined capacity equal to maximum calculated heat balance steam flow conditions. Technical Specification 3.7.1, "Main Steam Safety Valves (MSSVs)", requires 5 of 5 MSSVs on each steam-line to be Operable above 57% RTP, 4 of 5 MSSVs Operable above 38% RTP, 3 of 5 MSSVs Operable above 19% RTP, and 2 of 5 MSSVs Operable at or below 19% RTP.

Power-operated relief valves (PORVs, one per steam line) are provided upstream of the main steam isolation valves to provide atmospheric steam relief capacity as a means of heat dissipation in the event of loss of normal heat sink capabilities. Technical Specification 3. 7.4, 2

ATTACHMENT "Steam Generator Power Operated Relief Valves (SG PORVs)", requires 3 of the 4 steam-line PORVs to be Operable in Modes 1 thru 4.

If the main condensers are not available during normal unit shutdown, or sudden load rejection on turbine trip, the power-operated relief valves and the spring-loaded safety valves can discharge full main steam flow to the atmosphere and effect safe reactor shutdown.

Main steam isolation valves (MSIVs) are provided in each steam generator steam line immediately downstream of the safety valves to isolate each individual steam generator and prevent reverse flow in the event of a steam line rupture. The main steam isolation valves close on high-high Containment pressure signal and/or on high steam line pressure rate of change or low steam line pressure as the result of a main steam line rupture between the steam generator and the turbine steam stop valves. The main steam isolation valves are located as close to the Containment as possible and protected in service by reinforced concrete doghouses. The valves and piping within the doghouse are restrained to prevent pipe whip damage if pipe break occurs within the doghouse.

UFSAR Section 10.3.3, "Safety Evaluation", describes that, "a failure of any main steam line or malfunction of a valve in the system does not:

1. reduce flow capability of Auxiliary Feedwater System below the minimum required,

2. prohibit function of any Engineered Safety Feature,

3. initiate a loss-of-coolant accident,

4. cause uncontrolled flow from more than one steam generator,

5. jeopardize Containment integrity.

Relevant Regulatory Guidance As stated in part in Regulatory Guide 1.117, "Tornado Design Classification", Rev. 1:

It is not necessary to maintain the functional capability of all Seismic Category I structures, systems, and components because the probability of the joint occurrence of low-probability events (loss-of-coolant accident with a design basis tornado (DBT) or smaller tornado, or earthquake with DBT or smaller tornado) is sufficiently small.

However, equipment used to provide long-term core cooling following a LOCA should be protected.

Structures, systems, and components important to safety that should be protected from both the direct and indirect effects of a Design Basis Tornado are:

1. Those necessary to ensure the integrity of the reactor coolant pressure boundary;

2. Those necessary to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition (this includes both hot standby and cold shutdown capability); and

3. Those whose failure could lead to radioactive releases resulting in calculated offsite exposures greater than 25% of the guideline exposures of 10 CFR Part 100 using appropriately conservative analytical methods and assumptions.

3

ATTACHMENT The Appendix to Reg. Guide 1.117, Rev. 1, lists structures, systems, and components, which together with their foundations and supports, should be protected against tornadoes. Item 4 of Appendix A addresses main steam lines:

4. Systems or portions of systems that are required for (1) attaining safe shutdown, (2) residual heat removal, (3) cooling the spent fuel storage pool, (4) mitigating the consequences of a tornado-caused PWRsteam line break3, (5) makeup water for the primary system, and (6) supporting the above systems, e.g., cooling water, ultimate heat sink, air supply, auxiliary feedwater, and ventilation.

(Footnote 3 relating to tornado-caused PWR main steam line breaks states that, "Alternatively, the main steam system, up to and including a second isolation valve such as a redundant series MSIV, or a turbine stop valve, may be protected." McGuire does not have protected double-isolation of the main steam lines thus this note is not germane.)

Application of TORMIS Relative to SM/SV System Licensing Basis Neither the Duke Class B Main Steam (SM) piping nor the MS IVs are exposed to tornado-generated missiles, however as described in the subject LAR (ref. Duke Energy letters dated December 8, 2017 and July 3, 2018), some components of the Main Steam Vent to Atmosphere (SV) system are not fully protected. Specifically, portions of the MSSV vent stacks, which are not physically connected to the MSSV's (the MSSVs themselves are not targets), and portions of the steam-line PORVs and associated piping (upstream PORV block valves are not targets).

As described in RIS 2008-14, the EPRI TORMIS methodology " ... employs Monte Carlo techniques to assess the probability that tornado missile strikes will cause unacceptable damage to safety-related plant features".

The McGuire TORMIS analysis of exposed steam-line-related components evaluates the probability of unacceptable damage to the unprotected MSSV and PORV components. Since the MSSVs and PORVs are functionally related SSCs, they are analyzed in TORMIS using Boolean logic which corresponds to defined unacceptable damage. Unacceptable damage is conservatively defined as damage which affects a PORV or MSSV (or both) on more than one steam line. "Acceptable damage" is thus conservatively limited to damage affecting a PORV and/or MSSV on only a single steam line, and is therefore consistent with UFSAR Section 10.3.3 descriptions of failure or malfunction affecting a single steam line.

Limiting damage to components associated with a single steam line is considered very conservative, because damage limited to affecting components of a single steam line is shown to be bounded by existing UFSAR Chapter 15 analyses of the Main Steam Line Break (MSLB).

As described in MNS UFSAR Chapter 15.1.5, "Effects of minor secondary system pipe breaks are bounded by the analysis presented in this section. Minor secondary system pipe breaks are classified as ANS Condition Ill events, as described in Section 15.0." The analyses of the bounding ANS Condition IV MSLB show that the ability to achieve and maintain safe shutdown is not challenged by even a complete, unisolable, double-ended guillotine break of a 34" diameter main steam line. The maximum diameter of any exposed SV system relief valve upstream piping is 6". The most likely scope of damage resulting from tornado missile impact on unprotected portions of the SV system would be a minor steam leak much smaller than that analyzed for MSLB; damage resulting in either a valve sticking closed, or a pipe crimp restricting discharge flow, is also possible. Unaffected MSSVs and PORVs provide ample capacity to 4

ATTACHMENT dissipate decay heat, and RHR entry conditions can be achieved using unaffected PORVs to cool the unit. All Category I Emergency Core Cooling System (ECCS) / Residual Heat Removal (RHR) SSCs are fully protected from tornado winds/missiles, thus the ability to achieve and maintain safe shutdown, including both hot standby and cold shutdown. Long-term core cooling capability is unaffected. 1 Qualitative arguments provided below show that the risk of exceedance can be expected to be lower than that predicted by TORM IS.

Qualitative Arguments Supporting a Lower Risk than Calculated by TORMIS

• TORM IS assumes that ANY damage combination affecting more than a single steam line results in inability to achieve and maintain safe shutdown; in reality, many combinations of damage affecting multiple steam lines (e.g., damage to one MSSV on multiple steam lines, etc.) would still allow for safe shutdown to be achieved and maintained.

• The main steam lines, MSIVs, and MSSVs are protected from tornado missiles in accordance with the licensing basis. However, the TORMIS analysis conservatively assumed that the following scenarios result in "failure" of a main steam line.

o A steam leak is assumed to occur on the corresponding main steam line whenever a tornado missile impacts an MSSV exhaust stack that causes a failure of any lateral supports on the pipe leaving the pipe free to impact the valve nozzle below, or failure of more than 2 vertical support lugs that could result in the exhaust stack falling on the MSSV and main steam line below. This is conservative because these conditions do not necessarily produce a steam line leak. Note that the MSSV exhaust stacks are not physically connected to the MSSVs themselves.

o PORVs are assumed to be rendered inoperable when any part of the PORV assembly (including exhaust, steam supply pipe, actuator, etc.) is impacted by a missile that causes yielding of any components in the valve stem, yoke, plug, or tee of the valve. Further, a PORV is assumed to be inoperable if any supports are damaged by a tornado missile that results in failure/detachment of the support. This is conservative in that such conditions will not necessarily render the PORV inoperable.

• Steam leak due to damage of a PORV could likely be isolated by closure of the associated PORV block valve; block valves are fully protected from missiles; note that PORV blocks do not receive 1E power, so local manual isolation might be required to accomplish this; PORV blocks are at a lower elevation than the PORVs such that local access is likely to be possible RAl-08 As stated in the licensee's December 8, 2017 and July 3, 2018, letters, the Control Room Area Ventilation System (VC/YC) outside air intakes are included in the post-TORMIS analysis. These components are not fully protected and are not part of the current licensing basis for tornado missile protection. The licensee has chosen to analyze these components by combining VC/YC and Spent Fuel Pool (SFP) in post-TORMIS analysis. As indicated in the 5

ATTACHMENT licensee's response to RAI 6 in its July 3, 2018, letter, some failure induced in post-TORMIS Boolean logic results in a loss of safety function for McGuire, Units 1 and 2, simultaneously.

TORM IS is used to justify probability of strike or failure of nonconforming SSCs is sufficiently low not require protection. The licensee defines unprotected SSCs as acceptable and screens for inclusion in TORMIS analysis. The licensee uses Boolean logic and defines or justifies Loss of Function for VC/YC as acceptable scenarios without use of TORM IS to validate overall low probability of component failure. As seen in Table 8 of the licensee's July 3, 2018, letter, loss of both units VC/YC (Combination 6) is a relatively large contributor to overall failure frequency but treated as acceptable failure combination. This is reflected as "Survive" in Table 8 of of the RAI response.

In its July 3, 2018 letter, on page 34, the licensee states:

As documented in the MNS UFSAR, the analyzed tornado missile accident postulates a tornado missile penetrating the North end of one of the Spent Fuel Fool Buildings and rupturing spent fuel assemblies in Region 2 of the Spent Fuel Pool. In the worst case scenario of this accident, only one of four VC/YC Air Intakes remains intact to provide air intake to the Control Room filtration system (VC). Despite this worst case scenario, the resulting doses to the Control Room are well within the 10 CFR 50.67 limits.

In addition to loss of function, failure of all VC/YC, as indicated, is beyond worst case scenario.

The NRC staff requests the following:

a. Please provide the basis for use of Boolean combinations that classify loss of safety function (i.e. Item 6, Control Room), as a system success and/or acceptable configuration. Provide justification or licensing basis for acceptability of loss of function (beyond worst case scenario) and its impact on overall safety.

b. Please provide discussion on impact of the overall TORM IS results with YC/VC loss of function failure in both Units during a single Tornado event. Also, provide justification or licensing basis that reflects acceptable YC/VC loss of function failure in both Units.

Duke Energy Response:

Background

As stated in part_ in Regulatory Guide 1.117, "Tornado Design Classification," Rev. 1:

It is not necessary to maintain the functional capability of all Seismic Category I structures, systems, and components because the probability of the joint occurrence of low-probability events (loss-of-coolant accident with a design basis tornado (DST) or smaller tornado, or earthquake with DST or smaller tornado) is sufficiently small. However, equipment used to provide long-term core cooling following a LOCA should be protected.

Structures, systems, and components important to safety that should be protected from the effects of a DST are:

6

ATTACHMENT

1. Those necessary to ensure the integrity of the reactor coolant pressure boundary;

2. Those necessary to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition (this includes both hot standby and cold shutdown capability);

and

3. rfhose whose failure could lead to radioactive releases. I The Appendix to Reg. Guide 1.117 lists structures, systems, and components, which together with their foundations and supports, should be protected from the effects of a DBT.

Item 7: The control room, including all equipment needed to maintain the control room within safe habitability limits for personnel and safe environmental limits for tornado-protected equipment.

Description of the McGuire Control Room Ventilation System The McGuire Control Room ventilation system (VC) consists of three subsystems. The Control Room subsystem (CR) provides a habitable environment for the shared main Control Room.

The Control Room area subsystem (CRA) provides heating and cooling for the electrical penetration rooms, battery rooms, motor control center rooms (MCC), cable rooms, restricted instrument shop, and mechanical equipment room. The switchgear subsystem (SGR) provides cooling for the four essential switchgear rooms 1ETA, 2ETA, 1ETB and 2ETB. All VC subsystems are located and protected within the Auxiliary Building.

The CR subsystem has two redundant trains. Each train consists of an air handling unit (AHU) and a filter package. Each AHU contains a water cooling coil (YC system) and a fan.

Each filter package includes a two-stage heater, a demister/pre-filter; a High Efficiency Particulate Air (HEPA)filter, a charcoal adsorber and one Outside Air Pressurization Filter Train (OAPFT) fan. Both OAPFTs draw in outside air from one or more outside air intakes. Two intakes are located on the Unit 1 side of the plant, and two intakes are located on the Unit 2 side of the plant.

During normal operation, the CR-AHU recirculates and cools the air in the Control Room. No outside air is provided. Make up air is provided by routine door openings. In normal operation, the filter package (OAPFT) and associated fan is off and isolated by dampers. The outside air intakes are not required during normal VC system operation.

Upon a loss of coolant accident (LOCA) and/or loss of offsite power (LOOP) signal from the engineered safety feature actuation signal (ESFAS) system, the OAPFT fans start to provide filtered outside air thru the VC system outside air intakes and to pressurize the Control Room.

During a radiological release event, the OAPFTs maintain Control Room Operator dose within regulatory limits. The CR-AHU also remains in service.

In summary, the Control Room ventilation and cooling subsystem (CR-AHU) will continue to function normally if all four outside air intakes were to be damaged by tornado missiles. The CR-AHUs operate in recirculation mode without fresh air intake. This meets the criteria of Item 7 in the Appendix to Reg. Guide 1.117. The outside air intakes, in conjunction with the OAPFT fans, are only necessary during a radiological event like a LOCA. As stated in Regulatory Guide 1.117, LOCAs are not postulated with Tornado Missile events. As such, McGuire has the capability to shut down both reactors and maintain them in a safe shutdown condition. The 7

ATTACHMENT Control Room environment would remain habitable without the VC system outside air intakes and the OAPFT and fans.

As documented the McGuire UFSAR and the subject LAR, the north end of the spent fuel buildings are not provided with tornado missile protection. As such, radiol0gical consequences are assumed after a Tornado Missile event that impacts the spent fuel buildings. The TORM IS analysis has demonstrated that the probability of damage to these unprotected essential features, spent fuel in the spent fuel pools and VC system outside air intakes, in the same tornado event is sufficiently small.

VC System Air Intake Failure Criteria used in TORMIS The Boolean logic implemented for the TORM IS analysis is described in detail in the response to RAl-06e. It is important to note that the "system" referred to in the "System Survive or Fail" column of Table 8 of the RAI response refers to the spent fuel pools and VC outside air intakes only, and does not include the normal functioning of the VC system (CR-AHU) discussed above.

As such, failure is only concluded when both the Unit 1 and Unit 2 VC outside air intakes are impacted by tornado missiles and they are required to operate (i.e. when there is tornado missile damage to fuel in either spent fuel pool).

In addition, the McGuire TORMIS analysis conservatively assumed that any missile hit simultaneously damages (crimps closed) both VC outside air intakes at one location (Unit 1 side or Unit 2 side). Given their location in between the Reactor and Auxiliary Buildings, these outside air intakes are protected from many large missiles and are primarily exposed to lightweight missiles such as metal siding from the Turbine Buildings. Additional detailed analysis was not undertaken to credit the inherent missile resistance of the VC outside air intakes, and the fact that there are two separate outside air intakes at each location. Such analysis would likely show a significant reduction in the damage frequency for the VC system outside air intakes.

Summary of RAI Response RAl-08-a: Please provide the basis for use of Boolean combinations that classify loss of safety function (i.e. Item 7, Control Room), as a system success and/or acceptable configuration. Provide justification or licensing basis for acceptability of loss of function (beyond worst case scenario) and its impact on overall safety.

As discussed above, the VC system (CR-AHU subsystem) can function and maintain the Control Room habitable if the VC outside air intakes were to be damaged rendering the OAPFTs and fans non-functional. Reg. Guide 1.117 Appendix Item 7, Control Room, can be met. Only the ability to pressurize the Control Room is affected by a loss of the OAPFT outside air intakes. Control Room pressurization will only be needed in a tornado event if a tornado missile also causes a radiological release (i.e. spent fuel damage). For Tornado Missile events without radiological consequences, the loss of the VC system air intakes and the OAPFTs and fans does not impact the capability to shut down the reactor and maintain it in a safe shutdown .condition (overall safety). The Control Room Ventilation system does not experience a complete loss of function.

The Boolean combinations consider the "system" to fail with tornado missile damage to the VC outside air intakes only when they are required due to fuel damage in the spent 8

ATTACHMENT fuel pools. Damage to the VC outside air intakes in all other scenarios does not impact the functioning of the VC (CR-AHU) system.

RAl-08-b: Please provide discussion on impact of the overall TORM IS results with 1YCNC loss of function failure in both Units during a single Tornado event. Also, provide justification or licensing basis that reflects acceptableYCNC loss of function failure in both Units.

The overall TORM IS results are not impacted by the loss of the VC system outside air intakes and the OAPFTs and fans. The TORMIS analysis has demonstrated that the probability of simultaneous damage to these unprotected essential features, spent fuel buildings and VC system outside air intakes, is sufficiently small. The Control Room is maintained habitable by the CR-AHU subsystem.

For Tornado Missile events without radiological consequences, the loss of the VC system outside air intakes and the OAPFTs and fans does not impact the ability to maintain the Control Room habitable and does not impact the capability to shut down the reactor and maintain it in a safe shutdown condition. The Control Room Ventilation system does not experience a complete loss of function.

9