ML19260E084

Issuance of Amendments 415, 417, and 416, Regarding the Updated Final Safety Analysis Report Description of Tornado Mitigation

ML19260E084
Person / Time
Site:	Oconee
Issue date:	10/31/2019
From:	Audrey Klett Plant Licensing Branch II
To:	Burchfield E Duke Energy Carolinas
Klett A
References
EPID L-2018-LLA-0251
Download: ML19260E084 (67)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 October 31, 2019 Mr. J. Ed Burchfield, Jr.

Site Vice President Oconee Nuclear Station

• Duke Energy Carolinas, LLC 7800 Rochester Highway Seneca, SC 29672-0752

SUBJECT:

OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3- ISSUANCE OF AMENDMENTS 415,417, AND 416, REGARDING THE UPDATED FINAL SAFETY ANALYSIS REPORT DESCRIPTION OF TORNADO MITIGATION (EPID L-2018-LLA-0251)

Dear Mr. Burchfield:

The U.S. Nuclear Regulatory Commission (NRC or the Commission) has issued the enclosed Amendment Nos. 415, 417 and 416, to Renewed Facility Operating Licenses Nos. DPR-38, DPR-47, and DPR-55, for the Oconee Nuclear Station, Units 1, 2, and 3, respectively. The amendments revise the Updated Final Safety Analysis Report (UFSAR) in response to the application from Duke Energy Carolinas, LLC by letter dated September 14, 2018, as supplemented by letters dated January 24, 2019, and dated July 31, 2019.

The amendments revise the UFSAR tornado licensing basis to allow credit for the Standby Shutdown Facility to mitigate a tornado with the assumed initial conditions of loss of all alternating current power to all units with significant tornado damage to one unit, approval for use of tornado missile probabilistic methodology (TORM IS), and approval for elimination of the spent fuel pool to high pressure injection flow path for reactor coolant makeup.

J. E. Burchfield, Jr. The NRC staff's safety evaluation of the amendments is enclosed. A Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

ffi' Audrey L. Klett, Project Manager Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-269, 50-270, and 50-287

Enclosures:

1. Amendment Nos. 415 to DPR-38, 417 to DPR-47, and 416 to DPR-55

2. Safety Evaluation cc: Listserv with Enclosures

ENCLOSURE 1 AMENDMENT NO. 415 TO DPR-38, AMENDMENT NO. 417 TO DPR-47, AND AMENDMENT NO. 416 TO DPR-55

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 DUKE ENERGY CAROLINAS, LLC DOCKET NO. 50-269 OCONEE NUCLEAR STATION, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 415 Renewed License No. DPR-38

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment to the Oconee Nuclear Station, Unit 1 (the facility), Renewed Facility Operating License No. DPR-38, filed by Duke Energy Carolinas, LLC (the licensee), dated September 14, 2018, and supplemented by letters dated January 24 and July 31, 2019, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations as set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2. Accordingly, by Amendment No. 415 Renewed Facility Operating License No. DPR-38 is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR), as set forth in the application dated September 14, 2018, as supplemented by letters dated January 24 and July 31, 2019. The licensee shall update the UFSAR to incorporate the changes as described in the licensee's application and as described in the NRC staff's safety evaluation enclosed with this amendment.

3. This license amendment is effective as of its date of issuance and shall be implemented by the completion of refueling outage 1EC33 (Fall 2024) for Unit 1.

FOR THE NUCLEAR REGULATORY COMMISSION Michael T. Markley, Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: October 31 , 2 O1 9

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 DUKE ENERGY CAROLINAS, LLC DOCKET NO. 50-270 OCONEE NUCLEAR STATION, UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 417 Renewed License No. DPR-47

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment to the Oconee Nuclear Station, Unit 2 (the facility), Renewed Facility Operating License No. DPR-47, filed by Duke Energy Carolinas, LLC (the licensee), dated September 14, 2018, and supplemented by letters dated January 24 and July 31, 2019, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations as set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2. Accordingly, by Amendment No. 417 Renewed Facility Operating License No. DPR-47 is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR), as set forth in the application dated September 14, 2018, as supplemented by letters dated January 24 and July 31, 2019. The licensee shall update the UFSAR to incorporate the changes as described in the licensee's application and as described in the NRC staff's safety evaluation enclosed with this amendment.

3. This license amendment is effective as of its date of issuance and shall be implemented by the completion of refueling outage 2EC32 (Fall 2025) for Unit 2.

FOR THE NUCLEAR REGULATORY COMMISSION Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: October 31 , 2 O1 9

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 DUKE ENERGY CAROLINAS, LLC DOCKET NO. 50-287 OCONEE NUCLEAR STATION, UNIT 3 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 416 Renewed License No. DPR-55

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment to the Oconee Nuclear Station, Unit 3 (the facility), Renewed Facility Operating License No. DPR-55, filed by Duke Energy Carolinas, LLC (the licensee), dated September 14, 2018, and supplemented by letters dated January 24 and July 31, 2019, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations as set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2. Accordingly, by Amendment No. 416, Renewed Facility Operating License No. DPR-55 is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR),

as set forth in the application dated September 14, 2018, as supplem~nted by letters dated January 24 and July 31, 2019. The licensee shall update the UFSAR to incorporate the changes as described in the licensee's application and as described in the NRC staff's safety evaluation enclosed with this amendment.

3. This license amendment is effective as of its date of issuance and shall be implemented by. the completion of refueling outage 3EC33 (Spring 2026) for Unit 3.

FOR THE NUCLEAR REGULATORY COMMISSION Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: October 31, 2019

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION FOR AMENDMENT NO. 415 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-38 AMENDMENT NO. 417 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-47 AMENDMENT NO. 416 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-55 DUKE ENERGY CAROLINAS, LLC OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3 DOCKET NOS. 50-269, 50-270, AND 50-287

1.0 INTRODUCTION

By letter RA-18-0026 dated September 14, 2018 (Reference 1), as supplemented by letters RA-19-0086 dated January 24, 2019 (Reference 2) and RA-19-0301 dated July 31, 2019 (Reference 4), Duke Energy Carolinas, LLC (the licensee) applied for license amendments to Renewed Facility Operating Licenses DPR-38, DPR-47, and DPR-55, for the Oconee Nuclear Station, Units 1, 2, and 3 (Oconee), respectively. The licensee requested that the Updated Final Safety Analysis Report (UFSAR) be revised regarding the tornado licensing basis to allow credit for the Standby Shutdown Facility (SSF) to mitigate a tornado with the assumed initial conditions of loss of all alternating current (AC) power to all units with significant tornado damage to one unit, approval for the use of tornado missile probabilistic methodology (TORM IS), and approval for elimination of the spent fuel pool (SFP) to high pressure injection (HPI) flow path for reactor coolant makeup.

The licensee's application dated September 14, 2018, and its supplements supersede the application dated June 26, 2008 (Reference 5) and its tornado-related documentation associated with this licensing action. Some of the superseded documentation contains information not applicable to this review but continues to pertain to other licensing actions.

Additionally, the application dated September 14, 2018, contains discussions of past commitments related to tornado or high energy line break (HELB) that e?(ist or have been closed. However, these past commitments are outside the scope of this application review.

Therefore, approval of this application does not constitute U.S Nuclear Regulatory Commission (NRC or Commission) acceptance or approval of the closure of any referenced past commitments.

From February 11 through March 29, 2019, the NRC staff conducted an audit to support its review of the amendment request, as discussed in the NRC staff's audit plan dated February 8, 2019 (Reference 6), and audit summary dated September 17, 2019 (Reference 7). By electronic mail (e-mail) dated June 28, 2019 (Reference 3), the NRC staff sent the licensee a Enclosure 2

request for additional information (RAI). By letter dated July 31, 2019, the licensee responded to the NRC staff's request. The licensee's supplement of July 31, 2019, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the NRC staffs original proposed no significant hazards consideration determination as published in the Federal Register on April 2, 2019 (84 FR 12638).

2.0 REGULATORY EVALUATION

2.1 Description of Oconee's Tornado Protection and Mitigation In its application dated September 14, 2018, the licensee stated that the current tornado protection licensing basis is a combination of probabilistic analyses, diversity, and defense-in-depth strategies addressing the capability to provide for safe shutdown of the Oconee units. In the early 1980s, the licensee installed the SSF, which was not a part of the original plant design, to address concerns related to plant security, fire protection, and turbine building flooding.

The SSF is designed as a standby system for use under certain emergency conditions. The system provides additional "defense-in-depth" protection for the health and safety of the public by serving as a backup to existing safety systems. Although the SSF structure is tornado protected, there are vulnerable areas of the SSF systems primarily where the piping and cabling enter the Auxiliary Building (AB) via the west penetration room (WPR) and cask decontamination tank room (CDTR). The plant also contains exposed components on the main steam and feedwater systems. This license amendment request (LAR) is proposing to define the future Oconee tornado licensing basis (LB) as a deterministic approach with a defined mitigation strategy using the SSF.

Currently, for primary side make-up water and reactor coolant seal cooling, the licensee stated in its application that it could use High Pressure Injection (HPI), powered by the normal, emergency, or Protected Service Water (PSW) power supplies, or the SSF Reactor Coolant Makeup (RCMU) system. The licensee stated that the Borated Water Storage Tank or the SFP could be used as a suction source for HPI, and the SFP could be used as a suction source for the SSF RCMU.

The Reactor Coolant System (RCS), by virtue of its location within the Reactor Building, is protected from tornado damage. A sufficient supply of secondary side cooling water for safe shutdown could be available with PSW Pumps located in the Auxiliary Building and taking suction from Oconee 2 Condenser Circulating Water (CCW) intake piping. Currently, redundant and diverse sources of secondary makeup water are credited for tornado mitigation. These include: 1) the other units' Emergency Feedwater (EFW) Systems, 2)the PSW pumps, and

3) the SSF ASW pump.

In its application, the licensee also described sources of onsite and offsite power systems that supply the unit auxiliaries during normal operation and the reactor protection and engineered safeguards protection systems during abnormal and accident conditions. The licensee's description included tornado-protected underground pathways from the Keowee Hydro Station to the turbine building and PSW buildings.

2.1.1 SSF Systems Used for Stabilization To accomplish the tornado mitigation success criteria and achieve stabilization using the SSF, the licensee utilizes specific systems. These systems will allow mitigating initial conditions of loss of all alternating current power to all units with significant tornado damage to one unit.

While the licensee evaluated the ability to mitigation significant damage to one unit, Oconee's Updated Final Safety Analysis Report (UFSAR, Reference 16), Section 3.2.2 "Tornado,"

requires the ability to shutdown all three units in the event of a tornado. The UFSAR states, "The Reactor Coolant System will not be damaged by a tornado. A loss of Reactor Coolant Pump (RCP) seal integrity was not postulated as part of the tornado design basis. Capability is provided to shutdown safely all three units." In response to request for additional information (RAI 15), the licensee clarified its proposed mitigation strategy whereby significant damage is only assumed to a single unit, and all units are assumed to be impacted by the tornado. A loss of all AC power is assumed for all three units. In this unlikely event, the licensee is assuming a tornado damage condition that includes loss of the Keowee Hydro units due to the exposed upper structures, loss of off-site power, and major damage to one of three units.

In response to the loss of AC power, secondary makeup would be required for all three units and the SSF auxiliary service water (ASW) system is credited to provide secondary makeup to the significantly damaged unit. Makeup water is provided to the other units as well, initially by the EFW pumps. Following a loss of all AC power, the turbine-driven EFW pump for each undamaged unit starts automatically. The water inventory that is immediately available to the turbine driven EFW pump (Upper Surge/Tank) is sufficient to supply feedwater to the SGs for at least 40 minutes assuming automatic SG level control and no reliance on operator action. After this time, operators align the water source to the condenser hotwell.

As indicated above, the current licensing basis defined in the UFSAR for tornado mitigation provides redundancy, independence, and diversity with reliance on the combined capabilities of the tornado-protected station power path and major components of the PSW system, EFW from the unaffected units, and the SSF ASW system. However, none of these systems have a design basis assuring protection from the postulated effects of a tornado, including postulated missiles. The licensee proposed a tornado mitigating strategy that changes the SSF designbasis, classifying it as a system capable of withstanding the postulated effects of a tornado, and relies on the SSF systems to safely shutdown one tornado-damaged unit under conditions including a loss of normal and emergency AC power. The normal safety-related systems and the PSW system, which are not designed to fully withstand the effects of a tornado, would still be available to safely shutdown the units that are assumed to be undamaged by the tornado.

2.1.2 SSF Components As indicated above, specific systems and components are required to the assure mitigation of a tornado event.

The specific components relied upon to assure mitigation of a tornado event under the proposed licensing basis utilize the following features of the SSF and the containment structure.

2.1.2.1 SSF Structure The SSF is a reinforced Class 1 concrete structure consisting of a diesel generator room, electrical equipment room, mechanical pump room, control room, central alarm station (CAS),

and ventilation equipment room. As described in Section 9.6.1 of the UFSAR, the SSF houses stand-alone systems that are designed to maintain the plant in a safe and stable condition following postulated emergency events that are distinct from the design basis accidents and design basis events for which the plant systems were originally designed.

As defined in the UFSAR, the SSF structure is designed to withstand tornado differential pressure, wind, and missile loadings. Revision 1 to Regulatory Guide 1. 76 (Reference 18) was incorporated into the SSF licensing basis in 2007. As stated in the UFSAR, the design of all future changes to and/or analysis of SSF-related systems, structures, and components subject to tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Regulatory Guide 1. 76, Revision 1.

As stated in the licensee's application, no licensing basis changes are proposed related to the SSF structure.

2.1.2.2 CCW Piping (Unit 2)

The SSF ASW pump utilizes a suction supply of lake water from the embedded Unit 2 Condenser Circulating Water (CCW) piping. The SSF ASW pump is the major component of the system and is housed in the SSF building. The water contained in the buried CCW piping for Unit 2 serves as the water supply. For long-term supply, the SSF portable pumping system includes a submersible pump and a flow path capable of taking suction from the intake canal and discharging water into the Unit 2 CCW line.

2.1.2.3 SSF RCMU System The SSF RCMU system is designed to supply borated makeup to the RCS, RCP seal cooling, and RCS inventory. There is one RCMU train per unit.

The SSF RCMU system is aligned to take suction from the SFP to borate the RCS, maintain adequate RCS inventory control, and provide RCP seal cooling. The inventory in the SFP is sufficient to support operation of the SSF RCMU system for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The SSF RCMU system components include the makeup pump, suction valves, discharge valves, and RCS letdown valves. The RCMU system pressure boundary piping is contained entirely in the Reactor Building. The Reactor Building is designed to withstand the postulated tornado loadings including missiles created by tornado winds.

2.1.2.4 SSF Powered Pressurizer Heaters As indicated in UFSAR, Section 9.6.3.2, SSF controlled pressurizer heaters are part of the RCMU system to support achieving and maintaining RCS natural circulation flow by offsetting pressurizer heat loss due to ambient heat loss from the pressurizer and pressurizer steam space leakage.

The SSF is capable of supplying power to pressurizer heater bank 2, groups B and C. These heater groups are controlled from the SSF control room (CR) to restore and maintain the RCS within the desired pressure range.

The pressurizer heaters for each unit are supplied from non-safety-related motor control centers (MCC), with the exception of SSF group B and C pressurizer heaters. The Group B and C heaters are supplied from safety related MCCs.

No change to licensing basis was proposed related to the pressurizer heaters.

2.1.2.5 SSF ASW System Oconee's UFSAR, Section 9.6.3.3, states that the SSF ASW system is designed to cool the RCS during a Station Blackout (SBO) and in conjunction with the loss of the normal and emergency feedwater system by providing steam generator cooling. The SSF ASW pump is the major component of the system. One motor-driven SSF ASW pump serves all three units and is located in the SSF.

The suction supply for the SSF ASW pump, the SSF heating, ventilation, and air conditioning (HVAC) service water pumps, and the SSF discharge surface water (DSW) pump, is lake water from the embedded Unit 2 CCW piping. A portable submersible pump that can be installed in the intake canal and powered from the SSF is available to replenish the water supply in the embedded CCW pipe if both forced CCW and siphon flow through the CCW pipe are lost.

As a result of postulated tornado effects, the main feedwater and EFW systems (except the turbine-driven emergency feedwater pump (TDEFWP) on undamaged units), are assumed to be unavailable. The SSF ASW system is designed to feed directly to the steam generators (SGs) to provide secondary side decay heat removal (SSDHR) to cool the RCS following this postulated loss of all main feedwater and EFW systems. In the licensee's application, two analyses were performed, overheating and overcooling:

• For an overheating event, the significantly damaged unit is supplied by SSF ASW. The other two units will be initially supplied by the TDEFWP and subsequently supplied by SSFASW.

• For an overcooling event, the TDEFWP is assumed conservatively to run until the contents of the upper surge tank are depleted (to maximize the overcooling). SSF ASW flow is subsequently established to all three units as needed.

2.1.2.6 SSF Diesel Generator Tornado-protected electrical power to the SSF system is provided by an independent 4 kilovolt (kV) diesel generator (DG) contained within the SSF structure. The 4kV generator, diesel engines, and associated electrical equipment (switchgear, transformers, load center, motor control centers, and panel boards) are contained within the SSF structure.

2.1.2. 7 SSF Instrumentation The instrumentation needed to support safe shutdown (SSD) from the SSF CR is either physically protected or analyzed by TORMIS computer code modeling. The instrumentation used to mitigate the tornado with indications in the SSF CR are described in Section 3.2 of the licensee's application.

2.2 Licensee's Proposed Changes The licensee requested to revised the UFSAR tornado licensing basis to allow credit for the Standby Shutdown Facility (SSF) to mitigate a tornado with the assumed initial conditions of loss of all alternating current (AC) power to all units with significant tornado damage to one unit, approval for the use of tornado missile probabilistic methodology (TORM IS), and approval for elimination of the spent fuel pool (SFP) to high pressure injection (HPI) flow path for reactor coolant makeup.

The licensee proposed to revise and clarify the tornado licensing basis description documented in UFSAR Sections 3.2, 3.3, 3.5, 5.1, 5.2, and 9.6, and add the TORMIS methodology, inputs, and results to UFSAR Section 3.5. The licensee included marked up and clean UFSAR pages in Attachments 2 and 3, respectively, of its application, as modified by its supplement dated July 31, 2019. The licensee also proposed to revise and clarify the SSF Bases for Technical Specification (TS) 3.10.1, "Standby Shutdown Facility," to address degradation of passive civil features as not applying to operability under TS limiting condition of operation (LCO) 3.10.1, but rather as UFSAR commitments outside of the TSs.

The licensee proposed to credit the SSF as the assured mitigation path following a tornado.

While much of the SSF is protected from tornado, TORM IS would be used to justify the lack of tornado protection for low probability of failure of unprotected SSF components that are required to support tornado mitigation. The licensee proposes that main steam (MS) and feedwater (FW) systems be allowed to remain unprotected, with the use of the SSF system to address failure of these unprotected portions of the MS and FW systems in event of tornado.

Oconee proposes to incorporate the following changes in its licensing basis:

1. Credit the SSF as the assured mitigation path following a tornado with the assumed initial conditions of loss of all AC power to all units with significant tornado damage to one unit.

2. Incorporation of tornado missile probabilistic methodology (TORM IS) in the Oconee tornado LB and associated UFSAR changes.

3. Elimination of the SFP to HPI flow path for RCMU.

The proposed license amendment would modify the plant licensing basis for Oconee 1, 2, and 3 by revising the UFSAR to describe the methodology and results of the analysis performed to evaluate the protection of the plant's structures, systems, and components (SSCs) from tornado-generated missiles.

In its application, the licensee described commitments and modifications that it was making to the plant to collectively enhance overall design and safety margin. In its application, the licensee stated that it was not applying for NRC approval of the modifications; rather, that the licensee determined that prior NRC approval was not required via 10 CFR 50.59. The licensee proposed to credit the plant modifications to enhance the plant's capability to withstand the effects of a damaging tornado. The licensee stated that equipment installed by these modifications will be physically protected or evaluated in the TORMIS model. The modifications include providing missile protection for the outdoor SSF diesel fuel oil tank fill and vent lines to prevent shear or perforation of the piping and subsequent rain water intrusion into the underground tank, a new SSF RCMU pulsation dampener in each unit to accommodate

operation of the SSF RCMU system at lower range RCS pressures, a new SSF letdown line in each unit to provide SSF control room operators with the ability to control the plant at lower range RCS pressures, and new quality assurance (QA)-1 instrumentation in the SSF control room for steam generator pressure, nuclear instrumentation, core exit thermocouples, pressurizer temperature, and temperature compensated pressurizer level.

Licensee's Proposed UFSAR Changes The licensee proposed to revise Section 3.2.2, "System Quality Group Classification," of the UFSAR as follows (deletions shown in double strike-out and additions shown in underlined text):

4. Tornado TRe Ree0t"n CeeleRt System will Ret ee eeme§e& By e terRe&e. />. less ef Reeeter CeeleRt Pwmp (RCP) seel iRte§rity wee Ret pestwleteo es peft ef tRe terneee eesi§R Besis. Cepeeility is prnvieee te sAwteewR sefely ell u~ree

~

TRe Reeeter CeeleRt System, By viftwe ef its leeetieR witRiR tRe Ree8ter iwileiR§, is preteetee frem terReee eeme§e. A swffieieRt swpply ef seeeR&8FJ' siee eeeliR§ weter fer sefe sRwtlewR is esswre1 ey Preteete1 ierviee Weter Pwmps leeetee iR tRe Aw>ili8FJ' iwilliR!!!I 8R& tel(ifl!!!I swetieR ffem OeeRee 2 CC\/!.' iRtel(e pipiR!!!I, RelwR&8Rt SR! eiverse sewrees ef seeeR&SFJ' mel(ewp weter ere ereeiteo fer terRe&e miti!!!letieR. TRese iRelwoe: 1) tRe etAer wRits' liF,\AJ Systems, 2) tRe PS>JV pwmps, eRe 3) tRe SSF AS\A.' pwmp.

Preteete1 er pAysieelly seperetee liRes ere wsee te swpply eeeliR!!!I water te eeeR steem !!!l&Rereter. TRe sewrees ef pe1;1.rer te tRe PS\Ai.' pwmps ere tRe

• Keewee Myore StetieR eRd tRe CeRtral Tie SwiteRyerd vie e 1QQ kV treRsmissieR liRe te e 1QQ/13.S l(V swestetieR.

The Reactor Coolant System, by virtue of its location within the Reactor Building, will not be damaged by a tornado. Capability is provided to shutdown safely all three units. Tornado is not considered a design basis event {DBE) or transient for Oconee. Protection against tornado is an Oconee design criterion, similar to the criteria to protect against earthquakes, wind, snow, or other natural phenomena described in UFSAR Section 3.1.2.

A specific occurrence of these phenomena is not postulated.

The statement, "Capability is provided to shutdown safely all three units" was intended to be a qualitative assessment that, after a tornado, normal shutdown systems would remain available or alternate systems would be available to allow shutdown of the plant. It was not intended to imply that specific systems should be tornado proof. As part of the original FSAR development, specific accident analyses were not performed to prove this judgment, nor were they requested by the NRC. Subsequent probabilistic studies confirmed that the original qualitative assessments were correct. The risk of not being able to achieve safe shutdown after a tornado was sufficiently small that additional protection was not required.

In an effort to ensure the risk of not being able to achieve safe shutdown after a tornado is maintained sufficiently small, design criteria are applied to the SSF through physical protection and TORM IS to establish its capability to mitigate a tornado. The overall tornado mitigation strategy utilizes the deterministically tornado protected SSF for secondary side decay heat removal (SSDHR) and reactor coolant makeup (RCMU) following a postulated loss of all normal and emergency systems which usually provide these safety functions.

Successful mitigation of a tornado condition at Oconee is defined in UFSAR Section 9.6, SSF. The SSF and its related equipment have been physically protected to meet tornado requirements or have been evaluated using TORMIS.

In addition to the SSF deterministic capability to mitigate a tornado, the inherent plant design of system redundancy, independence, and diversity is maintained for reasonable assurance that sufficient primary and secondary makeup is available following a tornado. Though all features of the inherent plant design are not tornado proof, their collective capabilities result in high availability and reliability to ensure that system functions are not reliant on any single feature of the design. As such, the high availability and reliability provided by the inherent design of the plant which includes redundancy, independence, and diversity ensures defense in depth is maintained if the SSF and related components become unavailable either prior to or during a tornado. The sources of secondary makeup include: 1) the Emergency Feedwater system including the capability to cross connect from another unit,

2) the PSW system, and 3) the SSF ASW system capable of being powered by the SSF diesel. The sources of primary makeup include: 1) the SSF Reactor Coolant Makeup Pump supplied from the Spent Fuel Pool and capable being powered from the SSF diesel and 2) A High Pressure Injection (HPI) pump supplied from the Borated Water Storage Tank. Note that in addition to their normal and emergency power sources, the "A" and "B" HPI pumps can be powered from the PSW switchgear.

The revised tornado mitigation strategies will be implemented when the SSF letdown line, SSF control room QA-1 instrumentation upgrade, and SSF diesel fuel oil tank fill/vent missile protection conforming modifications are completed.

An external source of cooling water is not immediately required due to the large quantities of water stored underground in the intake and discharge CCW piping. The stored volume of water in the intake and discharge lines below elevation 791ft would provide sufficient cooling water for all three units for at least 30 days after trip of the three reactors.

AI0~0~~1=1 R0t f~lly pr=0te0tes fr=0m t0rnes0e8, tl=le fellewiR~ 8e~r=ee8 prnvise r=ee80Rehle 888~f8Ree tl=let e 8~:ffieieRt 8~pply er= pr=imer=y 8ide mel(e~p water=

i8 eveilehle s~r=iR~ e t0rnes0 iRitieteo 1088 0f 0:ffeite pewer=.

e. Tl=l0 ssi;: ~eeet0r= C00leRt Mel(e~p Pwmp eeR take 9weti0R fr=0m tl=l0 SpeRt i;:~el P00I. Tl=IEI p~mp EIBR 00 8~ppliE1s p0wE1r= frnm tl=le ssi;: QiE18E1I.

e. A MiSR Press1.1re IRjeetiefl P1.1fflp eefl tel<e s1.1etiefl freffl eitf;ier tf;ie liereteo

'.A!eter Sterese TeRI< er tf;ie SpeRt F1.1el Peel. Eitf;ier tf;ie "A" ef "Q" Mist;i Press1.1re lfljeetiefl P1.tfflp 88fl ee pe'l:vere1 freffl tf;ie PS'ft/ Switef;iseer.

Preteetiefl eseiflst terReoe is efl Oeeflee oesisfl eriterie, siffliler te tf;ie eriterie te preteet eseiflst eertR!1.tel<es, *.vifl&, sRe*.v, er etf;ier Ret1.1rel pReflefflefle oeseriee1 ifl YFSAR seetiefl 3.1.~. A speeifie eee1.1rreF1ee ef tf;iese pRefl@ffl9fle is fl@t pest1.1lete1, Rer is ell 811.tipffleflt tf;iet we1.1l0 B8 1.1s8& te eriflS tf;ie pleflt te sefe sf;i1.1to0wfl eempreReflsiv81y listeo. Tt;ie steteffleflt, "Cepeeility is previ1e1 h~ sf;i1.1t1ewfl sefely ell tf;ir9e 1.tflits" is iflt8fl&e1 te oe e 11.telitetive essessffl&flt tf;iet, efter e terfle1e, Aerfflel sF11.1t1ewfl systeffls will reffleifl eveileele er elterAete systeffls will ee eveileel8 te elle1;1.r sf;i1.1t1ewfl ef tf;ie pleRt.

It wee Ret ifltefl181 te ifflply tf;iet sp9eifie systeffls sf;ie1.1l1 ee terfle1e preef. :A.s pert ef tf;ie erisiRel FSAR eevelepffl&flt, speeifie eeei1eflt eAelyses were Aet per=feFffle1 te pFeve tf;iis j1.11seffl&flt, Rer we Fe tf;iey r8!1.t8ste1 ey tRe MRC. S1.1e&e!1.t8flt pFeeeeilistie st1.11ies f;ieve eeflfirffle1 tf;iet tf;ie eFiSiflel 11.telitetive essessffleflts were eerreet. Tt;ie Fisk ef Ret eeiRS eels te e8Rieve sefe sf;i1.1toe*,vfl efteF e terneee is s1.1ffieiefltly &fflell tf;iet e11itieRel pFeteetiefl is Ret re!1.tiFe1.

lfl a11itiefl, tReFe was eeRsi1eFeele eerFespeF11eF1ee eetweefl 01.tl<e efl1 ~JRC iFI tf;ie yeers pest TMI 1ise1.1ssiRS OeeRee's eeility te s1.1rvive teFRe1e seF1erete1 missiles.

liese1 1.1pefl tf;ie preeeeility ef feil1.1Fe ef tf;ie Elr\A.' afl1 Stetiefl AS'/!.' systeffls eemhifle1 witR tf;ie prete8tiefl eseiRst t@Fflede fflissiles effeF1e1 ey tf;ie SSF ASW system, tf;ie ~JRC eeflel1.11e1 tf;iet tf;ie seeeA1ary si1e 1eeey f;ieet refflevel f1.1F1etiefl eefflplie1 witR tRe eriteriefl fer preteetiefl eseiflst terneeees.

The licensee proposed to add the following reference to the new license amendments to Section 3.2.3, "Reference," of the UFSAR (with bracketed information to be updated with the amendment numbers and their date of issuance): "5. License Amendment No. [XXX, XXX, and XXX] (date of issuance - [Month XX, 20XX]); Tornado Mitigation."

The licensee proposed to add the following text (shown underlined) to the last paragraph of Section 3.3.2.1, "Applicable Design Parameters," of the UFSAR, as follows:

... The design of new systems (and their associated components and/or structures) that are required to resist tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Regulatory Guide 1. 76, Revision 1 or be evaluated by TORM IS.

The licensee proposed to add the following reference to the new license amendments to Section 3.3.3, "References," of the UFSAR (with bracketed information to be updated with the amendment numbers and their date of issuance): "3. License Amendment No. [XXX, XXX, and XXX] (date of issuance - [Month XX, 20XX]); Tornado Mitigation."

The licensee proposed to add the following text (shown underlined) to the last paragraph of Section 3.5.1.3, "Missiles Generated by Natural Phenomena," of the UFSAR, as follows:

... The design of new systems (and their associated components and/or structures) that are required to resist tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Regulatory Guide 1.76, Revision 1 or be evaluated by TORMIS.

Due to confusion on use of "or be evaluated by TORMIS", the NRC staff issued RAI 13 requesting the licensee to describe compliance with the NRC staffs position (RIS 2008-14) regarding the future use of the TORMIS methodology to evaluate plant nonconformances. In response to RAI 13, the licensee clarified that TORMIS will be used to address newly found nonconformances and will be considered in combination with the impact of other SSCs that were previously analyzed using TORM IS methodology. The NRC staff understands this to mean all future plant modifications will meet the current licensing basis and use of TORM IS is limited to found non-conformances.

The licensee proposed to add the following new Section 3.5.1.3.1, "TORMIS Methodology,"

after the last paragraph of Section 3.5.1.3 of the UFSAR, as follows:

3.5.1.3.1 TORMIS Methodology The TORMIS methodology provides an approach to demonstrate adequate protection for existing SSCs that were originally required to be protected from tornado missiles in accordance with the plant design basis but that are not adequately protected due to some oversight. The approved methodology does not allow TORMIS analysis to be used to temporarily or permanently eliminate existing barriers that are credited for providing tornado missile protection.

The TORMIS acceptance criteria are based on the cumulative damage frequency of tornado missile damage to all safety-related SSCs that are not provided positive protection. Therefore, the impacts of all non-conforming items are combined so that the total missile damage frequency is evaluated against the acceptance criterion of 1E-06 per year. If additional new non-conforming SSCs are identified in the future, TORMIS analysis may be used to evaluate these specific plant features and combine their damage impacts with the impacts of SSCs that were previously analyzed using the TORMIS methodology to determine if adequate protection is maintained.

The TORMIS computer code is used to determine the frequency of a damaging tornado missile strike on unprotected plant SSCs that are used to mitigate a tornado. The TORM IS code is an updated version of the original TORM IS code developed for the Electric Power Research Institute (EPRI). The methodologies used in the code to evaluate the frequency of damaging tornado missile strikes are documented in References 9, 10, 11, and 12.

The TORM IS code accounts for the frequency and severity of tornadoes that could strike the plant site, performs aerodynamic calculations to predict the transport of potential missiles around the site, and assesses the annual frequency of these missiles striking and damaging structures and other targets of interest.

The analysis requires the development of input data in three broad areas:

1. development of site tornado hazard information.

2. development of site missile characteristics.

3. development of target size, location, and physical properties.

TORMIS Model Inputs The TORMIS methodology seeks to demonstrate that the annual probability of a radioactive release in excess of 10 CFR 100 resulting from tornado missile damage to unprotected SSCs used to mitigate a tornado is less than the acceptance criterion of 1E-06/rx-yr [reactor-year]. This means that the unprotected SSCs are evaluated collectively against the acceptance criterion rather than individually. For a multi-unit site such as Oconee, this criterion is applied to each unit individually.

For this evaluation, the prevention of a "release in excess of 10 CFR 100" is accomplished by establishing SSD conditions following a tornado strike and maintaining these conditions for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The following safety functions are required:

• Secondary Side Decay Heat Removal,

• Reactor Coolant Makeup,

• Reactor Coolant System pressure boundary integrity.

Through a process of plant walkdowns and reviews of plant drawings, calculations, and other information, a detailed list of structures and equipment lacking deterministic protection was developed that meets the scope of the TORMIS safety targets described above.

TORMIS Results A site specific analysis of vulnerable tornado mitigation equipment (SSCs) has been conducted using the TORMIS analysis methodology. This includes a characterization of the site tornado hazard and potential tornado generated missiles developed in a manner consistent with the requirements of the TORM IS User's Manual and other TORMIS reference materials.

For each Oconee unit, the mean annual frequency of a damaging tornado missile strike resulting in a radiological release in excess of 10 CFR 100 limits was determined to be less than the acceptance criterion of 1E-06 per year. The analysis was performed in a manner consistent with the requirements of the EPRI topical reports and with the requirements set forth in the NRC's SER (Reference 14) and [Regulatory Issue Summary] RIS 2008-14 (Reference 15).

The licensee proposed to add references for documents discussed in the new Section 3.5.1.3.1 to Section 3.5.3, "References," of the UFSAR, as follows, with bracketed information to be updated with the amendment numbers and their date of issuance:

9. Electric Power Research Institute Report - EPRI NP-768 and NP-769, "Tornado Missile Risk Analysis," dated May 1978.

10. Electric Power Research Institute Report - EPRI NP-2005, Volumes 1 and 2, "Tornado Missile Risk Evaluation Methodology," dated August 1981.

11. Applied Research Associates, Inc., Project 5313, "TORMIS95 User's Manual:

Tornado Missile Risk Methodology," dated December 1995.

12. License Amendment No. [XXX, XXX, and XXX] (date of issuance-

[Month XX, 20XX]); Tornado Mitigation.

13. Regulatory Issue Summary 2015-06, "Tornado Missile Protection," dated June 10, 2015.

14. Rubenstein, LS., "Safety Evaluation Report - Electric Power Research Institute (EPRI) Topical Reports Concerning Tornado Missile Probabilistic Risk Assessment (PRA) Methodology," U.S. Nuclear Regulatory Commission letter to F. J. Miraglia, dated October 26, 1983.

15. Regulatory Issue Summary 2008-14, "Use of TORM IS Computer Code for Assessment of Tornado Missile Protection," dated June 16, 2008.

The licensee proposed to add the following paragraph after the last paragraph in Section 5.1.2.4, "Natural Circulation," of the UFSAR, as follows:

The effects of a tornado may drive a unit to an average reactor coolant temperature less than 525°F. The subsequent minor reduction in RCS temperature required to compensate for the increase in RCS inventory by the SSF RCMU pump during plant stabilization does not constitute a natural circulation cooldown requiring use of the reactor vessel head vent. Refer to Reference 2 for additional information.

The licensee proposed to add the following reference to Section 5.1.3, "References," of the UFSAR, as follows, with bracketed information to be updated with the amendment numbers and their date of issuance: "2. License Amendment No. [XXX, XXX, and XXX] (date of issuance -

[Month XX, 20XX]); Tornado Mitigation."

The licensee proposed to revise the following paragraph in Section 5.2.3.4, "Steam Generators,"

of the UFSAR, as follows (deletions shown in stricken text):

Feedwater line breaks, tl=le temeell e*JeRt, and other overheating events impose compressive loads on the steam generator tubes as the RCS heats up and/or the steam generator shell cools down. Tl=le temeell ~rnteetilA eAelysis eredite e me>cim1=1m elm~res&i¥e t1=11iile tl sl=lell AT 9f +1Q6°i; wt;iile tl=le feedweter liAe liilreek eAel~*sis ereditiAS MPI fureeel eeeliRS res1=1lts iR a 1lwer elm~ressive t1=11iile tl sl=lell

~ Analyses have demonstrated that steam generator tube integrity is maintained for these loads for the replacement steam generators.

The licensee proposed to add the following text after the last paragraph in Section 9.6.1, "General Description [of the SSF]," of the UFSAR: "Based on subsequent SSF licensing correspondence, different design criteria may have been applied for new SSF events. Refer to the event specific design bases below for details."

The licensee proposed to revise Section 9.6.2, "Design Bases [for the SSF]," of the UFSAR, as follows (deletions shown in stricken text and additions as underlined text):

SSF TORNADO DESIGN CRITERIA This is a design criterion for the SSF structure that was committed to as part of the original SSF licensing correspondence and remains valid. All parts of the SSF it8eUstructure that are required for mitigation of the SSF events are required to be designed against tornado winds and associated tornado missiles. This requirement is satisfied through appropriate design of the SSF structure.

Originally, the design criterion didT~is re~wiremeRt &888 not extend to SSCs that were already part of the plant which SSF relies upon and interfaces with for event mitigation. The design criterion is now extended to SSCs that are a part of the plant which the SSF relies upon and interfaces with for tornado mitigation. This is satisfied either through physical protection or evaluated by TORM IS. It is important to note that the overall tornado mitigation strategy utilizes the SSF was R8t li0eRsee to mitigate a tornado eveRt 8f e t8FR8&8 missile eveRt (Reference 442). Tornado design requirements for the plant itself are addressed

• in Section 3.2.2.

Successful mitigation of a tornado condition at Oconee shall be defined as meeting the following criteria to ensure that the integrity of the core and RCS remains unchallenged:

• The core must remain intact and in a coolable core geometry during the credited strategy period.

• Minimum Departure from Nucleate Boiling Ratio (DNBR) meets specified acceptable fuel design limits

• RCS must not exceed 2750 psig (110 percent(%) of design).

In addition to the criteria specified above, the following criteria are validated for the overcooling analysis to demonstrate acceptable results:

• Steam Generator tubes remain intact.

• RCS remains within acceptable pressure and temperature limits.

The tornado initial conditions are defined for the unit( s) as MODE 1, 102% rated thermal power at end of core life (690 effective full-power days). The tornado is assumed to leave one unit significantly damaged and a loss of all AC power to all

three units. Two bounding analyses were performed, overheating and overcooling. For an overheating event, the significantly damaged unit is supplied by SSF ASW. The other two units will be initially supplied by the TDEFWP

[turbine driven emergency feedwater pump] and subsequently supplied by SSF ASW. For an overcooling event, the TDEFWP is conservatively assumed to run until the contents of the Upper Surge Tank are depleted (to maximize the overcooling). SSF ASW flow is subsequently established to all three units as needed.

Following a tornado induced overcooling event the unit may experience a minor return to power of short duration. There are no consequences associated with the return to power due to the very low power level generated. The SSF is not required to meet the single failure criterion or the postulation of the most reactive rod stuck fully withdrawn. Failures in the SSF system will not cause failures or inadvertent operations in other plant systems. The SSF requires manual activation and can be activated if emergency systems are not available. A subsequent issue related to crediting SSF ASW as an alternative for EFW tornado missile protection vulnerabilities is discussed below (see EFW Tornado Missile Design Criteria).

The licensee proposed to add the following text (shown underlined) to the last paragraph under the heading, "WIND AND TORNADO LOADS," of Section 9.6.3.1, "Structure," of the UFSAR:

... The design of all future changes to and/or analysis of SSF-related systems, structures, and components subject to tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Regulatory Guide 1. 76, Revision 1 or be evaluated by TORM IS.

The licensee proposed to add the following text (shown underlined) to the last paragraph under the heading, "MISSILE PROTECTION," of Section 9.6.3.1 of the UFSAR:

... The design of all future changes to and/or analysis of SSF-related systems, structures, and components subject to tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in Regulatory Guide 1.76, Revision 1 or be evaluated by TORMIS.

The licensee proposed to revise Section 9.6.5, "Operation and Testing," of the UFSAR, as follows (deletions shown in stricken text and additions as underlined text):

The SSF will be placed into operation to mitigate the consequences of the following events/criterion:

Note that tornado is a design criterion per Section 3.2.2, but is treated similar to an event in that planned, formalized actions are taken as the result of a reported tornado.

1. Flooding

2. Fire

3. Sabotage

4. Station Blackout

5. Tornado

[... l

For flooding, sabotage, station blackout. tornado, and those fire events where the SSF is credited for safe shutdown, operators will be sent to the SSF. [ ... ]

The licensee proposed to add the following reference to Section 9.6.6, "References," of the UFSAR, as follows, with bracketed information to be updated with the amendment numbers and their date of issuance: "42. License Amendment No. [XXX, XXX, and XXX] (date of issuance -

[Month XX, 20XX]); Tornado Mitigation."

2.3 Regulatory Review The NRC staff considered the following licensing and design basis information and guidance during its review of the proposed changes.

Licensing and Design Basis Information Oconee pre-dates the NRC General Design Criteria (GDC). The plant was licensed to principal design criteria derived from the draft AEC Design Criteria published in the Federal Register on July 11, 1967. The tornado protection requirements for Oconee are defined in the UFSAR.

The NRC requires that nuclear power plants be designed to withstand the effects of tornado and high-wind-generated missiles so as not to adversely impact the health and safety of the public in accordance with the design criteria. The design criteria which constitute the licensing bases for Oconee are those described in Chapter 3.1, "Conformance with NRC General Design Criteria,"

of the UFSAR and in other UFSAR sections. These design criteria establish the necessary design, fabrication, construction, testing, and performance requirements for structures, systems, and components (SSCs) important to safety; that is, SSCs that provide reasonable assurance that the facility can be operated without undue risk to the health and safety of the public.

Section 3.1.2, "Criterion 2 - Performance Standards (Category A) of Revision 27 of the UFSAR (Reference 16), states, in part:

Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be designed, fabricated and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as ... tornadoes.... The design bases so established shall reflect: a) appropriate consideration of the most severe of these natural phenomena that have been recorded for the site and the surrounding area and,

[sic] b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.

2. Natural Phenomena These essential systems and components have been designed, fabricated, and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena. The designs are based upon the most severe of the natural phenomena recorded for the vicinity of the site, with an appropriate margin to account for uncertainties in the historical data.

These natural phenomena are listed below. Design bases are presented elsewhere in this report where specific systems, structures, and components are discussed.

b. Tornado - See details in Section 3.2.2 Oconee's UFSAR, Section 3.3.2 indicates that Revision 1 of Regulatory Guide (RG) 1.76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," was incorporated into the plant's licensing basis and that new systems (and their associated components and/or structures) that are required to resist tornado loading will conform to the tornado wind, differential pressure, and missile criteria specified in RG 1. 76, Revision 1 (Reference 18).

The design tornado used in calculating tornado loadings is in conformance with Regulatory Guide 1.76, Revision O (Reference 17). UFSAR, Section 9.6.3.1, states that Revision 1 of RG 1.76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," was incorporated into Oconee's SSF licensing basis in the 4th quarter of 2007. The UFSAR indicates that the design of all future changes to and/or analysis of SSF-related systems, structures, and components subject to tornado loadings will conform to the tornado wind, differential pressure, and missile criteria specified in RG 1. 76, Revision 1.

The typical method used for tornado mitigation is to provide positive protection features, such as locating required equipment in structures designed for tornado missiles, providing barriers designed for tornado missiles or designing components to withstand tornado conditions. The licensee is requesting a change to the Oconee 1, 2, and 3 licensing bases to allow certain components to remain unprotected from tornado missiles based on revised tornado mitigative features of the plant and use of TORM IS computer code.

The Electric Power Research Institute (EPRI) developed the tornado missile probabilistic methodology described in two topical reports: EPRI NP-768 (Reference 11) and NP-769, "Tornado Missile Risk Analysis and Appendices," issued May 1978, and EPRI NP-2005,

Tornado Missile Risk Evaluation Methodology," Volumes I and II, issued August 1981 (References 12 and 13). These topical reports document the TORMIS computer code methodology. The ERPI methodology employs Monte Carlo techniques to assess the probability that tornado missile strikes will cause unacceptable damage to safety-related plant features. The NRC staff concluded in a safety evaluation report (SER) dated October 26, 1983 (Reference 14), that the EPRI TORMIS methodology can be used in lieu of deterministic methodology when assessing the need for positive tornado missile protection for specific safety-related plant features in accordance with the criteria of SRP Section 3.5.1.4. The SER also stated that the use of the EPRI methodology or any tornado missile probabilistic study should be limited to the evaluation of existing plant-specific features.

Regulations Title 10 of the Code of Federal Regulations (CFR), Part 50.36(c)(2)(ii) requires that a technical specification limiting condition for operation of a nuclear reactor must be established for each item meeting one or more of the following criteria:

(A) Criterion 1. Installed instrumentation that is used to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary.

(B) Criterion 2. A process variable, design feature, or operating restriction that is an initial condition of a design basis accident or transient analysis that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

(C) Criterion 3. A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

(D) Criterion 4. A structure, system, or component which operating experience or probabilistic risk assessment has shown to be significant to public health and safety.

Guidance The NRC staff uses NUREG-1764, "Guidance for the Review of Changes to Human Actions,"

Revision 1 (Reference 19), to review changes to human actions proposed by licensees in LARs.

Sections 3.5.1.4, Revision 4 (Reference 8) and 3.5.2, Revision 3 (Reference 9) of NUREG-0800, "Standard Review Plan [SRP] for the Review of Safety Analysis Reports for Nuclear Power Plants," contain the current NRC review guidance governing tornado missile protection. This guidance generally specifies that SSCs that are important to safety be provided with sufficient, positive tornado missile protection (i.e., barriers) to withstand the maximum credible tornado threat. The Appendix to NRC Regulatory Guide 1.117, "Tornado Design Classification," Revision 1, issued April 1978 (Reference 10), lists the types of SSCs that should be protected from design basis tornadoes. However, SRP Section 3.5.1.4 allows the NRC staff to find it acceptable for a licensee to not install tornado missile protecting barriers if the licensee can demonstrate that the probability of damage to unprotected essential safety-related features is sufficiently small.

The NRC staff's approval of a licensee's application using TORMIS is subject to the appropriate resolution of five specific concerns identified in the SER for the EPRI TORM IS methodology (Reference 14). These specific concerns are related to the assumptions used in the input parameters for the analysis (e.g., locations and numbers of potential missiles presented at a specific site, wind speed, wind speed near the ground, etc.). The staff reviewed the submittal with respect to: (1) the five specific concerns related to the NRC approval of the TORM IS methodology, (2) the acceptability of the TORM IS analysis for calculating the appropriate mean strike and damage probabilities, and (3) a comparison of the TORM IS results against the guidance provided in the SER on EPRI TORMIS methodology (Reference 14) and RIS 2008-14.

In June 16, 2008, the NRC issued Regulatory Issue Summary (RIS) 2008-14 "Use of TORMIS Computer Code for Assessment of Tornado Missile Protection" (Reference 10). This RIS addresses: ( 1) the NRC staff position on the use of the TORM IS computer code for assessing nuclear power plant tornado missile protection, (2) issues identified in previous license amendment requests to use the TORMIS computer code, and (3) information needed in license amendment applications using the TORMIS computer code.

RIS 2008-14 states that the initial use of the TORMIS methodology requires a license amendment in accordance with 10 CFR 50.59(c)(2)(viii) and subsequent revision to the plant licensing basis because it is a departure from the method of evaluation described in the UFSAR

used in establishing the design bases or in the safety analysis as defined in 10 CFR 50.59(a)(2).

Once the TORM IS methodology has been approved for the plant and incorporated in the plant licensing basis, it can be used to address additional tornado missile vulnerabilities identified in the future without seeking NRC approval, provided its use is consistent with the approved licensing basis of the plant.

3.0 TECHNICAL EVALUATION

The current tornado protection licensing basis at Oconee is a combination of a probabilistic approach, along with diversity, and defense-in-depth strategies addressing the capability to provide safe shutdown of the Oconee units. The SSF is designed as a standby system for use under certain emergency conditions. The system provides additional "defense-in-depth" protection for the health and safety of the public by serving as a backup to existing safety systems. Although the SSF structure is tornado protected, there are vulnerable areas of the SSF systems primarily where the piping and cabling enter the AB via the WPRs and CDTRs.

The plant also contains exposed components on the MS and FW systems. The licensee is proposing to define the future Oconee tornado LB using a deterministic approach with a defined mitigation strategy and probabilistically defining SSF components as protected from tornado missiles.

The typical method used for tornado mitigation is to provide positive protection features, such as locating required equipment in structures designed for tornado missiles or providing barriers designed for tornado missiles. The licensee is requesting a change to the Oconee 1, 2, and 3 licensing bases to allow certain components to not be protected from tornado missiles based on revised tornado mitigative features of plant and use of computer code TORMIS.

In determining whether an amendment to a license will be issued, the Commission is guided by the considerations that govern the issuance of initial licenses to the extent applicable and appropriate. The NRC staff evaluated the licensee's application to determine if the proposed changes are consistent with the regulations, guidance, and licensing and design basis information discussed in Section 2 of this safety evaluation. The NRC staff reviewed human factors considerations associated with the operator manual actions described in the licensee's application and supplements. As stated above, the NRC staff performed a Level Ill human factors review per the guidance in NUREG-1764, Revision 1. The LAR proposes to credit the existing SSF and associated operator actions for tornado mitigation at Oconee. The LAR does not propose to change or add any new time critical actions (TCAs). In addition, the LAR proposes the elimination of specified operator actions currently credited for tornado mitigation.

Given that no new operator actions are added, and no performance time requirements are altered, the NRC staff performed a Level Ill human factors review per NUREG-1764 to confirm that detailed evaluation of operator actions is not required.

3.1 Revised Licensing Basis Strategy for Tornados 3.1.1 Proposed Licensing Strategy The licensee has proposed a new mitigation strategy based, in part, on a deterministic approach. Although diverse means of primary makeup, secondary decay heat removal, and electrical power may remain available during a tornado, the proposed strategy is based only on utilization of the SSF. The licensee proposed crediting the SSF as the assured mitigation path following a tornado with the assumed initial conditions of loss of all AC power to all units with significant tornado damage to one unit. As defined in response to RAI 15, significant tornado

damage includes failure of all unprotected components directly associated with the damaged unit that are not either physically protected or evaluated within the TORMIS methodology described within the LAR. To ensure availability and operability of the SSF components, LCO 3.10.1 identifies SSF subsystems separately with a 7-day completion time for each subsystem and a 45-day aggregated unavailability limit for the year. Based on the low frequency of tornado strike occurrence, the 7-day unavailability limit is commensurate with the frequency of challenges from a tornado during operation.

More specifically, the LAR proposed crediting SSF ASW as the replacement for EFW and PSW, and crediting SSF RCMU as the replacement for HPI. The SSF RCMU System is designed to supply borated makeup to the RCS to provide RCP seal cooling and RCS inventory.

Unprotected portions of the SSF systems and associated support systems were evaluated with TORMIS. Typically, TORMIS is approved to allow licensees to resolve existing, exposed components found in noncompliance with their current licensing basis (i.e., UFSAR and supporting documents). In the licensee's LAR, the use of TORMIS was proposed to demonstrate that the potential for tornado damage to unprotected portions of the SSF systems would be sufficiently low to support reliance on these systems for the shutdown functions.

3.1.2 Revised Tornado Protection Licensing Basis (one damaged unit+ loss of all AC)

Although diverse means of primary makeup, secondary decay heat removal, and electrical power may remain available during a tornado, the proposed strategy is based only on utilization of the SSF. TORMIS is typically used and approved as a probabilistic approach for demonstrating compliance with GDCs for components not in conformance with the licensing basis. For the limited portions of the SSF and associated support systems that are not physically protected as a result of structural/physical/economic constraints, TORMIS is utilized.

The existing licensing basis defined in the UFSAR for tornado mitigation following a tornado provides redundancy, independence, and diversity with reliance on the combined capabilities of the tornado-protected station power path and major components of the PSW system, EFW from the unaffected units, and the SSF ASW system. However, the proposed tornado mitigating strategy includes reliance on the use of SSF ASW alone, which degrades the level of defense-in-depth and subsequently increases risk. Additional risk results from TS allowing the SSF to be inoperable for 45 days. As discussed on page 6 of the licensee's letter dated September 14, 2018, CDTR and WPR were modified to increase safety. However, current tornado mitigation strategy contains some defense-in-depth and redundancy with the use of multiple systems for tornado mitigation.

The defense-in-depth philosophy has traditionally been applied in plant design and operation to provide multiple means to accomplish safety functions. System redundancy, independence, and diversity result in high availability and reliability of the function and help ensure that system functions are not reliant on any single feature of the design. By relying only on a manually operated SSF ASW system as the assured means of providing secondary side heat removal (SSHR) following a tornado, redundancy and diversity are lost. Eliminating the redundancy and diversity of the SSHR capability and RCMU makeup path provided under the existing licensing basis for tornado mitigation reduces defenses-in-depth and increases risk related to achieving safe shutdown (SSD) following a damaging tornado. While the proposed combination of physical protection and use of TORM IS meets the intent of a fully protected system, it was not clear to the NRC staff whether the planned use of the SSF alone is enough to overcome the loss of redundancy and diversity that would result from the proposed change. Accordingly, the

NRC staff requested (in RAI 16C) the licensee to elaborate on how defense-in-depth is maintained in event of unavailable SSF function.

In its July 31, 2019 letter, the licensee stated in response to RAI 16C that the design of the plant which includes redundancy, independence, and diversity, ensures defense in depth is maintained if the SSF, and related components become unavailable either prior to or during a tornado. The licensee clarified that no changes are proposed to eliminate the tornado design criteria applied to the various systems, structures, or components as described in the UFSAR.

The available sources of secondary makeup include: 1) the Emergency Feedwater system including the capability to cross connect from another unit, 2) the PSW system, and 3) the SSF ASW system capable of being powered by the SSF diesel. The sources of primary makeup include: 1) the SSF Reactor Coolant Makeup Pump supplied from the Spent Fuel Pool and capable being powered from the SSF diesel and 2) an HPI pump supplied from the Borated Water Storage Tank. FLEX equipment is also available as a viable beyond design basis event mitigation option.

The normal EFW supplies and RCS injection capabilities are subject to TSs and would be available for damage states that did not cause a loss of all AC. That is adequate defense-in-depth if the SSF availability is commensurate with the low frequency of challenges from tornados that cause the assumed tornado damage state.

UFSAR Section 3.2.2 "System Quality Group Classification," Item 4, "Tornado," requires the ability to shutdown all three units in the event of a tornado. It states, "The Reactor Coolant System will not be damaged by a tornado. A loss of RCP seal integrity was not postulated as part of the tornado design basis, and, therefore, RCP seal cooling must be restored if interrupted to ensure seal integrity. Capability is provided to shutdown safely all three units." It further states that "Capability is provided to shutdown safely all three units" is intended to be a qualitative assessment that, after a tornado, normal shutdown systems will remain available or alternate systems will be available to allow shutdown of the plant."

The licensee's proposed tornado licensing basis assumes that a tornado strikes the plant site during full power operation and disables all AC power supplies to the site. This includes loss of power from the Keowee Hydro Units, transformer CT-5, the PSW substation to the PSW building, the 230kV switchyard, and the 525kV switchyard. A loss of all AC power to the site results in a loss of normal reactor coolant injection and RCP seal cooling capability to all three units. The revised tornado LB also assumes that the tornado results in significant damage to one Oconee unit causing either an overheating scenario from a loss of all sources of feedwater to the SGs or an overcooling scenario from a possible breach of the MS system pressure piping. For an overheating scenario, the turbine driven EFW pump is assumed to be unavailable for the significantly damaged unit. For an overcooling scenario, the turbine-driven EFW pump is assumed to be available until the upper surge tank is depleted.

3.2 Thermal-Hydraulic Acceptance Criteria The current tornado licensing basis is derived from information presently contained within several sections of the Oconee UFSAR and generally relies on probabilistic insights, separation, and defense-in-depth concepts to provide reasonable assurance that SSD can be achieved.

Protection against tornado is considered an Oconee design criterion, similar to the criteria to protect against earthquakes, wind, snow, or other natural phenomena as described in UFSAR Section 3.1.2. A specific occurrence of these phenomena is not postulated, nor is all equipment that would be used to bring the plant to SSD listed comprehensively. Capability to bring the

plant to SSD is intended to be a qualitative assessment that, following a tornado, normal shutdown systems will remain available or alternative systems will be available to allow shutdown of the plant. No accident analyses were originally performed, nor were they required.

The risk of not being able to achieve SSD after a tornado is sufficiently small that additional protection is not required.

As stated by the licensee, the purpose of the LAR is to credit the SSF as the assured mitigation path following a tornado. More specifically, the LAR credits SSF Auxiliary Service Water (ASW) as the replacement for Emergency Feedwater (EFW) and PSW, and credits SSF RCMU as the replacement for HPI. In addition, the SSF eliminates reliance on the other onsite and offsite power systems for SSD. The proposed licensing basis for tornado establishes the SSF as a deterministic strategy, which requires a thermal-hydraulic (TH) analysis.

As stated in Section 9.6.1 of the Oconee UFSAR, the SSF is designed to:

1. Maintain a minimum water level above the reactor core, with an intact RCS and maintain RCP seal cooling.

2. Assure natural circulation and core cooling by maintaining the primary coolant system filled to a sufficient level in the pressurizer while maintaining sufficient secondary side cooling water.

3. Transfer decay heat from the fuel to an ultimate heat sink.

4. Maintain the reactor 1% shutdown with the most reactive rod stuck fully withdrawn, after all normal sources of RCS makeup have become unavailable, by providing makeup via the reactor coolant makeup pump system which always supplies makeup of a sufficient boron concentration ....

The proposed acceptance criteria for tornado mitigation given in the LAR are as follows:

• The core must remain intact and in a coolable core geometry during the credited strategy period.

• RCS must not exceed 2,750 psig (110% of design).

• Minimum departure from the Nucleate Boiling Ratio (DNBR) meets specified acceptable fuel design limits.

• Steam generator tubes remain intact.

• RCS remains within acceptable pressure and temperature limits.

The proposed acceptance criteria are different than the generic acceptance criteria of the SSF.

The NRC staff requested the licensee to clarify whether the current UFSAR SSF criteria are applicable, and met by the existing analysis and, if the current criteria are not applicable to tornado events, then to justify why these criteria are no longer needed.

The licensee responded that the criteria described in UFSAR 9.6.1 are specific to the SSF for fire and turbine building flood and are not applicable to the SSF for tornado. As described within UFSAR, Section 9.6.2, the SSF was not originally licensed to mitigate a tornado. The SSF ASW system was later identified after Three Mile Island as an alternative for EFW tornado missile protection vulnerabilities. UFSAR, Section 9.6.2 does not specify a tornado missile event or define a tornado missile mitigation strategy. Using a probabilistic approach, it focused on ensuring that a secondary side heat removal path is designed adequately to withstand the effects of tornado missiles. As part of the SSF licensing history, the acceptance criteria for the SSF have varied based on the event or scenario. The varying acceptance criteria for the events and scenarios associated with the SSF are detailed within UFSAR, Section 9.6.2.

As part of the current proposed licensing action, the tornado acceptance criteria for the SSF was modeled after the SBO success criteria. As described within UFSAR, Section 9.6.2, for SBO, "The success criteria is to maintain the core covered ... " Specific to the analyses performed for tornado, the proposed acceptance criteria are:

• Verify the core remains intact and in a coolable core geometry and verify minimum DNBR limits that ensures sufficient core coverage.

• Verify that the peak allowable RCS pressure is not exceeded; the steam generators remain intact; and the RCS remains within acceptable pressure and temperature limits that ensures the capability to establish long term core cooling, thereby maintaining core coverage.

Page 21 of the Enclosure to the LAR states, "In addition to the criteria specified above, the following criteria are validated for the overcooling analysis to demonstrate acceptable results:

• The steam generator tubes remain intact.

• RCS remains within acceptable pressure and temperature limits."

The above implies that these last two criteria are examined only for the overcooling analysis and not the overheating analysis. The NRC staff requested the licensee to clarify whether the last two criteria are validated for the overheating analysis and, if not, justify why different criteria between the two analyses (overheating and overcooling) are used. In addition, the NRC staff indicated that this distinction is not made clear in the proposed revisions to the UFSAR section.

The licensee responded that the two additional criteria validated in the overcooling analysis recognize the thermal stress induced on the RCS and SG materials during the transient evolution. These criteria ensure the thermal stress induced on the RCS materials during the transient evolution does not challenge the integrity of the RCS pressure boundary. The first criterion is required by the once-through steam generator (OTSG) design. The second criterion is validated to ensure the transient response remains within analyzed limits.

During the initial stages of an overcooling event, the SG tubes become cooler than the surrounding SG shell. Because the upper and lower tubesheets are constrained at the edge by the SG shell, a tensile load develops due to the decreasing temperature in the SG tubes relative to the SG shell temperature. Later in the recovery phase of the event a compressive load can develop if the SG tube temperatures increase due to RCS temperatures returning to a normal zero power condition with a depressurized SG secondary allowing the SG shell temperature to

decrease. This compressive stress develops as the SG shell cools by steam cooling and ambient heat losses through the insulation.

The licensee stated that for overheating events with an intact SG secondary, such as the limiting feedwater line break cases evaluated for the tornado LAR, RCS and SG tube temperatures tend to remain within normal bounds and validating the thermal stress limits is not required for these events. For overheating events with an intact SG secondary, RCS and SG tube temperatures do increase but not sufficiently to approach the compressive temperature limit. Similarly, the tensile limits are not approached for an event where RCS temperatures are increasing. Therefore, the thermal stress related criteria are not used for overheating transients.

The licensee also noted that the acceptance criteria identified in LAR, Section 2.6, for the UFSAR, Section 9.6.2 description on page 17 of the LAR, is not consistent with the content of LAR, Section 3.2. In its letter dated July 31, 2019, the licensee provided UFSAR revisions to address the inconsistencies.

The NRC staff finds that it acceptable to only consider the last two acceptance criteria (steam generator tubes remain intact and RCS remains within acceptable pressure and temperature limits) for the overcooling event given the larger temperature and thermal stress differences observed for this event.

3.3 Reactor Coolant System Thermal-Hydraulic Analysis As stated by the licensee, the main feedwater and main steam piping located outside containment are not protected from tornado missiles. Therefore, these piping systems may or may not remain intact following a tornado strike. The RCS thermal-hydraulic (TH) analysis was performed for the SSF considering the possibility that either piping system could be faulted. A faulted main feedwater line is considered in the overheating analysis while assuming main steam lines remain intact to maximize the overheating. A faulted main steam line(s) is considered in the overcooling analysis while assuming main feedwater piping remains intact.

Both the overheating and overcooling analyses assume that tornado damage has resulted in the loss of both offsite and onsite emergency power sources with the SSF as the assured mitigation path.

For tornadoes that are postulated to create either a main feedwater or main steam line break, the licensee performed thermal-hydraulic analyses using Duke Energy's RELAP5/MOD2-B&W Oconee TH model. The Oconee RELAP5/MOD2-B&W model and analysis methods are described in Duke Energy's NRC approved methodology report DPC-NE-3003-PA. The licensee stated that this model has been approved previously for use in the Oconee UFSAR, Chapter 6 Loss of Coolant Accident (LOCA) mass and energy release analyses. The Oconee RELAP5 model is designed primarily for use with small and large break LOCA applications.

This model has been modified to include additional detail and features required to perform these analyses.

RELAP5/MOD2-B&W is derived from RELAP5/MOD2 Cycle 36.05, which is an advanced TH computer code developed by EG&G Idaho for the Nuclear Regulatory Commission (NRC). The code was originally developed to provide the NRC with a tool for auditing licensing analyses of both large and small break LOCAs. Babcock & Wilcox (B&W) (now Framatome) modified RELAP5/MOD2 by including the evaluation model correlations and methods required by 10 CFR Part 50, Appendix K.

Given that the model was designed primarily for LOCA applications, the NRC staff requested the licensee to provide additional details on the approval of the RELAP5/MOD2-B&W code and model for use in analyzing overcooling (main steam line break) and overheating (loss of feedwater) transients, including any limitations and conditions. The licensee responded that RELAP5/MOD2-B&W has been approved for non-LOCA analyses in the BAW-10193NP-A Safety Evaluation Report dated October 15, 1999 (Reference 24), which is a Framatome topical report for the B&W-designed nuclear steam supply system (NSSS).

The BAW-10193 topical report presents benchmarks of RELAP5/MOD2-B&W calculations to data from test facilities and plant transients, as well as comparisons to other computer code predictions, to demonstrate that RELAP5/MOD2-B&W properly predicts the phenomena exhibited by Babcock and Wilcox (B&W) designed Pressurized Water Reactors (PWRs) during non-LOCA events. The benchmarks and comparisons include an overheating and an overcooling event. While the safety evaluation does not provide limitations and restrictions for the use of the topical report, Framatome included Appendix A in response to NRC staff questions. Appendix A describes the noding details to be used to model the NSSS for various accidents and lists the options for constitutive models and correlations. The discussion provided in BAW-10193 Section A.2 relates to the code options available in RELAP5/MOD2-B&W to deal with interface drag inputs for the OTSGs, and heat transfer correlation adjustments made to the nucleate boiling, critical heat flux (CHF) and post-CHF correlations. The licensee stated that these options are either not available in the code version used by Duke Energy or are not adjusted from the base coding values in the Oconee RELAP5 model. The Duke Energy Oconee RELAP5 model is similar to the large detail model* described in BAW-10193 Appendix A. The Oconee model has a similar number of steam generator (SG) secondary nodes, uses the same approach for the high elevation auxiliary feedwater (AFW) model, and has a finer nodalization in the reactor core and pressurizer.

RELAP5/MOD2-B&W is described in BAW-10164P-A and approved for use with OTSGs in Revision 3. This code provides the basis for the B&W plant safety analysis capability described in BAW-10193. Duke Energy methods use RELAP5/MOD2-B&W version 13.0 which roughly corresponds to BAW-10164 Revision 1. The topical revision record on page v of BAW-10164 Revision 4, provides a description of the changes included in the various revisions of BAW-10164. The modifications made to RELAP5/MOD2-B&W in BAW-10164 Revisions 2, 3 and 4 are primarily to facilitate the peak cladding temperature (PCT) calculations required for LOCA analyses.

The limitations and restrictions from BAW-10164 Revisions 1 through 4 (References 25 through 29) were discussed by the licensee in the response to RAI 8. The licensee described each limitation or restriction and provided the applicability to the Duke Energy DPC-NE-3003-PA based methods used for the Oconee tornado analyses. The limitations are provided below, along with the licensee's response.

From BAW-10164, Revision 1, the following conditions and restrictions were placed on the use of the RELAP5/MOD2-BAW code.

1. The Chen-Sundaram-Ozkaynak film-boiling correlation in the core heat transfer model and the B&W auxiliary feedwater model for OTSGs were not reviewed and, therefore, should not be used in licensing calculations without prior review and approval by the NRC.

The licensee stated that the core heat transfer model identified is not selected for use in the Duke methods and the B&W AFW model is part of the approved DPC-NE-3003-PA (Reference 30) methods. NRC staff finds the licensee response acceptable as the limitation has been addressed appropriately.

2. Pre-rupture cladding swell is not modeled because Babcock & Wilcox Fuel Company (BWFC) indicated that the swell is generally less than 20 percent with insignificant flow diversion effects. The acceptability of neglecting the effects of pre-rupture swelling is part of the LOCA EM review based on BWFC's analysis of the flow diversion effects.

The licensee stated that the pre-rupture cladding swell option is not used. NRC staff finds the licensee response acceptable as the limitation has been addressed appropriately.

3. The built-in kinetics data for decay heat calculations in the RELAP5/MOD2-B&W code are based on the 1973 and 1979 standards of the American Nuclear Society (ANS).

Because Appendix K requires the use of a value that is 1.2 times the 1971 ANS standard for decay heat calculation, BWFC should ensure that the decay heat used in licensing LOCA analysis complies with Appendix K.

The licensee stated that the Oconee tornado analyses use input designed to replicate ANS-79 based decay heat loads. The Duke Energy Oconee applications are not required to comply with 10 CFR Part 50, Appendix K. Given that the analysis is not a design basis calculation, NRC staff finds the licensee response acceptable as the limitation has been addressed appropriately.

4. The LOCA assessments of the Extended Henry-Fauske and Moody critical flow models were based on the use of the static properties as input to the critical flow tables. The LOCA licensing calculations should be performed accordingly.

The licensee stated that the Extended Henry-Fauske and Moody critical flow models are not used. Given that the analysis is not a LOCA calculation subject to the requirements of 10 CFR 50.46, NRC staff finds the licensee response acceptable as the limitation has been addressed appropriately.

5. The interphase drag model of the RELAP5/MOD2-B&W code tends to overpredict interphase drag. This overprediction may cause nonconservative predictions of loop seal clearing phenomena in that liquid is cleared even when the steam flow is not sufficiently high to drag the-liquid out of the loop seal. Therefore, this model may not accurately calculate the core uncovery and the PCT. A resolution requiring a sensitivity study to choose a proper loop seal nodalization that results in the highest PCT calculation will be addressed in the LOCA EM review.

The licensee stated that the Duke Energy applications are not used for determining PCT. The loop seal clearing phenomena described in the limitation is applicable to recirculating steam generator (RSG) plants. The internal reactor vessel vent valves in the B&W plant eliminate this phenomena during LOCAs. NRC staff finds the licensee response acceptable as the limitation has been addressed appropriately.

6. Even though noncondensible gases are not modeled in the Small Break LOCA (SBLOCA) system analysis, BWFC demonstrated negligible effect that all sources of noncondensible gases will have on the overall response of the system for the range of

SBLOCAs. However, BWFC noted that a 50 psi increase above the steam generator control pressure of 1, 150 psia could result from a worst case release of noncondensible gases. The NRC staff believes that this pressure increase generally would not substantially reduce the injection capabilities of the charging and safety injection (SI) systems. However, because the performance characteristics of the SI pumps vary widely in the plants, verification should be made on a plant-specific basis to ensure that a 50 psi pressure increase will not greatly reduce SI flow such that the PCT would increase by more than 500°F. Otherwise, additional information should be provided to justify neglect of noncondensible gases, or the effect of the pressure increase caused by non-condensable gases should be included in the analysis.

The licensee stated that the Duke Energy applications are not used for determining PCT, and non-condensable gases are not modeled. The concern identified in the limitation is not present in the Oconee tornado analyses. NRC staff finds the licensee response acceptable as the limitation has been addressed appropriately.

7. For a complete safety analysis, an approved core thermal hydraulic code and CHF correlation should be used with the RELAP5/MOD2-B&W code. The noding details and inputs should be justified on a plant-specific basis. The choice of constitutive models including the empirical models and correlations should be justified to ensure their use is within the ranges of applicability.

The licensee stated that the Duke Energy methods use an approved core thermal hydraulic code and CHF correlation to evaluate the core thermal response using transient results from the RELAP5/MOD2-B&W code. A departure from nucleate boiling ratio (DNBR) evaluation is performed for the overcooling analysis using the VIPRE code and the EPRI and Modified Barnett CHF correlations. The VIPRE methodology used is described in the Duke Energy NRC approved methodology report DPC-NE-3000-PA (Reference 31). The EPRI CHF correlation is used to identify the limiting critical heat flux and DNBR statepoints. The Modified Barnett CHF correlation is then used to evaluate the limiting statepoints identified with the EPRI correlation and the peak heat flux statepoint. The Modified Barnett correlation is the current licensed correlation used for low pressure (steam line break) events for Oconee and B-HTP fuel. The NRC staff finds the licensee response acceptable as the limitation has been addressed appropriately.

From BAW-10164, Revisions 2 and 3, the following conditions and restrictions were placed on the use of the RELAP5/MOD2-B&W code.

1. Use of the Wallis and UPTF parameters at the tube bundle and steam generator plenum inlet are acceptable. The parameters used in the CCFL [counter-current flow limiting]

model for any other application must be validated, and the validation reviewed and approved by the NRC staff for that application. The licensee responded that these options are not used. The CCFL model input addressed by this limitation is not available in the code version used by Duke Energy.

The NRC staff finds the licensee's response acceptable as the limitation has been addressed appropriately.

2. The B&W universal mixing vane (BWUMV) correlation is limited to pressures above 1300 psia. The licensee responded that the BWUMV correlation option is not used.

The NRC staff finds the licensee's response acceptable as the limitation has been addressed appropriately.

3. For large break LOCA ECCS evaluation model calculations, form losses due to ruptured cladding should not be excluded using the user option. The licensee responded that the cladding rupture options are not used.

Given that this is not a LOCA calculation, the NRC staff finds the licensee response acceptable as the limitation has been addressed appropriately.

4. The value of the user specified parameters (i.e. those used for the benchmark calculations) are the only acceptable values for LOCA licensing calculations. The licensee responded that a review of the specific parameters indicates these options are not used. In addition, the Duke Energy methods are not used for LOCA licensing calculations to determine fuel cladding PCT.

The NRC staff finds the licensee's response acceptable as the limitation has been addressed appropriately.

From BAW-10164, Revision 4, the following conditions and restrictions were placed on the use of the RELAP5/MOD2-B&W code.

1. A change that will model the hot channel modeling to treat the hot pin and the hot assembly as two heat structures for large break LOCA (LBLOCA) evaluations of RSG and OTSG plants.

The licensee stated that the Duke Energy methods do not include hot channel modeling and are not used for LOCA licensing calculations to determine fuel cladding PCT. The NRC staff finds the licensee response acceptable as the limitation has been addressed appropriately.

2. A change to the initial fuel stored energy uncertainty that will apply a lower uncertainty in the initial fuel stored energy, derived from TAC03, to the hot assembly and core average heat structures for LBLOCA evaluations of RSG and OTSG plants.

The licensee stated that the Duke Energy methods use an initial core average fuel temperature which was selected based on the transient objectives. For the overcooling analysis, the predominant concern is the potential for a return to criticality. A high initial fuel temperature is assumed to maximize the Doppler feedback during the transient. For the overheating analysis, a high initial fuel temperature is assumed to maximize the initial stored energy in the core. The limitation is intended to ensure appropriate inputs are selected for the initial fuel stored energy for analyses that determine fuel cladding PCT. The Duke Energy methods are not used for LBLOCA licensing calculations to determine fuel cladding PCT. The NRC staff finds the licensee response acceptable as the limitation has been addressed appropriately.

3. A change to automate the void dependent crossflow model and to interpolate the inter-channel void-dependent cross-flow for SBLOCA evaluations for OTSG plants.

The licensee stated that the Duke Energy methods do not include the void dependent crossflow model and are not used for SBLOCA licensing calculations to determine fuel cladding PCT. The NRC staff finds the licensee response acceptable as the limitation has been addressed appropriately.

4. Automation of the core heat BEACH [computer program] blockage limitation that will automate the flow blockage limit in BEACH, used for LBLOCA and SBLOCA analyses of RSG and OTSG plants.

The licensee stated that the Duke Energy methods do not include hot channel modeling and are not used for LOCA licensing calculations to determine fuel cladding PCT. The NRC staff finds the licensee response acceptable as the limitation has been addressed appropriately.

In the response to RAI 8, the licensee also provided a review of the transient phenomena for both overcooling and overheating events which are summarized below.

The initiating event for the overcooling transient is a loss of the secondary system pressure boundary (i.e., main steam line break) that leads to an RCS temperature and pressure decrease, pressurizer level decreases, and a reactor trip. The RCPs are either tripped by a loss of power or by the operator in accordance with procedural guidance, causing a flow coastdown.

Liquid flashing in the condensate and feedwater piping occurs. Sustained two-phase conditions develop in the RCS. RCS makeup flow refills the RCS and restores pressurizer level. Steam line relief valves must be modeled, and high elevation heat transfer occurs in the SGs as the heat sink is restored. With the exception of the initial increase in SG heat transfer due to decreasing SG pressure, each of these phenomena is present in the large and small break LOCA analyses using the approved methods described in DPC-NE-3003-PA.

The initiating event for the overheating analysis is a loss of SG heat transfer (i.e., main feedwater line break) that leads to an RCS temperature and pressure increase, pressurizer level increase, and a reactor trip. The RCPs are either tripped by a loss of power or by the operator causing a flow coastdown. Pressurizer and steam line relief valves must be modeled, and high elevation heat transfer occurs in the SG(s) as the heat sink is restored. With the exception of the RCS pressure and temperature increase, resulting in a pressurizer level increase, each of these phenomena is present in the large and small break LOCA analyses using the approved methods described in DPC-NE-3003-PA.

Overall, the NRC staff finds that the transient phenomena associated with both overcooling and overheating events are well within the capabilities of the RELAP5/MOD2-B&W code. The overcooling transient benchmark results provided in BAW-10193 demonstrate the code capability, and the acceptability is provided by the NRC's approval of BAW-10193 and BAW-10164 for performing non-LOCA analyses for the B&W-designed NSSS. The overheating transient benchmark results provided in BAW-10193 demonstrate the code capability, and the acceptability is provided by the NRC's approval of BAW-10193 and BAW-10164 for performing non-LOCA analyses for the B&W-designed NSSS. Therefore, the NRC staff finds the licensees' use of Duke Energy's RELAP5/MOD2-B&W Oconee TH model and analysis methods as described in Duke Energy's NRC approved methodology report DPC-NE-3003-PA to be acceptable.

3.4 Thermal-Hydraulic Analysis Model Modifications To simulate SSF-mitigated tornado events, the licensee made modifications to the base RELAP5 model. These modifications include ambient heat losses, reactor vessel head axial conduction, pressurizer nodalization for thermal stratification of pressurizer fluid, main feedwater and condensate system nodalization, main steam system nodalization, steam generator modeling, and boundary condition modeling. Each type of modification is described below.

3.4.1 Ambient Heat Losses The existing RELAP5/MOD2-B&W Oconee TH model does not include ambient heat losses from the RCS and pressurizer components. This phenomenon is typically not included in TH models as losses from the RCS do not play a significant role during relatively short duration events. The licensee modeled ambient heat losses from the pressurizer in both the overheating (after the peak RCS pressure occurs) and overcooling analyses. This change is considered an enhancement to the existing models since it allows more accurately modeling of the impact of real phenomena on the pressurizer response for longer duration events associated with the SSF. The NRC staff agrees with the licensee that this is an enhancement and finds this acceptable.

3.4.2 Reactor Vessel Head Axial Conduction Due to nodalization limitations in the existing RELAP5/MOD2-B&W Oconee TH model, the top-most reactor vessel upper head node is effectively a dead-ended volume. During a transient, the fluid conditions in this node can be affected by the nodalization and result in non-physical buoyancy effects that would cause circulation and mixing of the RCS fluid in this region. If the dead-ended node were to become voided due to depressurization, the dead-ended volume effect would impact the nature of subsequent condensation and refill.

Therefore, modifications were made to mitigate this non-physical behavior. The NRC staff finds the modifications acceptable.

3.4.3 Pressurizer Nodalization for Thermal Stratification of Pressurizer Fluid The pressurizer plays a significant role in regulating RCS pressure during both overheating and overcooling events and experiences several important phenomena. In general, for overheating events, there is an initial surge of subcooled liquid into the pressurizer from thermal expansion of the RCS inventory. If the overheating transient is short lived, the presence of subcooled liquid in the pressurizer has little impact on the immediate response. This is because there is little mixing in the fluid region under these conditions and buoyancy (density) effects cause the colder liquid in the pressurizer to remain near the bottom of the vessel, while the hotter (originally saturated) liquid remains near the top of the water column and in contact with the vapor space. Thermal stratification of the pressurizer liquid helps limit the amount of steam condensation that occurs at the steam-liquid interface during these pressure excursions.

For RCS overcooling transients, saturated liquid in the pressurizer flashes to steam, expands, and limits the depressurization rate of the RCS. Subsequently, when the pressurizer refills, insurges of subcooled liquid to the pressurizer can limit the ability of the pressurizer to regulate subsequent depressurizations of the RCS. For more severe overcooling events, the pressurizer may empty because of the initial overcooling, but subcooled liquid will refill the pressurizer once operators restore RCS pressure or pressurizer level to the specified operating range. In the longer-term recovery phase, operator actions to stabilize pressurizer level and pressurizer heaters are able to re-saturate the fluid in the pressurizer and restore RCS pressure to a desired range.

To evaluate longer duration SSF events, it is important that the thermal-hydraulic models be capable of capturing the effects from thermal stratification and ambient heat losses in the pressurizer. Modifications for modeling ambient heat losses are described above and found to be acceptable. To improve the modeling capability for thermal stratification of fluid in the

pressurizer region, the model was modified to have a finer nodalization. The NRC staff finds the finer nodalization of the pressurizer acceptable as this results in a more accurate representation of both thermal stratification and heat losses during longer term events.

3.4.4 Main Feedwater and Condensate System Nodalization The licensee stated that the base model nodalization includes the main feedwater piping between the last check valve and the steam generator. This enables modeling flashing of the main feedwater in the piping if the steam generator pressure decreases low enough for the flashing to occur. Should this occur, additional hot water will be expelled into the steam generator with the potential to increase secondary to primary heat transfer, which is conservative for LOCA mass and energy .release calculations.

For overheating events, it is conservative to minimize the amount of feedwater that can enter the steam generators. Therefore, in the SSF mitigated tornado event overheating analysis, the main feedwater piping included in the base RELAP5 model is removed to conservatively minimize liquid added to the steam generators. The NRC staff finds this modification acceptable.

For overcooling events, it is conservative to maximize the amount of feedwater that can enter the steam generators. Therefore, in the SSF mitigated tornado event overcooling analysis, the portions of the condensate and feedwater system piping that are anticipated to flash due to the depressurization and contribute mass to the steam generators are included in the model. The main feedwater control valves are assumed to remain open to allow the maximum amount of feedwater to enter the steam generator. The NRC staff finds this modification acceptable.

3.4.5 Main Steam System Nodalization The licensee stated that the base RELAP5 model represents the main steam piping from the steam generator to the turbine with a single volume for each loop. This level of nodalization is acceptable for performing mass and energy release calculations where the turbine stop valves are assumed to close immediately without delay upon break initiation and the turbine bypass valves are assumed to be unavailable, and other main steam branch lines are also assumed to be isolated. Therefore, the secondary coolant is isolated in the steam generators and steam lines and is available to transfer energy to the primary fluid. The secondary steam release is characterized by the main steam relief valves.

The NRC staff finds that for overheating events, the nodalization included in the base RELAP5 model is conservative to represent the heat transfer and steam release from the steam generators. However, for overcooling events, additional phenomena are present that potentially impact the ability to remove heat from the steam generators. These phenomena are associated with the rapid depressurization due to postulated main steam piping breaks. The rapid depressurization will initially cause a liquid level swell and entrainment due to high steam velocities. The steam generator outlet nozzles installed in the replacement once through steam generators serve to limit the blowdown mass flow rate. Entrained liquid droplets in the steam flow may become de-entrained in the vertical portions of the steam line piping downstream of the steam generators. Modeling the vertical piping enables a liquid level in this section of steam line that could impact conditions within the steam generator. Therefore, the licensee added additional details in the model that preserve flow area and elevation change in the steam line nodalization used for the SSF mitigated tornado event overcooling analysis, to allow the

analysis to capture these effects. The NRC staff finds these modifications both necessary and acceptable.

3.4.6 Steam Generator Modeling The licensee stated that the base RELAP5 model steam generator modelling approach provides conservative modeling of primary to secondary heat transfer for small and large break LOCA applications. The licensee then described the SG modelling from BAW-10164 for both LOCA and non-LOCA transients which has been approved for use in licensing calculations for OTSG designs. The licensee's model modifications are related to the EFW and the wetted tube fraction, so as to appropriately model the SG heat transfer. The NRC staff finds these modifications acceptable in that they conservatively model the SG heat transfer for both overheating and overcooling events.

3.4. 7 Boundary Condition Modeling To simulate the overheating and overcooling analyses for SSF mitigated tornado events, several additional features and boundary conditions that are not included in the base RELAP5 model are necessary. The licensee stated that these modeling features include the steam line atmospheric dump valves (ADVs), SSF ASW, turbine driven EFW, secondary steam loads, and the SSF letdown line. The modeling approach for several of these features considers the impact of asymmetric loop conditions on the performance of the individual boundary condition.

These modeling features are applied in a manner to ensure appropriate boundary conditions are specified for each specific analysis. The NRC staff finds these modifications acceptable.

3.5 Initial Condition Assumption In the LAR, the licensee makes the assumption that plant initial conditions are 102% rated thermal power at end of core life. However, the NRC staff found that these initial conditions may not be bounding for a tornado induced main steam line break (overcooling event).

Therefore, the NRC staff asked the licensee to provide justification for assuming a single initial condition and no consideration of other initial conditions (i.e., low power/low decay heat) which could be more limiting.

The licensee stated that similar to other non-design basis events, it does not need to look at other power/decay heat levels and it cited station blackout (SBO) as an example where it only considers full power. In addition, the licensee stated that off nominal conditions represent a very small portion of the operating cycle and that these low power or low decay heat conditions were not deemed to result in an appreciable contribution to overall plant risk.

While the NRC staff does not agree with the licensee's SBO example, as the full power initial conditions are bounding for an SBO, the NRC staff does agree with the licensee that a tornado induced steam line break which leads to core damage is a low probability event. While probability numbers were not provided by the licensee, it is reasonable to conclude that there is a very low probability of a tornado induced main steam line break occurring when the plant is at off-nominal conditions, leading to core damage. NRR memorandum "Closeout of Low Safety Significant/Low Risk Concerns - Tornado-Generated Missile Protection," dated February 28, 2019 (Reference 32), states that tornado missile scenarios that may lead to core damage are generally very low probability events. Therefore, the NRC staff finds that the licensee's determination to only consider full power at end of core life is acceptable.

3.6 Failure of FW System (Overheating event)

The postulated piping failures in the main feedwater system outside containment were analyzed for their effects on the ability to achieve and maintain SSD of the affected unit following a tornado. It is assumed that a loss of all station AC power occurs as a result of the tornado. The Standby Shutdown Facility (SSF) auxiliary service water (ASW) is credited with providing an alternate means of establishing steam generator heat removal should emergency feedwater (EFW) be lost, including the ability to align EFW from an unaffected unit. The SSF ASW system is credited with providing a means of establishing SG heat removal to the unit experiencing the main feedwater line break. For an overheating event, the significantly damaged unit is supplied by SSF ASW. The other two units will be initially supplied by the TDEFWP and subsequently supplied by SSF ASW.

As indicated in Section 3.2 of LAR, the licensee defined the proposed licensing basis strategy as following a tornado induced overheating event, the SSF provides the means to achieve and maintain the unit in MODE 3 with average RCS temperature;?; 525°F (unless the initiating event causes the unit(s) to be driven to a lower temperature) for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a tornado.

The licensee performed an analysis to evaluate the plant transient response to a loss of main feedwater and the 4160VAC engineered safeguards and 6900VAC switchgear for all three units due to a tornado that also damages the switchyard and other equipment in the turbine building.

The primary objective of the analysis is to demonstrate the SSF is capable of meeting the proposed tornado mitigation acceptance criteria for a limiting overheating event.

The transient begins with an immediate and complete loss of main feedwater from hot full power conditions, as well as a loss of the 4160VAC switchgear and the 6900VAC switchgear. Hot full power conditions are defined as 102% rated thermal power at end of core life (690 effective full-power days). An immediate reactor trip and trip of the RCPs occur due to the loss of power.

The motor driven EFW pumps are powered from the 4160VAC switchgear and are not available due to the loss of power. The turbine driven EFW pump is assumed to be unavailable as a conservative assumption. Since portions of the integrated control system (ICS) are unprotected from tornado damage, the pressurizer power operated relief valve (PORV) is assumed to be unavailable. Steam generator pressure increases rapidly to the main steam relief valve (MSRV) lift setting following the turbine trip. SG pressure cycles on the lowest lifting MSRV bank until the SG liquid inventory has boiled away. At this point, SG pressures stabilize just below the lift setpoint of the lowest lifting MSRV bank until the operators establish SSF ASW flow.

The combination of high end of cycle decay heat and delayed SSF ASW flow to the SGs causes an overheating event in the primary system and an increase in RCS pressure. Since the pressurizer PORV is unavailable, RCS pressure increases up to the pressurizer safety valve (PSV) lift setting at which point, the PSVs cycle to control RCS pressure until operators establish SSF ASW flow. The establishment of SSF ASW flow to the SGs within 14 minutes of a loss of all feedwater is described in the LAR as an operator action that is designated as a time critical action and is discussed below in Section 3.5, "Evaluation of Operator Actions."

The peak RCS pressure in the overheating analysis is limited by the pressurizer safety relief valve characteristics as the PORV is not available. With an immediate reactor trip, the rate of RCS pressurization is such that pressurization does not continue after the PSVs begin to lift.

The maximum pressure observed in the analysis remains below the 2,750 psig limit. Thus, the peak RCS pressure results obtained are not contingent on the timing of SSF ASW flow.

Pressurizer level increases with increasing RCS temperatures and the analysis shows that the level eventually goes off scale high, since the instrumentation is located below the top of the pressurizer and cannot register levels at higher locations. However, the pressurizer never transitions to a water-solid condition and there is no liquid relief through the PSVs.

In the longer-term response, operators use SSF ASW to increase SG levels to promote sustained natural circulation flow in the RCS and use the SSF controlled pressurizer heaters and SSF letdown line to control RCS pressure and pressurizer level, respectively.

Successful mitigation of a tornado condition at Oconee was defined by the licensee as meeting the acceptance criteria, as described above in Section 3.2 to ensure that the integrity of the fuel and RCS remains unchallenged. For the overheating analysis, the fuel integrity is ensured by the reactivity added by control rod insertion and maintaining the core covered. A minimum DNBR evaluation was not performed for this analysis since the transient does not include a return to power. RCS integrity is demonstrated by verifying the RCS pressure remains below the 2,750 psig limit.

The NRC staff finds the results of the tornado-induced feedwater line break analysis demonstrates that the SSF is capable of ensuring peak RCS pressure remains below the 2,750 psig limit, and it provides sufficient decay heat removal and primary coolant makeup to keep the core covered and maintain the RCS in MODE 3 with an average RCS temperature

~ 525°F (unless the initiating event causes the unit(s) to be driven to a lower temperature) for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a tornado.

3.7 Failure of Main Steam Line {MSL) System (Overcooling event)

The Main Feedwater and Main Steam piping located outside containment are not protected from tornado missiles. Therefore, these piping systems may or may not remain intact following a tornado strike. The RCS T-H analysis was performed for the SSF considering the possibility that either piping system could be faulted. A faulted Main Steam line(s) is considered in the overcooling analysis while assuming main feedwater piping remains intact. Both the overheating and overcooling analyses assume that tornado damage has resulted in the loss of both offsite and onsite emergency power sources.

The primary objective of the overcooling analysis is to demonstrate adequate core cooling and establish a basis for mitigation strategies using the SSF for establishing and maintaining SSD conditions following a tornado. This analysis evaluates the Oconee RCS response to a single or double main steam line break on one unit and loss of all AC power to all three units due to a tornado. The TDEFWP is assumed conservatively to run until the contents of the upper surge tank are depleted (to maximize the overcooling).

As indicated in Section 3.2 of LAR, the licensee defined the proposed licensing basis strategy for responding to a tornado induced overcooling event is to use the SSF to provide the means to achieve and maintain the unit in MODE 3 at a reduced RCS temperature and pressure for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The licensee performed an analysis to evaluate the plant transient response to a single or double main steam line break (MSLB) and loss of the 4160VAC Engineered Safeguards and 6900VAC switchgear for all three units due to a tornado that results in damage to the switchyard and other equipment in the turbine building. The primary objective of the analysis is to

demonstrate that the SSF is capable of meeting the proposed tornado mitigation acceptance criteria for a limiting overcooling event.

In its letter dated September 14, 2018, the licensee states the following:

Upon initiation of a single or double MSLB, RCS pressure, hot and cold leg temperature, SG pressure and pressurizer level rapidly decrease due to the overcooling and contraction of the fluid in the RCS. The RCS saturates, and pressurizer level goes off scale low. The turbine driven EFW pump is conservatively assumed to automatically start and run without being throttled until the contents of the upper surge tank are delivered to the SGs. The SSF RC

[reactor coolant] makeup pump is started to restore RCP seal cooling and makeup to the RCS. SSF ASW flow is available at 14 minutes, but not aligned to the SGs at this time due to the overcooling.

The minimum RCS pressure reached is a function of the number of broken steam lines. With a single MSLB, after the RCPs coast down, RCS flow in the intact loop stagnates and allows primary coolant in the intact loop to flash, limiting the RCS depressurization. This void formation in the intact loop allows the affected RCS loop to remain full and circulating. For the single MSLB cases, RCS pressure remains above 600 psig, preventing boron from the core flood tanks (CFT) from entering the RCS. The sustained overcooling in the affected loop is sufficient to result in a minimal return to power (<0.1 % power). The core remains covered and subcooled during the return to power, with adequate departure from nucleate boiling (DNB) margin. The overcooling continues until shortly after the turbine driven EFW pump stops feeding the SGs.

The limiting core response obtained with a single MSLB is evaluated further by a sensitivity case that does not credit boron added by the SSF RC makeup pump.

The maximum core power level reached in this sensitivity case is 2.4% power at 1501 seconds. The indicated core exit subcooling between 1200 and 1800 seconds is greater than 120°F, and consistently greater than 60°F subcooled during the return to power.

The RELAP5 core response is determined with a point kinetics model which is generally recognized as providing a conservative power response relative to the response obtained using 3D reactor core physics methods. To ensure that the appropriate transient reactivity is calculated, a SIMULATE-3K (S3K) 3D core model to assess the RELAP5 reactivity calculation. The results of this comparison demonstrate the RELAP5 calculation is conservative (i.e., higher return to power) relative to the S3K calculation performed for the selected core design. The S3K calculation follows the guidance described in the NRC approved methodology defined in Reference 3, DPC-NE-1006-PA "Oconee Nuclear Design Methodology Using CASM0-4 / SIMULATE-3," Reference 4, DPC-NE-3005-PA "UFSAR Chapter 15 Transient Analysis Methodology," and Reference 5, NFS-1001-A "ONS Reload Design Methodology." This comparison is incorporated as a reload check into future Oconee core designs.

A DNBR evaluation performed using VIPRE and the EPRI and Modified Barnett critical heat flux CHF correlations demonstrates a large amount of DNB margin exists for the statepoint at the peak heat flux. The VIPRE methodology that was

used is described in Duke Energy's NRC-approved methodology report DPC-NE-3000-PA (Reference 2).

For a double MSLB, the RCS depressurization and shrinkage causes a reactor vessel (RV) head void that expands into the hot legs. This interrupts RCS loop flow to the steam generators and limits the cooldown of the core. While hot leg flow is interrupted, recirculating liquid flow through the RV internal vent valves ensures the core remains cooled. When primary loop flow stagnates, heat transfer to the SGs is interrupted. RCS pressure increases as the liquid in the reactor vessel absorbs the core decay heat and expands, raising the liquid level in the hot legs until a spillover event occurs. Each spillover transfers hot liquid into the SG tubes and returns cool fluid from the bottom of the SG to the cold legs. Spillovers cause the liquid circulating in the reactor vessel to cool, and results in a decrease in RCS pressure. As RCS pressure decreases below 600 psig, the two core flood tanks inject additional borated inventory into the RCS. The core remains covered throughout the overcooling transient. While a brief recriticality is indicated by the RELAP5 point kinetics model, the resulting fission power obtained is not significant (less than one Watt). The overcooling continues until shortly after the turbine driven EFW pump stops feeding the SGs.

After the overcooling has terminated, the RCS begins to slowly reheat and swell, and pressurizer level returns on scale. The SSF powered pressurizer heaters are manually energized when level in the pressurizer exceeds 90 inches. SSF ASW flow is established to the SGs to stabilize pressurizer level in order to limit the volume of water in the pressurizer that must be heated to saturated conditions. Saturated conditions are established in the pressurizer approximately three hours into the event at which point the steam bubble in the pressurizer begins to increase RCS pressure. Pressurizer heaters are then cycled to maintain RCS pressure stable. Stable subcooled natural circulation conditions are also achieved approximately three hours into the event.

Successful mitigation of a tornado condition at Oconee was defined by the licensee as meeting the acceptance criteria, as described above in Section 3.2, in order to ensure that the integrity of the fuel and reactor coolant system remains unchallenged. For the overcooling analysis the fuel integrity is demonstrated by the DNBR analysis.

The NRC staff has reviewed the analysis and finds the results of the tornado induced MSLB analysis demonstrate that the transient can be mitigated using SSF equipment. The overcooling analysis demonstrates that for either a single or double MSLB tornado scenario, the following acceptance criteria are satisfied:

• The core remains intact and in a coolable geometry,

• Minimum DNBR meets specified acceptable fuel design limits,

• RCS pressure does not exceed 2,750 psig,

• The steam generator tubes remain intact, and

• RCS remains within acceptable pressure and temperature limits.

3.8 Implementation of the TORMIS Methodology The licensee requested a change to Oconee's licensing bases to allow certain components to remain unprotected from tornado missiles based on revised tornado mitigative features of plant and use of computer code TORMIS. Typically, TORMIS is approved to allow licensees to resolve existing, exposed components found in non-compliance with their current licensing basis (i.e., UFSAR and supporting documents). In this submittal, the use of TORMIS was proposed to demonstrate unprotected portions of the SSF system and other components necessary for mitigation of damage to the MS or FW systems would have a high likelihood of remaining undamaged by a tornado, and, therefore, could be relied on to perform the tornado mitigation and shutdown functions.

The NRC staffs approval of a licensee's application using TORMIS is subject to the appropriate resolution of five specific concerns identified in the SER for the EPRI TORM IS methodology.

These specific concerns are related to the assumptions used in the input parameters for the analysis (e.g., locations and numbers of potential missiles presented at a specific site, wind speed, wind speed near the ground, etc.). The NRC staff reviewed the submittal with respect to: (1) the five specific concerns related to the NRC approval of the TORMIS methodology, and (2) the acceptability of the TORM IS analysis for calculating the appropriate mean strike and damage probabilities and of the TORM IS results against the guidance provided in the SER on EPRI TORMIS methodology, and RIS 2008-14.

The Oconee TORM IS results provide estimated probabilities of tornado missile damage to modeled targets. There are 14 individual unprotected safety-significant targets modeled in Oconee TORMIS, as shown in LAR Attachment 4, Table 6, "Oconee Tornado Damage Frequency Results". The licensee considered systems or portions of systems such as ASW header, SSF electrical cabling, main steam relief valves, main feedwater and main steam piping, RCS letdown line, SFP piping and CCW surge line.

In a memorandum dated November 7, 1983, "Position on the Use of Probabilistic Risk Assessment in Tornado Missile Protection Licensing Actions" (Reference 20), the NRC staff summarized its position on use of probabilistic risk assessment in tornado missile protection licensing actions. This memorandum, which is used in probabilistic tornado missile reviews, states that an expected rate of occurrence of potential exposures in excess of the 10 CFR Part 100 guidelines of approximately 1 x 10-6 per year is acceptable, if, when combined with reasonable qualitative arguments, the risk can be expected to be lower.

As noted in the Oconee TORMIS results, the mean annual frequency of a damaging tornado missile strike that could result in a failure of essential mitigation equipment and a subsequent radiological release in excess of 10 CFR Part 100 limits was determined to be less than the acceptance criterion of 1 x 10-6 per year.

The SER approving the TORMIS methodology (Reference 14), requires licensees using the methodology to consider and address five points in their applications. The five points and the licensee's responses are summarized below:

1) Data on tornado characteristics should be employed for both broad regions and small areas around the site. The most conservative values should be used in the analysis or justification provided for those values selected.

For its TORMIS submittal, tornado hazard was evaluated using data for a broad region and the local area around the Oconee site for the period of 1950 to 2014. A broad 15° x 15° latitude longitude square centered on the Oconee site was used as the starting region. This large area covered 619,052 square miles of land and included 18,621 tornadoes in the Storm Prediction Center (SPC) tornado data set. Within this broad region, the tornado risk was quantified for O. 1°, 1 °, 1.4°, and 2° cells. A statistical method, termed cluster analysis, was used to determine how the distinct cells group into similar clusters of tornado risk. These procedures were performed separately for the 0. 7°, 1°, 1.4°, and 2° grids. The final selected subregion covers a broad area (115,000 square miles of land) representing 2,866 tornadoes that includes several high-risk tornado areas surrounding the Oconee plant.

The licensee compared wind exceedance probabilities derived for TORM IS input and NUREG/CR-4461 (Reference 22) results reported for the Oconee site. This comparison shows that the Oconee plant curve is higher than the NUREG curve for all wind speeds.

Based on the licensee's use of data more recent than the data in the UFSAR, the NRC staff finds the licensee's use of current data to be reasonable for the Oconee TORM IS application.

2) The EPRI study proposes a modified tornado classification, F'-scale, for which the velocity ranges are lower by as much 25-percent than the velocity ranges originally proposed in the Fujita, F-scale. Insufficient documentation was provided in the studies in support of the reduced F'-scale. The Fujita F-scale tornado classifications should therefore be used in order to obtain conservative results.

The licensee stated that the original Enhanced Fujita (EF) scale wind speeds were utilized in the TORM IS analysis. The hazard curve developed for the Oconee analysis does not utilize either the SER-specified Fujita (F) scale or the SER-prohibited modified Fujita (F') scale. Instead the analysis utilizes the EF scale wind speeds in accordance with NUREG/CR-4461. Although the 1983 NRC SER called for the use of the F-scale of tornado intensity for assigning tornado wind speeds to each intensity category (F1-F5), the NRC subsequently adopted the EF scale in the positions of RG 1. 76, Revision 1, that are based on NUREG/CR-4461, Revision 2.

Based on limitations of use and consistency with the recent design basis tornado defined in Revision 1 of RG 1. 76, the NRC staff has concluded that the use of the EF scale is reasonable for analyzing SSCs within the licensee's TORMIS application.

3) Reductions in tornado wind speed near the ground due to surface friction effects are not sufficiently documented on the EPRI study. Such reductions were not consistently accounted for when estimating tornado wind speeds at 33 feet above grade on the basis of observed damage at lower elevations. Therefore, the user should calculate the effects of assuming velocity profiles with ratios Vo (speed at ground level)/ V33 (speed at 33-foot elevation) higher than that in the EPRI study. Discussion of the sensitivity of the results to changes in the modeling of the tornado wind speed profile near the ground should be provided.

The licensee selected tornado wind field parameters so that the ratio of velocity at ground level to that at 33 feet is 0.82. Use of this parameter is consistent with other TORM IS applications.

Therefore, the NRC staff finds this acceptable.

4) The assumptions concerning the locations and numbers of potential missiles presented at a specific site are not well established in the EPRI studies. However, the EPRI methodology allows site-specific information on missile availability to be incorporated in the risk calculation. Therefore, users should provide sufficient information to justify the assumed missile density based on site-specific missile sources and dominant tornado paths of travel.

The licensee developed site missile characterization to estimate of the number, type, and location of missiles on and near the plant site as well as the physical properties of these missiles. This process entails a series of site surveys to identify areas (zones) in which potential missiles can be reasonably characterized as somewhat uniformly distributed and counting the missiles of each type located in each of the zones. The process is intended to estimate the number of potential missiles that are "minimally restrained," or could become unrestrained. A set of 21 missile zones was defined for the Oconee site with the center of the Unit 2 reactor building located roughly at the center. The outermost boundaries were defined to ensure that the minimum distance to the closest safety-related target is greater than 2,000 feet.

A site-specific missile spectrum for Oconee was developed by conducting a detailed site survey to evaluate the types of missiles, number of missiles, and their locations. Surveys were conducted both during a plant outage and while all units were at power to account for potential conditions where the site inventory count may be higher than typical. In addition, aerial and ground photographs were used in conjunction with tree density observed during the survey to estimate potential tree missiles in remote zones. Conservatively, the additional outage materials have been added to the total missile count for each zone.

The final derived missile count for EF-5 tornadoes was estimated at 394,599. Missile sources were catalogued and modeled to a distance of approximately 2,000 feet. A conservatism is provided by the analysis in that many components are assumed to fail and become unrestrained potential missiles, whereas, in reality, a large portion of the structural components will generally remain connected to one another or attached to the foundation.

The licensee's missile count provides a reasonable missile density in comparison to some other plants that reported less than 250,000 total missiles. Therefore, the NRC staff finds the postulated missile count as acceptable.

5) Once the EPRI methodology has been chosen, justification should be provided for any deviations from the calculational approach.

The licensee stated that the TORMIS code, a legacy FORTRAN computer code, has been updated to modern computers. These changes include: porting the legacy code from mainframe to modern computer operating systems; post processing data routines; updates to the random number generation; enhanced output options; and addressing other issues in the legacy code. All code changes have been checked and verified through comparisons to the preceding version. These changes and software version are consistent with previous plants' TORMIS submittals. The NRC staff concludes that these changes to the original TORMIS methodology are reasonable and acceptable.

Based on the above, the NRC staff has determined that the licensee considered and appropriately addressed each of the five points described in the NRC TORM IS SER, dated October 26, 1983.

In addition to the five points above, the NRC issued RIS 2008-14 to inform licensees of additional details needed to provide adequate information for the NRC staff to confirm that applicants have properly applied and implemented the TORMIS methodology.

One item related to the RIS is the concern regarding future use of TORM IS and how it is applied to future nonconformances. The licensee noted that plant modifications are being performed under 10 CFR 50.59 and that their approval is not a part of this LAR. With the licensee's proposed use of the phrase "or be evaluated in the TORM IS model," the licensee appeared to have proposed allowing the option to evaluate the future plant modifications in the TORMIS model. However, the TORMIS methodology is approved to address existing plant structures' and components' nonconformances. In addition, when using TORMIS to address any additional tornado missile vulnerabilities identified in the future, the analysis should include those SSCs that were analyzed previously. Therefore, the NRC staff issued RAI 13 requesting the licensee to describe compliance with the NRC staff's position regarding the future use of the TORM IS methodology to evaluate plant nonconformances. In response to RAI 13, the licensee clarified that TORMIS will be used to address newly found nonconformances and will be considered in combination with the impact of other SSCs that were previously analyzed using TORM IS methodology. An update was proposed to the UFSAR to clarify future use in this manner and the NRC staff agrees this is consistent with RIS proposed limitation.

RIS 2008-14 identifies issues raised by the NRC staff during reviews of TORM IS applications, including a concern that licensees did not fully address the fifth point identified in the SER nor explain how the methodology was implemented when the parameters used differed from those specified in the TORM IS methodology. With the LAR Attachment 1 proposing future commitments, it was unclear whether these are required to support the new methodology of crediting the SSF for tornado mitigation. Therefore, the staff requested additional details of the proposed modifications that are presented as commitments and their possible impact on TORMIS results. Additional details provided in response to RAI 14 indicate that commitments are needed to complete the licensee's proposed mitigation strategy or have potential impact on TORMIS results. To address these items, the licensee has explained that until the enhancement modifications are completed, the existing Tornado licensing basis will be maintained during the implementation period. The licensee has proposed to update the UFSAR by stating that the revised tornado mitigation strategies will be implemented when the SSF letdown line, SSF control room QA-1 instrumentation upgrade, and SSF diesel fuel oil tank fill/vent missile protection conforming modifications are completed.

To address the guidance of the RIS 2008-14, the licensee addressed each item of the RIS individually in Section 8.3 of the licensee's letter dated September 14, 2018. The NRC staff reviewed the licensee's assessment of the RIS items and finds the licensee provided sufficient detail to address each RIS item and provided adequate information in describing the bases for its conclusions.

3.8.1 Components included in TORMIS As indicated in LAR, the targets to be considered in the TORMIS model are (1) unprotected piping or equipment associated with the SSF used to provide decay heat removal, RCMU which includes RCP seal cooling, and the committed modifications associated with the CDTR and

WPR, and (2) unprotected piping or equipment that could (if damaged) indirectly cause failure of SSF equipment or failure of the SSF mitigation strategy. The specific targets were categorized as either unprotected SSF mitigation equipment or unprotected SSCs that if damaged could fail the SSF mitigation strategy.

Through a process of plant walkdowns and the review of plant drawings, calculations, and other information, the licensee developed a detailed list of structures and equipment lacking deterministic protection to create the scope of TORM IS safety targets. Table 6, "Oconee Tornado Missile Damage Frequency Results" of the LAR show each of these components have a very low probability of damage.

Unprotected components modeled in TORMIS are:

1. Electrical cable trays and penetrations in the WPR and CDTR containing SSF-related cabling.

The licensee clarified that the WPR and CDTR walls have been physically upgraded to the requirements of RG 1. 76, Revision 1, to resist the effects of tornado wind and differential pressure, but not tornado missiles. The existing SSF related piping and control cables routed through the WPR and CDTR, other systems and components necessary for the SSF to function, and the proposed pathway of committed modifications necessary to improve the ability of the SSF to mitigate a tornado are physically protected or are evaluated with TORMIS.

The SSF power and control cables in the WPR are routed in several cable trays to a specific set of containment electrical penetrations and evaluated in TORMIS. These items are classified as unprotected SSF mitigation equipment.

The WPR and CDTR contain walls made of steel and masonry concrete. Since the analysis of the masonry walls in portions of the auxiliary building is not within the damage prediction capability of the TORM IS code, the masonry walls of the EPR and WPR are not modeled explicitly. Only reinforced concrete columns, beams, and floor slabs, or engineered steel barriers are modeled. This approach leaves large openings in between these structural members for TORM IS to track missiles into the room toward the safety targets.

To determine missile damage frequency, assumptions were made to determine damaging missile types based on the missile's ability to penetrate the applicable wall. Missile damage velocity criteria were established based on either the target's impact capacity or by the assumed impact capacity of the wall that the missile had to penetrate. For these cable tray and penetration targets, damage was determined to be impacted by a missile greater than a minimum damage velocity (VDAM parameter) value for each missile subset which is based on the type of wall that the missile had to penetrate. Therefore, the analysis only evaluates the missiles capable of penetrating the existing wall design (steel or concrete). The licensee's evaluation of WPR was completed using one model to evaluate missiles striking WPR targets coming through the corner shield walls and another to evaluate missiles striking the targets through other walls, which consist of concrete beams, columns, and in-fill (double-thick) concrete brick walls. The results concluded that wood plank and metal siding missiles were of concern. Using this modeling approach, the licensee derived tornado missile damage frequency results, as shown in Table 6 of the LAR.

As a modeling conservatism, the licensee noted that a substantial number of interferences inside the turbine building and auxiliary building from large components, other piping systems,

electrical conduits and cable trays, hangers and steel supports, platforms, handrails, and ventilation ductwork are not modeled, or credited as shielding targets. The licensee indicated some of these areas are quite congested and would likely dissipate and stop missiles from damaging critical piping and equipment.

Based on the location of exposed components, building wall physical upgrades that have been made to resist tornado wind, the reasonableness of the licensee's approach to define realistic missile capabilities, and the low probability of a damaging missile impact on unprotected components, the NRC staff finds these assumptions acceptable for modeling in this TORM IS analysis.

2. SSF ASW piping in the WPR and CDTR - SSF ASW piping in the WPR/CDTR, including connected header piping to the RB penetration.

The SSF ASW system is designed to feed directly to the SGs to provide secondary side heat removal to cool the RCS following a postulated loss of all main feedwater and EFW systems.

To meet these criteria, the SSF ASW must survive the tornado event and remain functional, including the unprotected portions of the ASW system. Since portions of the SSF ASW piping are unprotected, TORMIS was used to demonstrate that tornado missile strike has a low probability of occurrence.

The specific targets identified for evaluation in the TORMIS analysis include SSF ASW piping in the WPR/CDTR, including connected header piping to the Reactor Building penetrations and SSF ASW flow instrumentation in CDTR. These are classified as unprotected SSF mitigation equipment.

As described in LAR, these targets inside the WPR and CDTR are protected by the ruggedness of the guard piping and significant structural interferences present in the rooms near the targets.

The NRC staff reviewed the inputs and assumptions presented for modeling these unprotected components shown in Section 5.3 of LAR. Like cable trays discussed above, the SSF ASW piping in the WPR and CDTR is protected by the masonry and steel barriers. A significant portion of the SSF ASW unprotected piping is seismically qualified 6-inch piping that is contained within a 10-inch guard pipe (pipe in a pipe). The licensee defined a damage event as a missile penetrating the steel guard pipe or penetration of the outside wall. Credit was taken for the protective guard pipe, and only missiles with sufficient energy to penetrate the guard pipe were considered in developing the TORMIS damage frequency.

Using this modeling approach, TORM IS determined that the tornado missile damage frequency for the SSF ASW Header was low, as shown in Table 6 of Attachment 4 to the LAR. The NRC staff finds these results are reasonable based on the low probability of a tornado occurring at the plant and striking the component in a manner resulting in loss of function.

Based on the location of exposed components, the building wall physical upgrades, the low probability of a damaging missile impact on unprotected components, and additional protection afforded by protective piping, the NRC staff finds these assumptions acceptable for use in this TORMIS analysis.

3. SSF ASW flow instrumentation in CDTR The licensee analyzed SSF ASW flow instrumentation in the CDTR using TORMIS. This instrumentation was included in the TORMIS analysis and shown to have low frequency of

damage from tornado missiles. This instrumentation is classified as unprotected SSF mitigation equipment.

In addition to this instrumentation, Section 3.2 of LAR defined other instrumentation needed to support safe shutdown as future upgrades. The scope of instrumentation analyzed in TORM IS was unclear and future upgraded instrumentation (Section 2.5, LAR Item 2.5. 7) could impact TORMIS results. The NRC staff asked in RAI 14 for the licensee to clarify. In response to RAI 14, the licensee clarified the modifications or upgrades provide new QA-1 instrumentation in the SSF CR for SG pressure, nuclear instrumentation, core exit thermocouples, pressurizer temperature, and temperature compensated pressurizer level. The licensee clarified the portions of the new SSF instrumentation will be routed within the footprint of analyzed missile strikes associated with the unprotected portions of the SSF pathway detailed within the TORM IS analyses and represented by the current TORMIS conclusions provided in the LAR.

The licensee has analyzed existing instrumentation with TORMIS and requests to use similar model to allow new or upgraded instrument to be unprotected. The licensee indicated that unprotected portions of the upgraded instrumentation will be routed within the footprint of the instrumentation currently evaluated. Since TORMIS involves modeling components as specific volumes and determines the strike frequency on the specific modeled component, there would be little or no increase in strike probability for new instrumentation that is bounded by the current TORMIS model instrumentation footprint. In addition, the licensee stated that the committed future instrumentation is proposed for use to support SSD from the SSF CR and will be either physically protected or analyzed by TORM IS.

The licensee's future commitments are considered to be outside the scope of this review. To meet tornado protection criteria, these future changes will be required to meet the tornado protection licensing basis at the time of new installation or modification.

The NRC staff finds the proposed upgrade and newly installed instrumentation will result in an increase in plant safety and will augment current instrumentation. The licensee's TORMIS analysis shows significantly low damage frequency (Table 6 of LAR). Therefore, the use of current model for upgraded instrumentation results in little increase in risk and the NRC staff finds this acceptable for use in TORMIS analysis.

4. Main steam relief valves (MSRVs) - damage preventing adequate steam relief for SSDHR.

The specific targets identified for TORM IS evaluation include MSRVs and their damage preventing adequate steam relief for SSDHR. MSRVs are classified as unprotected SSCs that if damaged could fail the SSF mitigation strategy.

The licensee defined SSF mitigation strategy requiring certain MSRVs to open (at specific lift setpoints) in order for the SSF ASW system to provide adequate decay heat removal. These relief valves are located on the MS headers just outside of the East Penetration Room (EPR) and battery room. Tornado missile impact on the required MSRVs may cause them to fail to open and thus fail the SSF ASW decay heat removal function. Modeling of the required MSRVs also includes concrete and steel structural supports, the MS access platform, and adjacent MSRVs and exhaust stacks.

Conservatively, the missile damage criteria are assumed to be "hit"' equals damage and the target size is increased from one-foot diameter cylinder to three feet diameter to address offset

hits. This is conservative because lower velocity impacts and offset hits impart much less energy to the target SSC and, therefore, should not affect valve operability, unlike a direct collinear strike. Also, some prominent missile types such as metal siding are highly deformable and less likely to cause sufficient damage.

The assumed success criteria used in the TORM IS analysis for SSHR for tornado mitigation are that one of the two lowest set pressure MSRVs opens, and that one additional relief valve (any one of eight) on the opposite header opens for overpressure protection. These success criteria translate to the three combinations of MSRV failures (damage events) that are evaluated in the analysis model.

Based on the conservative modeling of increased component size and individual strike resulting in failure, the NRC staff finds the licensee's approach acceptable for main steam relief valve (MSRV) modeling in the TORMIS code. In addition, resulting value indicate a low probability

{Table 6 of LAR) of damaging missile impact on unprotected components, which is acceptable, based on the low probability of a tornado occurring at the plant and striking the component in a manner resulting in loss of function.

5. Main feedwater (MFW) and main steam (MS) piping -

a. MS header in EPR - damage causing pipe rupture affecting SSF equipment in the WPR.

b. MFW headers in EPR - damage causing pipe rupture affecting SSF equipment the in WPR.

MFW and MS piping are classified as unprotected SSCs and if damaged could fail the SSF mitigation strategy. The specific targets identified for evaluation in the TORMIS analysis are MS in the EPR and MFW headers in the EPR, related to damage causing pipe rupture affecting SSF equipment in WPR.

Damage to the MFW and MS piping in the EPR is only a concern to the SSF tornado mitigation strategy due to the potential for a pipe rupture that could cause excessive temperatures in the WPR area where SSF electrical cables are routed. The fire and security barriers between the EPR and WPR are not designed for pipe rupture loads and are assumed conservatively to fail if a MS or MFW line break occurs in the EPR itself.

The NRC staff questioned the licensee's modeling of MS and FW lines and requested (in RAI 17) the licensee to discuss whether the complete portion of the exposed components on the main steam and feedwater systems are included and analyzed in the TORMIS analysis. The licensee's response clarified which portions of main steam and feedwater piping located inside the EPR are included in TORM IS models for each respective unit. A tornado induced rupture of main steam or main feedwater piping inside the EPR is postulated to fail the barrier separating the EPR and WPR, potentially exposing SSF equipment for that unit to adverse environmental conditions. Damage to the portions of main steam and main feedwater piping outside the EPRs will dissipate the energy to either the turbine building or the outside environment and is not postulated to cause damage to the WPR barrier or pose an adverse environmental condition to SSF equipment located there. Therefore, the portions of main steam and main feedwater piping located outside the EPR are not included in the Oconee TORMIS model.

The exposed portion of MFW and MS piping was modeled conservatively with a thickness of 0.25 in to increase potential damage from a missile, although actual header thickness is an inch or greater. In the model, this conservatively increases the quantity of damaging missiles impacting the piping. The licensee did not incorporate target size adjustments or increase target size to account for potential offset of missile strikes in the model, due to the ruggedness of the piping, exterior walls, and significant structural and other interferences. The NRC staff finds modeling inside the EPR to be typical for TORMIS piping modeling and acceptable.

6. CCW surge lines - damage to vent lines (crimping/crushing) for SSF ASW suction source.

The licensee identified CCW surge lines as a target for evaluation in the TORMIS analysis, related to damage to vent lines (crimping/crushing) for the SSF ASW suction source. These CCW surge lines are classified as unprotected SSCs that if damaged could fail the SSF mitigation strategy. The licensee's review of unprotected CCW surge lines utilized TORMIS to evaluate the probability of failure of the surge lines from the impact of a tornado missile.

The SSF ASW pump utilizes a suction supply of lake water from the embedded Unit 2 CCW piping. The SSF ASW pump is the major component of the system and is housed in the SSF building. The water contained in the buried CCW piping for Unit 2 serves as the water supply.

The majority of the CCW system needed for tornado protection is protected, with the exception of unprotected CCW surge lines whose damage could fail vent lines (crimping/crushing) for the SSF ASW suction source.

The licensee describes the CCW surge lines as very rugged such that a direct impact on the pipes would be necessary to cause significant damage.

As indicated in the application. CCW surge lines are unprotected and their damage could fail vent lines (crimping/crushing) for the SSF ASW suction source. Oconee used both qualitative analyses and TORMIS to evaluate the exposed CCW piping in the LAR.

The CCW surge lines consist of two 24-inch diameter pipes that provide a vent path for the ASW System. The surge piping targets are evaluated for crushing or crimping failure that would prevent adequate vent flow. An evaluation showed that only 44% of the flow area of only one of the 24-inch pipes (one of two for success) is required to provide an adequate vent path. A finite element analysis (FEA) was used to evaluate a set of conservatively assumed damage velocities for the three assumed dominant missile types impacting the surge lines. The missile type subset consisted of a concrete block, a wood plank and metal siding. The defined missile types in the current licensing basis as defined in UFSAR Table 9-17 include a utility pole, which is usually the most conservative in terms of damage. Section 5.3 of the LAR states that the dominant missile types striking safety targets are the wood plank and metal siding types; however, the NRC staff noted that the wood plank may not bound a utility pole. The NRC staff, therefore, requested the licensee to justify the missile set chosen for the FEA.

In its letter dated July 31, 2019, the licensee stated that, for the analysis of the (CCW) surge lines, a set of preliminary TORM IS simulations was made to collect data on missile hits on the surge lines. The license stated that the data showed that most hits came from wood planks, aluminum siding, and concrete blocks, and these missile types were then evaluated using detailed analysis to estimate the minimum impact velocity (VDAM). The licensee further stated that the TORMIS analysis utilized the estimated VDAM values for the wood plank, aluminum siding, and concrete block and applied a conservative VDAM value of zero (thereby assuming

that all strikes results in damage) for all other missile types including the utility pole. The NRC staff finds this approach will provide overall conservative results and is, therefore, acceptable.

The purpose of the finite element analysis (FEA) of tornado-missile impact damage at the Oconee Nuclear Station (ONS) was to verify that impacts by the missiles identified with TORMIS will not crimp the CCW surge pipes beyond acceptable limits. The results are used to validate that the critical damaging missile velocities used in the TORMIS analyses are conservative lower bounds of the true critical velocities. According to OSC-11760, "FINITE ELEMENT ANALYSIS [FEA] OF ONS [Oconee] CCW SURGE PIPES," the concrete block missile is modeled with smooth particle hydrodynamics (SPH) as opposed to finite elements.

However, the distance chosen between particles can affect the failure property of the aggregate structure, and hence affect the actual energy delivered to the target and the subsequent deformation. The NRC staff requested the licensee to explain the basis for how the particle distances are chosen and benchmarked.

The licensee stated in its letter dated July 31, 2019 that the SPH particle spacing was selected based on prior experience conducting concrete missile impact analyses against other targets.

The licensee also stated that based on the previous analyses they performed, the selection of smaller particles would likely result in equal or less crimping. Further, the licensee considered the specific concrete block geometry such that sufficient resolution ( 10 particles through the thickness of each wall of concrete block) was used to resolve through-thickness and bending stress. The NRC staff finds the licensee's response to be reasonable and acceptable. The licensee's response is substantiated in the literature, where, if the distance between particles decreases, the solution using SPH is closer to the FE benchmarked solution. The licensee's observation of "less crimping or equal crimping" for smaller particle distances indicates that a parametric study was completed in the past. The results collaborate the expected effect of progressively decreasing the size until the minimum threshold is met to match the benchmarked FEA result observed in the literature.

The potential for tornado missile damage to CCW piping (excluding the CCW surge lines) was evaluated qualitatively. This piping provides the SSF ASW suction source and is located in the turbine building basement (elevation 775.0 ft) and is well shielded from potential tornado missiles except for a few specific locations and angles of approach. Although certain CCW piping segments within the basement could be postulated as potential tornado missile targets, the licensee further evaluated these targets and concluded that any missile strike to the CCW piping within the turbine building basement area will not result in the loss of the required safe shutdown function.

7. SFP piping - damage causing loss of credited SFP inventory for RCMUP suction.

The specific unprotected target identified for evaluation in the TORMIS analysis is SFP Piping damage causing loss of credited SFP inventory for the RCMU pump (RCMUP) suction. SFP piping is classified as an unprotected SSC that if damaged could fail the SSF mitigation strategy.

The SSF RCMU system is designed to supply makeup to the RCS and RCP seal cooling in the event that normal makeup systems are unavailable. An SSF RCMUP located in the reactor building of each unit supplies makeup to the RCS should the normal makeup system flow and seal cooling become unavailable. An SSF RCMUP is capable of delivering borated water from

the SFP to the RCP seal injection lines. A portion of this seal injection flow is used to makeup for RCP seal leakage.

The SSF RCMUP for each unit utilizes its respective SFP as its suction source; however, it is postulated that tornado damage to SFP piping below certain elevations could drain the SFP below the required inventory for successful SSF mitigation. The critical elevation for Units 1 and 2 is 840. 7 feet, and 838 feet for Unit 3. This piping is sufficiently protected in most areas of the auxiliary building, but several areas were identified with tornado missile vulnerabilities.

The primary locations of vulnerable SFP piping is in the EPR for each unit near the crossover to the WPRs. The models are configured to address the concern that this target is also vulnerable from missiles coming through the WPR and through the crossover area because the security and fire barrier between the EPR and WPR is not qualified or credited for tornado missile protection. For Unit 3 only, there is an additional vulnerable area in the 3rd floor change room and the 4th floor cable room where there is a pair of SFP pipes in the northwest corner of the room and another pair of SFP pipes in the southwest corner of the room.

For simplification, each pair of SFP lines is modeled as a "box" around the piping with the damage criteria conservatively assumed to be "hit" equals damage. As discussed in LAR, conservatism was added for the SFP piping in the Auxiliary Building by modeling conservatively without credit for the pipe thickness to resist damage. In addition, very few interferences in these very congested areas were credited in the model.

Based on the conservative assumptions and low probability (Table 6 of LAR) results of a damaging missile impact on unprotected components, the NRC staff finds the licensee chose acceptable assumptions for the modeling of exposed piping.

8. RCS (normal) letdown line - normal HPI letdown line (from the containment penetration to isolation valve HP-5).

A short segment of the RCS letdown line runs from the containment penetration to the EPR floor Penetration. This item is classified as an unprotected SSC that if damaged could fail the SSF mitigation strategy.

The licensee described the HPI letdown line as a very rugged target deep inside the EPR with many structural columns and beams in the room, as well as piping, cable trays, and their associated steel supports. Additionally, the licensee noted that these interferences make damaging offset hits from tumbling or non-collinear impact orientations very unlikely.

The NRC staff find these assumptions acceptable for modeling, and the TORM IS results (Table 6 of LAR) reasonably reflect a very low probability of damaging strike.

3.8.2 Use of Boolean Logic With two exceptions, the LAR does not use Boolean logic when considering success criteria for missile targets. That is, if a target is damaged, the damaged component or system is considered as failed. However, in two instances a damaged target is not always considered to be failed. First, the success criteria for the CCW surge lines is identified as 44% of the flow area of one of the two 24-inch diameter CCW surge lines. Therefore, damage to one surge line is not counted as a failure. Second, the success criteria for the MSRVs is identified as the

lowest pressure relief valve on either the 'A' Header or the 'B' Header opens and one relief valve on the opposite header opens.

However, the LAR does not include references to calculations that support the assumptions made in the success criteria. In RAI 3, dated June 28, 2019, the NRC staff requested that the licensee provide references to calculations that support its success criteria. In its response, dated July 31, 2019, the licensee identified the calculations supporting the success criteria.

These calculations had been previously examined during the regulatory audit, and the NRC staff determined that the assumptions were reasonable and support the success criteria.

The NRC staff finds that the identified assumptions support the licensee's success criteria and therefore finds that the use of Boolean logic as presented in the LAR is acceptable because it is consistent with the licensee's use of the TORM IS code. Furthermore, the NRC staff finds that the referenced calculations acceptably provide traceability, auditability, and inspectability.

3.8.3 Results of the TORM IS Analysis In Section 3.5.1.3.1 of the proposed UFSAR revision, the licensee stated that the TORMIS computer code is used to determine the frequency of a damaging tornado missile strike on unprotected plant SSCs that are used to mitigate a tornado. SSCs included in the TORMIS probabilistic tornado risk analysis are listed in 6 of the LAR. The licensee stated that the Oconee TORMIS tornado missile risk analysis results show that the arithmetic sum of damage frequencies for all target groups affecting the individual units are lower than the acceptable threshold frequency of 1 x 10-6 per year per Unit and are lower than the acceptable threshold frequency of 1 x 10-6 per year established in SRP Section 2.2.3.

The Oconee TORMIS model used site tornado hazard information, site missile characteristic and target size, location, and physical properties to define input data in estimating probabilities of tornado missile damage on modeled targets. There are 14 individual unprotected safety-significant targets modeled in Oconee TORMIS, as shown in LAR Attachment 4, Table 6, "Oconee Tornado Missile Damage Frequency Results". As shown in Table 6 of the LAR, targets individually and collectively result in low probability of damage.

Based on the above, the NRC staff finds that because unique tornado missile protection has not been required for identified targets (analyzed by the TORMIS code), the probability of a malfunction of equipment important to safety will slightly increase. However, the frequency of a tornado-generated missile damaging these targets is less than 1 x 10-6 per year, and meets the guidance described in the SRP Section 2.2.3.

3.9 Review of Flow Path Elimination The LAR requested approval for elimination of the SFP to HPI flow path for RCMU. It was unclear to the NRC staff if the flow path was being physically removed, so the NRC staff requested the licensee to confirm that this request is specifically to eliminate the flow path from the tornado licensing basis and not to make any changes to the plant itself. The licensee responded that although it will not be credited in the tornado licensing basis nor in plant operating procedures, the existing piping configuration that connects the SFP suction path to the HPI system will remain in the plant for a beyond design basis response. The NRC staff found this response to be acceptable. The additional functions of this connection, unrelated to the instant LAR, have not been reviewed by NRC staff.

Section 2.2.1 of the LAR provides a summary of the current licensing basis requirements for tornado protection. As described in the LAR, if the normal and emergency power supplies to the HPI system are lost, an HPI train powered from Protected Service Water (PSW) is capable of providing primary makeup. If the HPI system is lost, the SSF RCMU system is capable of providing primary makeup. In addition to providing primary makeup, these systems ensure RCP seal cooling to prevent seal failure after a loss of normal seal injection and Component Cooling system flow. Main control room operators can align an HPI train to the PSW switchgear and align its suction source to the Borated Water Storage Tank (BWST). If the BWST is unavailable, the HPI suction source can be locally aligned to the SFP. Cooling water to the HPI motor is provided by the PSW Booster pump. The SSF RCMU pump takes suction from the SFP, and RCS inventory is managed from the SSF CR An adequate supply of borated water is provided to the SSF RCMU pumps from the SFP for each respective unit. This inventory is assured based upon minimum required SFP levels and maximum allowed SFP temperatures.

The licensee stated that the SFP suction path to the HPI system currently described in UFSAR Section 3.2.2 is being deleted to eliminate an alternative plant configuration that, when aligned and operated, involves significant operator actions outside of the control room and that availability of the path provides no appreciable benefit with respect to the overall station tornado mitigation capability. Previously, the BWST was not fully tornado missile protected and the SFP provided another source of HPI suction if the BWST was unavailable. The BWST has since been modified to withstand tornado missiles defined in UFSAR Section 3.5.1.3, such that the SFP is not expected to be needed for the HPI pumps. With the new tornado licensing basis crediting the SSF as the assured mitigation path following a tornado, the HPI system and any affiliated suction source are no longer necessary for meeting the tornado success criteria.

The defense-in-depth philosophy has traditionally been applied in plant design and operation to provide multiple means to accomplish safety functions. System redundancy, independence, and diversity result in high availability and reliability of the function and help ensure that system functions are not reliant on any single feature of the design. By relying only on the single RCMU flow path, redundancy and diversity are lost. Eliminating the redundancy and diversity of the RCMU makeup path provided under the existing licensing basis for tornado mitigation eliminates defenses-in-depth and increases risk related to achieving safe shutdown (SSD) following a damaging tornado. It was not clear to the NRC staff whether the planned use of alternate flow path is enough to overcome the loss of redundancy and diversity that would result from the proposed change. Since the proposed approach relies on a single makeup path for tornado mitigation with lack of defense-in-depth, the NRC staff requested the licensee to elaborate on how defense-in-depth is maintained in event of an unavailable makeup path from BWST.

The licensee responded that one of the redundant, diverse paths for makeup to the RCS is the BWST flowpath to the suction of the HPI pumps. The BWST has since been modified to withstand tornado missiles defined in UFSAR Section 3.8.4 (Table 3-23), such that the SFP is not expected to be needed as a redundant or diverse suction path for the HPI pumps. In addition, FLEX equipment is also available as a viable beyond design basis event mitigation option. The NRC staff finds this response acceptable and finds that the SFP to HPI flowpath can be eliminated from the tornado licensing basis.

3.10 Evaluation of Operator Actions As described in Section 2.4 of this SE, the NRC staff performed a Level Ill human factors review per NUREG-1764, Revision 1.

3.10.1 Description of Operator Actions The licensee's LAR dated September 14, 2018, proposes to credit the existing SSF, its support systems and associated operator actions as the sole tornado mitigation path at Oconee. In addition, the LAR proposes the elimination of specified operator actions associated with tornado mitigation to establish the SFP to high pressure injection (HPI) flow path for RCS makeup.

3.10.2 Task Analysis, Functional Requirements Analysis/Allocation and Procedure Design Use of the SSF to mitigate a tornado at Oconee would utilize the system as currently designed.

Existing operator actions associated with placing the SSF in service and establishing and maintaining safe shutdown conditions would be implemented to mitigate a tornado. Section 3.3 "Operations Response, Training and Procedures," of the LAR dated September 14, 2018, states that the operating crew will respond to a reactor trip by performing procedure EP/1,2,3/A/1800/001, "Emergency Operating Procedure," (EOP) and procedure AP/O/A/1700/025, SSF Emergency Operating Procedure," (SSF EOP) as directed by the main control room.

Section 3.3 of the LAR dated September 14, 2018, notes that the current SSF EOP provides guidance to place the unit(s) in an SSD condition following an RCS overheating event and that the SSF EOP will be revised to provide the guidance required to place the tornado affected unit in an SSD condition following an RCS overcooling event. Operation of the SSF during RCS overcooling conditions was reviewed and approved by the NRC staff in the SE associated with the Oconee license amendment issued on December 17, 2018 (Reference 23). Therefore, the operator actions required to utilize the SSF to mitigate a tornado are directed and specified by currer:it plant procedures or have been previously approved by the NRC st~ff and will be added to the applicable plant procedures as required.

The Control Room Senior Reactor Operator (CRSRO) is required to preemptively staff the SSF with a licensed operator upon receipt of a "Tornado Warning" message in accordance with abnormal operating procedure AP/O/A/1700/006, "Natural Disaster." The Shift Manager, acting as the site Emergency Coordinator, also has the discretion to staff the SSF (including continuously) in accordance with site Emergency Plan Response Procedure RP/O/A/1000/035, "Severe Weather Preparations." Multiple access paths to the SSF are identified and evaluated for inaccessibility due the tornado. In addition, Section 3.4, "Other Safety Considerations," of the LAR dated September 14, 2018, describes the confirmation performed to ensure that the operator travel routes to the SSF will not be adversely impacted by tornado damage to chemical storage tanks in the vicinity of the routes. Therefore, initiation of SSF staffing to respond to a tornado is currently controlled by existing plant procedures and the potential impact of hazards on the pathways has been evaluated.

Section 3.3 of the LAR dated September 14, 2018, describes five operator actions that are designated as time critical actions (TCAs ):

• Restoration of RCP seal cooling within 20 minutes of a loss of seal cooling;

• Establishment of SSF Auxiliary Service Water flow to the Steam Generators within 14 minutes of a loss of all feedwater;

• Closing the inside containment RCP seal return valve within 15 minutes;

• Closing of the other RCS boundary isolation valves within 20 minutes;

• Energizing the pressurizer heaters within 20 minutes.

The actions listed above are currently controlled as TCAs and managed in accordance with fleet directive NSD-514 (AD-OP-ALL-0205), "Control of Time Critical Tasks."

The LAR dated September 14, 2018, proposes the elimination of the operator actions associated with tornado mitigation to establish the SFP to high pressure injection (HPI) flow path for RCS makeup. With regard to human factors considerations, elimination of these actions reduces operator work load and does not require additional task analysis.

The operator actions required to mitigate a tornado at Oconee utilizing the SSF are directed by existing procedures or are previously reviewed and approved by the NRC staff and will be added to existing procedures. Therefore, the NRC staff finds that no new functional analysis is required, and functional allocation is unchanged. In addition, given that operator actions designated as TCAs are currently identified and administratively controlled as TCAs, the NRC staff finds that no new task analysis is required.

3.10.3 Human-System Interface Design The SSF is designed as a standby system for use under certain emergency conditions. The system provides additional "defense-in-depth" protection by serving as a backup to existing safety systems. The proposed use of the SSF to mitigate a tornado at Oconee relies on plant modifications and human-system interface (HSI) design changes implemented under the license amendment issued on December 17, 2018 (Reference 23). These approved changes include the capability of the operators to utilize the SSF to establish and maintain SSD during RCS overcooling and overheating conditions.

In addition, the licensee's letter dated July 31, 2019, states that new QA-1 instrumentation will be installed in the SSF control room for SG pressure, nuclear instrumentation, core exit thermocouples, pressurizer temperature, and temperature compensated pressurizer level. The licensee states that this instrumentation will be implemented per the criteria of 10 CFR 50.59 and will provide similar instrumentation in the SSF as is provided in the Main Control Room for operation with a potential loss of the secondary side pressure boundary. Therefore, the NRC staff finds the Oconee proposal acceptable with regard to HSI considerations.

3.10.4 Training Program Design Section 3.3 of the LAR dated September 14, 2018, states that licensed operators receive classroom, simulator (including the SSF simulator) and on-the-job training on the EOPs and the abnormal procedures (AP) during the initial licensed operator training program. Non-licensed operators also receive training on relevant EOP and AP tasks. Proficiency is maintained with periodic continuing training. Shift licensed, and non-licensed operators are also required to perform quarterly SSF proficiency drills per Operations Management Procedure (OMP) 2-23, "Shift Manager Rules of Practice." The NRC staff finds that the licensee has implemented appropriate training programs to support the utilization of the SSF to mitigate a tornado at Oconee.

3.10.5 Human Factors Verification and Validation As described above, the operator actions required to mitigate a tornado at Oconee utilizing the SSF are directed by existing procedures or were previously reviewed and approved by the NRC staff and will be added to existing procedures. Section 3.3 of the LAR dated September 14, 2018, states that the Oconee EOP and AP procedure changes go through a rigorous verification and validation process governed by OMP 4-02, "Verification and Validation Process for APs, EOP, and Support Procedures."

In addition, per Section 3.3 of the LAR dated September 14, 2018, the operator actions relied upon for utilizing the SSF to mitigate a tornado at Oconee are currently identified as TCAs and managed in accordance with fleet directive NSD-514 (AD-OP-ALL-0205), "Control of Time Critical Tasks." The fleet directive includes a periodic test procedure listing all TCAs and the test procedure is performed at least once every five years to verify the ability to accomplish the actions.

The NRC staff finds that appropriate verification and validation has been applied to and will be maintained for the operator actions associated with utilization of the SSF to mitigate a tornado at Oconee.

3.11 Technical Specifications Evaluation The licensee stated that no Technical Specification (TS} changes are proposed as part of the LAR. In Section 3.8 of the LAR, the licensee stated:

Because a tornado is a design criterion and does not constitute a design basis accident or transient as described in 10 CFR 50.36(c)(2)(ii), degradation of passive civil features protecting the SSF will not apply to operability under TS LCO 3.10.1, "Standby Shutdown Facility."

The NRC staff requested additional information regarding the meaning of "passive civil features" and the reasoning for why degradation of passive civil features protecting the SSF will not apply to operability under TS LCO 3.10.1, "Standby Shutdown Facility [SSF].", given the fact that the SSF meets Criterion 4 of 10 CFR 50.36(c)(2)(ii). The licensee provided a further discussion of the passive civil features in RAI 1 response on Page 1 of Enclosure 1 of the letter dated July 31, 2019 which stated:

Tornado is a design criterion that applies to structures, systems, and components (SSCs) credited in the Oconee Current Licensing Basis (CLB) for the mitigation of tornadoes. Similar to the treatment of other design criteria in the CLB, the operability/functionality process is entered when aspects of a particular design criterion are found deficient. Since there are no Technical Specifications applicable to tornado, functionality is assessed according to station procedures to determine if a non-conforming condition exists.

To control design features that are credited in the mitigation of tornadoes, Oconee maintains a passive design features control process. The process is described in Site Directive 3.2.16, "Control of Passive Design Features." The objective of this process is to maintain civil structures to protect important systems and components from both internal and external events described in the Updated Final Safety Analysis Report (UFSAR). The directive allows tornado

protection barriers to be temporarily taken out of service to allow maintenance or changes to the facility. However, the directive requires in those cases that compensatory actions be available should a tornado watch/warning be declared by the National Weather Service. The compensatory actions may take different forms including: (1) Having the means, such as tools, equipment, labor, etc. in place to restore the original barrier back to its design configuration; (2) Having the means to install a temporary barrier equivalent to the normal barrier. Also, the directive provides guidance that intentional breaches of tornado related barriers should be accomplished in periods of the year where there is a lower risk of a tornado impacting the site.

If a passive design feature is found to be out of service without Operation's approval, then Operations shall be contacted immediately. A Nuclear Condition Report must be initiated, operability/functionality assessed, and action taken to restore the design feature. Appropriate contingency actions must be established until the passive design feature is restored. The LAR credits the Standby Shutdown Facility (SSF) as the tornado mitigation system.

The licensee responded to the NRC staff's request regarding the reasoning for why degradation of passive civil features protecting the SSF will not apply to operability under TS LCO 3.10.1, "Standby Shutdown Facility." in RAI 2 response on page 2 of Enclosure 1 of the letter dated July 31, 2019 and stated:

TS Limiting conditions for operations (LCOs) are defined in 10 CFR 50.36(c)(2) as " ... the lowest functional capability or performance levels of equipment required for safe operation of the facility." 10 CFR 50.36(c)(2)(ii) notes that "A technical specification limiting condition for operation of a nuclear reactor must be established for each item meeting one or more of the following criteria."

Criterion 4 of 10 CFR 50.36(c)(2)(ii) states "A structure, system, or component which operating experience or probabilistic risk assessment has shown to be significant to public health and safety." The NRC Policy Statement associated with technical specification improvements (No.93-102, dated July 23, 1993) refers to "unique plant vulnerabilities" that a plant specific probabilistic safety assessment (PSA) has shown to be significant to public health and safety.

Oconee agrees that the SSF meets criterion 4 for scenarios to which it was originally designed and licensed and not specifically to the mitigation of tornadoes or the maintenance of tornado passive design features associated with the SSF. The plant specific PSA shows that the importance of SSF is primarily associated with the mitigation of fire events and its vulnerabilities are associated with human reliability and equipment availability/reliability and not the maintenance of tornado passive design features.

Oconee maintains that tornado is not a design basis accident or transient. The SSF was originally licensed to mitigate fires postulated to occur in the TB [turbine building], internal flooding in the TB due to failures of CCW, and security events.

The facility met 10 CFR 50.36 criterion 4 based on the risk associated with these events, not tornado.

Oconee has recognized the importance of managing and maintaining passive design features in protecting the station from natural phenomena. To that end, a site administrative directive was created to manage the barriers to facilitate

modifications to and maintenance of the station. The site directive (SD 3.2.16, "Control of Passive Design Features") is described in the response to RAl-1. The site directive requires that contingency actions be established prior to the intentional or planned breach of a given barrier associated with the SSF. This provides assurance that a given barrier can be quickly restored should deteriorating weather develop. It also requires entry into the operability process should a given barrier be discovered impaired. This provides assurance that should a given barrier be found deficient, functionality will be assessed, and corrective actions implemented in a timely manner to restore the barrier. Given the NRG-recognized low probability of a tornado impacting a particular nuclear station, the actions described above collectively assure that the SSF associated tornado passive design features will be in place and functioning should a tornado impact the site.

Oconee concludes that the potential degradation of SSF related tornado passive design features does not apply to the operability of the SSF as defined in TS 3.10.1 "Standby Shutdown Facility." This is due to the insignificant contribution of passive design features to the overall risk profile of the SSF, the NRG-recognized low probability of a tornado impacting a particular nuclear station, and the robust control and maintenance of tornado passive design features as described in the site directive.

• The NRC staff reviewed the licensee's response and determined that no changes to the TS are required for the requested license amendment because there are no TS applicable to tornados, and functionality of tornado passive design features is assessed according to Site Directive 3.2.16 to determine if a non-conforming condition exists.

3.12 Technical Evaluation Summary Based on the above, the NRC staff concludes that the licensee has adequately addressed the items identified in the NRC SER approving the TORM IS methodology, and that the EPRI TORMIS methodology has been implemented appropriately in accordance with the guidance provided in the 1983 TORMIS SER and RIS 2008-14. Furthermore, the NRC staff concludes that the reported results comply with NRC guidance and are acceptable.

The frequency of a tornado-generated missile damaging these targets is less than 1 x 10-6 per year and meets the guidance described in the SRP Section 2.2.3. Therefore, the NRC staff finds that the revisions to the UFSAR appropriately reflect Oconee 1, 2, and 3 compliance with NRC guidance and the use of NRG-approved methodology for a TORM IS analysis.

Additionally, the NRC staff has reviewed the thermal-hydraulic analysis and finds the results of the tornado induced main steam line or main feedwater line break analysis demonstrate that the transient can be mitigated using SSF equipment and meet the appropriate acceptance criteria.

4.0 REGULATORY COMMITMENTS While the proposed modifications are presented as commitments by the licensee, NRC approval of these license amendments does not rely on these commitments. The licensee's

implementation of these modifications is subject to inspection under the Reactor Oversight Process (ROP).

5.0 STATE CONSULTATION

In accordance with the Commission's regulations, the NRC staff notified the State of South

'Carolina official by email on September 12, 2019 (ADAMS Accession No. ML19255H284), of the proposed issuance of the amendments. On September 12, 2019, the NRC confirmed that the State official had no comments (ADAMS Accession No. ML19256C856).

6.0 ENVIRONMENTAL CONSIDERATION

The amendments change requirements with respect to the installation or use of facility components located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts and no significant change in the types of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding, which was published in the Federal Register on April 2, 2019 (84 FR 12638). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22( c)(9).

Pursuant to 10 CFR 51.22(b ), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

7.0 CONCLUSION

Based on the aforementioned considerations, the Commission has concluded that: ( 1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

8.0 REFERENCES

1. Burchfield, J. Ed Jr., Duke Energy, Letter to NRC, "Proposed Amendment to the Renewed Facility Operating Licenses Regarding Revisions to the Updated Final Safety Analysis Report Sections Associated with the Oconee Tornado Licensing Basis," dated September 14, 2018, (ADAMS Accession No. ML18264A023).

2. Burchfield, J. Ed Jr., Duke Energy, Letter to NRC, "Proposed Amendment to the Renewed Facility Operating Licenses Regarding Revisions to the Updated Final Safety Analysis Report Sections Associated with the Oconee Tornado Licensing Basis," dated January 24, 2018 (ADAMS Accession No. ML19036A625).

3. Klett, Audrey, Email to Arthur Zeremba (Duke Energy), "NRC Request for Additional Information for Oconee LAR 2018-02 (L-2019-LLA-0251)," dated June 28, 2019 (ADAMS Accession No. ML19183A483).

4. Burchfield, J. Ed Jr., Duke Energy, Letter to NRC, "Proposed Amendment to the Renewed Facility Operating Licenses Regarding Revisions to the Updated Final Safety Analysis Report Sections Associated with the Oconee Tornado Licensing Basis - Responses to Request for Additional Information," dated July 31, 2019 (ADAMS Accession No. ML19217A167)

5. Baxter, Dave, Duke Energy, Letter to NRC, "License Amendment Request to Revise Portions of the Updated Final Safety Analysis Report Related to the Tornado Licensing Basis," dated June 26, 2008 (ADAMS Accession No. ML081840371)

6. Klett, Audrey, Memo to Michael T. Markley (NRC), "Oconee Nuclear Station, Units 1, 2 and 3 - Regulatory Audit in Support of Review of License Amendment Request No. 2018-02 (EPID L-2018-LLA-0251}," dated February 8, 2019 (ADAMS Accession No. ML19037A005).

7. Klett, Audrey, Letter to J. Ed. Burchfield, Jr. (Duke Energy}, "Oconee Nuclear Station, Units 1, 2 and 3 - Summary of Regulatory Audit in Support of License Amendment Request No. 2018-02 (EPID L-2018-LLA-0251)," dated September 17, 2019 (ADAMS Accession No. ML19214A222).

8. NRC, Section 3.5.1.4, Revision 4, "Missiles Generated By Extreme Winds," of NUREG-0800, (ADAMS Accession No. ML14190A180).

9. NRC, Section 3.5.2, Revision 3, "Structures, Systems, and Components to be Protected from Externally-Generated Missiles," of NUREG-0800, (ADAMS Accession No. ML070460362).

10. NRC, Regulatory Guide (RG) 1.117, Revision 1, "Tornado Design Classification," issued April 1978 (ADAMS Accession No. ML003739346).

11. Electric Power Research Institute Report- EPRI NP-768, "Tornado Missile Risk Analysis," dated May 1978 (ADAMS Accession No. ML16015A147, non-public).

12. Electric Power Research Institute Report- EPRI NP-2005, Volume 1, "Tornado Missile Simulation and Design Methodology, Volume 1: Simulation Methodology, Design Applications, and TORMIS Computer Code," dated August 1981 (ADAMS Accession No. ML17033A872, non-public).

13. Electric Power Research Institute Report- EPRI NP-2005, Volume 2, "Tornado Missile Simulation and Design Methodology, Volume 2: Model Verification and Data Base Updates," dated August 1981 (ADAMS Accession No. ML17033A863, non-public).

14. NRC, Safety Evaluation Report, "Electric Power Research Institute (EPRI) Topical Reports Concerning Tornado Missile Probabilistic Risk Assessment (PRA)

Methodology," October 26, 1983 (ADAMS Accession No. ML080870291)

15. NRC, Regulatory Issue Summary 2008-14, "Use of TORM IS Computer Code for Assessment of Tornado Missile Protection," dated June 16, 2008 (ADAMS Accession No. ML080230578)

16. Duke Energy, Oconee Nuclear Station, Updated Final Safety Analysis Report, Revision 27, dated June 29, 2018 (ADAMS Package No. ML18192A809).

17. NRC, Regulatory Guide 1. 76, Revision 0, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," dated April 1974 (ADAMS Accession No. ML003740273).

18. NRC, Regulatory Guide 1.76, Revision 1, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," dated March 2007 (ADAMS Accession No. ML070360253).

19. NRC, NUREG-1764, "Guidance for the Review of Changes to Human Actions,"

Revision 1, published September 2007 (ADAMS Accession No. ML072640413 ).

20. NRC, "Position on use of Probabilistic Risk Assessment in Tornado Missile Protection Licensing Action, dated November 7, 1983 (ADAMS Accession No. ML080870287).

21. NRC, Section 2.2.3, Revision 3, "Evaluation of Potential Accidents," of NUREG-0800, "Standard Review Plan," dated March 2007 (ADAMS Accession No. ML070460336)

22. Pacific Northwest National Laboratory, NUREG/CR-4461, Revision 2 (PNNL-15112, Revision 1), "Tornado Climatology of the Contiguous United States," dated February 2007 (ADAMS Accession No. ML070810400).

23. Klett, Audrey L., Letter to J. Ed Burchfield Jr., "Oconee Nuclear Station - Units 1, 2, and 3 - Issuance of Amendments Regarding the Updated Final Safety Analysis Report Section for the Standby Shutdown Facility (EPID L-2017-LLA-0365)," dated December 17, 2018 (ADAMS Accession No. ML18311A134).

24. Framatome Technologies Group, Topical Report- BAW-10193NP-A, "RELAP5/MOD2-B&W For Safety Analysis of B&W-Designed Pressurized Water Reactors,"

January 2000, (with Memo) "Safety Evaluation of Topical Report BAW-10193P, "RELAP5/MOD2-B&W For Safety Analysis of B&W-Designed PWRS," dated October 15, 1999 (ADAMS Accession No. ML003682985).

25. Idaho National Engineering Laboratory, Prepared for NRC, BAW-10164P, "RELAP5/MOD2-B&W, An Advanced Computer Program for Light Water Reactor LOCA and Non-LOCA Transient Analyses," NRC Rounds of Questions, dated March 31, 1988 (ADAMS Accession No. ML030220205).

26. Idaho National Engineering Laboratory, Prepared for NRC, BAW-10164(P)(A),

Revision 1, "Technical Evaluation Report - RELAP5/MOD2-B&W, An Advanced Computer Program for Light Water Reactor LOCA and Non-LOCA Transient Analyses,"

Revision 1, February 1990 (ADAMS Accession No. ML030410278).

27. SCIENTECH, Inc., Prepared for NRC, BAW-10164A, "Technical Evaluation Report -

RELAP5/MOD2-B&W, An Advanced Computer Program for Light Water Reactor LOCA and Non-LOCA Transient Analyses," Revisions 2 and 3, dated March 1995 (ADAMS Accession No. ML030220258).

28. Barnett, Leslie W., NRC, letter to James F. Mallay, "Safety Evaluation of Framatome Technologies Topical Report BAW-10164P Revision 4, "RELAP5/MOD2-B&W, An Advanced Computer Program for Light Water Reactor LOCA and Non-LOCA Transient Analyses," dated April 9, 2002 (ADAMS Accession No. ML013390204).

29. Framatone ANP, Inc., Prepared for NRC, BAW-10164-A, Topical Report, RELAP5/MOD2-B&W, An Advanced Computer Program for Light Water Reactor LOCA and Non-LOCA Transient Analyses," Revision 4, dated November 2002 (ADAMS Accession No. ML030220134.)

30. Jones, R. A., Duke Power, letter and Topical Report to NRC, "Issuance of Approved Version of DPC-NE-3003-P, Revision 1 (DPC-NE-3003-PA, Revision 1; DPC-NE-3003-A, Revision 1), dated January 11, 2005 (ADAMS Accession No. ML050310359).

31. Morris, James R., Duke Power, letter to NRC, "Issuance of Approved Version of DPC-NE-3000-P, Revision 3 (DPC-NE-3000-PA, Revision 3, DPC-NE-3000-A, Revision 3),dated February 28, 2005 (ADAMS Accession No. ML050680273).

32. Nieh, Ho K., NRC, Memo to NRC Regional Administrators, "Closeout of Low Safety Significant/Low Risk Concerns - Tornado-Generated Missile Protection," dated February 28, 2019 (ADAMS Accession No. ML19037A004).

Principal Contributors: G. Curran, NRR R. Beaton, NRR C. Moulton, NRR M. Breach, NRR Date: October 31, 2019

J. E. Burchfield, Jr.

SUBJECT:

OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3- ISSUANCE OF AMENDMENTS 415,417, AND 416, REGARDING THE UPDATED FINAL SAFETY ANALYSIS REPORT DESCRIPTION OF TORNADO MITIGATION (EPID L-2018-LLA-0251) DATED OCTOBER 31, 2019 DISTRIBUTION:

PUBLIC RidsNrrLAKGoldstein Resource RidsACRS_MailCTR Resource RidsNrrPMOconee Resource RidsNrrDorlDpr Resource RidsRgn2MailCenter Resource RidsNrrDorlLp12-1 Resource K. Nguyen, NRR/DEX RidsNrrDssSnsb Resource R. Beaton, NRR/DSS RidsNrrDssScpb Resource G. Curran, NRR/DSS RidsNrrDraAplb Resource C. Moulton, NRR/DRA RidsNrrDraApob Resource J. Hughey, NRR/DRA RidsNrrDssStsb Resource M. Hamm, NRR/DSS RidsNrrDexEmib Resource M. Breach, NRR/DEX RidsNrrDexEeob Resource ADAMS Access1on Nos.: ML19260E084 *b1vema1*1 OFFICE D0RULPL2-1 /PM D0RULPL2-1 /LA DSS/SRXB* DSS/SCPB*

NAME AKlett (MMahoney for) KGoldstein RBeaton GCurran DATE 10/01/2019 09/30/2019 10/02/2019 10/02/2019 OFFICE DRA/APOB* DRA/APLB* DSS/STSB* DE/EMIB*

NAME JHughey CMoulton MHamm MBreach DATE 09/25/2019 09/17/2019 09/25/2019 09/23/2019 OFFICE DE/EEOB* DSS/SRXB/BC DSS/SCPB/BC DRA/APOB/BC NAME EKleeh JBorromeo SAnderson (SJones for) AZoulis DATE 09/24/2019 10/09/2019 10/10/2019 10/03/2019 OFFICE ORA/AP LB/BC DSS/STSB/BC* DE/EMIB/BC* DE/EE OB/BC*

NAME MReisiFard VCusumano SBailey DWilliams DATE 10/04/2019 10/03/2019 09/30/2019 10/07/2019

• .. .. f OFFICE OGC (NLO) D0RULPL2-1 /BC D0RULPL2-1 /PM .* .* *.

NAME DATE STurk 10/31/2019 MMarkley 10/31/19 AKlett (MMahoney for) 10/31/19 OFFICIAL RECORD COPY

.*.