ML23109A078

NRC-2022-000160 - Resp 2 - Final, Agency Records Subject to the Request Are Enclosed, Part 2 of 7

ML23109A078
Person / Time
Issue date:	04/13/2023
From:	NRC/OCIO
To:
Shared Package
ML23109A075	List: ML23109A076 ML23109A077 ML23109A078 ML23109A079 ML23109A080 ML23109A082 ML23109A083 ML23109A084
References
NRC-2022-000160
Download: ML23109A078 (1)

Text

II. *I

Duke Pou:er Compum : i\\.' JI, \\f/'7(;_1 Oconee.\\uclea, Generat ion Deour.n:,tr;; *, *e Prt!.11d~nr Pd B()X N];J ",_'/;,.,.i.J./.'1:' (jfftff

,:;J :-.~~5-35,;.1 Fu.r

! e DUKE POWER December 28, 1995

U. S. Nuclear Regulatory Commission Attention : Document Control. Desk Washington, DC 20555

Subject:

Oc onee Nuclear Sta t ion, Unit~ 1 and 2

• Docket Nos.: 50-269, 50-270 and 50-287 Individual Plant Examination of External Events (I PEEE) Submitt al

Gentlemen:

In response to Generic Letter 88-20, Supplement 4, Duke Power Company has completed the Individual Plant Examina.tion of External * ~vents * (IPEEE) for severe accident vulnerabilities at t he Oconee Nuclear Station ; The

• attached report presents *the *results.' The Ocon~e IPEEE program was conducted in accordance with the

• appx;oacr and methodology described in our December 18; 1991, 180. day response letter,

• with one exception. The relay review, being done in conjunction with the USI A-46 relay review, has not been completed. The 180 day response was accepted by the NRC by its letter of June 16, 1992.

The scope.* of

• the relay. chatter re:view for Oconee is

• consistent with the s i te's seismic :margin r~v~3w level earthqu a ke classification as defined in Table 3.1 of NUREG- *. '

1407. Oconee is in the "full s9ope " : bin. The full _scope evaluation requires a relay chatter revie w for all essential relays in *accordance wi t h the procedures outlined iri the Generic Implementation Procedure (GIP). A simila *r *review of relays i s required for resolution of USI A-46. The relay

• review is in progress but has not been completed.

Approximately 5500 relays are being reviewed. To date, appr c ximately. 3860 of these relays ha~e been evaluat~d and determined not to be a concern. *By letter dated Octobe~ 3, 1995, Duke - Power requested a revised submit~al date of

• Decembe3: 31, 1996 for USI A-46 in order to. c'?mplete this wor!c. In order to *meet the December 31,

• 1595 IPE~E submittal date, relay chatter *is accounted for in the IPEEE report

~~ -~~ 9

.. ~*-.. *.. *.,:.. *.. - 020 C~Cl Document Control Desk December 21, 1995 Page 2

using the same fragilities as listed in the existing Oconee

• PRA. It is ou!" expectation that the core damage frequency

• for seismic events reported in this _ submittal w.i..11 not be significantly affected by the remaining relay analysis. An

• a.ddendum to the submittal _report will be s ubmitted by December 31, 1996 if the relay evaluation indicates any significantly new results in the existing relay chatter fragilities and seismic core damage frequency.

This Oconee IPEEE Submittal Report contains a ~ummary of the methods, results and conclusions of the Oconee IPEEE program. The IPEEE process and supporting Ocone~ PRA include a comprehensive, systematic examination of severe. accident potential resulting from external initiating events. The Oconee IPEEE has identifie d the severe accident sequences *of significance resulting from the external initiating events with quantitative perspectives on their likelihood. The insights from this study prompted some plant enhancements, as discussed in Section 7 of the enclosed repo _rt. The examination process and the accompanying dialogue have improved our understanding of these types of accidents. The integ ra ted safety profile evident from the risk results confirms that the Oconee Nuclear Station poses no undue risk to the public health and safety. Therefore, the objectives of GL 88-20 are fully satisfied.

Several. generic issues and unresolved saf~+:y

• issues were addressed and are considered closed out as a result of the previous PRA work and the IPEEE effort. These are: USI A-45, USI A-17, GI 57, GI 1 03, the Eastern U. S. Seismicity Issue, and NUREG/CR~5088.

+n conclusion, the Oconee IPEEE completes all the studies requested by Generic Letter 88-20. This IPEEE submittal along with *the previous IPE submittal contains adequate information to resolve the severe accident vulnerability issue for Oconee.

Document Controi Desk December 21, 1995 Page 3

I declare under pena l ties of per,ury that the statements set forth herein are true and correct to the best of my kn9wledge.

. Very truly yours, 1!}f1!1};_f.r J. W. Hampton

Attachment (IPEEE Submittal Report)

xc: *(with attachment):

Mr. S. D. Ebneter, Regional Administrator U. S. Nuclear Regulatory Commission, Region II

Mr. Patrick D. Milano Office of Nuclear Reactor Regu l ation

Mr. P. E. Harmon Senior Resident Inspector Oconee Nuclear Site Duke Power Compauy

OCONEE NUCLEAR. STATION

IPEEE SUB.MITT AL REPORT

December 21, 1995 TABLE OF CONTENTS

EXECUTIVE

SUMMARY

1-1

1. 1 BACKGROUND AND OBJECTIVES 1-1 1.2 PLANTFAMILIARIZATION 1-1 1.3 OVERALL METHODOLOGY 1-2 1.3. l External Events Methodology 1-2 1.3.2 Plant Model 1-3 1.4

SUMMARY

OF MAJOR FINDINGS 1-3 1.4. 1 Core Damage Frequency Results 1-3 1.4.2 Containment Performance Results 1-4 1.4.3 Vulnerability Findings 1-6

2. EXAMINATION DESCRIYfION 2-1.

2. 1 INTRODUCTION. 2-1 2.2 CONFORMANCE WITH GENERIC LEITER AND SUPPORTING MATERIAL 2-1 2.3 GENERAL METHODOLOGY 2-3 2.4 INFORMATION ASSEMBLY 2-4

3. SEISMIC ANALYSIS 3-1 3.0 METIIODOLOGY SELECTION 3-1

3. 1 SEISMIC PRA 3-1 3.1.1 Hazard Analysis 3-f

3. 1.2 Review of Plant Information and Wallcdown 3-2

3. 1.2. l Plant Information 3-2

3. 1.2.2 Information Sources

• 3-4 3.1.2.3 Wallcdowns 3-6 *

3. 1.3 Analysis of Plant System and Structure Re spom,~ 3-10

3. 1.4 Evaluation of Component Fragilities and Failure Modes 3~ 13

3. 1.5 Analy sis of Plant Systems and Sequences 3-*15 3.1.5.1 Seismic Event Tree 3-15 3.1.5.2 Supporting Fault Tree Logic 3-18 3.1.5.3 Event Tree Sequences 3-25

3. 1.5.4 Seismic Fault Tree Solution 3-27

3. 1.5.5 Sequence Di stribution and Timing of Core Damage 3-29

3. 1.5.6 Sensitivity of the Auxiliary Building Surrogate 3-29

• 3.1.5.7 Extrapolation Beyond l.02g* Acceleration Levels 3-30 3.1.6 Analysis of Containment Perfor:mance* 3-30 3.2 USI A-45, GI-131, AND OTHER SEISMIC SAFETY ISSUES 3-32 Section ~

4. INTERNAL FIRE ANALYSIS 4-1.,, METI-JOOOLO~YSELECTION 4-1 "

4. 1 FIRE HAZARD ANALYSIS 4-1 4.2 REVIEW OF PLANT INFORMATION AND WALKDOWN 4-2 4.3 FIRE GROWTJ::1 AND PROPAGATION 4-2

4. 3. 1 Cable Shaft Fire 4-2 4.3.2 Turbine Building Fire 4-3 4.4 EVALUATION OF COMPONENT FRAGILITIES AND FAILURE MODES 4-3 4.5 FIRE DETECTION AND SUPPRESSION 4-4 4.6 ANALYSIS OF PLANT SYSTEMS, SEQUENCES, AND PLANT RESPONSE 4-4 4.7 ANALYSIS OF CONTAINMENT PERFORMANCE 4-5 4.8 TREATMENT OF FIRE RISK SCOPING STUDY ISSUES 4-5 4.8. 1 Strategy 4-5 4.8.2 Walkdown Team 4-5 4.8.3 PRA Assumptions, Input and Verification 4-5 4.8.4 Smoke Generation/Migration Effects 4-6 4.8.5 Water Spray and Migration Effects 4-7 4.8.6 Seismic/Fire Interaction 4-7 4.8.7 Control System Interactions 4-9 4.8.8 Compartment Interaction Analysis 4-9 4.8.9 Walkdown Conclusions 4-10 4.9

SUMMARY

OF RECOMMENDATIONS 4-10

4. 10 USI-45 AND OTHER SAFETY ISSUES 4-11

4. 11 SENSITIVITY STUDIES 4-11

4. 12. DOCUMENTS 4-11

s. HIGH WINDS, FLOODS AND OTHERS 5-1 5.1 HIGH WINDS 5-1

5. 1.1 Overview 5-1

5. 1.2 Methodology 5-2

5. 1.2. 1 Tornado Occurrence Frequencies 5-2

5. 1.2.2 Tornado Wind Effects 5-3 5.1.2. 3 Tornado Missile Simulation Analysis 5-8 5.1.2.4 Keowee Tornado Path 5-9

5. 1.3' Tornado Event Tree 5-10

5. 1.3. 1 Event Tree Structure 5-10 5.1.3.2 Top Event Failure Logic 5-11 5.1.3.3 Event Tree Sequences 5-13

5. 1.4 Containment Performance 5-15

5. 1.4. 1 Containment Isolation 5-15 5.1.4.2 Containf!lent Safeguards 5-15

ii*

Section fue

5. 1.5 Limitations of the Analysis 5-15

5. 1.6 Re su'. :s 5-16 5.1.7 Unit Differencies 5-16 5.1.8 Insights 5-17 5.1.9 Conclusions 5-17 5. 1.10 Recommendations 5-17 5.2 EXTERNAL FLOODS 5-17 5.2. 1 Methodology 5-18 5.2. 1.1 External Flooding From Precipitation 5-18 5.2. 1.2 External Flooding From Dam Failure 5-19 5.2.2 Event Tree 5-23 5.2.2. 1 Event Tree Structure 5-23 5.2.2.2 Event Tree Sequences 5-24 5.2.3 Fault Tree Analysis 5-25 5.2.4 Containment Performance 5-26 5.2.5 Limitations of the Analysis 5-26 5.2.6 Results. 5-27

• 5.2.7 Insights 5-27 5.2.8 Conclusions 5-27 5.3 TRANSPORTATION AND NEARBY FACil...ITY ACCIDENTS 5-27 5.3.1 Aircraft Crashes 5-27 5.3.2 Transponation Events 5-30 5.3.3 Impact of Nearby Military and Industrial Facilities 5-31 5.3.4 On-Site Storage of Toxic Materials 5-31 5.3.5 On-Site Storage of Explosive Materials 5-32 5.3.5.1 Propane Tanks 5-32 5.3.5.2 Hydrogen Storage 5-33 5.3.6 Gas Pipeline Ruptures 5-35 5.3.6.1 Natural Gas Pipelines 5-35

5. 3.6. 2 Off-Site Propane Storage Facilities 5-35 5.4 OTHERS 5-35

6. LICENSEE PARTICIPATION AND INTERNAL REVIEW TEAM 6-1 6.1 IPEEE PROGRAM ORGANIZATION 6-1 6.2 COMPOSITTON OF INDEPENDENT REVIEW TEAM 6-1 6.3 AREAS OF REVIEW AND MAJOR COMMENTS 6-1 6.4 RESOLUTION OF COMMENTS 6-2

7. PLANT IMPROVEME~TS AND UNIQUE SAFETY FEATURES 7-1

8.

SUMMARY

AND CONCLUSIONS 8-1

9. REFERENCES 9-1

iii APPENDIX A OCONEE SEISMIC FAULT TREE APPENDIXB OCONEE PRA REV. 2, SECTION 3.5 APPENDIXC OCONEETORNADOFAULTTFEE APPENDIXD OCONEE EXTERNAL FLOOD FAULT TREE

LIST OF FIGURES

EiiYJC Number

Figure 3-1.Oconee Seismic Hazard Curves 3-68 Figure 3-2 Oconee Seismic Event Tree 3-69

Figure 5-1. Oconee Tornado Event Tree 5-95 Figure 5-2 Diagram of Tornado Origins 5-96 Figure 5-3 Layout of Oconee Nuclear Station 5-97 Figure 5-4

• TORMIS Analysis Plant Site Model 5-98 Figure 5-5 Oconee Nuclear Station Missile Origination Zones 5-100 Figure 5-6 Oconee External Flooding Event Tree 5-101

LIST OF TABLES

Table Number ~

Table l

• l External Initiating Events Core Damage Frequency 1-7

Table 3-1 Component Fragilities Used In The Oconee Seismic Analysis 3-34 Table 3-2 Additional Seismic Plant Model Basic Event Data 3-36 Table 3-3 Enhancements Resulting from the IPEEE Seismic Verification Walkdown 3-39 Table 3-4 Dominant Seismic Event Sequences 3-44 Table 3-5 Dominant Seismic Event Sequences - LLNL Curve 3-63 Table 3-6 Seismically-Induced Core-Melt Results By Sequence 3-66 Table 3-7 Timing of Seismic Core D_amage Sequences 3-67

Table 5-1 Preliminary External Initiating Event List 5-36 Table 5-2 Tornado Data and Frequency 5-37

iv Table Number

Table 5-3 Piping Damaged by Tornado-Induced *west Penetration Room Failure 5-38 Table 5-4 Oconee Nuclear Station Missile Distribution 5-39 Table 5-5 Conditional Probability *of Damage By Tornado-Generated Missile 5-41 Table 5-6 Keowee Conditional Failure Probabilities 5-42 Table 5-7 CAFf A TornadoBasic Event Data 5-43 Table 5-8 Event Tree Failure Modes Considered 5-44 Table 5-9 Tornado Cut Sets 5-47 Table 5-10 Tornado Results By Sequence 5-72 Table 5-11 Oconee Tornado Event Importance Measures 5-73 Table 5-12 External Aooding Model Reliability Data 5-74 Table 5-13 External Flood Cut Sets With Sequence* Designations 5-80 Table 5-14 External Flood Results By Sequence 5-86 Table 5-15 Dam F~lures Used in This Study 5-87 Table 5-16 Chronological Order of Dam Failures 5-88 Table 5-17 1993 Greenville / Spartanburg Air Traffic Summary 5-89 Table 5-18 1993 Asheville Air Traffic Summary 5-90 Table 5-19 Accident Rate For U.S. Air Carriers; 1980 - 1991 5-91 Table 5-20 Screening Justification for Other External Initiating Events 5-92

Table 6-1 Peer Review Team Members 6-3 Table 6-2 Peer Review Team Comments and Re solutions 6-4

V

1. EXECUTIVE

1.1 BACKGROUND

AND OBJECTIVES

In l ~ov, the Nuclear Safety Analysis Center (NSAC). uiges ted that ' a plant-specific.

probabilistic risk assessment (PRA) be undenaken by the nuclear industry. on its own initiative. The proposal for an industry PRA project, managed by NSAC and performed in cooperation with a utility, was reviewed with the NSAC utility advisors and. approved.

Duke Power Company and Oconee Nuclear Station were chosen. for the project The NSAC study was published in June 1984 as NSA~ -60 (Ref. 1.1).

• Soon after embarking on the NSAC-60 effort, Duke organized a Severe Accident Analysis Group to facilitate large scale PRA and reliability stu~ies. This group was charged with the responsibility to plan, conduct and coordinate. iill proposed *PAA studies, and to maintain and update the plant PRA models as appropriate.

In January 1987, Duke Power initiated a large-scale review and update of the original study. The major objectives of the review and update were to (1) incorporate plant changes made since the time ofthe original study, (:Z) improve on asswnptions made in the original study, (3) make use of plant experience/data from the 1980s, and ( 4) make use of improvements in PRA methodology and up-to-date techniques.

In December 1990, Duke submitted this updated PRA (Ref. 1.2) to meet the requirements of Generic Letter 88-20 {Ref. 1.3) concerning the Individual. Plant Examination (IPE) covering internal events. The IPE submittal {Ref. 1.4) explained that the Oconee PRA is a full-scope, level 3 PRA with complete analysis of external e_vents in addition to internal

• events. External events have been included in the Oconee PRA studies beginning with the original study.

Consistent with the IPEEE submittal plans outlined in the December 18, 1991.Duke letter (Ref. i.5), and approved by the NRC letter of June 16, 1992 (Ref. 1.6), Duke Power Company provides herein the response to GL 88-20, Supplement 4 {Ref. 1.7). Included in this report (designated as the IPEEE Submittal Report) is a revisi~n of certain sections of the Oconee PRA report. To facilitate the NRC staff review, the IPEEE information has been presented using the standard table of contents given in Table C. l of NUREG-1407 (Ref. 1.8)....

1.2 PLANT FAMILIARIZATION

Oconee Nuclear Station, located in Oconee County in northwestern South Carolina, is sited on the shore of Lake Keowee, a Duke impoµndment on the Keowee River, a tributary of the Savannah River. The station was buiit during the 1967 to 1974 period.

Unit 1 began commercial operation in 1973, and the last unit (Unit 3) began commercial operation in 197 4. The station con~ists of three Babcock & Wilcox pressurized water reactors, each designed to. generate 2568 MWt. The balance of plant station was designed

1-1 and constructed by Duke Power Company, with Bechtel Corporation designing the Reactor Building.

The station consists of three. reactor buildings, a comm on turbine building for all three units, and two auxiliary buildings; one servicing units I and 2, and the other servicing unit 3: The nuclear steam supply system has two loops with two cold legs each. Each unit has two "once-through" steam generators that produce superheated steam at constant pressure. The reactor and nuclear steam supply system are contained within the reactor building, a prestressed, post-tensioned reinforced concrete cylinder and dome with a ste~I liner.

Emerg~ncy power for the Oco*nee systems is provided by the tw o units of the Keowee hydroelectric station, which is located at the Keowee Darn, about a mile away from the plant. In addition to a large grid network, backup power is also available through a dedicated line from three. combustion turbine units at the _Lee Stearn Station, approximately 30 miles away.

The piant design incorporates the Standby Shutdown Facility (SSF), a totally independent means of achieving and maintaining safe shutdown conditions if the normal plant safety systems are unavailable.

1.3 OVERALL METHODOLOGY

1.3. 1 External Events Method<?logy

The evaluation of external events was performed in the original Oconee PRA repon and its subsequent update with four events identified for a detailed review:

• Seismic Activity

• Fires

• Floods

• Tornadoes

In addition, NUREG-1407 requires a review of transportation and nearby facility accidents. (It should be noted that thes_e events were also evaluated in the original PRA repon, but their probabilities of occurrence were determined to be very low -

<lE-08. Nevertheless, an evaluation using updated information is presented.)

A variety of methodologies were employed to derive the overall event frequencies for these events, as explained in detail in Sections 3'. 0, 4.0, a_nd 5.0 of this repon.

The findings from the original PRA studies have been updated as necessary to suppon this examination.

1-2

, 1.3.2 Plant Model

The Oconee PRA is a full-scope analysis comprised of three pan s and use*s methods consistent with the PRA Procedures Guide (NUREG-2300) (Ref. 1.9). The Level I or "front end" analysis determines core damage sequences as a result of various internal and external events and places ihese sequences into plant-damage state bins.

The Level II and III or "back end" analyses determine the effect of the acddent sequences on containment and the resulting radiological releases to the public.

The basic models used for accident. '. sequence de':'eloprrient are event trees and fault

trees. The event trees used in this analysis are functional e\\*ent trees, with the top

• events defining the functions needed to protect the.core. The end states of the functional event tree represent functional sequences. The event tree end states are also used to place accident sequences into plant-damage state bins. These bins are the transition from the front end analysis to the back end analys is.

The plant systems have been analyz.ed with detailed fa ult trees, generally to the component level. The level of detail in the model is defined by the level.at which data is available.

This IPEEE study is primarily a Level I analysis which determines the event frequencies of external events. As with internal ~vents, external events are input to the Levei I plant model and their contribution to core damage risk is detennined.

The Level II analysis involves the containment response to various accidents and core damage progression thereof and, _thus, is not expressly influenced by external events. Rather, the external event impacts on active systems that affect containment performance (e.g., containment ventilation, spray, isolation, etc.) arc addressed in this examination. * * *

~-4

SUMMARY

OF MAJOR FINDINGS.

The major findings from this examination are that there are no unduly significant sequences (v ulnerabilities) from external events. Seismic events are the most significant external event contributors to core damage risk. There were no pl~nt cha:1ges identified that would significantly reduce the risk from external events.

1.4. 1 Core Damage Frequency Re sults

The re sults of the Oconee PRA report provide an estimate of. plant severe accident risk and an understanding of the basis for this risk. The Core Damage Frequency (C DF) from external events as a result of the IPEEE evaluation is 6. 1 E-05 / yr.,

compared to 8.7E-05 / yr. estimated in the Oconee IPE report. These results are applicable to all three units of the plant

1-3 The contribution of the external events to the CDF and their comparison with the IPE values is shown in Table 1-1.

Seismic events comprise approximately 59% of the calculated external event CDF.

The primary accident sequences involve Joss of power events coupled with SSF failures. Flooding events (due to the seismically-induced failure of the focassee Dam) are also dominant contributors to the seismic CDF.

The mean seismic hazard curve, generated by EPRI specific~y for the Oconee site, is used as the basis for this analysis. A sensitivity study was perfQrmed using the January 1989 Lawrence Livermore National Lab (LLNL) hazard curves for Oconee.

The dominant accident sequences are ~omparable in their ranking with the EPRI curve results and do not add to or alter any of the insights of this analysis.

Tornado events make uo annroxirnatelv 21% of the calculated external event CDF.

(b)(7)(F), (bX3) 16 U.S.C. § 824 0-l(d)

Internal fire events account for approximately 8% of the calculated external events CDF. The dominant fire sequences occur in the Turbine Building; however, there were no unacceptable risks or outliers identified.*

• External flooding events (caused by a random failure of Jocassee com rise

&RVC£H l 12% f the total external event CDF (bX7)(F), (bX3) : 16 U.S.C. § 8240-l(d)

1.4.2

• Containment Performance Results

External event impact on containment performance has been examined from several perspectives, as follows:

• Containment Structure - The Reactor Building and containment internal structures were found to be seismically *rugged based upon an evaluation of their median seismic fragilites. These structures are also designed to withstand tornado and other high wind effects. The consequences of airplane crashes and turbine~generated missiles were determined to be insignificant. No other hazard was identified that could challenge the containment structure.

SENSITIVE SEGUIHTY R£UrTED INfOIH,f1rTf ON Cftl'flCAL ENERGYIELECTRf GAb INF RASTil:UCTUEUs 1Nr0~,4ATIO~J 1-4.

• Containment Isolation - A screening analysis of containment penetrations was performed in the PRA report to detennine which penetrations, if failed, could kad to significant release pathways. The sei~mic impact on containment isolation was evaluated by analyzing t:, : ;~ p.:netrations along with their associated piping and valves. They were found to

• be sufficiently rugged to withstand a seismic event. The probability of damage to penetrations and valves due to a tornado were judged to be low.

• The containment isolation signals are generated via the Emergency Safeguards Features Actuation System (ESFAS). The cabinets housing this equipment were evaluated for functional ruggedness. Likewise. the respective panelboards and motor control centers providing *power to actuate the valve solenoids and motors were analyzed and evaluated via plant wallcdowns. The motor control centers, load centers, and panelboards were modeled as a group due to their similarity of design. Thus, specific equipment of this nature used to actuate containment isolation was evaluated on this basis. Two failure modes were identified for this equipment. Structural failures are modeled by the Auxiliary Building surrogate. The other failure mode for these items is unrecovered ~lay chatter. Reviews are currently being conducted to detennine (and replace, as necessary) any 'bad actor' relays found within the systems identified under the IPEEE scope of review. The ES FAS is included in this scope.

External flooding events will result in a loss of all power to the containment*

isolation valves. The plant response at this point would. be the same as other station blackout events. Motor-operated valres are designed to fail in their "as

. is" position. Air-operated valves are designed to fail in the closed position upon a loss of instrument air.

(b)(7)(F), (b)(3):16 U S.C. § 824 0- l(d)

....._ ___ _____ ___,J,Each of these is designed to fail close upon e1 er a loss of power or air. Failures of the remaining penetrations were detennined to be probabilistically insignificant

• Containment Safe&uards - External events were *ud ed to have no Wli ue irn act on the containment safe uards.

(b)(7)(F), (b)(3):!6 U.S.C § 8240-l(d)

In general, the containment safeguards systems are well rotected from the effects of tornado wind and missile dama e (b)(7)(F), (b)(3):16 U.S.C. § 8240-l(d)

1-5 r X7XF), (b)(3) 16 U.S.C. § 8240-l(d)

The* containment safe uards com nents were evaluated for seismic ru edness:

(bX7)(F). (bX3) 16 U.S C. § 8240-l(d)

l(b)(7XF ), (bX3) 16 U.S.C. § 82-fo-l (d)

1.4.3 Vulnerability Findings

The basic finding of the evaluations summariz.ed in this report is that there are no fundamental weaknesses or vulnerabilities with regard to severe accident risk at Oconee Nuclear Station.

1-6 TABLE 1-1

External Initiating Events Core Damage Frequency

IPE Report (.12/90) IPEEE Report (12/95)

Core Damage Percent of Core Damage Percent of Frequency Total Frequency Total (per year) (per year)

Initiating Event

Seismic 5.0E-05 57.5% 3.6E-05 58.9%

Fires

• 2.2E-05 25.3% 5.0E-06 8.2%

Tornadoes 9.7E-06 11.1% l.3E-05 21.3%

Ext. Flooding 4.9E-06 5.6% 7.0E-06 ' 11.5%

Transportation -------- -------- ---*-- -- --------

& Nearby Facilities

• Tota) External 8.7E-05 6.lE-05

1-7

2. EXAMINATION DESCRIPTION

2. 1 INTRODUCTION

The Individual Plant Examination Of External Events (lPEEE) for Oconee Nuclear Station was performed on the basis of the original Oconee PRA and its subsequent update.

This report summarizes the examination process for external events performed from 1980

- 1984 for the original Oconee PRA (NSAC-60), the continuing process of updating the risk model which resulted in the updated PRA issued in 1990, and the results of the latest update to support the IPEEE.

The method of examination of external events used in the Oconee PRA and the subsequent updates is the standard PRA method, with the enhancements described in Section 4 of the Generic. Letter 88-20, Supplement 4.. State-of-the -art probabilistic risk assessment (PRA) methods and current plant information were used in the original Oconee PRA and in the subsequent updates. The specific external events identified in.GL 88-20, Supplement 4 have been addressed and arc disc~ssed in the, pertinent sections.

Comprehensive plant walkdowns have been performe~ !to investiga~ and tQ incorporate the actual plant conditions in the examination. The basic event valu~s involving random equipment failure, human error probabilities, and test and maintenance.. unavailabilities are compiled in the IPE analysis.

2.2 CONFORMANCE WITH GENERIC LETTER AND SUPPORTING. MATERIAL

Generic Letter 88-20, Supplement 4 identified four ge,ieral purposes for each utility in performing the IPEEE. Duke Power Company has satisned these as f o,Uows:

1, Develop.an Appreciation of Severe *Accident Behavior - Duke Power Company's initial staffing to enable large scale PRA and reliability studies in-house began in 1980. A severe accident analysis group was organized and charged with the responsibility to plan, conduct, and coordinate all proposed PRA studies and to maint:::1 and update the plant PRA models as appropri::1t*P.. In addition to PRA studies, this group is also utilized for engineering *support involving severe accident input in such areas as emergency planning, plant deiign changes. and plant operational problems. *

• In conducting,a full-scope.PRA, personnel from the Severe Acciqent Analysis Section perform a majority of the PRA-related tasks. This core group is augmented by specialized expertise in mechanical, electrical and civil disciplines from other areas of the Nuclear Generation Department. In addition, the expertise of an operations engineer, assigned to support the PRA

• effort, is :* utilized to factor in operational.. I insights on initiating events, accident sequence modeling, human reliability analysis and recovery actions. In the case of some specialized inputs, such as site seismology and equipment fragilities, outside expertise is utilized to complete the tasks.

2-1 The IPEEE effort was completed primarily in-house, with limited contract support for seismic studies.

2. Understand the Most Likely Severe Accident Sequences - lbe Oconee PRA report and. the IPEEE ~valuation have consistently ~ ~,1w~1 the same dominant accident sequences from external events. Seismic events, mternal fires, tornadoes and external flocxfing events are identified to be the most significant external event contributors t c e dama e risk. Seismic events com rise a ma *ori of the external event CDF

(bX7)(F), (b)(3):16 U.S C. § 8240- l (d)

SRVCEif

3. Gain a More Qualitative Understanding of the Probabilities of Core Damage and Releases - The plant systems have been analyzed with detailed fault trees, generally to the component level. The CAFT A computer code (Ref. 2: 1) was used to solve the plant models and generate accident sequences in response to various ~ternal and external events. Once the accident sequences have been determined, they are categorized, or 'binned', according to the severity of the systems failures, LOCAs, etc. A complete set of computer runs using the Modular Accident Analysis Program (MAAP) code (Ref. 2.2) *has been developed for each 'bin' and provides *an estimate of time to core damage. The resulting releases from external-event core damage accidents are discussed fully in the Oconee PRA report (Ref. 1.2).

4. Reduce, if Necessary, the Overall Probabilities of Core Damage and Releases -

Whereas mis examination of external events* did not result in any major actions or modifications which could potentially reduce the overall core damage probability, several plant enhancements were identified during the development of the internal events portion of the IPE. These may be found in Section 6.0 of the Oconee IPE submittal report. The detailed IPEEE walkdown effort identified a few repairs and modifications that are minor in scope to enhance the seismic adequacy of several components. These are listed in Table 3-3 and Section 4.9.

6J;;N6ITIVJ;; 6J;;GUR,1TY ~bATJ;;D nJPORUATION Rff1AL EHEROYfELECTRiCAL HffRAS1 ' RUCTURE HffOf~MAHOH 2-2 The Generic Letter Supplement also identified the issu~ of ensuring tl,te _technical adequacy of the IPEEE and validating its results. These are addressed as follows:.

• . The pre-IPEEE analyses, original PRA study and subsequent update, have received several stages of 1.11ternal review. First, each of the major analytical tasks went through a peer review within the project team. Subsequently. it was reviewed by the project.manager/ engineering supervisor to ensW"F that the analyst had perfonned an adequate analysis and that it had gone through an.appropriate peer review. Following

• the two levels of review performed within' the. project team, engineering personnel outside the PRA project team familiar with plant systems and accident sequences conducted a review of system models, underlying assumptions, system level results, and overall results. In parallel with the engineering review, the PRA draft repon was reviewed by selected station personnel. The _ focus of this review was the reasonableness of the underlying assumptions for system operation and operator actions. Besides the technical review of the PRA, management briefings were given to apprise key management personnel of the results and conclusions. 1

• The results of the IPEEE effon were given approximateiy the same level of review as the previous studies.

• Independent Review Teams (seismic and fi~e) were formed to perform a review of the IPEEE process and results. These teams consisted of senior level employees with experience in PRA methodology, seismic equipment qualification, fire_ protection, and systems engineering. The seismic team included experts from outside the company.

Thus, Duke Power has satisfied the objectives of the generic letter by its original PRA, subsequent updates, and the latest IPEEE effort. The )Duke Power_ staff_ has realized the maximum benefits from the program by their involvement in all aspects of the examination.

2.3 GENERAL MEIBODOLOOY

The general methodology for examining external events is consistent with the methods

. presented in _NUREG/CR-2300. The general approach used to develop the external event PRA *is as *follows:

• Natural and man-made external events of interest were identified using other PRAs, NSAC/60, ANSI/ANS-2.12 (Ref. 2.3), and the aforementioned NUREG/CR-2300.

• The resulting events were screened in order to sel~ct significant events requiring funher review. Twenty events were identified.

• A scoping analysis was perfonned on the remaining events. Four were identified that warranted a detailed quantification: earthquakes, floods, tornadoes, and fires.

2-3 This approach is presented in greater detail in the Oconee PRA report. (Note that this revised external events analysis also includes an updated review of transportation and nearby facilities accidents per NUREG-1407.)

The specific methodology for each hazard is di sc ussed ir, Sections 3.0, 4.0, and 5.0.

2.4 INFORMATION ASSEMBLY

Many sources of information were used during the IPEEE process. These include the Oconee FSAR (Ref. 2.4), Oconee SER (Ref. 2.5), vendor seismic qualification design reports, vendor seismic qualification test reports, equipment spedfications, plant drawings, vendor drawings, dynamic analyses of structures, in-structure response spectra, Oconee Probabilistic Seismic Hazard Evaluation (Ref. 2.6), structural design calculations, equipment anchorage design calculations, flow diagrams, computer codes, air traffic infonnation, evacuation plans, operating procedures; National Weather Service data, and various other NRC and EPRI technical reports. Additional sources of information related to the fire review are listed in Section 4.12.

The original PRA report included the then-c urrent plant de sign documents, operating procedures, Tech. Specs., and plant configuration. The subsequent revision to the PRA used updated information as appropriate.

Coordination activities of the IPEEE teams among the external events are handled by Duke Power's Severe Accident Analysis Section which is responsible for the Oconee PRA.

Individuals from this group were on all the teams and were responsible for coordination and the final results.. As an example, any potential for seismically-induced fires was communicated between the fire and seismic teams.

• 2-4 S. HIGH WINDS, FLOODS, AND OTHERS

A detailed *list of natural and man-made external events was reviewed and screened for applicability to Oconee. A listing of these events is given in Table 5-1 and may also be found in Section 3. I of the Oconee PRA report. Of these, four were identified that warranted a detailed quantification: earthquakes, fires, tornadoes, and floods.

Transportation and nearby facility accidents were also evaluated in the original PRA report and its revision, but their probabilities of occurrence were found to be very low.

Nevertheless, tQ meet the specifications of NUREG-1407, an evaluation using updated information is also presented for these events.

5. l HIGH WINDS

5.1. I ' Overview

This section describes the process of assessing potential plant vulnerabilities induced by high winds and tornadoes. Initially, three* types of winds were initially considered for this study: Hurricanes, Tornadoes, and Non-torriadic (Straight) Windstorms. However, Oconee' s inland location makes the probability of severe wind damage due to hurricanes very unlikely and the probability of damage to importarit components or structures from non-tornadic (straight) winds.is low compared to that of tornadoes. The Oconee *FSAR

. reports the maximum 100 year wind velocity at the site to be 95 mph. All class 1 structures at Oconee are designed for at least 95 mph wind or to a higher standard. For these reasons, hurricanes and "straight windstonns" arc not considered any further. The primary purpose of this.assessment is focused only on tornado damage _events and the resulting core damage frequency.

• Only tornado events which cause damage to plant structures or equipment in conjunction with a loss.of off-site power are*considered in this assessment. The switchyard and Kcowee overhead path are assumed unavailable following a tornado strike. The risk associated with tornadoes that re sult in only a loss of off-site power but no damage to plarit structures or equipment is implicitly covered by the T5W (LOOP due to weather) initiating event in the IPE Study.

This assessment is an update to an earlier tornado study.for the Oconee PRA (Ref. 1.2).

. This previous study also relied heavily on a tornado assess)nent perfonried for NSAC/60.

Consistent with the Oconee PRA, Unit 3 is used as the reference unit for this study; An.

event tree is conscructed to delineate core damage sequences caused by probable missile damage and tornado-wind effects on vulnerable structures. The analysis considers two categories of tornado events:

5-1 ath of the most robable tornado direction and thus is more su sce tible to dama e.

(bX7)(F), (bX3):16 U.S.C. § 8240-l(d)

5.1.8 Insights

nee Tornado Core-Melt Fre

(bX7XF), (bX3):16 u.s.c. § 8240-l(d)

. Damage caused by. tornado-generated missiles are an insignific~t contributor to the probability of core damage.

-5.1.9 Conclusions

The Oconee tornado core damage frequency of 1.29E-05 is of the same magnitude as other potential severe accidents such as seismic. events, fires, floods, and other events. Thus,

Oconee plant risk due to tornado does not _pose a severe accident vulqerability.

5.1.10 Recommendations *

~~ ~.._,which has the highest impact on tornado ris~(bX7XF). (bX3)16 u.s.c. § 8240 -1<d)

It is recommended that station rsonnel stud enhancements to the natural

~......... __......

rocedure (bX7)(F), (bX3):16 U.S.C. § 8240- l (d)

5.2 'EXTERNAL FLOODS

_The details of the Oconee flooding analysis are presen~d in Section 3.3 of the PRA repon.

Flooding from both internal and external sources was reviewed. External flooding occurs

• from heavy rains or breaches of dams.

• Two potential events were found that ~ould lead to external flooding of the Oconee site.

The first is a general ~ooding of the rive:s and reservoirs in the area due to a rainfall in excess of the probable 'maximum precipitation (PMP). Since the Oco,nee site is well inland,

1 reservoirs the effects... ' ' of hurricanes were not considered. The relative size of thearound the plant, and the distance of the site from the coast, are considered ~jor *impediments to

5-17 hurricane-induced surge flooding of a *severity approaching that which is caused by runoff type flooding. During review of simil_arly _located sites, the NRC staff found that surge

. producing winds would be significantly reduced when land mass frictional effects are encountered; therefore, surge flooding is negligible at Oconee Nuclear Station.

The second source of external flooding is a possible random failure of the Jocassee Dam.

Random dam failures include all causes other than a ra in-induced failure (which will be discussed below) or an earthquake-induced failure (see Section 3.0 of this report).

5.2.1 Methodology

5.2.1.1 External Floodinc from Precipitation

The PMP postulated for the Oconee site would be 26.6 inches within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. The effects of this PMP on reservoirs and spillways were evaluated in a study performed by Duke Power Company in 1966 (Ref. 5.22). The results of this study demonstrated that the Keowee and Jocassee reservoirs are designed to contain and control* the floods that could result from a PMP. Thus, in order to flood the plant site, rainfall exceeding the PMP must occur. The frequency of exceeding the PMP was obtained from the analysis presented in Ref. 5. 23 for the Oconee site and was used as a bounding estimate of the frequency of core damage due to rain-induced external flooding.

The analysis yields the following frequencies of a PMP ass~iated with the lower, median, and upper bounds of the probability distribution:

Cumulative PMP frequency probability (J)er yr)

0.05 4.9E-8 0.50 2.9E-7 0.95 8.9E-7

The cumulative probability for a particular frequency interval is to be interpreted as the degree of cenainty that the PMP frequency observed over a long period of time will be less than or equal to _the upper value of that frequency interval.

0,Xl)()'), 0,)()) 16 U s C, § 82'0. J(a)

SRVC£H.

1

Applying the SSF as a response to exceeding the PMP results in a calculated core damage frequency appro~imately an order of magnitude lower than the mean PMP frequency. In addition, the calculated mean. frequency of the PMP is more than an order of magnitude less than that due to a random failure of Jocassee Dam, which would also flood the site.

For both these reasons, it was concluded that precipitation-induced external flooding is a S£HSITIY£ SECURITY RELATED Ht POP"1 t AT IO~ +

GIUTIGAL E~HiRGY}ELEGTRJGAL nrPRA~TRUGTURE l~+fQR;p4ATIO~t 5-18 negligible con.tributor to core damage frequency and p~blic risk.

5.2.1.2 External Flooding From Dam Failure

7-: : Oconee site _ has a yard grade elevation a few ~r t r t c: J W the full-pond level of Lake Keowee, which serves as the source of its condenser circulating water. Lake Jocassee has a full-pond.elevation about 300 feet above Lake Keowee. If a sudden failure of the Jocassee Dam were to occur, and a rapid enough release of the impounded water from Lake Jocassee into Lake Keowee resulted, the flood wave generated in Lake Keowee would overtop the Keowee Dam and the Oconee intake dike, flooding the plant This section presents the analysis performed to estimate the frequency of such a flood.

Frequency of Dam Failure

. The Jocassee Dam is an earth-rockfill structure approximately 400 feet high. The dam was completed in 1972, and the reservoir was filled by April 1974. The spillway lies-along one of the abutments, about one-quarter of a mile from the dam, and is a concrete structure founded on granite.

An analysis was performed to determine an annual frequency of failure-for earth, earth

.rockfill, and rockfill dams due to events other than ovenopping and earthquake ground shaking, which were considered in separate analyses. Also, based on dam design

• information, structural failure of the spillway-during discharge and failure associated with seepage along an outlet works have been eliminated as a possible failure mechanism. The following principal modes of failure were considered:

• I. Piping.

2. Seepage.

3. Embankment slides.

4. Structural failure of the foundation or abutments.

These failure mechanisms are referred to collectively as random failures. Only" failures resulting in the complete collapse of the structure.and the uncontrolled release of the re servoir's contents were considered to have the potential for flooding the Oconee plant

Previous investigations into the frequency of dam failure indicate that it decreases with later years of construction (Ref 5.24). This is generally attributed to improvements in the methods of design and construction. Therefore, another criterion considered in developing a data base and *failure-frequency estimate was the period of construcµon.

The age of a darn is another factor that has been identified as having an effect on the rate of dam failure. Approximately half the darn failures occur during the first 5 years of operation (Ref. 5.31). Therefore, age was also considered in developing a data base.

Size, type of construction, realistic failure modes,.Pcrio.d of construction, and age were the

5-19 major considerations used to define a data base for use in estimating the failure frequency of the Jocassee Dam.

The data base characteristics that were attributed to the Jocassee Dam are:

Characteristic Jocassee Dam

Location (country) United States Year completed 1972 Age (years in operation) 21 Height (feet) 400 Type Earth-rockfill

Various catalogs were used to develop the data groups that were studied (Ref. 5.25). Each group consisted of large earth, earth-rockfill, or rockfill dams (more than 45 feet high -

Ref. 5.26) in the United States that were in operation 6 or more years when they failed. Of the references used in this *study, none were a complete catalog, and therefore they were used collectively. At present, these references represent the best. readily available information. From the various listings off ailures, cross-checks were made when possible.

A data base uniquely suited in every major respect to the Jocassee Dam was unattainable because of a scarcity of the number of the earth-rockfill type.

The data base ultimately developed reflects discussions with Duke Power engineers familiar with the characteristics of the Jocassee Dam. It was decided that the data biise should include only the failure modes that could occur at Jocassee. The two major failure types excluded from the data set w~re failures resulting from piping at a conduit passing through the dam and structural failures of the spillway during the flood discharge. Neither of these failures can* occur because the necessary physical conditions do not exist at _ 'Jocassee.

(Note, however, that dams in the data base do include those that can fail in either or both of these modes, This is proper because the experience from these dams represents realizations of non-failure for other failure modes, such as embankment piping, foundation failure, and slope failure.)

Because of limitations in the historical record, it is possibly only* to develop a data set that takes into account a limited number of the specific.. propenies of the Jocassee Dam. Since Jocassee is a structure designed and constructed in recent times, it,can be assumed that state-of-the-art technology was used in its design. In addition, because of its role as a critical facility of large size and importance, other aspects of,the dam, such as seepage monitoring and inspection programs, are important factors that decrease the likelihood that the dam will fail. The following specific characteristics o( Jocassee are identified as relevant factors that will affect the frequency of failure:

5-20

1. Quality maintenance and inspection programs.

2. Monitoring of the dam (i.e., seepage, *settlement, etc.).

3. Presence of personnel at the site.

4. Responsiveness of the owner to potential problems (i.e., implementation of emergency plans).. *

5. Detailed geologic investigations conducted before site selection..

6. Experience of ~arth-rockfill dams in Jocassee's class (with respect to random failures).

7. Design techniques.

. These factors notwithstanding, the data were examined, and the best availab~e data base for application to Jocassee Dam was extracted and used.

The data base covered the period of dam construction from 1940 to 1987. During this period, U.S. dams in operation 6 or more years at the time of failure and 45 feet or more in

. height were considered. The dams were of three types--earth, earth-wckfi.11, or rockfiU--and only catastrophic failures were included. Table 5-15 lists the failures considered in the analysis.

The number of *dam-years of operation was.determined fro*m d1ata on the rate of construction provided in Refs. 5.26 and 5.27. Table 5-16 lists chronologically, I for the period of construction the year a failure occurred, the interval between'. each _failure in years, the cumulative number of dam-years to the year of failure, and

• the number of dam-years between failures.

Ref. 5.28 updated this information by taking into account the additional amount of dam-years from 1988 through 1993. As shown therein, ther~ were no additional dam failures meeting the above criteria during this period. The re~ised analysis indibates that the revised random failure frequency for the class of large U.S. built earthen dams meeting the above criteria.is l.3E-05. This number is a point estimate using the 2 failures'shown in Table 5-15 and the estimated 154,380 dam-years of operation from Ref. 5.28 and Table 5-16 (i.e., 2 /

154,380 = 1.3E-05). To the extent that this class is representative* of the Jocassee Dam, these results can be interpreted as the predicted annual random failure frequency of the Jocassee Dam from causes other than earthquakes or ovenopping.

• In order to evaluate the contribution of randon:i failure o( Jocassee D~ to the frequency of core damage at Oconee Unit 3, three factors must be quantified: The first factor was the frequency of random dam failures calculated above. The remaining two factors arc:

1. The conditional probability of flooding of the Oconee site given a failure of the. (.

Jocassee Dam. *.

2. The conditional probability of core damage given flooding at the Oconee site.

The conditional probability of flooding at the Oconee si te given a f~ure of the Jocassee Dam is a complex function of several variables. The level of the Joca~s ee Lake at the time

5-21 of failure determines the amount of impounded water that.will be released into Lake Keowee; the level (?f Lake Keowee determines how much flow can be received from Lake Jocassee before Keowee Dam and

• the Oconee intake dike are ovenopped. The time

• available for warning of an impending dam failure will determine the likelihood that

. =ffective action can be taken to lower the levels of the Jo cas~ee and Keowee Lakes. The conditional probability of flooding given a dam failure also depends on the mode of failure, the rate of erosion (time to failure), the vertical depth to which the failure penetrates (fraction of the impounded water released), and whether either. Keowee Dam or the east intake dike fails rapidly when ovenopped.

Previous memos have been written (Ref 5.29) to address this phenomenon. There is evidence, based upon rock-filled dams that have either failed or have been saved from failure, that pre-failure damage in the form of seepage would be observable for some time before significant failure occurs. Even though significant warning times would be needed to prevent Keowee ovenopping, the overall resulting flood levels could be reduced by lowering lake levels as quickly as possible via the spillway and the generators.

The data base includes only catastrophic failures by modes believed applicable to Jocassee.

Most of the catastrophic failures reported in the literature for earth or earth-rockfill dams were total (i.e., the entire.reservoir emptied), and most times to failure were in the range of 1 to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. However, the failures in the data base (Table 5-15) occurred only in earthen dams ; thus, there is some question as to how applicable their rates of erosion and depths of failure are to the Jocassee Dam, an earth-rockfill structure.

• The Hell Hole Dam, an earth-rockfill' structure, failed during construction in 1964 when extreme precipitation caused ovenopping. Since construction had not been completed and since the dam was ovenopped, it did not satisfy the data-base characteristics and was not included in the failure set. However, its material of construction and size were very similar to those of Jocassee, and its failure behavior can therefore be used as one point of reference in judgments about the possible failure behavior of Jocassee. The ovenopping of this partly constructed dam lasted for more than 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> before a catastrophic failure occurred. This suggests that a long warning time may be ayailable, at least in some cases, before the failure of an earth-rockfill dam. Once the dam was breached, however, the breach propagated the.

full depth of the dam, down to the foundation,.in about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Thus, though more warning time may have been available, once failure began, the time and depth to complete breach.were quite similar to those observed for earthen dams.

On the basis of the information to date, it is obvious that the potential exists for a complete.

spectrum of flood levels. More exhaustive studies could be undenaken to address this problem, but were deemed inappropriate from a cost / benefit perspective. Given this lack of information, a bounding value of 1 was used for the conditional probability of flooding of the Oconee site given a catastrophic failure of the Jocassee Dam.

The probability of core damage given flooding at the Oconee ~ite depends on.the warning time, actions taken by operators, the depth of the flooding and other factors. The

5-22 discussion of the possible role of the SSF in Section 5.2.1.1 above would also apply to this set of seque~ces, given the discussion of the time to complete failure of the Hell Hole Dam.

. 5.2.2 Event Tree

• 5.2.2. 1 Event Tree Structure

The external flooding event tree is shown* in Figure 5-6. It is based upon the internal initiator tree and contains many of the same functional top events. The applicable portions of the SSF fault tree, as mentioned above, arc brought in at the appropriate places.

Event H: Flood Height is Less Thanlib~~~~ ul.

(b)(7)(F), (bX3)16 U.S.C § 8240-l(d)

SfH/CEII

Event K: RPS Trips the Reactor

This event is used to represent an A 1WS event. In the event of an *external flood, it is assumed that off-site and station power will be lost due to flooding of the switchyard.

Thus, the nonnal Reactor Protection System is assumed inoperable, and alternative reactor scram methods must be employed.

Event B: Secondazy Side Heat Removal Maintaine~

In the event of an external flood, it is assumed that off-site and station ower will be lost floodin of the switch ar

CbX7)(F), (bX3)-!6 U s.c. § 8240- l(d )

Event Qr: Pressurizer Relief Valves Close After Opening

l(b)(7XF), (b)(3):16 u.s.c § 8240- l(d)

. Event Os: RCP Seat'lntesrity Maintained r l)(F), OXJ),16 u.s.c. § m~l(d)

~E~+~ITP'la )laCIIJUTY REX 4TFD 1NFQRM4I I ON CPITIC A I. li)HH2,G¥/J;;IsEGTI.UG A,I,, l~U*RA~TRUGifUR~ I HrOR~4ATJON 5-23 r X3) 16 U.S C. § 8240- l(d). (bX7XF) I The SSF RCM System is designed to provide RCP seal cooling flow to all three Oconee units in the event of a total Joss of HPI and a loss of thermal barrier coolin from CC.

(bX7)(F), (b)(3):16 U.S.C § 82-lo-l(d)

Event U: High Pressure Irijection Established

(b)(7XF), (bX3).16 U.S.C § 8240-l(d)

s.2.2.2 Event Tree Sequences Sequence XQsU l(bX')(J), ~ )())16 U.s C. § 82'0, I( d)

Sequence XBU

Sequence XBOsU

(b)(7)(F), (bX3)!6 U.S C. § 824 0- l (d)

8Itl/C£H Sequence XBQrU

(bX7XF), (b)(3) 16 U S.C. § 8240-l(d)

8t:HSf'FfYE ~ECURITY Rfil::~.Tim 1Nr0R~4ATIO~l CBJTJCAJ ENE RGY/fl ECIBICA J INER ASI BJTCIIJBE INFORM 4TION 5-24 5.2.3 Fault Tree Analysis

(bX7)(F). (bX3)1 6 U.S C. § 8240-l(d)

• I [ )()XF), 0)(7)'6 U. S C § 82'0->(d)

-=- St<I/GEII-lt l

.el

(bX7)(F). (b)(3):16 U.S.C. § 8240-l(d)

.. (b)(7)(F), (bX3):16 U.S C § 8240-l(d)

r )(7)(F), (bX3)16 U.S C. § 8240-l(d)

(bX7)(F), (bXJ):16 U.S.C. § 8240-l(d)

SeveraJ maintenance events for sys tem components are included.in the fault tree.

SpecificaJly, these include:

SEHSrFI YE SECURl'fY - RfLA'.'fff) f W?O RMA'.'f f OH CR,ITICAL EHERGY/ELEC'f'RtCA ~ l ~ RA'.S'FRUC'fUR£ fN't<OlH\\11A'.'f t 01q

• SSF Unit 3 RCM Pump Train

• SSF ASW Pump Train

• 4160 V ac SSF Switchgear OTSI

• 600 V ac SSF MCC XSF Bus

• 600 V ac SSF MCC 3XSF Bus

• 125 V de SSF Distribution Center DCSF

• SSF Diesel Generator

A complete tis.ting of the basic events used in this analysis may be found in Table 5-12.

5.2.4 Containment Performance

The external flooding analysis assumes that a failure of the Jocassee Dam floods the site to the extent that tile switc *

• c rendered ino rable. CbX7)(F), (b)(3)'. !6 USC. § 8240-l(d)

External flooding events were judged to have no unique impact on the containment performance model. That is to say, the containment response does not reflect any ne uncommon cut sets that e not realize (bX7XF), (bX3)16 USC. § 8240- l(d)

(bX7)(F), CbX3)16 U.S C. § 8240- l(d)

5.2.5 Limitations of the Analysis 1* X7)(FJ, (>JO) 16 U S C. § 82'* < ( aJ 8R:ffC£H

As also discussed previously, the random failure frequency of the Jocassee Dam is based upon known failures of similarly constructed dams. To the extent that the set of criteria specified is representative of the Jocassee Dam, this value can be interpreted as the predicted annual random failure frequency of the Jocassee Dam from causes other than earthquakes or overtopping..

SEHSFfiYE S£ CU:EHTY RELATED INFORMATIO~J CRITICAL ENERGY /ELEGTJUGt'rb HffRASTRUGTURE HffOHMAT lOl>l 5-26

TABLE 5-14

External Flood Results By S.rn.~

Sequence Name Sequence Probability

~1U/C EH FLOOD >t(b)\\lj(XBQsU)

Q2:_ (b 2.60E-06

.bXt)(F). (b) 2.49E-06 (3):16 U.S.C.

§ 8240-l( d) l.04E -06

8.21E- 07 5.54E - 08 Total Ext. Flood CMF = 7.0lE-06

3EH'3f'flVE 3ECUftf'fY-ftEtA:'fEt) IH'l" O'.K':fvf A:'ftrnq:

CR:f'ffC,'tL ENER'GY/ELECfRiCiltL l NrRA:S'f RUC'fU'R::E rNrOftMJl!:'ffOH'

5-86 Table S-15

Dam Failures Used in This Study

Year Year Dam

• completed failed

Baldwin Hills a 1951 1963 Walter Boudin b 1967 1975

a Data from Babb and Mennel (1968) and USCOLD (1975).

b Data from Jansen ( I 980).

• 5-87 Table 5-16.

Chronological Order of Dam Failures

Year of Years Cum ulative Dam-years*

failure between failures dam-years between failures

Period of Construction* 1940-1993

1963 23 32,207 32,207 1975 12 74,782 42,575 1987 No failure 126,435 No failure 1993 No failure 154,380 No failure

5-88

8.

SUMMARY

This report details the methodology, implementation; and results *of the supplemental

• examination of external events for severe accident v\\tlnerabilities at Oconee Nuclear Station. This work ha:, been completed by using the exis~g Oconee PRA, which already included external events, updating it as appropriate and performing. the additional enhancements recommended in NUREG-1407.

The Oconee PRA model

• is based on Unit 3. However, walkdo.wns and supponing _:

evaluations were conducted on all three units. For the IPE submittal report (Ref. 1;4),

• which included external events, an analysis was performed to determine the applicability of the PRA results to Units 1 and 2. Any differences were analyzed to determine their effect on risk. The conclusion was that unit differences do not measurably change the calculated annual core damage frequency or risk ~tween units at Ocoriee.

The major finding from this examination is that* there are no yulnerabilities to severe accident risk from external events. Seismic events, internal fires, tornadoes and external flooding events are identified to be the most significant external event contributors to core damage risk.

..__ ____ __. Hooding events (due to the seismically-induced failure. of the Jocassce Dam) are also dominant contributors to the seismic CDF.

(b)(7)(F), (bX3):16 U S.C. § 8240-l(d)

CbX )(F).

SRI/CEH Finall for external floodin events the dominant cut set involves floods that exceed the CbX3) 16 (bX7)(F), (b)(3):16 U.S.C. § 8240-l( d)

There were no plant changes identified that would significantly reduce the risk from external events. Some enhancements to the plant were identified during the review. They are currently being reviewed and some have been implemented.

The IPEEE effort was completed using in-house expertise with limited outside consultant support, re sulting in maximum benefit to the company staff iri (1 ) developing an appreciation of severe accident behavior, (2) understanding ' ' the most likely severe accident

SEHSl'f lVE SECURf'f7t' *REUc'fED IHflORMA'flOH

'-- CR:t'ffCAL EHERO'i/ELECTRlCAL IHFlbr\\STRUCTURE HffORMATTOn 8-1 sequences, and (3) gaining a qualitative understanding of the overall likelihood of core damage and radioactive material release.

Several generic iss ue s and unresolved safety iss ues were addressed and considered closed out as a re s ult of the pre vi ous PRA work and the IPEEE effort, including:

• USI A-45, "Shutdown Decay Heat Removal Requirements"

• Eastern U.S. Seismicity Issue

• USI A-17, "Sy~tem Interactions in Nuclear Power Plar.ts"

• NUREG/CR-5088, "Fire Risk Scoping Study"

• GI 57, "Effects of Fire Protection Sy stem Actuati_on on Safety-Related Equipmc;nt" *

• GI 103, "Design for Probable Maximum Precipitation (PMP)"

Thus, the examination for external event severe accident vulnerabilities, as requested by

• the NRC via supplement 4 of G.L. 88-20, has been completed for Oconee Nuclear Station, Units. 1, 2 & 3. The objectives of this program have also been satisfied for Oconee.

8-2

9. REFERENCES

Section 1.0

l.1 EPRI, "NSAC-6U, Oconee PRA, A Probabilistk r.isk -'\\ssessment of Oconee Unit 3, " Palo Alto, CA, June 1984.

1.2 Duke Power Company, "Oconee Nuclear Station Unit 3 Probabilistic Risk Assessment." December 1990.

1.3 USNRC, Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50-54(f)," November 23, 1988.

1.4 Duke Power.Company, "Oconee Nuclear Station IPE'* Submittal Report,"

December 1990.

1.5 H. B. Tucker, Letter to USNRC, "Response to Generic Letter 88-20, Supplement 4," Duke Power Company, December 18, 1991.

• 1.6 R. E. Martin, Letter to M. S. Tuckman, "Review of Response to Generic Letter 88-20, Supplement4," USNRC, June 16, 1992.

1.7 USNRC, Generic Letter 88-20, Supplement 4, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50-54(t),"

June 28, 1991.

1.8 USNRC, NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," June 1991.

1.9 USNRC, NUREG/CR~2300, "PRA Procedures Guide," January 1983.

Section 2.0

2.1 Science Applications International Corporation, "CAFTA_: Manual," Palo Alto, California, September 1987.

2.2 MAAP Modular Accident Analysis Program User's Manual, "IDCOR Technical Report 16. 2-3," Fauske and Associates, Inc., Burr Ridge, IL; Februany 1987.

2. 3 ANS, "Guidelines for Combining Natural and External Man-Made Hazards at Power Plant Sites," an American National Standard, ANSI/ANS-2. 12, La Grange Park, Illinois, 1978.

9-1

2.4 Duke Power Company, "Oconee Nt1clear Station Final Safety Analysis Report,"

1994 Revision.

• 2.5 USNRC, "Safety Evaluation Report, Oconee Nucle~r Statiqn, Units I 2, & 3,"

Original and Supplements 1 - 3.

2.6 EPRI, "RPI0l-53, Probabilistic Seismic Hazard Assessment for Oconee Nuclear Station," Palo Alto, California, April 1989.

Section 3.0

3.1 EPRI, NP-6041, Rev. 0 and Rev. 1, "A Methodology of Assessment of Nuclear Power Plant Seismic Margin," October 1988 and August 1991.

3.2 EPRI, NP-4726-A, '.'Seismic Hazard Methodology for the Central and Eastern United States," July 1986.

3.3 SQUQ, "Generic Implementation Procedure (GIP) For Seismic Verification Of Nuclear Plant Equipment," Revision 2, Corrected 2/14/92.

3.4 OSC-6040, " Seismic Qualification of Equipment for A46/IPEEE for Oconee."

3.5 KC-2026, Seismic Qualification of Equipment for A46/IPEEE for Keowee and Switchyard."

3.6 USNRC, NUREG/CR-0098, "Development of Criteria for Seismic Review of Selected Nuclear Power Plants," 1978.

3.7 OSC-572 4, "Dynamic Reanalysis of the Auxiliary Buildings for IPEEE, Units 1, 2, and 3."

3.8 OSC-5789, "Scaling of Existing Spectra For The IPEEE."

3.9 Structural Mechanics Associates, SMA 12904.01, "Conditional Probabilities Of Seismic Induced Failures For Structures And Components For Oconee Generating Station Unit 3," September 1981.

3.10 Veneziano, "Seismic Fragility Curves For Jocassee Dam and Oconee Dikes, " June 1981.

3.11 Letter from R. V. Hester, Oconee Engineering Division, to T. F. Wyke, Engineering Support Division, Attention: K.. S. Canady, July 16, 1990, File No.

OS -203.

9-2 3.12 Letter from NTS Engineering, Long Beach, CA, to T.F. Wyke, Duke Power Compa~y. August 27, 1986.

3.13 Documentation of the Seismic Event Impact Sequence \\.1odel' (SEISM) Computer

• Code, PSA 17, Duke Power Company, September 1984.

3.14 Commonwealth Edison, "Zion Probabilistic Safety Study," 198l. -. ' '

• 3.15 USNRC, NUREG/CR-3263, '.'A Comparison of Methods for Uncertainty Analysis of Nuclear Power Plant Safety System Fault Tree Models," April 1983.

3.16 OSC-6219, "LLNL Seismic Hazard Curve :Sensitivity Study For The Oconee IPEEE."

3.17 OSC-6048, "Miscellaneous IPEEE Seismic and Fire/Seismic Issues."

Section 4.0

4.1 USNRC, NUREG/CR-5088, "Sandia Fire Risk Scoping Study, " January 1989.

4.2 ' OSC-5995, "Fire Protection For The IPEEE"

• 4.3 Berry, D. L. and Minor, E. E., NUREG/CR-0654, "Nuclear Power Plant Fire Protection - Fire-Hazard Analysis" (Subsystems Study Task 4), Sandia National Laboratory, September 1979.

4.4 Correspondence To Conrad. E. McCraken, USNRC, from Raymond N. Ng, NUMARC, dated August 4,_ 1989.

Section 5.0

5.1 "Tornado Occurrences Within 125 NM Radius Of Oconee Nuclear Station,"

National Severe Storms Forecast Center, Kansas City, MO, August, 1994.

5.2 Minor, J. E., "Applications Of Tornado Technology In '.Professional Practice,"

Proceedini:s of the Symposium on Tornadoes; Assessment of Knowledi:e and lmpljcatiops for Map. June 22-24, 1976, Texas Tech Universi'ty, Lubbock, Texas, pp 375-392.

5.3 McDonald, J. R., "Tornado -Generated Missiles and The~ E(fects, " £rQceedipi:s of the Symp*osjum on Tornadoes: Assessment of Knowledi:e a,nd Implications for Man, June 22-24, 1976, Texas Tech University, Lubbock,'Texas, pp 331-348.

9-3 5.4 Golden, J. H., "Comments in Session l," ProceedinKs of the Symposium on Tornadoes: Assessment of KnowledKe and Implications 1976, Texas Tech University, Lubbock, Texas, pp 483. for Man, June 22-24,

5.5 Fujita, T. T., *"Comments in Session 7," ProceedinKs of the Symposium on Tornadoes; Assessment of KnowledKe and Implications for Man, June 22-24, 1976, Texas Tech University, Lubbock, Texas, p. 673.

5.6 Oconee Nuclear Station Procedure AP/3/Nl700/l 1, Change 11, "Loss of Power."

5.7 Oconee Nuclear Station Procedure AP/3/Nl700/19, Change 4, "Loss of Main Feedwater."

5.8 Oconee Nuclear Station Procedure AP/3/N1700/06, Change 0, "Natural Disaster."

5.9 Ramsdell, J.V. and Andrews, G. L., "_Tornado Climatology of the Contiguous United States," NUREG/CR-4461, U. S. Nuclear Regulat9ry Commission, Washington, DC, May, 1986.

5.10 Ram sdell, J. V., et al., "Methodology for Estimating Extreme Winds for Probabilistic Risk Assessments," NUREG/CR-4492, U.S. Nuclear Regulatory Commission, Washington, DC, October 1986.

5.11 McDonald, J.R., "A Methodology for Tornado Hazard Probability Assessment,"

NUREG/CR-3058, U. S. Nuclear Regulatory Commission, Washington, DC, October 1983.

5.12 OSS-0254.00-00-1000, "Design Basis Specification for the Emergency Feedwater and Auxiliary Service Water Systems," Rev. 12, May 1. 1995.

5.13 Berket,::e, B. H., Memo To File, " Wind Load Capacity }f West Penetration Room Exterior Walls," May 31, 1990, Duke File No: 0S-203.

• 5.14 Kanipe, L. M.,,;Calculation Of Tornado Strike Probabilities For Oconee Nuclear Station," SAAG File# 175, Dl;lke Power Company, Charlotte, N.C., March 1995.

5.15 *McCann, M. W. Jr., Jack Benjamin & Associates, "Wind Capacity of Oconee Nuclear Station Borated Water Storage Tanlc," July 26. 1982.

5.16 Twisdale, L.A., et al., "Tornado Missile Simulation and Design Methodology,"

_NP-2005, Electric Power Research Institute, Palq Alto, CA, August 1981.

5.17 Twisdale, L. A., et al., "Tornado Missile Ri sk Analysis," NP-768 and NP-769, Electric Power Re search Institute, Palo Alto, CA, May 1978.

9-4

• 5.18 Deskevich, S. A.* "Verification of Computer Progra_m TORMIS;" COM-0204.C6-11-0038 Revision 1, Duke Power Company, Charlotte, NC, October, 199~.

5.19 Deskevich, S. A., "VeJ'.ification of TORMIS Enhancement," COM-0204.C6-l 1-0039 Revision 1, Duke Power Company, Charlotte, NC, ~tober 1993.

5.20 Kanipe.

• L. M., "Damage Frequency of the Oconee Nuclear Station Emergency Feedwater System *By Tornado-Generated Missiles," osc~3361 Rev. 1, Duke Power Company, Charlotte, NC, November 1993.

• 5.21 Kanipe, L. M.* " Keowee Tornado Path Simulation Model," SAAG File # 174, Duke Power Company, Charlotte,"N.C.* April 1995.

5.22 Duke Power Company, "Aood Study, Jocassee and Keowee Reservoirs,"

Charlotte, N.C., 1966.

5.23. Oconee PRA, "A Probabilistic Risk Assessment of Oconee Unit 3," NSAC-60,

Electric Power Research Institute, Palo Alto, CA, June, 1984.

• 5.24 1;3aecher, G. B., M. E. Pate, and R. _De Neufville, 1980. "Risk of Dam Failure in Benefit-Cost Analysis," Water Resources Research, Vol. 16, No. 3, pp. 449-456.

5.25 Benjamin, Jack R., and Associates, 1981. " Statistical Evaluation of the Frequency of Random Dam Failure," Prepared for NSAC, Palo Aho, Calif.

5.26 USCOLD, 1988, "Lesson from Dam Incidents USA-II, " American Society of Ovil Engineers.

5.27 Nash.

• J. A., Memo to File, "Update of the Random Failure Frequency of the Jocassee Dam," File No. OS-203, October 3, 1989.

5.28

• Farish, P. T., Memo to File, "Update of the Jocassee Dam Random Failure Frequency," File No. OS-203, March 15, J995 *

• 5.29 Lewis, S. R., Memo to File ; " Evaluation of Jocassee Dam Failure, " 7/2/82

5.30

• Farish, P. T., Memo to File; "Jocassee Dam Flooding Factors: " Ftle No. OS-203; December 16, 1994 '

5.31 Benjamin, Jack R., and Associate s, 1982, "A Database for the Evaluation of the Frequency of Random Dam Failure," Report 120-010-01, Palo Alto, CA.,

5.32 USNRC, NUREG-0800, "Standard Revie w Plan, " Rev. 2, dated 7/81.

9-5 5.33 Atlanta Sectional Aerial Nautical Chart, 52nd Edition, 3/31/94

5. 34 Greenville / Spartanburg Air Traffic Control Tower (Traffic. Management Unit);

1993 Traffic Su111Mary.

5.35 Asheville Air Traffic Contr o l Tower (Traffic Management Unit); 1993 Traffic Summary.

5.36 NTSB-ARC 1: Annual Review of Aircraft Accident Data : U. S. Air Carriers -

Calendar Year 1980; National Tran sponation Safety Board ; Washington, D.C.;

Bureau of Accident Investigation; 1/14/83

• 5.37 NTSB-ARC 1; Annual Review of Aircraft Accident Data ;. U. S. Air Carriers -

Calendar Year 1981; National Transponation Safety Board; Washington, D.C.:

Bureau of Accident Investigation; 2/1/85

5.38 NTSB-ARC-86-1 : Annual Review of Aircraft Accident Data ; U. S. Air Carriers -

. Calendar Year 1982; National Transponation Safety Board; Washington, D.C.;

Bureau of Accident Investigation ; 1986

5.39 NTSB-ARC-87-1; Annual Review of Aircraft Accident Data; U. S. Air Carri~rs -

Calendar Year 1983; National Transponation Safety Board; Washington, D.C.;

Bureau of Accident Investigation; 2/13/87

• 5.40 NTSB -ARC-87-2; Annual Review of Aircraft Accident Data; U. S. Air Carriers -

Calendar Year 1984; National Transponation Safety Board ; Washington, D.C.;

Bureau of Accident Investigation; 4/15/87

5.41

• NTSB -ARC-87-3; Annual Review of Aircraft Accident Data; U. S. Air Carriers -

Calendar Year 1985; National Transponation Safety Board; Washington, D.C. ;

• Bureau of Accident Investigation; 11/27 /87

5.42 NTSB-ARC 1 ; Annual Review of Aircraft _Accident Data; U. S. Air Carriers -

Calendar Year 1986: National Transponation Safety Board; Washington, D.C.;

Bureau of Accident Investigation; 2/3/89

5.43 NTSB -ARC-90-1; Annual Review of Aircraft Accident Data; U. S. Air Carriers -

Calendar Year 1987; National Transportation Safety Board; Washington, D.C.;

Bureau of Accident Investigation; 11/29/90

5.44 NTSB-ARC-91-1 ; Annual Review of Aircraft Accident Data ; U. S. Air Carriers -

Calendar Year 1988; National Transponation Safety Board; Washington, D.C. ;

Bureau of Accident Investigation ; 4/18/91

9-6 APPENDIX A

• OCONEE SEISMIC FAULT TREE APPENDIXD

OCONEE EXTERNAL FLOOD FAULT TREE

cc CD C>

C0'

• a..

C n.: a..

a, a,

I-...

~

I LL. m "8 0 u::::

n, C:

CD w )(

a:

a..

CD

.... ~

u. ca

-g 0

u.

as C:

~

w

-N a>

CJ>

a.. m

C a:

0..

g~* 8 ~;

llfi.l~ :110-

> 0 t !j!i I ~i. **r*

t tii "'..... 1.1...

,~i m a,

lj D........._

..... D.!:: ::::,

LL m ii§ It~

I.... I~<< 'C

.. 0 I,: u: 0

m C

Q)

I! -><

r~ w 11