ML15224A213

Forwards SER on Internal Events Portion of Ipe.Based on Review,Util Met Intent of Generic Ltr 88-20

ML15224A213
Person / Time
Site:	Oconee
Issue date:	04/01/1993
From:	Wiens L Office of Nuclear Reactor Regulation
To:	Hampton J DUKE POWER CO.
References
REF-GTECI-023, REF-GTECI-105, REF-GTECI-130, REF-GTECI-NI, TASK-023, TASK-105, TASK-130, TASK-23, TASK-OR GL-88-20, TAC-M74440, TAC-M74441, TAC-M74442, NUDOCS 9304080199
Download: ML15224A213 (27)

Text

April 1, 199 Docket Nos. 50-269, 50-270 DISTRIBUTION and 50-287 L. Berry NRC/Local PORs OGC Mr. J. W. Hampton PDII-3 RF ACRS (10)

Vice President, Oconee Site S. Varga E. Merschoff, Rh Duke Power Company G. Lainas A. Thadani P. 0. Box 1439 D. Matthews R. Herman Seneca, South Carolina 29679 L. Wiens C. Ader E. Chow W. Beckner

Dear Mr. Hampton:

D. Wheeler J. Flack

SUBJECT:

EVALUATION OF THE OCONEE, UNITS 1, 2, AND 3 INDIVIDUAL PLANT EXAMINATION (IPE) - INTERNAL EVENTS SUBMITTAL (TAC NOS. M74440, M74441, AND M74442)

By letter dated November 30, 1990, Duke Power Company (DPC) submitted its IPE for the Oconee Nuclear Station, Units 1, 2, and 3. Enclosed is NRC's evaluation report on the internal events portion of the IPE submittal.

The staff's conclusions are based on a "Step 1," NRC review of the IPE submittal which included the Oconee Probabilistic Risk Assessment (PRA) and DPC's responses to staff questions. A "Step 1" review focuses on the completeness and quality of a submittal, and does not include a detailed validation of the IPE results. Based on this review, we conclude that DPC has met the intent of Generic Letter 88-20 for the Oconee Nuclear Station, Units 1, 2, and 3.

As part of the IPE process, you also proposed resolution of Generic Safety Issues GSI-23, "Reactor Coolant Pump Seal Failures," GSI-105, "Interfacing System LOCA in LWRs," and GSI-130, "Essential Service Water Pump Failures at Multi-Unit Sites."

The staff is still evaluating your proposed resolution of these issues. We will provide safety evaluation reports to document our review in a separate correspondence.

If you have questions regarding this matter, contact me at (301) 504-1495.

Sincerely, ORIGINAL SIGNED BY:

L. A. Wiens, Project Manager Project Directorate 11-3 Division of Reactor Projects -

I/II Office of Nuclear Reactor Regulation

Enclosure:

Safety Evaluation cc w/enclosure:

C FlE C TE R C P Y See next page OFFICE

__I-PAJ3P NIME L.-/ERK -

g%4 E'

D1,JATT H E W S DATE DI 93 t/

/93 OFFICIAL RECORDICOPY FILE NAME: G:\\OCONEE\\IPE.SER 9304080199 930401 PDR ADOCK 05000269 P

PDR

R E UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON. D.C. 20555-0001 April 1, 1993 Docket Nos. 50-269, 50-270 and 50-287 Mr. J. W. Hampton Vice President, Oconee Site Duke Power Company P. 0. Box 1439 Seneca, South Carolina 29679

SUBJECT:

EVALUATION OF THE OCONEE, UNITS 1, 2, AND 3 INDIVIDUAL PLANT EXAMINATION (IPE) - INTERNAL EVENTS SUBMITTAL (TAC NOS. M74440, M74441, AND M74442)

By letter dated November 30, 1990, Duke Power Company (DPC) submitted its IPE for the Oconee Nuclear Station, Units 1, 2, and 3. Enclosed is NRC's evaluation report on the internal events portion of the IPE submittal. The staff's conclusions are based on a "Step 1," NRC review of the IPE submittal which included the Oconee Probabilistic Risk Assessment (PRA) and DPC's responses to staff questions. A "Step 1" review focuses on the completeness and quality of a submittal, and does not include a detailed validation of the IPE results. Based on this review, we conclude that DPC has met the intent of Generic Letter 88-20 for the Oconee Nuclear Station, Units 1, 2, and 3.

As part of the IPE process, you also proposed resolution of Generic Safety Issues GSI-23, "Reactor Coolant Pump Seal Failures," GSI-105, "Interfacing System LOCA in LWRs," and GSI-130, "Essential Service Water Pump Failures at Multi-Unit Sites."

The staff is still evaluating your proposed resolution of these issues. We will provide safety evaluation reports to document our review in a separate correspondence.

If you have questions regarding this matter, contact me at (301) 504-1495.

Sincerely, L. A. Wiens, Project Manager Project Directorate 11-3 Division of Reactor Projects -

I/Il Office of Nuclear Reactor Regulation

Enclosure:

Safety Evaluation cc w/enclosure:

See next page

Mr. J. W. Hampton Oconee Nuclear Station Duke Power Company cc:

Mr. A. V. Carr, Esquire Mr. M. E. Patrick Duke Power Company Compiance 422 South Church Street Duke Power Company Charlotte, North Carolina 28242-0001 Oconee Nuclear Site P. 0. Box 1439 J. Michael McGarry, III, Esquire Seneca, South Carolina 29679 Winston and Strawn 1400 L Street, NW.

Mr. Alan R. Herdt, Chief Washington, DC 20005 Project Branch #3 U. S. Nuclear Regulatory Commission Mr. Robert B. Borsum 101 Marietta Street, NW. Suite 2900 Babcock & Wilcox Atlanta, Georgia 30323 Nuclear Power Division Suite 525 1700 Rockville Pike Assistant Attorney General Rockville, Maryland 20852 North Carolina Department of Justice Manager, LIS P. 0. Box 629 NUS Corporation Raleigh, North Carolina 27602 2650 McCormick Drive, 3rd Floor Clearwater, Florida 34619-1035 Mr. G. A. Copp Licensing -

ECO50 Senior Resident Inspector Duke Power Company U. S. Nuclear Regulatory Commission P. 0. Box 1006 Route 2, Box 610 Charlotte, North Carolina 28201-1006 Seneca, South Carolina 29678 Regional Administrator, Region II U. S. Nuclear Regulatory Commission 101 Marietta Street, NW. Suite 2900 Atlanta, Georgia 30323 Mr. Heyward G. Shealy, Chief Bureau of Radiological Health South Carolina Department of Health and Environmental Control 2600 Bull Street Columbia, South Carolina 29201 Office of Intergovernmental Relations 116 West Jones Street Raleigh, North Carolina 27603 County Supervisor of Oconee County Walhalla, South Carolina 29621

STAFF EVALUATION OF OCONEE NUCLEAR STATION UNITS 1, 2, AND 3 INDIVIDUAL PLANT EXAMINATION (IPE)

(INTERNAL EVENTS ONLY)

TABLE OF CONTENTS-PG EXECUTIVE

SUMMARY

BACKGROUND............----**

11.

STAFF'S REVIEW.......... *

1.

Licensee's IPE Process........... 2

2.

Front-End Analysis............. 3

3.

Back-End Analysis.............. 6

4.

Human Factor Considerations....... 9

5.

Containment Performance 11 Improvements (CPI)........*

6.

Decay Heat Removal (DHR).......

12 Evaluation.........*

7.

Generic Safety Issues........... 13

8.

Licensee Actions and Commitments from the IPE.........

13 CONCLUSION..................****

IV.

REFERENCES.....

16 APPENDIX A OCONEE DATA

SUMMARY

SHEET............. A-1

E X EC-UTIVE -S UMMAR Y The NRC staff completed its review of the internal events portion of the Ocoee nit 1,2, nd3 Individual Plant Examination (IPE) submittal and asoeit informain. Teltter includes licensee responses to staff generated questions seeking clarification of the licensee's process.

enesee's qu E is based on an Oconee Level 3 probabilistic safety analysis The licensee'sIEi ae Papcoe~

lnt e

considerableoinvolvement (PSA).

Duke Power Company (DPC personnel maintained cnie Level involv e in the development and application of the Level 3 PSA e.

facility, by maintaining the PSA technology "in-house."

The Oconee IPE submittal did not identify any severe accident vulnerabilities associated with either core damage or "unusually poor " containment prformaent.fy9a Hwv, te per idwnify safety enhancements which focus oPE reducing both core damage frequency and ofstreaeof~ iatity Although all of these improvements are under consideration by the licensee, they are not expected to significantly impact the IPE conclusions.

Based on the review of the Oconee fE submittal and the associated documentation, the staff concludes that the licensee met the intent of Generic Letter 88-20. This conclusion is based on the following findings: (1) the IPE is complete with respect to the information requested in Generic Letter 88-20; (2) the front-end systems analysis, the back-end containment performance analysis, and the human reliability analysis are technically sound and cabl of identifying plant-specific vulnerabilities to severe accidents ; (3) the licensee employed a viable means (walkdowns) to verify that the IPE reflected the current plant design and operation; (4) the PSA which formed the basis of the RPE had been peer reviewed; (5) the licensee participated fully in the IPE process consistent with the intent of Generic Letter 88-20; (6) the licensee appropriately evaluated Oconee's decay heat removal (DHR) function for vulnerabilities, consistent with the intent of the USI A-45 resolution; and (7) the licensee re sponded appropriately to recommendations stemming from the containment performance improvement (CPI) program.

In addition, the licensee states that the IPE is being used in the accident management program as a "living" document to enhance plant safety. This latter activity is not a requirement of Generic Letter 88-20.

It should be noted that the staff's review is a process review which, in general, is not intended to validate the accuracy of the licensee's RPE findings. Although certain aspects of the RPE were explored in more detail.

than others, the review primarily focused on the licensee's ability to examine Oconee for severe accident vulnerabilities, and not specifically on the detailed findings (or quantification estimates) which stemmed from the examination.

i

As part of the IPE process, the licensee also proposed resolution of Generic Issue (GI)-23 "Reactor Coolant Pump Seal Failures," GI-105 "Interfacing System LOCA in LWRs," and GI-130, "Essential Service Water Pump Failures at Multi Unit Sites."

GI-130 involves concerns pertaining to the reliability of essential service water at only seven multi-unit sites. GI-153 "Loss of Essential Service Water (ESW) in LWRs," addresses concerns pertaining to the reliability of ESW and related problems for all light water reactors except those sites addressed under GI-130. Because Oconee is not one of the seven sites addressed under GI-130, the reliability of the ESW system for Oconee has been considered under GI-153. The review of these GIs are being addressed in separate staff evaluation reports.

11

I. BACKGROUND On November 23, 1988, the NRC issued Generic Letter 88-20 (Ref. 1) which requires licensees to conduct an Individual Plant Examination in order to identify potential severe accident vulnerabilities at their plant, and report the results to the Commission. Through the examination process, a licensee is expected to (1) develop an overall appreciation of severe accident behavior, (2) understand the most likely severe accident sequences that could occur at its plant, (3) gain a more quantitative understanding of the overall probabilities of core damage and fission product releases, and (4) if necessary, reduce the overall probability of core damage and radioactive material releases by modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accident.

As stated in Appendix D of the IPE submittal guidance document NUREG-1335 (Ref. 2), all IPEs are to be reviewed by NRC teams to determine the extent to which each licensee's IPE process met the intent of Generic Letter 88-20. The IPE review itself is a two step process; the first step, or "Step 1" review, focuses on completeness and the quality of the submittal.

Only selected IPE submittals, determined on a case-by-case basis, will be investigated in more detail under a second step, or "Step 2" review. The decision to go to a "Step 2" review is primarily based on the ability of the licensee's methodology to identify vulnerabilities, and the consistency of the licensee's IPE findings and conclusions with previous PSA experience. A unique design may also warrant a "Step 2" to better understand the implication of certain IPE findings and conclusions. As part of this process, the Oconee IPE only required a "Step 1" review.

On November 30, 1990, Duke Power Company (DPC) submitted the Oconee Units 1, 2, and 3 IPE (Ref. 4 and 5) in response to Generic Letter 88-20 and associated supplements (Ref. 1, 6 and 7).

The submittal consists of an IPE submittal report (Ref. 4) and the accompanying level 3 Oconee Unit 3 Probabilistic Risk Assessment (PRA) Report (Ref. 5).

The current PRA is an update of NSAC-60 (Ref. 8) which is the 1984 Oconee level 3 PRA with internal and external events, sponsored by Electric Power Research Institute (EPRI) and DPC. The staff's contractor, Brookhaven National Laboratory (BNL), reviewed NSAC-60 and published its findings in NUREG/CR-4374 Vol. 1-3 (Ref. 9-11).

The IPE submittal contains the results of an evaluation of internal and external events; however, the staff will review the external events portion of the Oconee IPE separately, within the framework prescribed in Generic Letter 88-20 Supplement 4 (Ref. 12).

Following receipt of the licensee's IPE submittal, the NRC review team met with the licensee on February 12, 1991 (Ref. 13) to discuss the Oconee IPE findings and conclusions. On June 26, 1991 (Ref. 14) the staff sent a first round of questions to the licensee seeking additional information to support its review. The licensee responded to the staff's request in a letter dated August 21, 1991 (Ref. 15).

In order to further understand the licensee's IPE process, supplementary questions (Ref. 16) were sent to the licensee on July 17, 1992, seeking additional information and clarification. The licensee

-2 responded to the staff's request in a letter dated August 14, 1992 (Ref. 17).

The following list summarizes the basic information reviewed during the staff's evaluation of the licensee's IPE review process:

1.

Oconee Units 1, 2, and 3 IPE submittal report and associated PRA (Ref. 4 and 5)

2.

Oconee IPE briefing NRC information (Ref. 13)

3.

Oconee response (Ref. 15) to NRC's first request for additional information (Ref. 14)

4.

Oconee response (Ref. 17) to NRC's second request for additional information (Ref. 16)

5.

Brookhaven National Laboratory's review of the internal events in Oconee-3 PRA (NUREG/CR-4374, Vol. 1) (Ref. 9)

6.

Brookhaven National Laboratory's review of the containment performance, radiological source terms and risk estimates in Oconee-3 PRA (NUREG/CR-4374, Vol. 3) (Ref. 11)

This report documents findings and conclusions which stemmed from the NRC review. Specific numerical results and other insights taken from the licensee's IPE submittal are listed in the appendix.

II. STAFF'S REVIEW

1.

Licensee's IPE Process The Oconee IPE submittal describes the approach taken by the licensee to confirm that the IPE represents the as-built, as operated plant. In addition to detailed reviews of the documentation by both in-house personnel and independent experts, several plant walkdowns were performed: (1) to provide a general understanding of the arrangement of plant systems; (2) to determine spatial interaction and system interaction due to flooding, fire, and other external events; (3) to assess the feasibility of operator actions modeled as recovery actions; (4) to become familiar with the containment arrangement; (5) to review plant modifications; (6) to obtain a better perspective on plant features related to some IPE result (e.g., seismic and tornado events).

Based on review of the information submitted with the IPE, the staff concludes that the licensee's walkdowns and documentation reviews constituted a viable process for confirming that the IPE represents the as-built, as-operated plant.

The IPE submittal contains a summary description of the licensee's IPE process, the licensee's personnel participation in the process and subsequent in-house peer review of the final product. The staff reviewed the licensee's description of the IPE program organization, composition of the peer review teams, and peer findings and conclusions. The staff notes that DPC personnel maintained involvement in the development and application of PSA techniques to the Oconee facility. To this end, DPC has maintained a permanent group of engineers with the responsibility for maintaining and applying the IPE/PRA.

The staff notes that virtually all of the plant departments provided input to the IPE/PSA development.

-3 As part of the review effort, the staff requested and reviewed comments and comment dispositions stemming from peer reviewers.

Based on the submitted information, the staff concludes that the licensee's peer review process provided reasonable assurance that the IPE analytic techniques had been correctly applied, and documentation accurate.

The licensee's IPE submittal provides a discussion of the criteria used to define "vulnerability." The licensee stated that core-melt functional sequences with a frequency greater than 1.OE-6/yr. and functional sequences which bypass the containment (steam generator tube rupture (SGTR) and interfacing system LOCA (ISLOCA) sequences) with frequencies greater than 1.OE-8/yr. were treated as potential vulnerabilities. Consistent with the above definition, the process led the licensee to assess the items resulting from this search for their cost-effectiveness.

Based on the review of the Oconee IPE submittal and associated documentation, the staff finds reasonable the licensee's IPE conclusion that no fundamental weakness or significant severe accident vulnerabilities exist at Oconee. The staff finds the Oconee IPE process capable of identifying severe accident risk contributors (or vulnerabilities) and that such capability is consistent with the objective of Generic Letter 88-20.

2.

Front-End Analysis The staff examined the IPE front-end analysis for completeness and consistency with acceptable PSA practices. The licensee capitalized on insights stemming from NSAC-60 (Ref. 8), and the NUREG-115 0 analysis (Ref. 18).

The front-end IPE analysis employed the small event tree/large fault tree (or fault tree linking) methodology, and the CAFTA (Ref. 19) computer code for core damage frequency (CDF) quantification.

Functional event trees were developed for unique initiating events, with event tree top logic linked to system failure criteria. System dependencies and inter-unit ties were identified and treated explicitly in the fault trees. The front-end system model interfaces with the back-end containment response model essentially map out the relationship between core damage bins and the containment safeguards state.

The staff finds the employed methodology clearly described and justified for selection. The chosen methodology is consistent with methods identified in Generic Letter 88-20.

The licensee's IPE process identified 46 initiating events (lEs) from which 19 initiator groups were formed based on plant response. The licensee has also evaluated the total failure of support systems as Es.

The licensee searched for plant-specific initiators, (e.g., excessive feedwater) and triple unit initiators (loss of offsite power and loss of instrument air) using final safety analysis report (FSAR) and actual plant experience. Additional Es were identified during this process and were evaluated during the fault tree system analysis phase. The IPE examined piping systems for potential initiation of ISLOCA events. The tE employed FSAR core cooling information to establish B&W plant-specific success criteria for major IE groups. The staff found that the licensee's generic Es were consistent with those generated by other PSAs and NUREG/CR-2300 (Ref. 20).

-4 Accident sequences were binned into Plant damage states (PUSS) according to Acorendmat imn n

co system Pressure at time of reactor vessel met throuh The licensee u sed PUSS to account fo re inin c dons ei thre ageh e

impact sed back-end analysis.

PUS attributes includedotanment amage timing woul iprcturee containment pressure boundary statuscnaimn safeguards status, and cavity condi d th Constens witn currenthe SAont-e practices, these attributes facilitatdtetasto ewe h rn-n and back-end analysis.

a manner that is consistent The IPE analyzed frontline andtsupport ss temshn a man mn delsa n

withothr P~s. In general, the staff finds the RPE sytmodl mrehesie PS andthe fault trees complete System dependencies and depedenie d te inerunit and intraunit asymmetries were treated explicitly through the fault tree linking process. Tnst aff system, an exprlcty powr syte, standby shutdown facility, instrument air sys te loweressuPore sricster ys, are shared among units. Appendix C of the lem prviesca conce decr sptoe of these shared systemsn and differences between Unit 3 (which the tzE is based on) anat One of the unique features ofthe Oconee facility is the utilization of An alernathe sutni feturesing sytem or safe shutdown facility (SSF), as backup alternate shutdown cooling systheSFcan em el ab enofrsupor, to te nrma safty ystms. The SSF contains a dedicated dieselgnrtr ao the normal safety systempump and a standby makeup pumP capable of supplying an auxiliary service w and reactor coolant PUMP (RP)s provide to no-in steam generator cooling, and reaco oln up(C)sa neto oln seall eet cnints.

Training for the SSF operation is provided to non forane thr ts. leed reactor operators, and senior licensed operators.

Ticesedeoperatexp citl a ssesed the r eiability of the SF (Appendix 13),

and Ocapialed onA thel S i esolving Generic Issue (GI)-2 3 (see Appendix B) and capitalized on thbe t

(see Secno IIr and assessing DHR reliability (see Section 11.6.)for The Oconee IPE utilized both generic data and plantaspecific datechnee e

quantification, mean values were employed Bata exi upan tscimes dert applied in situations where limited failure datedtexps aste ond atang included initiating events, component failure rates, sures (

es a te andmantnance unavailabilities. Plant-specific data was based onoprtn experience frtepro 190-98. Common cause failures (CCF) were and ~

fo manenn e nava od 1980 - 1987. Com nasteER Advanced Light experience by thzating beta-factors contained in the EPRID vae d Tht Water Reactor (ALWR) PRA Key Assumptions and Groun accedent environments, identified essential equipment subjected to severe accidn sray pumps.

i.e., the reactor building cooling unit and reactor building spra pups The CET quantification recognized the potend forsystems to fail in severe environments.

ding evaluation, the licenseemade use of the information a

as part of theloo development of fault trees and event trees, along wieth as eailedf eaution for plant-specific floods and postulated floods in various flood zones in the three Oconee units. Its nitii evnt ion includes a causemP asis (a detailed flood source identification and categorization analysis), that quantifies o

c flood sat e vn reec (if applicable for a given zone) based on pipe locatos, flood sours,aditr location of safety system components, main condensers, watertanspndinter zone flood propagation mechanisms. The licensee's nalyiSoznescic

-5 floods (adjusted to flood size group) determined specifically whether a postulated flood could cause a reactor trip and/or could affect one or more trains of a mitigating safety system. In summary, the analysis identified three critical flood groups for turbine building and auxiliary building, and estimated the flood induced core damage frequency to be 6E-6 per reactor-year.

Based on the review of the internal flood analysis and associated information, the staff finds the IPE flood assessment to be consistent with the intent of Generic Letter 88-20.

Unlike other nuclear facilities, Oconee Units 1, 2, 3 utilize two hydro electric generators (instead of diesel generators) as backup AC emergency power. The Keowee hydro units are located approximately 2 kilometers from the Oconee facility, and can be started from either the main control room (MCR) at the Oconee facility, or at the hydro station. Unlike diesel generators at other commercial nuclear power facilities, the hydro units are normally generating AC power to the offsite grid, and designed to switch power to the Oconee units on emergency demand. The MCR and its operator at Oconee, however, have priority and override capability to assure power is available to the nuclear units on demand. The Oconee technical specifications also credits the Lee gas turbine unit (located in Lee Steam Station about 80 kilometers from the plant) as an additional independent AC source, although this source is susceptible to severe weather conditions (high winds).

The licensee evaluated the Keowee hydro facility, and backup Lee Steam Station as emergency and alternate emergency power sources. The licensee stated that improvements to the hydro facility and related maintenance practices were performed, and initiated a technical audit which is to systematically study the hydro switching circuit (AC and DC circuits) in order to identify all failure modes that could potentially affect the overall unavailability of the hydro units. After the submittal of the Oconee IPE, however, several events related to the unavailability of the hydro facility occurred. In a separate effort (outside the IPE program), the NRC staff conducted an inspection related to the switchyard events and licensee corrective actions, and identified various problems. On September 17, 1992, the NRC staff accompanied by an IPE team member met with the licensee at the site to discuss the recent problems and the licensee's actions. The site visit included a tour of the Keowee hydro facility. The licensee indicated that corrective actions (changes to hydro facility hardware and related maintenance procedures) have been taken (Ref. 21), and was conducting a failure analysis of the hydro switching circuits (AC and DC circuits) to identify all failures (both occurred failures and potential failures) affecting the unavailability of the hydro facility. Because of the separate on-going effort to review the licensee's failure analysis of hydro switching circuit as part of an upcoming NRC electrical distribution system functional inspection (EDSFI), the IPE review team did not pursue this aspect any further.

With respect to offsite power configuration, Oconee design features which includes enhanced recovery (Lee Steam Station), places Oconee into one of the preferred switchyard configurations (see Ref. 22).

Based on this classification, extreme-weather (high winds) would be expected to dominate the station blackout risk at Oconee (excluding external events which will be evaluated at a future date).

The staff's review of the Oconee IPE submittal

-6 and visit of the hydro facilities, however, did not find the Oconee emergency power (hydro units) unusually susceptible to high winds.

(Keowee lines are underground and not exposed to high winds).

However, the staff does note the importance of the communication system between the Oconee units and the hydro facilities for coordinating of recovery of AC power, and believes the licensee should review the reliability of the communication system between the stations as part of its accident management program.

The IPE identified the dominant functional accident sequences in accordance with Appendix 2 to Generic Letter 88-20. Loss-of-coolant accidents (LOCAs) contributed 43% to the CDF, and transients contributed 26%. Steam generator tube ruptures (SGTRs), anticipated transients without scram (ATWS), and interfacing system LOCAs (ISLOCAs) had a negligible contribution to the CDF.

Appendix A summarizes these results.

Transient-induced pump seal LOCA contributes approximately 17% to the CDF.

The analysis assumed a 100 gpm/pump leak rate on all four reactor coolant pumps 15 minutes following a total loss of seal cooling. Seal cooling can be maintained by either the high pressure injection pump, cooling water flow to the thermal barrier heat exchanger and pump cooling jacket from the component cooling water system, or from the independent standby shutdown facility's dedicated standby makeup pump.

The staff finds the licensee's front-end IPE analysis essentially complete, with documentation consistent with the information requested in NUREG-1335.

The IPE submittal contained a summary description of the licensee's participation in the systems analysis and subsequent in-house peer review of the final product. The staff notes that an extensive peer review has been performed and that utility personnel have been involved in the IPE process.

Based on the staff's review of the front-end analysis and the staff's finding that the employed analytical techniques are consistent with other NRC reviewed and accepted PSAs and capable of identifying potential core damage vulnerabilities, the staff finds the IPE front-end analysis meets th.n intent of Generic Letter 88-20.

3.

Back-End Analysis The staff examined the Oconee Units 1,2, and 3 back-end (Level 2) analysis for completeness and consistency with acceptable PSA practices.

The analysis utilized methodology similar to that exercised in the Surry-NUREG-115 PRA, and employed Revision 11 of the MAAP-3.OB computer code (Ref. 23) to model the containment thermal response. Revision 11 of the MAAP 3.OB code was used because it was the latest PWR version available at the time the Oconee PRA was performed. The Oconee input decks were re-run with later versions of MAAP (including 3.OB Rev. 17), as they became available, to determine if any of the results and conclusions affecting containment event tree (CET) quant ification would be significantly affected. The licensee found that there were no changes in the conclusions affecting CET quantifications.

The staff examined the licensee's methodology, identification of analytical codes exercised, and input assumptions. The staff found the licensee's

-7 approach to be consistent with Generic Letter 88-20, Appendix 1 (Guidance on the Examination of Containment System Performance).

Core melt sequences from the front-end (Level 1) analysis were grouped into 19 core melt bins. Using 6 containment safeguard states and 3 containment isolation states with the 19 core melt bins, 342 plant damage states were determined. These plant damage states were analyzed by utilizing each as the entry point to the CET. The CET is comprised of 11 top events, six of which are developed with the aid of decision trees. The CET top events are quantified using MAAP-3.OB analytical results, hand calculations, insights from previous studies and insights from the compendium of literature available from severe accident research. The CET end states were binned into 41 release categories.

The 41 release categories were further sub-divided into 9 major release categories. The MAAP code was used to determine source terms for the 41 release categories.

The CRAC-2 code was used to determine off-site consequences for the 22 most significant release categories.

Oconee Units 1, 2, and 3 employ large (1.86 x 106 ft.) dry containment structures constructed from post-tensioned, reinforced concrete with steel liners. The containment design pressure is 59 psig. The licensee performed a plant-specific structural analysis of the Oconee containment buildings using the methods of NUREG/CR-1891 (Ref. 24). A failure is predicted to occur due to yielding of the circumferential posttensioning tendons. The failure location is near mid-height of the building cylinder. The licensee's failure pressure distribution corresponds to a log normally distributed probability function with a median pressure value of 144 psig, a mean pressure of 142.6 psig, and 5th and 95th percentile values of containment failure pressure of 117 psig and 166 psig respectively.

The RE submittal estimates the following conditional containment failure probabilities for internal events:

Containment bypass negligible Containment isolation failure 0.002 Early containment failure 0.009 Late containment failure 0.014 Basemat melt-through 0.597 No containment failure 0.377 When compared to the containment performance profiles determined in the NUREG 1150 evaluation of Zion and Surry, the Oconee distribution shows reasonable agreement for early containment failure and bypass probabilities, but indicates smaller probabilities of a late failure and intact containment and a greater probability of basemat melt-through. This is because at Oconee most accidents will result in a dry reactor cavity and siliceous concrete (which delays or precludes overpressurization failure) was used in containment construction.

Containment isolation failure is explicitly modeled and solved as an integral part of the development of PDS frequencies, and is estimated to have a total probability of 3.8 x 10 over the range of possible effective leak sizes.

0rl 0 sd10sa The licensee considered failure anf elatmria matrapimail usedl tosalur personnel and equipment hatches andft electrical peeationasbletsthetua mehaialad thermal propertie ofteeatme'el nbeyelalr presure tobean ecss of the failure pressures predited byite sctura calyses for alli acien scenarios, except those esulting in direc continet haig(C)

Foscarsreulting in DCH containment atmophe e matures ceed texendseal degradation temperature Imi of ti mn 350F detrmne expeietal n de s4J G/R-5806 (Ref. 25), for only a sort peio d of d tried (on the order of 3 or 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />). ThelicenOfse i t has cons erivel etima toed the catastrophic failure probabilitY POh containment, given a DCH event, high enough to account forte~siiiYo failure of elastomer sel swl ssrctural failure.lday ia The icesees eamintio oftheback-end results has not reveale n

containmen ofnrbii s hoevetelcne a identified a potenta nedt ttecontainment aunrbiii s apart of a miigation scheme to prvnto delay core damage for scnro initate byitraaloigo h ubne

~uiling.The trategy involves turning off containmetprytocnrv b uratdi g wa e t r g ank (B WJST) inventory for fee -and

-bleed ool n g n contaent eat streova via containment venting, since the flood has a hig probbiliY ao reoabln the low pressure service water (LPSW~) pumps thus dsbitecontainment fa/ci colr h iese is dveloping a trategy for long-term high pressure inpectio (hI olngfl igav turbine ~~~ilding flood which will identifY the mostaprritwytovn the containment building to control pressureithcoanetspysav been turned of f and LPSWJ is unavailable.

udrtn n uniy0svr The licensee employed an adequate pocestormndetnd an unti s er accident progression.

The proces of dee mtone of conita oti n failure probabilities and

, cnAnmendfilur moe wa onsihstentmwithe the intent of Generic Letter 88-,

Apedx1.Dmnntcnrbuost cotimn failure were found to be consistent with niht fo rmraS o paint of similar design. The IPE characterized contadinn perac f each ft he CE0n a e by asessing containment loa ing Theall licensee's E T ddressates most important severe accident phenomeanral o asscaeh wt larg dry cotmen tht s DCH, induced SGTR (1SGTR),

an h o e n com ust on lar eith regard to hydrogen combustion, c thne nt cnsrd rgeomuspthwans bteen the cavity and the uppe IotanIeTh iderd gaeou patwatsien to promote natural circulation.Th volums t confirm adequate communicainpolmoreos staff's review did not identifYy obiuorsgfcatpblmoreos in the back-end analysis.

bakedaayiisttthlcneeasme The overall assessment ofth einpromg the back-end analysistathlicese hasd mae reasonable use of PSA techniqu e in de ntifming h e vcke nd acci ydent anh t a the ~chiques employed are capable fj tfigsvr anccde tha vuelcnebliis Based on these fndings, the staff conluesnt h

enei licensee's back-end IPE processicossetwhteinntfGnrc

0 0

9

4.

Human_

df the HRA in NSAC-60.

As The human reliability analysis (HRA) is an udaedo tem er int fdac as pardt of haaPRA, a new HRA method (called the nfio trix aproac) was, dee lod a used. BNL reviewed the Oconee NSAC PRA documened itdS findings in NUREG/CR-4374 (Ref. 9).

In this report the BNL reviewers stated, "The BNL review is basicalth the ubmdeit approach and quantification of human errors used in the io me P

additional recovery actions for the instrument air system were identied tobN BNL and were discussed with DPC. Changes to the plant, includingprcurs were made as a result of the NSAC PRA.

DPC updated the NSAC PRA, including the HRA, in May 1988. The IPE submittal states that the licensee initiated a large-scale review and update of the NSAC study in January 1987.

The licensee indicated that the HRA performed for the C

oreviewed and updated and that all the postacciden h

eRrrs

w.

erA m an acf e pe accident human errors. T e c

apr e

oe naon.e ehey we r sc e neasgi m c eetge Thoselu mie e d o aic updated a second time in November 1990. The last updaewssbitdt R as part of the IPE submittal.

TheHRAmehodology in the IPE utilized the general principles of SHARP in TheHRAme s f uma acios wreanayzd an EPRI NP-3583 (Ref. 26).

Two general typeso human actionsw analyze eod as part of the IPE. The first is prewaccident ereeions a e s

d n postaccident human actions.

Preaccident human actioswr aldltn human errors by the licensee, and post-accident human actions, dynamic human errors. This human action taxonomy is logical and representative of those used in other PRAs, and it supports the identification of important human Pre-accident human actions were screened using a screening human error probability (HEP) of 0.01. Events surviving the screening process were further analyzed and quantified. A generic model using technique for human erro rat prediction (THERP) was used to quantify most of the preaccident h n actis i fed in the screening process. No justification was provided for the selection of this simple model ex estimates similar to those in the NSAC PRA.

Post-accident human errors include operational human actions and recovery actins.

Operational human actions are actions required for successful system operation. They were screened using a screening HEP of 0.1.

Recoveryacin are actions taken in response to equipment failures. Those recovery actions included in the logic model were screened using a value of i.0. Those dynamic actions which survived the screening process were quantified using the human cognitive reliability (HCR) model, simulator dat a, or engineering judgment.

Oconee was one of the original participants in the simulator studies for development of the model.

The submittal stated that the times for dynamic human errors were based on information from thermal/hydraulic computer code analyses done with such codes as RETRAN. The time available for the action and time required for the action are given for each.dynamic human action in the submittal which used the HCR model.

10 The IPE submittal contained a summary of the important accident sequences, many of which contained an operator action. The PRA, submitted as part of the IPE submittal, contained a more detailed discussion of the sequences and, where appropriate, the important operator actions. These discussions showed that the licensee has a general appreciation for severe accident behavior and the importance of human actions with respect to the accident sequences.

The licensee stated that the HEP estimates obtained from the human action quantification effort were compared with plant-specific data where possible, which inherently contains performance shaping factors. In addition, the licensee stated that the HCR model implicitly contains the necessary information through the performance shaping factors it considers. The HCR time reliability curve used in the study is a generic curve. However, though the licensee participated in the simulator trials used to develop the HCR generic curve, the licensee did not make direct use of the plant-specific results in the quantification process. The staff believes that the use of plant-specific results in future updates may help in better understanding human performance and its contribution to plant safety and performance.

The IPE submittal contained a list of actions taken as a result of the NSAC PRA. Many of these actions included changes or enhancements to procedures and training. As part of the HRA for the IPE, the licensee reviewed relevant plant procedures and identified areas requiring potential enhancements.

Examples of these include guidance in operating the low pressure injection (LPI) pumps during a small LOCA, enhancement of the turbine building flood procedure, and implementation of the loss of LPSW procedure. Other procedures have been developed and are being considered for implementation.

The licensee has utilized the PRA in its training program, in both the classroom and the simulator training. The submittal stated that training scenarios have been revised to focus on those sequences and operator actions which have been determined to be important to plant risk. The submittal also indicated that the licensee is considering building a simulator for the standby shutdown facility (SSF) so operators could be trained on important operator actions and sequences related to the SSF.

The staff notes that the dominant cut set in the accident sequence with the highest CDF consists of a medium LOCA initiating event and a single human action, "Operators Fail To Initiate High Pressure Recirculation (TTRHPRIDHE)."

The licensee identified this human action in the sequence summary in the IPE submittal.

On page 5.7-24 of the PRA (Rev. 1) portion of the IPE submittal, the licensee states, "This action is in procedures but not practiced...."

This human action basic event occurs in 48 of the 155 dominant accident sequence cut sets in the Oconee MAR-D data base, and indicates that this action should receive more consideration by the licensee.

Based on the review of the licensee's IPE submittal and associated supporting information, and responses to staff questions, the staff finds the licensee's assessment of human reliability, conducted as part of the Oconee IPE, is capable of discovering severe accident vulnerabilities from human errors consistent with the intent of Generic Letter 88-20. The HRA methodology described in the licensee's IPE submittal supports the quantitative

00 11 understanding of CDF, as well as an understanding of the contribution of human actions to CDF. In addition, the licensee's intent to maintain a "living" IPE program will insure that a mechanism exists for the licensee to continue to identify and evaluate the risk significance of potentially important human actions during plant operation and maintenance. However, the staff believes that the use of plant specific data/information and plant-specific performance shaping factors in future updates of the PRA can help in better understanding human performance and its contribution to plant safety and performance.

5.

Containment Performance Improvements (CPI)

Generic letter 88-20, Supplement 3 (Ref. 7), contains CPI recommendations which focus on the vulnerability of containments to severe accident challenges. For large dry containments, such as the Oconee Units 1, 2, and 3, the reference contains a recommendation that IPEs consider hydrogen production and control during severe accidents, particularly the potential for local hydrogen detonation.

Containment failure due to containment overpressurization from global hydrogen combustion has been addressed explicitly by the licensee in the IPE. Hydrogen concentrations in the containment were determined for a PDS by MAAP runs representative of the dominant sequence within the PDS. In these runs the hydrogen combustion parameters were set in a manner that would prevent hydrogen combustion. In this way the maximum hydrogen concentration likely to exist during the time frame of interest could be determined. The observed hydrogen concentration was then used in assessing the magnitude of the pressure spike that could be expected should a burn occur. The pressure spike was calculated using the pressure ratios observed in the EPRI combustion tests and the base pressure that existed in the MAAP results. These pressures were then compared to the containment failure probability distribution curve to determine a containment failure probability.

Because of the robust containment design (median failure pressure of 144 psig) the probabilities of containment failure, as determined above, are ;mall.

This is obvious as the conditional probability of early and late containment failure (0.009 and 0.014 respectively) are low, and include the contributions of other phenomena such as non-condensible overpressure failure as well as global hydrogen combustion.

As a result of the evaluation and analysis of the Oconee containment design and comparison to the Bellefonte containment design, the licensee has concluded that there is a negligible probability of containment failure resulting from local detonations due to hydrogen "pocketing" inside the containment building. The licensee bases this conclusion upon the potential for the open containment features, minimal enclosed spaces and use of open floor gratings to promote good mixing in the containment. The licensee also cites the NUREG/CR-4803 (Ref. 27) evaluation of the potential for local detonations of hydrogen in the Bellefonte Nuclear Plant. Bellefonte, like Oconee, is a B&W NSSS plant with a large dry containment. The NUREG analysis concluded that only one volume within the containment presented conditions in which deflagration to detonation transition (DDT) may occur. This volume was a tunnel between the steam generators. The Oconee design is more open than

12 the Bellefonte design and this enclosed volume does not exist in the Oconee reactor building. In-the Bellefonte analysis it was also concluded that a DDT occurring in this volume was not likely to propagate to any adjacent volumes.

For these reasons the likelihood of a DDT that could result in a significant challenge to the Oconee containment was considered to be insignificant. This conclusion is also consistent with those from NUREG-1150 for Surry and Zion (plants with large dry containments).

The staff, therefore, concludes that the licensee's response to CPI Program recommendations, which included searching for vulnerabilities associated with containment performance during severe accidents, is reasonable and consistent with the intent of Generic Letter 88-20 and associated Supplement 3.

6. DHR Evaluation In accordance with the resolution of USI A-45,*the licensee performed an examination of the Oconee facility to identify decay heat removal (DHR) vulnerabilities due to internal and external events.

The staff notes that the licensee made use of reliability insights from the staff-performed DHR analyses for the Arkansas Nuclear One, Unit 1 as part of the resolution of USI A-45. The licensee evaluated each safety function affecting the overall reliability of the DHR function following reactor shutdown, that is, secondary heat removal, reactor coolant system integrity, high pressure injection, and high pressure recirculation. The staff's findings related to these safety functions are as follows:

(A) The licensee has taken credit in its IPE for three separate means (one turbine-driven EFW pump, and two motor-driven EFW pumps) of providing secondary heat removal at each unit for all transients, SGTR events, and small break LOCA (SBLOCA) events. In addition, the licensee has taken credit for one train of the auxiliary service water (ASW) system that could be manually started and operated from the SSF. This ASW system receives AC power from diesel generator system located at the SSF and takes its suction from the condenser circulating water (CCW) system.

(B) To maintain primary system integrity, the licensee uses a reactor coolant makeup control (RMC) system which is a backup RCP seal cooling system to the conventional RCP seal cooling system. The RMC system is manually initiated and operated from the SSF. It receives AC power from one train of the diesel generator system and takes its suction from the spent fuel pool.

(C) To evaluate available plant design and operational features for independent means of providing coolant injection to the reactor, the licensee identified all DHR scenarios which have been found to have a CDF estimate of about 9E-6/reactor-year. The dominant contributor to this estimate is a severe weather-induced short-term SBO event followed by an operator failure to provide backup seal cooling from the SSF to the RCP seals. The frequency estimate of this scenario is about 2.6E-6 per reactor-year.

13 (D) To evaluate plant design and operational features for independent means of providing coolant recirculation, the licensee has identified all DHR sequences which have been found to have a CDF estimate of more than 1E-5 per reactor-year. The dominant contributor to this estimate is a medium LOCA event followed by an operator failure to align the high pressure recirculation (HPR) pumps to the reactor building emergency sump. The frequency estimate of this scenario is about 7.3E-6 per reactor-year.

Based on the process that the licensee used to search for DHR vulnerabilities, and review of plant-specific features, the staff finds the licensee's DHR evaluation to be consistent with the intent of Generic Letter 88-20, and resolution of USI A-45.

7.

Generic Safety Issues As part of its IPE submittal, the licensee proposed resolution of Generic Safety Issue (GSI)-23, "Reactor Coolant Pump Seal Failures," GSI-105, "Interfacing System LOCA in PWRs," and GSI-130, "Essential Service Water Pump Failures at Multi-Unit Plants."

GSI-130 involves concerns pertaining to the reliability of essential service water at only seven multi-unit sites.

GSI-153, "Loss of Essential Service Water (ESW) in LWRs," addresses concerns pertaining to the reliability of ESW and related problems for all light water reactors except those sites addressed under GSI-130. Because Oconee is not one of the seven sites addressed under GSI-130, the reliability of the ESW system for Oconee has been considered under GSI-153. The review of these GSIs are being addressed in separate staff evaluation reports.

8.

Licensee Actions and Commitments from the IPE The staff notes that the licensee used the IPE process in identifying plant or procedural modifications, and plans to maintain the PRA program "living."

The IPE submittal provides a discussion of improvements which the licensee is considering. Specifically, the licensee:

A.

Initiated a formal job-oriented task analysis to enhance the timely initiation of providing backup seal cooling to the RCPs following a station blackout scenario. The objective of this additional analysis is to identify the exact changes to the current reactor coolant makeup control (RCM) system seal cooling procedures, the need for additional parts or subparts, and changes to operator training, including potential Oconee simulator upgrades.

B.

Is evaluating modifications to procedures to isolate high pressure service water (HPSW) (an action to be performed from the main control room) to the CCW pumps during a turbine flooding event in order to double the amount of time the elevated water storage tank (EWST) inventory will last. This will allow more time to refill the EWST by an external method during a turbine flooding event which could fail the LPSW and HPSW pumps. The EWST is required to provide an alternate water source for cooling the HPI pumps during this scenario.

0 14 the backup AC power from the 4.16 KV main feeder bus C.

Is evaluating usiSSFth bm ents such as the ASW system following a turbne looingevent which could result in a falure iofrthe ttllose ofrthe EFo system. The objective of this changeawasrto improveithe rlaiyof secondaryst heat removal following a turbine flooding reliability Of secondary h event.

evetrategy to enhance the reliability of long term HPI D.

is developing a at ostulated large turbine flooding event. Su aof cooling followingl development of actions to (1) extend the life o the initial inventory of the borated water storage tank d

(BST prio)t refilling, (2) refill the BWST, (3) control the reactor b4uilrdig (RtBh)e pressure if the RB spray pumps will be turned off, and EWST.

failure-to-open of both Of E.

Changed the procedure related to simultaneouul rett n

of pump E. the HPI suction valves from the BwST that could result in HPI Pump damage.

ge team did not examine the merits of the above improvements

.lhog dhd notie exmnete egt PRA/IPE findings to in etalthe staff notes that the licensee is applyin R/P idnst enhance plant safety consistent with the inentGc neo i mLettea o20ble Tad staff, therefore, finds the licensee's actions and cmimnsraoal n acceptable for closure of severe accident concerns.

III. CONCLUSN al events including The staff finds the licensee's IPE sub itt for a eeve o

cnisent internal flooding essentially complete, withe o

the levelw of dealcnithen with the information requested in NUREG-1335. Bsdo the revie ofi the submittal and the associated supporting information, thentaf wefnesaor reasonable the licensee's RPE conclusion that no fundae tweks orat severe accident vulnerabilities exist at Oconee. The staff notentat (1) DPC personnel were considerably involved in the development and application of PSA techniques to the Oconee facility, and that the associated walkdowns and documentation revie s the as-built, as-operated process for confirming that the RE represen plant.

(2) The front-end E analysis appears complete, with the level of detail consistent with the information requested in NUREG-1335 In addition, the employed analytical techniques reflect commonly accepted practices and are capable of identifying potential core damage vulnerabilities.

(3) The back-end analysis addressed the most important severe accident phenomena normally associated with large dry contimns ao ntne DCH, ISGTR, and hydrogen combustion. No obvious or significant problems or errors were identified.

15 (4) The HRA allowed the licensee to develop a quantitative understanding of the contribution of human errors to CDF and containment failure probabilities.

(5) Based on the licensee's IPE process used to search for DHR vulnerabilities, and review of Oconee plant-specific features, the staff finds the licensee's DHR evaluation consistent with the intent of the USI A-45 (Decay Heat Removal Reliability).

(6) The licensee's response to CPI Program recommendations, which include searching for vulnerabilities associated with containment performance during severe accidents, is reasonable and consistent with the intent of Generic Letter 88-20 Supplement 3.

In addition, and consistent with the intent of Generic Letter 88-20, the staff believes the licensee's peer review process provided assurance that the IPE analytic techniques had been correctly applied and that documentation is accurate.

Based on the above findings, the staff concludes that the licensee demonstrated an overall appreciation of severe accidents, has an understanding of the most likely severe accident sequences that could occur at the Oconee facility, has gained a quantitative understanding of core damage and fission product release, responded to safety improvement opportunities. The staff, therefore, finds the Oconee IPE process acceptable in meeting the intent of Generic Letter 88-20. The staff also notes that the licensee's intent to continue use of the IPE as a "living" document, will enhance plant safety and provides additional assurance that any potentially unrecognized vulnerabilities would be identified and evaluated during the lifetime of the plant.

0 0

16 IV. REFERENCES

1.

NRC letter to All Licensees Holding Operating Licenses and Construction Permits for Nuclear Power Reactor Facilities, "Individual Plant Examination for Severe Accident Vulnerabilities -

10 CFR §50.54(f),"

Generic Letter 88-20, dated November 23, 1988.

2.

NUREG-1335, "Individual Plant Examination:

Submittal Guidance - Final Report," USNRC, August 1989.

3.

Letter from M. S. Tuckman of Duke Power Company to USNRC, "Oconee Nuclear Power station Docket Nos. 50-269, 50-270, and 50-287 Generic Letter 88-20," November 30, 1990.

4.

Duke Power Company, "Oconee Nuclear Station Units 1, 2, 3 IPE Submittal Report," December 1990.

5.

Duke Power Company, "Oconee Plant Unit 3 Probabilistic Risk Assessment Report," December 1990.

6.

NRC letter to All Licensees holding Operating Licenses and Construction Permits for Nuclear Power Reactor Facilities, "Initiation of the Individual Plant Examination for Severe Accident Vulnerabilities 10 CFR §50.54(f)," - Generic Letter No. 88-20, Supplement No. 1, dated August 29, 1989.

7.

NRC letter to All Licensees holding Operating Licenses and Construction Permits for Nuclear Power Reactor Facilities except Licensees for Boiling Water Reactors with MARK I Containments, "Completion of Containment Performance Improvement Program and Forwarding of Insights for Use in the Individual Plant Examination for Severe Accident Vulnerabilities - Generic Letter No. 88-20, Supplement No. 3, dated July 6, 1990.

8.

NSAC-60, "A Probabilistic Risk Assessment of Oconee Unit-3," Electric Power Research Institute, June 1984.

9.

NUREG/CR-4374, Vol. 1, "A Review of the Oconee-3 Probabilistic Risk Assessment: Internal Events, Core Damage Frequency," Brookhaven National Laboratory, March 1986.

10.

NUREG/CR-4374, Vol. 2, "A Review of the Oconee-3 Probabilistic Risk Assessment: External Events, Core Damage Frequency," Brookhaven National Laboratory, March 1986.

11.

NUREG/CR-4374, Vol. 3, "A Review of the Oconee-3 Probabilistic Risk Assessment: Containment Performance, Radiological Source Terms and Risk Estimates," Brookhaven National Laboratory, June 1986.

17

12.

NRC letter to All Licensees holding Operating Licenses and Construction Permits for Nuclear Power Reactor Facilities, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10CFR 50.54(f) (Generic Letter No. 88-20, Supplement 4), dated June 28.

13.

Duke Power Company, "Oconee IPE Briefing NRC Information Meeting,"

February 12, 1991.

14.

Letter from L. Wiens of USNRC to M. S. Tuckman of Duke Power Company, "Request for Additional Information - Oconee Generic Letter 88-20 IPE Submittal (TAC Nos. 74440, 74441 and 74442)," June 26, 1991.

15.

Letter from M. S. Tuckman of Duke Power Company to USNRC, "Oconee Nuclear Station Docket Nos: 50-269, -270, -287 Response to Request for Additional Information Generic Letter 88-20 IPE submittal (Tac Nos. 74440, 74441 and 74442)," August 21, 1991.

16.

Letter from L. Wiens of USNRC to J. W. Hampton of Duke Power Company, "Request for Additional Information - Oconee Generic Letter 88-20 Individual Plant Examination (IPE) Submittal (TAC M744440/M74441/M74442)," July 17, 1992.

17.

Letter from J. W. Hampton of Duke Power Company to USNRC, "Oconee Nuclear Site Docket Nos: 50-269, -270, -287 NRC Generic Letter 88-20 Individual Plant Examination Submittal Response to Request for Additional Information," August 14, 1992.

18.

NUREG-1150, "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants," June, 1989.

19.

Science Applications International Corporation, "CAFTA Manual," Palo Alto, CA, September 1987.

20. NUREG/CR-2300, "PRA Procedures Guide," January 1983.

21.

USNRC, "Summary of September 17, 1992 Meeting on Keowee Hydro Station Operation and Management," October 6, 1992.

22.

NUREG-1032, "Evaluation of Station Blackout Accidents at Nuclear Power Plants - Final Report," June 1988.

23.

Fauske and Associates, Inc., "Modular Accident Analysis Program User's Manual," IDCOR Technical Report 16.2-3, February 1987.

24.

NUREG/CR-1891, "Reliability Analysis of Containment Strength",

August 1982.

25.

NUREG/CR-5806, "Application of Containment and Release Management Strategies to PWR Dry Containment," June 1992.

0 18

26.

EPRI NP-3583, "Systematic Human Action Reliability Procedure (SHARP),"

Electric Power Research Institute, June 1984.

27.

NUREG/CR-4803, "The Possibility of Local Detonations During Degraded Core Accidents in the Bellefonte Nuclear Power Plant," January 1987.

APPENDIX A OCONEE DATA

SUMMARY

SHEET*

(INTERNAL EVENTS) o Total core damage frequency (CDF): 2.3E-5/year o

Major initiating events and contribution to CDF:

Contribution Transients (26%)

LOCAs (43%)

Internal Floods (26%)

o Major contributions to dominant core damage sequences:

A medium LOCA event followed by a failure of long-term recirculation capability.

A loss of feedwater event followed by failure of the emergency feedwater system (EFW) and the auxiliary feedwater system (AFW), and operator failure to establish high pressure recirculation from the reactor building (RB) emergency sump.

A station blackout event followed by operator failure to provide the reactor coolant makeup control (RCM) flow to the reactor coolant pump (RCP) seals and thermal barriers results in a RCP seal LOCA event.

o Major operator action failures:

Operators fail to complete high pressure recirculation during a medium LOCA event.

Operators fail to establish long-term EFW suction source and to throttle the EFW flow as necessary.

Operator failure to recover offsite power in a timely fashion resulting in a station blackout (SBO) event.

Operator failure to provide the RCM flow to the RCP seals and thermal barriers resulting in a transient-induced RCP seal LOCA event.

o Conditional containment failure probability given core damage:

Containment bypass Negligible Containment isolation failure 0.002 Early containment failure 0.009 Late containment failure 0.014 Basemat melt-through 0.597 No containment failure 0.377 A-1

o Additional staff findings and comments:

1.

Operator error and/or failure of major support system (AC, instrument air, and low pressure service water) occurred in many dominant core damage sequences.

2.

Common cause failures of the two-unit hydro system designed and configured for a three-unit nuclear site may require further examination to determine their importance.

3.

The faults related to the electrical interconnection between the hydro system and the nuclear units may require further examination to determine their importance.

o Plant actions and modifications being considered based on PSA considerations:

A.

A task analysis to identify changes to procedures, hardware, and operator training for providing backup seal cooling to the RCPs during an SBO event.

B.

A change in procedure to isolate the high pressure service water (HPSW) to the condenser circulating water (CCW) pumps in order to preserve the inventory of the elevated water storage tank (EWST) during a turbine flooding event.

C.

A change in procedure, hardware, operator training, and simulator upgrades to provide backup AC power from the 4.16 KV main feeder bus of Unit 2 to the safe shutdown facility (SSF) components such as the auxiliary service water (ASW) system during a turbine flooding event.

D.

Identification of a strategy to enhance the reliability of the long term high pressure injection (HPI) cooling during a large turbine flooding event.

E.

A change in procedure to deal with the problems related to simultaneous failure-to-open of both of the HPI suction valves from the borated water storage tank (BWST) that could result in HPI pump damage.

o Other future activities:

Periodic update of PRA

(*Information has been taken from the Oconee IPE and has not been validated by the NRC staff.)

A-2