ML20136G678

Advises of Completion of Review of Study, PRA of Oconee Unit 3, Jointly Undertaken by Util & EPRI Nuclear Safety Analysis Ctr.Overview Focused on Core Damage Accident Sequence Analysis.Overview Summary Rept Encl

ML20136G678
Person / Time
Site:	Oconee
Issue date:	08/14/1985
From:	Stolz J Office of Nuclear Reactor Regulation
To:	Tucker H DUKE POWER CO.
References
NUDOCS 8508190602
Download: ML20136G678 (16)

Text

. ~.

Y August 14, 1985 b bb ~D Docket No. 50-287 EISTM SU K EBrach CDo::ket FiDv JPartlow L

NRC PDR-ACRS-10 Mr. Hal B. Tucker L PDR RIngram Vice President - Nuclear Production ORBf4 Rdg HNicolaras Duke Power Company HThompson Gray File P. O. Box 33189 OELD H0rnstein 422 South Church Street EJordan WPaulson i

Charlotte, North Carolina 28242 BGrimes GEdison

Dear Mr. Tucker:

4

SUBJECT:

PROBABILISTIC RISK ASSESSMENT STUDY Re: Oconee Nuclear Station, Unit 3 l

We have reviewed the study on "Probabilistic Risk Assessment (PRA) of Oconee Unit 3".

The PRA study was undertaken jointly by Duke Power Company and

'EPRI's Nuclear Safety Analysis Center.

An.. initial reading of' the Oconee PRA was conducted to provide a sunnary overview of the major results of the PRA. Particularly, we focused on the analysis of core damage sequences and dominant contributors, to core damage accidents to check whether the results, as published, provide any new insights of safety significance. Although the PRA includes both internal and external events analysis, our overview focused only on core damage accident. sequence ana. lysis.. The core damage accident sequence analysis of the Oconee PRA is closely associated with regulatory significance because it treats the systems safety profile of the nuclear power plant. Our initial reading of the Oconee PRA did not show that you had identified any significant safety issues or new generic safety concerns. We have enclosed for your information (and, if you desire, for comment), a copy of our overview summary report.

After the overview, we started a detailed review of the Oconee PRA.

In support of the staff's review, Brookhaven National Laboratory (BNL) is performing a detailed review of the core damage sequence analysis. The results of the BNL more detailed review will be discussed by separate correspondence.

Sincerely'SICED bee

• 0CIGINAL JOBE L S30 W 7 John F. Stolz, Chief Operating Reactors Branch #4 Division of Licensing

Enclosure:

As Stated cc w/ enclosure:

See next page ORfid:DL RB' :DL HN1'eclaras;cf J 8/ /85 8f/8 8508190602 850814 PDR ADOCK 05000287 P

PDR J

Pr. H. B. Tucker Oconee Nuclear Station Duke Power Company Units Nos. 1, 2 and 3 cc:

Mr. William L. Porter Duke Power Company P. O. Box 33189 422 South Church Street Charlotte, North Carolina 28242 J. Michael McGarry, III, Esq.

Bishop, Liberman, Cook, Purcell & Reynolds 1200 Seventeenth Street, N.W.

Washington, D.C.

20036 Mr. Robert B. Borsum Babcock & Wilcox Nuclear Power Generation Division Suite 220, 7910 Woodmont Avenue Bethesda, Maryland 20814 Manager, LIS NUS Corporation 2536 Countryside Boulevard Clearwater, Florida 33515 Senior Resident Inspector U.S. Nuclear Regulatory Commission Route 2 Box 610 Seneca, South Carolina 29678 Regional Administrator U.S. Nuclear Regulatory Commission 101 Marietta Street, N.W.

Suite 3100 Atlanta, Georgia 30303 Mr. Feyward G. Shealy, Chief Bureau of Radiological Health South Carolina Department of Health and Environmental Control 2600 Bull Street Columbia, South Carolina 29201 Office of Intergovernmental Relations 116 West Jones Street Raleigh, North Carolina 27603 Honorable James M. Phinney County Supervisor of Oconee County Walhalla, South Carolina 29621 1

4 r

s s

J

SUMMARY

OVERVIEW OF OCONEE PRA Table of Contents I.

Background

II. Overview of Oconee Plant Safety III. Overview of Oconee Potential Core Damage Accidents A.

Core Damage Frequency B.

Dominant Sequences to Core Damage C.

Plant Modifications Resulting from PRA D.

Strengths and Weaknesses of Safety Systems IV.

Overview of Generic Safety Concerns Table 1:

Summary of Core Damage Frequency 9

J

I.

Background

Immediately after the core damage accident at Three Mile Island in March 1979, a nuclear utility industry group recognized the need to take the initiative by performing a probabilistic study of a nuclear power plant to ensure that the risks from reacter operations were held to an acceptably low level.

The Nuclear Safety Analysis Center (NSAC) of Electric Power Research Institute (EPRI) conducted a probabilistic risk assessment (PRA) for the Oconee plant Unit 3.

The Oconee Unit 3 was selected by the industry group, because of the willingness of Duke Power Company (DPC) to provide strong support, Oconee's significant operating experience, and the availability of detailed design and construction information.

The major objectives of the Oconee PRA study were: (1) to improve utility capabilities in PRA methods and applications; (2) to evaluate the risks to the plant and the public; (3) to make a comparison of the methods and results of contemporary risk studies; and (4) to provide the host utility with an analytical plant model that describes the combinations of failures thct can s

lead to core damage and can be used to estimate the likelihood of such combinations.

Oconee Unit 3 is a pressurized water reactor.

The nuclear facility consists of three separate reactor buildings, one turbine building that is shared by all three units and two connected auxiliary buildings, one servicing Units 1 and 2, and the other servicing Unit 3.

The reactor, designed and j

manufactured by Babcock and Wilcox (B&W), has a nuclear core consisting of 177 fuel assemblies.

The nuclear facility is built on the shore of Lake I

,,.- ~, _. -.,,,..,,

,,.,e.

k

. Keowee.

Keowee hydro station and Keowee Dam are located east of the Oconee facility.

Lake JoCassee is located 12 miles upstream of Oconee and is also 3

dammed.

An initial reading of the Oconee PRA was conducted to provide a summary overview of the major results of the PRA.

Particularly, we focused on the analysis of core damage sequences and dominant contributors to core damage accidents to check whether the results, as published, provide any new insights of safety significance.

Although the PRA includes both internal and external events analysis, containment response analysis, and offsite consequence analysis, our overview focused only on core damage accident sequence analysis. This limit.ed overview is partly due to the in-accessibility of some intermeciate risk results such as conditional consequences for various release categories and relative contribution of various accident initiators to early fatality, latent fatality and person rem.

Nevertheless, the core danage accident sequence analysis of the Oconee PRA is closely associated with regulatory significance because it treats the systems safety profile of the power plant.

4 II.

Overview of Oconee Plant Safet.y Our overview did not identify any issue that requires prompt regulatory action.

In the course of the study, the licensee made plant modifications to reduce the likelihood of core damage from internal floods caused by failures in the circulating water system.

The staff has previously concurred in these actions.

The Oconee PRA has yet to provide any clues that i

i

. could be interpreted as non-compliance of our deterministic regulatory l

requirements, specifically single failure requirements and separation requirements.

III. Overview of Oconee Potential Core Damage Accident A.

Core Damage Frequency The total core damage frequency after plant modification is about 2.5x10 4 per reactor year.

Before the plant modification, it was about 6x10 8 per reactor year.

The frequency estimates include contribution from both internal and external events.

A summary of the various events contributing to total core damage frequency is shown in Table 1.

B.

Dominant Sequences to Core Damage The Oconee PRA Study made use of RSS-type event tree techniques and developed the potential sequences leading to core damage accidents.

Also, the PRA has quantified all the potential core damage sequences, using improved fault tree techniques.

A summary of the top nine sequences is discussed below:

g Turbine Building Flooding Sequences (1) It involves basically turbine building (TB) flooding (caused by the circulating water system failure) r.esulting in failure of all feedwater systems and low pressure service water systems needed for long term heat removal.

The loss of the low pressure service water system also causes the failure of the backup cooling from the standby shutdown facility (SSF). The sequence relies on successful operation of high pressure injection (HPI) system needed for core cooling i

. initially. The sequence mean frequency estimate is about 2.9E-5 per reactor year.

(2) The sequence involves TB flooding resulting in failure of all feedwater systems and high pressure injection systems needed for core cooling followed by a stuck open pressurizer relief valve.

The failure of HPI system is due to either a 6 feet spillover of TB flooding into Auxiliary building (AB) where the HPI pumps are located, or HPI pump motor failure due to lost cooling provided by low pressure service water system which is also affected by the TB flooding.

The sequence mean frequency is about 1.8E-5 per reactor year.

(3) The sequence involves TB flooding causing the failure of all feedwater systems and HPI systems, followed by the operator failure to ensure long term suction to the SSF pumps, resulting in failure of long term cooling. The SSF was assumed to be operational.

The sequence mean frequency is about 1.9E-5 per reactor year.

(4) The sequence involves TB flooding, which causes failures of all feedwater systems and HPI systems, and failures of SSF equipment to pro'vihe backup cooling. The sequence mean frequency is about 1.3E-5 per reactor year.

Seismic Sequences (5) It is basically seismically induced failure of masonry walls in the AB (causing the failure of feedwater systems and HPI systems equipment) followed by either human failure to initiate SSF equipment or a stuck open pressurizer relief valve. The sequence mean frequency is about 3E-5 per reactor year.

(6)

It involves seismically induced rupture of condenser and failure of

. circulating water pipes connected to the condenser (causing a large flood and resulting in failure of feedwater system and HPI systems) followed by either human failure to initiate SSF equipment or stuck open pressurizer relief valve. The sequence mean frequency is about 2E-5 per reactor year.

(7) It involves seismically induced failure of blockhouse (where the standby transformer is located) and collapse of block walls (through which emergency buses pass) followed by either the stuck open pressurizer relief valve or human failure to initiate SSF equipment in a timely fashion to provide reactor coolant make up. The sequence mean frequency is about IE-5 per reactor year.

External Flooding Sequence (8) Tne sequence involves large scale flooding of the entire Oconee site due to the failure of JoCassee Dam located about 12 miles upstream from the Oconee site.

Although initial cold shutdown is

~'

achieved successfully, site flooding is expected to cause a loss of the ability to maintain long term decay heat removal.

The sequence mean frequency is atsut 2.5x10 5 per reactor year.

Transient Sequence (9) The sequence involves loss of low pressure service water system causing failure of pumps motors of HPI system emergency feedwater system and reactor coolant (RC) system.

Also, loss of low pressure service water system results in failure of heat exchangers of component 4

cooling systems and other decay heat removal systems.

The sequence

. also consists of operator failures to trip the pumps and to reestablish injection for RC pump seals using SSF makeup pumps within 30 minutes to prevent excessive RC leakage.

THe sequence mean frequency is about 1.3E-5 per reactor year.

C.

Plant Modifications Influenced 'y Oconee PRA o

During the conduct of the Oconee PRA, the licensee, DPC, recognized core damage accident vulnerabilities identified by the dominant sequences of the Oconee PRA.

Thus, DPC implemented plant modifications to correct some dominant accident sequence vulnerabilities.

Basically, these plant modifications have been implemented to reduce the likelihood of the turbine building internal flooding sequences.

The plant modifications include hardware change and operating procedure changes.

A summary of these plant modifications are:

1.

Sealing the doors and other penetrations between the turbine and auxiliary buildings to a height of about 6 feet above the floor of the turbine-building basement.

t 2.

Closing the cross connections between the three units to prevent a flood-isolation failure in one unit from feeding a break in another.

3.

Changing the auxiliary system alignments in such a way that only a limited quantity of backflow from the lake could continue.

4.

Adding a control switch in the control room to allow the operators to close all the circulating-water pump-discharge valves without the need to take action outside the control room.

5.

Providing special indications to enhance the ability of the operators to identify and deal with a flood, including the installation of an

1

- alarm to provide an unambiguous indication of the existence of a flood and improved training and procedures, particularly with regard to the actions needed to ensure the continued operation of important equipment once initial control of the flood has been achieved.

The modifications are expected to protect the equipment in the auxiliary building from all but the largest floods, to allow effective isolation for most floods, and to improve the likelihood of success for 4

flood isolation and other operator actions.

The Oconee PRA indicates that the frequency contribution of turbine building internal flooding sequences was reduced significantly (by a ratio of about 73:1) and thus, the total core damage frequency was reduced significantly (by a ratio of about 28:1) because of the above plant modifications.

s D.

Strenath and Weakness The Oconee PRA highlights the strengths and weaknesses of many safety systems that are of great importance of safety system unavailability and potential core damage accidents.

A summary of major highlights of safety i

systems weaknesses and strengths are given below:

1.

Location of Safety Systems - Emergency feedwater pumps and water sources low pressure service water system pumps and switchgear for emergency power supplies are located in turbine building.

Because Lake Keowee is higher than turbine building basement where the above safety

)

i I equipment is located, flooding becomes the most significant single point vulnerability to core damage accidents.

2.

Low Pressure Service Water - This system is very important to many internally and externally initiated sequences because it provides cooling to many safety system pumps and heat exchangers.

Its unavailability is dominated by transfer failure to the closed position of either of two single manual valves in the discharge flow paths.

It is noteworthy that the transfer failure mode could be difficult both to diagnose and remedy.

3.

Pressurizer Safety Valve - The PRA estimate for the pressurizer safety valve to reclose is about 0.1 per demand.

Because many events that j.

challenge the safety valves have also the potential to fail HPI systems, the failure mode of stuck open safety valves are very important to many potential core damage sequences.

4.

Emergency Feedwater System - The emergency feedwater system is needed for long term heat removal following both internally and externally

~'

initiated events.

Because both the main feedwater system and emergency I

feedwater system are dependent on upper surge tanks for suction, the ability to maintain long term suction supplied for emergency feedwater -

9 system is very important.

This is because local manual actions are needed to align long term water sources beyond about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, depending on the core damage sequence.

5.

Reactor Coolant System - The maintenance of injection and cooling for 1

the shaft seals of the reactor coolant pumps is important in many sequences.

Leakage, which may reach the equivalent of a small LOCA, is l

__..._,.. ~, _.. _..... _ -. _. _ _,. -. -..,., _ -. _. _ _.. _ _, _., _ _,. _, _ _ _. _, -

9_

predicted under some sets of conditions.

Timely initiation of backup seal injection from the standby shutdown facility can prevent seal degradation.

However, if normal seal injection is lost and backup seal injection from the standby shutdown facility is not initiated, the seals would degrade. With the pumps stopped, after about one-half hour, the leakage through the degraded seals would exceed the standby shutdown facility backup seal-injection capability and the standby shutdown facility would no longer constitute a viable means of recovery for those sequences.

6.

Instrument Air System - The instrument-air system was found to be significant system in a large number of sequences.

Loss of instrument air can be caused by air-system failures or by loss of offsite power where the compressors are load shed and action is not taken to restore their power.

Loss of instrument air affects a number of other functions, including main feedwater, emergency-feedwater suc. ion, seal cooling for the reactor coolant pumps, a large number of instruments in the

~'

control room, and the normal suction supply for the o

high pressure injection pumps.

The wide range of potential failures makes a loss of instrument air quite complex operationally.

7.

AC Power - For initiating events, other than tornadoes and seismic events, the emergency AC power system seems to be among the reliable systems.

Emergency AC power is supplied by two hydro units rather than diesel generator sets.

The PRA indicates that hydro units are more reliable than diesel generators.

Because of the large capacity of hydro units, Oconee does not have the complexity of load sequencing.

The

reliability of emergency AC power system is further enhanced by two Lee Station combustion turbine generators that can provide AC power to Oconee emergency buses.

Thus, the contribution of sequences involving loss of AC power was found to be small.

8.

DC Power - The DC power system for all three units are interconnected and isolation features have been provided to prevent faults from a DC bus of one unit from feeding back to other units.

The use of separate DC power system for Keowee hydro units, for switthyard operations and non-vital power-conversion system loads avoid loaj shedding u1 der emergency conditions and thus has improved the reliability of DC power system.

9.

Low Pressure Injection System - The low pressure injection (LPI) system has significant operational and design features. A procedurtl step has been added to LOCA procedure that enables the operator to turn off LPI pumps if they are deadheading, which could occur for certain small LOCAs. This particular failure mode is very important since it damages r

the LPI pump and results in subsequent unavailability during recirculation mode of LPI operation.

Also operating procedures enable the operator to throttle the pump discharge flow and thus to prevent pump damage which could happen after being switched to recirculation mode following a medium or large LOCA event.

Overall, the LPI system reliability has been improved by the above procedure changes.

10.

Inter Unit Connections - The Oconee PRA indicates that interconnections between three units have both positive and negative benefits.

The important benefit is the ability to obtain emergency feedwater, service

. water, AC and DC power from other units if they are needed and could be recovered by operators effectively.

Also, the PRA highlights the adverse impact of inter.annections and these are:

a.

Sharing of TB and AB allows internal flooding from one unit to affect the other.

It is a great contributor to dominant sequences.

b.

The interties in the condenser circulating water system in the unmodified plant made isolation capability of internal flooding more difficult.

This resulted in plant modification significantly.

11.

Corrected Single Active Failures - Tne Oconee PRA indicates that two valves in redundant trains of LPI system had a common power supply.

The licensee recognized the significance of the non-compliance of the 3

single failure criterion requirements and increased LPI system unavailability.

Therefore, he has now provided separate power supplies to the above valves.

IV.

Overview on Generic Safety Concerns

~'

An initial reading of the PRA dominant sequences and systems failures contributing to the dominant sequences has highlighted the relative contribution to core damage from large scale external flooding.

A seismically induced failure of the upstream JoCassee dam could cause a large scale flooding of components required for long term decay heat removal from the core.

The dam is located 12 miles upstream of the Oconee site at a higher elevation than turbine-building safety equipment.

Using very simple and approximate techniques to assess

- the impact of such dam failures at the Oconne site, the PRA has obtained i

an estimate of 2.5x10 5 per reactor year (10%) for the external flooding contribution of the core damage frequency.

Although, the above estimate seems to have a very large uncertainty, the potential exists that of external flooding could be significant at other nuclear facilities depending on the plant construction, its elevation relative to upstream dams, and the seismicity at that site.

e

I

. TABLE 1.

Summary of Core Damage Frequencies Contributors Mean Frequency (RY) 1 Turbine-building floods 8.8E-5 1/

Earthquakes 6.3E-5 Plant transients Loss of service water 1.3E-5 Feedwater-line break 4.8E-6 Loss of instrument air 3.2E-6 Loss of offsite power 2.4E-6 Turbine or reactor trip 1.8E-6 Loss of main feewater 1.2E-6 Other transients 2.6E-6 Subtotal 2.9E-5 External floods 2.5E-5 Tornadoes 1.3E-5 Loss-of-coolant accidents (LOCAs)

Large 9.0E-6 Small 6.1E-6 2/

Reactor-vessel rupture 1.1E-6 Subtotal 1.6E-5 Fire 1.0E-5 Transients without scram 6.0E-6 Steam generator tube ruptures 2.7E-6 Interfacing-system LOCA 1.4E-7 Total 2.5E-4 1/ Based on analysis of the modified plant.

Before the p ant modification, the mean frequency estimate was about 6.4E-3 per reactcr year.

2/ This value is for spontaneous small-LOCAs, including pipe ruptures and seal failures.

Other transient-induced LOCAs are included in the transient category.

.