ML23109A078
| ML23109A078 | |
| Person / Time | |
|---|---|
| Issue date: | 04/13/2023 |
| From: | NRC/OCIO |
| To: | |
| Shared Package | |
| ML23109A075 | List: |
| References | |
| NRC-2022-000160 | |
| Download: ML23109A078 (1) | |
Text
{{#Wiki_filter:II . *I Duke Pou:er Compum : i\.' JI, \f/'7(;_1 Oconee .\ uclea, Generation Deour.n:,tr;; *, *e Prt!.11d~nr Pd B()X N];J " ,_'/; ,.,.i.J./.'1:' (jfftff
,:;J :-.~~5-35,;.1Fu.r e
DUKE POWER December 28, 1995 U. S. Nuclear Regulatory Commission Attention : Document Control . Desk Washington, DC 20555
Subject:
Oc onee Nuclear Stat ion, Unit~ 1 and 2
- Docket Nos.: 50-269, 50-270 and 50-287 Individual Plant Examination of External Events (I PEEE) Submittal Gentlemen:
In response to Generic Letter 88-20 , Supplement 4, Duke Power Company has completed the Individual Plant Examina.tion of External * ~vents * (IPEEE) for severe accident vulnerabilities at t he Oconee Nuclear Station ; The* attached report presents *the
- results.' The Ocon~e IPEEE program was conducted in accordance with the* appx;oacr and methodology described in our December 18; 1991, 180. day response letter,
- with one exception. The relay review, being done in conjunction with the USI A-46 relay review, has not been completed . The 180 day response was accepted by the NRC by its letter of June 16, 1992.
The scope .* of
- the relay. chatter re:view for Oconee is
- consistent with the s i te's seismic :margin r~v~3w level earthqua ke classification as defined in. ' Table 3 .1 of NUREG -
- 1407. Oconee is in the "full s9ope " :bin. The full _s cope evaluation requires a relay chatter review for all essential relays in *a ccordance wi t h the procedures outlined iri the Generic Implementation Procedure (GIP) . A simila*r *review of relays i s required for resolution of USI A-46. The relay
- review is in progress but has not been completed.
Approximately 5500 relays are being reviewed. To date, apprc ximately . 3860 of these relays ha~e been evaluat~d and determined not to be a concern.
- By letter dated Octobe~ 3, 1995, Duke -Power requested a revised submit~al date of
- Decembe3: 31, 1996 for USI A-46 in order to . c'?mplete this wor!c. In order to *meet the December 31,
- 1595 IPE~E submittal date, relay chatter *is accounted for in the IPEEE report
~~
-~ ~9
. ~*- . *. *.,: . * . . - 020 C~Cl
Document Control Desk December 21, 1995 Page 2 using the same fragilities as listed in the existing Oconee* PRA. It is ou!" expectation that the core damage frequency* for seismic events reported in this_ submittal w.i..11 not be significantly affected by the remaining relay analysis. An
- a.ddendum to the submittal _r eport will be s ubmitted by December 31, 1996 if the relay evaluation indicates any significantly new results in the existing relay chatter fragilities and seismic core damage frequency.
This Oconee IPEEE Submittal Report contains a ~ummary of the methods, results and conclusions of the Oconee IPEEE program. The IPEEE process and supporting Ocone~ PRA include a comprehensive, systematic examination of severe . accident potential resulting from external initiating events. The Oconee IPEEE has identified the severe accident sequences *of significance resulting from the external initiating events with quantitative perspectives on their likelihood . The insights from this study prompted some plant enhancements, as discussed in Section 7 of the enclosed repo_r t. The examination process and the accompanying dialogue have improved our understanding of these types of accidents. The integrated safety profile evident from the risk results confirms that the Oconee Nuclear Station poses no undue risk to the public health and safety. Therefore, the objectives of GL 88-20 are fully satisfied. Several . generic issues and unresolved saf~+:y
- issues were addressed and are considered closed out as a result of the previous PRA work and the IPEEE effort. These are: USI A-45, USI A-17, GI 57, GI 1 03, the Eastern U. S. Seismicity Issue, and NUREG/CR~5088 .
+n conclusion , the Oconee IPEEE completes all the studies requested by Generic Letter 88-20. This IPEEE submittal along with *the previous IPE submittal contains adequate information to resolve the severe accident vulnerability issue for Oconee.
Document Controi Desk December 21, 1995 Page 3 I declare under penal ties of per,ury that the statements set forth herein are true and correct to the best of my kn9wledge . . Very truly yours, 1!}f1!1};_f.r J. W. Hampton Attachment (IPEEE Submittal Report) xc: *(with attachment): Mr. S. D. Ebneter, Regional Administrator U. S. Nuclear Regulatory Commission, Region II Mr . Patrick D. Milano Office of Nuclear Reactor Regu l ation Mr. P . E. Harmon Senior Resident Inspector Oconee Nuclear Site
Duke Power Compauy OCONEE NUCLEAR. STATION IPEEE SUB.MITTAL REPORT December 21, 1995
TABLE OF CONTENTS EXECUTIVE
SUMMARY
1-1
1.1 BACKGROUND
AND OBJECTIVES 1-1 1.2 PLANTFAMILIARIZATION 1-1 1.3 OVERALL METHODOLOGY 1-2 1.3. l External Events Methodology 1-2 1.3.2 Plant Model 1-3 1.4
SUMMARY
OF MAJOR FINDINGS 1-3 1.4.1 Core Damage Frequency Results 1-3 1.4.2 Containment Performance Results 1-4 1.4.3 Vulnerability Findings 1-6
- 2. EXAMINATION DESCRIYfION 2-1 .
2.1 INTRODUCTION
. 2-1 2.2 CONFORMANCE WITH GENERIC LEITER AND SUPPORTING MATERIAL 2-1 2.3 GENERAL METHODOLOGY 2-3 2.4 INFORMATION ASSEMBLY 2-4
- 3. SEISMIC ANALYSIS 3-1 3.0 METIIODOLOGY SELECTION 3-1 3.1 SEISMIC PRA 3-1 3.1.1 Hazard Analysis 3-f 3.1.2 Review of Plant Information and Wallcdown 3-2 3.1.2. l Plant Information 3-2 3.1.2.2 Information Sources *3-4 3.1.2.3 Wallcdowns 3-6
- 3.1.3 Analysis of Plant System and Structure Respom,~ 3-10 3.1.4 Evaluation of Component Fragilities and Failure Modes 3~ 13 3.1.5 Analysis of Plant Systems and Sequences 3-*15 3.1.5.1 Seismic Event Tree 3-15 3.1.5.2 Supporting Fault Tree Logic 3-18 3.1.5.3 Event Tree Sequences 3-25 3.1.5.4 Seismic Fault Tree Solution 3-27 3.1.5.5 Sequence Distribution and Timing of Core Damage 3-29 3.1.5.6 Sensitivity of the Auxiliary Building Surrogate 3-29
- 3.1.5.7 Extrapolation Beyond l.02g* Acceleration Levels 3-30 3.1.6 Analysis of Containment Perfor:mance* 3-30 3.2 USI A-45, GI-131 , AND OTHER SEISMIC SAFETY ISSUES 3-32
Section ~ 4. INTERNAL FIRE ANALYSIS
,," METI-JOOOLO~YSELECTION 4-1 4-1 4.1 FIRE HAZARD ANALYSIS 4-1 4.2 REVIEW OF PLANT INFORMATION AND WALKDOWN 4-2 4.3 FIRE GROWTJ::1 AND PROPAGATION 4-2 4.3.1 Cable Shaft Fire 4-2 4.3.2 Turbine Building Fire 4-3 4.4 EVALUATION OF COMPONENT FRAGILITIES AND FAILURE MODES 4-3 4.5 FIRE DETECTION AND SUPPRESSION 4-4 4.6 ANALYSIS OF PLANT SYSTEMS, SEQUENCES, AND PLANT RESPONSE 4-4 4.7 ANALYSIS OF CONTAINMENT PERFORMANCE 4-5 4.8 TREATMENT OF FIRE RISK SCOPING STUDY ISSUES 4-5 4.8.1 Strategy 4-5 4.8.2 Walkdown Team 4-5 4.8.3 PRA Assumptions, Input and Verification 4-5 4.8.4 Smoke Generation/Migration Effects 4-6 4.8.5 Water Spray and Migration Effects 4-7 4.8.6 Seismic/Fire Interaction 4-7 4.8.7 Control System Interactions 4-9 4.8.8 Compartment Interaction Analysis 4-9 4.8.9 Walkdown Conclusions 4-10 4.9
SUMMARY
OF RECOMMENDATIONS 4-10 4.10 USI-45 AND OTHER SAFETY ISSUES 4-11 4.11 SENSITIVITY STUDIES 4-11 4.12 . DOCUMENTS 4-11
- s. HIGH WINDS, FLOODS AND OTHERS 5-1 5.1 HIGH WINDS 5-1 5.1.1 Overview 5-1 5.1.2 Methodology 5-2 5.1.2.1 Tornado Occurrence Frequencies 5-2 5.1.2.2 Tornado Wind Effects 5-3 5.1.2.3 Tornado Missile Simulation Analysis 5-8 5.1.2.4 Keowee Tornado Path 5-9 5.1.3' Tornado Event Tree 5-10 5.1.3.1 Event Tree Structure 5-10 5.1.3.2 Top Event Failure Logic 5-11 5.1.3.3 Event Tree Sequences 5-13 5.1.4 Containment Performance 5-15 5.1.4.1 Containment Isolation 5-15 5.1 .4.2 Containf!lent Safeguards 5-15 ii
- Section fue 5.1.5 Limitations of the Analysis 5-15 5.1.6 Resu'. :s 5-16 5.1.7 Unit Differencies 5-16 5.1.8 Insights 5-17 5.1.9 Conclusions 5-17 5.1.10 Recommendations 5-17 5.2 EXTERNAL FLOODS 5-17 5.2.1 Methodology 5-18 5.2.1.1 External Flooding From Precipitation 5-18 5.2.1.2 External Flooding From Dam Failure 5-19 5.2.2 Event Tree 5-23 5.2.2.1 Event Tree Structure 5-23 5.2.2.2 Event Tree Sequences 5-24 5.2.3 Fault Tree Analysis 5-25 5.2.4 Containment Performance 5-26 5.2.5 Limitations of the Analysis 5-26 5.2.6 Results . 5-27
- 5.2.7 Insights 5-27 5.2.8 Conclusions 5-27 5.3 TRANSPORTATION AND NEARBY FACil...ITY ACCIDENTS 5-27 5.3.1 Aircraft Crashes 5-27 5.3.2 Transponation Events 5-30 5.3.3 Impact of Nearby Military and Industrial Facilities 5-31 5.3.4 On-Site Storage of Toxic Materials 5-31 5.3.5 On-Site Storage of Explosive Materials 5-32 5.3.5.1 Propane Tanks 5-32 5.3.5.2 Hydrogen Storage 5-33 5.3.6 Gas Pipeline Ruptures 5-35 5.3.6.1 Natural Gas Pipelines 5-35 5.3.6.2 Off-Site Propane Storage Facilities 5-35 5.4 OTHERS 5-35
- 6. LICENSEE PARTICIPATION AND INTERNAL REVIEW TEAM 6-1 6.1 IPEEE PROGRAM ORGANIZATION 6-1 6.2 COMPOSITTON OF INDEPENDENT REVIEW TEAM 6-1 6.3 AREAS OF REVIEW AND MAJOR COMMENTS 6-1 6.4 RESOLUTION OF COMMENTS 6-2
- 7. PLANT IMPROVEME~TS AND UNIQUE SAFETY FEATURES 7-1
- 8.
SUMMARY
AND CONCLUSIONS 8-1
- 9. REFERENCES 9-1 iii
APPENDIX A OCONEE SEISMIC FAULT TREE APPENDIXB OCONEE PRA REV. 2, SECTION 3.5 APPENDIXC OCONEETORNADOFAULTTFEE APPENDIXD OCONEE EXTERNAL FLOOD FAULT TREE LIST OF FIGURES EiiYJC Number Figure 3-1 .Oconee Seismic Hazard Curves 3-68 Figure 3-2 Oconee Seismic Event Tree 3-69 Figure 5-1 . Oconee Tornado Event Tree 5-95 Figure 5-2 Diagram of Tornado Origins 5-96 Figure 5-3 Layout of Oconee Nuclear Station 5-97 Figure 5-4
- TORMIS Analysis Plant Site Model 5-98 Figure 5-5 Oconee Nuclear Station Missile Origination Zones 5-100 Figure 5-6 Oconee External Flooding Event Tree 5-101 LIST OF TABLES Table Number ~
Table l* l External Initiating Events Core Damage Frequency 1-7 Table 3-1 Component Fragilities Used In The Oconee Seismic Analysis 3-34 Table 3-2 Additional Seismic Plant Model Basic Event Data 3-36 Table 3-3 Enhancements Resulting from the IPEEE Seismic Verification Walkdown 3-39 Table 3-4 Dominant Seismic Event Sequences 3-44 Table 3-5 Dominant Seismic Event Sequences - LLNL Curve 3-63 Table 3-6 Seismically-Induced Core-Melt Results By Sequence 3-66 Table 3-7 Timing of Seismic Core D_amage Sequences 3-67 Table 5-1 Preliminary External Initiating Event List 5-36 Table 5-2 Tornado Data and Frequency 5-37 iv
Table Number Table 5-3 Piping Damaged by Tornado-Induced *west Penetration Room Failure 5-38 Table 5-4 Oconee Nuclear Station Missile Distribution 5-39 Table 5-5 Conditional Probability *of Damage By Tornado-Generated Missile 5-41 Table 5-6 Keowee Conditional Failure Probabilities 5-42 Table 5-7 CAFfA TornadoBasic Event Data 5-43 Table 5-8 Event Tree Failure Modes Considered 5-44 Table 5-9 Tornado Cut Sets 5-47 Table 5-10 Tornado Results By Sequence 5-72 Table 5-11 Oconee Tornado Event Importance Measures 5-73 Table 5-12 External Aooding Model Reliability Data 5-74 Table 5-13 External Flood Cut Sets With Sequence*Designations 5-80 Table 5-14 External Flood Results By Sequence 5-86 Table 5-15 Dam F~lures Used in This Study 5-87 Table 5-16 Chronological Order of Dam Failures 5-88 Table 5-17 1993 Greenville / Spartanburg Air Traffic Summary 5-89 Table 5-18 1993 Asheville Air Traffic Summary 5-90 Table 5-19 Accident Rate For U.S. Air Carriers; 1980 - 1991 5-91 Table 5-20 Screening Justification for Other External Initiating Events 5-92 Table 6-1 Peer Review Team Members 6-3 Table 6-2 Peer Review Team Comments and Resolutions 6-4 V
- 1. EXECUTIVE
SUMMARY
1.1 BACKGROUND
AND OBJECTIVES In l ~ov, the Nuclear Safety Analysis Center (NSAC) . uigested that ' a plant-specific . probabilistic risk assessment (PRA) be undenaken by the nuclear industry .on its own initiative. The proposal for an industry PRA project, managed by NSAC and performed in cooperation with a utility, was reviewed with the NSAC utility advisors and. approved. Duke Power Company and Oconee Nuclear Station were chosen. for the project The NSAC study was published in June 1984 as NSA~-60 (Ref. 1.1).
- Soon after embarking on the NSAC-60 effort, Duke organized a Severe Accident Analysis Group to facilitate large scale PRA and reliability stu~ies. This group was charged with the responsibility to plan, conduct and coordinate .iill proposed *PAA studies, and to maintain and update the plant PRA models as appropriate.
In January 1987, Duke Power initiated a large-scale review and update of the original study. The major objectives of the review and update were to (1) incorporate plant changes made since the time ofthe original study, (:Z) improve on asswnptions made in the original study, (3) make use of plant experience/data from the 1980s, and (4) make use of improvements in PRA methodology and up-to-date techniques. In December 1990, Duke submitted this updated PRA (Ref. 1.2) to meet the requirements of Generic Letter 88-20 {Ref. 1.3) concerning the Individual. Plant Examination (IPE) covering internal events. The IPE submittal {Ref. 1.4) explained that the Oconee PRA is a full-scope, level 3 PRA with complete analysis of external e_vents in addition to internal
- events. External events have been included in the Oconee PRA studies beginning with the original study.
Consistent with the IPEEE submittal plans outlined in the December 18, 1991 .Duke letter (Ref. i.5), and approved by the NRC letter of June 16, 1992 (Ref. 1.6), Duke Power Company provides herein the response to GL 88-20, Supplement 4 {Ref. 1.7). Included in this report (designated as the IPEEE Submittal Report) is a revisi~n of certain sections of the Oconee PRA report. To facilitate the NRC staff review, the IPEEE information has been presented using the standard table of contents given in Table C. l of NUREG-1407 (Ref. 1.8). . . . 1.2 PLANT FAMILIARIZATION Oconee Nuclear Station, located in Oconee County in northwestern South Carolina, is sited on the shore of Lake Keowee, a Duke impoµndment on the Keowee River, a tributary of the Savannah River. The station was buiit during the 1967 to 1974 period. Unit 1 began commercial operation in 1973, and the last unit (Unit 3) began commercial operation in 1974. The station con~ists of three Babcock & Wilcox pressurized water reactors, each designed to. generate 2568 MWt. The balance of plant station was designed 1- 1
and constructed by Duke Power Company, with Bechtel Corporation designing the Reactor Building. The station consists of three .reactor buildings, a common turbine building for all three units, and two auxiliary buildings; one servicing units I and 2, and the other servicing unit 3: The nuclear steam supply system has two loops with two cold legs each. Each unit has two "once-through" steam generators that produce superheated steam at constant pressure. The reactor and nuclear steam supply system are contained within the reactor building, a prestressed, post-tensioned reinforced concrete cylinder and dome with a ste~I liner. Emerg~ncy power for the Oco*nee systems is provided by the two units of the Keowee hydroelectric station, which is located at the Keowee Darn, about a mile away from the plant. In addition to a large grid network, backup power is also available through a dedicated line from three . combustion turbine units at the _Lee Stearn Station, approximately 30 miles away. The piant design incorporates the Standby Shutdown Facility (SSF), a totally independent means of achieving and maintaining safe shutdown conditions if the normal plant safety systems are unavailable. 1.3 OVERALL METHODOLOGY 1.3.1 External Events Method<?logy The evaluation of external events was performed in the original Oconee PRA repon and its subsequent update with four events identified for a detailed review:
- Seismic Activity
- Fires
- Tornadoes
- Floods In addition, NUREG-1407 requires a review of transportation and nearby facility accidents. (It should be noted that thes_e events were also evaluated in the original PRA repon, but their probabilities of occurrence were determined to be very low -
<lE-08. Nevertheless, an evaluation using updated information is presented.)
A variety of methodologies were employed to derive the overall event frequencies for these events, as explained in detail in Sections 3'.0, 4.0, a_nd 5.0 of this repon. The findings from the original PRA studies have been updated as necessary to suppon this examination. 1-2
, 1.3.2 Plant Model The Oconee PRA is a full-scope analysis comprised of three pans and use*s methods consistent with the PRA Procedures Guide (NUREG-2300) (Ref. 1.9). The Level I or "front end" analysis determines core damage sequences as a result of various internal and external events and places ihese sequences into plant-damage state bins.
The Level II and III or "back end" analyses determine the effect of the acddent sequences on containment and the resulting radiological releases to the public. The basic models used for accident sequence de':'eloprrient are event trees and fault trees. The event trees used in this analysis are functional e\*ent trees, with the top
- events defining the functions needed to protect the .core. The end states of the functional event tree represent functional sequences. The event tree end states are also used to place accident sequences into plant-damage state bins. These bins are the transition from the front end analysis to the back end analysis.
The plant systems have been analyz.ed with detailed fa ult trees, generally to the component level. The level of detail in the model is defined by the level.at which data is available. This IPEEE study is primarily a Level I analysis which determines the event frequencies of external events. As with internal ~vents, external events are input to the Levei I plant model and their contribution to core damage risk is detennined. The Level II analysis involves the containment response to various accidents and core damage progression thereof and, _thus, is not expressly influenced by external events. Rather, the external event impacts on active systems that affect containment performance (e.g., containment ventilation, spray, isolation, etc.) arc addressed in this examination. * * * ~-4
SUMMARY
OF MAJOR FINDINGS . The major findings from this examination are that there are no unduly significant sequences (vulnerabilities) from external events. Seismic events are the most significant external event contributors to core damage risk. There were no pl~nt cha:1ges identified that would significantly reduce the risk from external events. 1.4.1 Core Damage Frequency Results The results of the Oconee PRA report provide an estimate of. plant severe accident risk and an understanding of the basis for this risk. The Core Damage Frequency (CDF) from external events as a result of the IPEEE evaluation is 6. 1E-05 / yr., compared to 8.7E-05 / yr. estimated in the Oconee IPE report. These results are applicable to all three units of the plant 1-3
The contribution of the external events to the CDF and their comparison with the IPE values is shown in Table 1-1. Seismic events comprise approximately 59% of the calculated external event CDF. The primary accident sequences involve Joss of power events coupled with SSF failures. Flooding events (due to the seismically-induced failure of the focassee Dam) are also dominant contributors to the seismic CDF. The mean seismic hazard curve, generated by EPRI specific~y for the Oconee site, is used as the basis for this analysis. A sensitivity study was perfQrmed using the January 1989 Lawrence Livermore National Lab (LLNL) hazard curves for Oconee. The dominant accident sequences are ~omparable in their ranking with the EPRI curve results and do not add to or alter any of the insights of this analysis. Tornado events make uo annroxirnatelv 21% of the calculated external event CDF. (b)(7)(F), (bX3) 16 U .S.C. § 8240-l(d) Internal fire events account for approximately 8% of the calculated external events CDF. The dominant fire sequences occur in the Turbine Building; however, there were no unacceptable risks or outliers identified.*
- External flooding events (caused by a random failure of Jocassee com rise l 12% f the total external event CDF
&RVC£H (bX7)(F), (bX3):16 U .S.C. § 8240-l(d) 1.4.2
- Containment Performance Results External event impact on containment performance has been examined from several perspectives, as follows:
- Containment Structure - The Reactor Building and containment internal structures were found to be seismically *rugged based upon an evaluation of their median seismic fragilites. These structures are also designed to withstand tornado and other high wind effects. The consequences of airplane crashes and turbine~generated missiles were determined to be insignificant. No other hazard was identified that could challenge the containment structure.
SENSITIVE SEGUIHTY R£UrTED INfOIH,f1rTf ON Cftl'flCAL ENERGYIELECTRf GAb INF RASTil:UCTUEUs 1Nr0~,4ATIO~J 1-4 .
- Containment Isolation - A screening analysis of containment penetrations was performed in the PRA report to detennine which penetrations, if failed, could kad to significant release pathways. The sei~mic impact on containment isolation was evaluated by analyzing t:, : ;~ p.:netrations along with their associated piping and valves. They were found to
- be sufficiently rugged to withstand a seismic event. The probability of damage to penetrations and valves due to a tornado were judged to be low.
- The containment isolation signals are generated via the Emergency Safeguards Features Actuation System (ESFAS). The cabinets housing this equipment were evaluated for functional ruggedness. Likewise. the respective panelboards and motor control centers providing *power to actuate the valve solenoids and motors were analyzed and evaluated via plant wallcdowns. The motor control centers, load centers, and panelboards were modeled as a group due to their similarity of design. Thus, specific equipment of this nature used to actuate containment isolation was evaluated on this basis. Two failure modes were identified for this equipment. Structural failures are modeled by the Auxiliary Building surrogate. The other failure mode for these items is unrecovered ~lay chatter. Reviews are currently being conducted to detennine (and replace, as necessary) any 'bad actor' relays found within the systems identified under the IPEEE scope of review. The ES FAS is included in this scope.
External flooding events will result in a loss of all power to the containment* isolation valves. The plant response at this point would. be the same as other station blackout events. Motor-operated valres are designed to fail in their "as
. is" position. Air-operated valves are designed to fail in the closed position upon a loss of instrument air.
(b)(7)(F), (b)(3):16 U S.C. § 8240-l(d)
.....__ _ __ _ _ _ ____,J,Each of these is designed to fail close upon e1 er a loss of power or air. Failures of the remaining penetrations were detennined to be probabilistically insignificant
- Containment Safe&uards - External events were *ud ed to have no Wli ue irn act on the containment safe uards.
(b)(7)(F), (b)(3):!6 U.S.C § 8240-l(d) In general, the containment safeguards systems are well rotected from the effects of tornado wind and missile dama e (b)(7)(F), (b)(3):16 U.S.C. § 8240-l(d) 1-5
r X7XF), (b)(3) 16 U.S.C. § 8240-l(d) The* containment safe uards com nents were evaluated for seismic ru edness: (bX7)(F). (bX3) 16 U.S C. § 8240-l(d) l(b)(7XF), (bX3) 16 U.S.C. § 82-fo- l (d) 1.4.3 Vulnerability Findings The basic finding of the evaluations summariz.ed in this report is that there are no fundamental weaknesses or vulnerabilities with regard to severe accident risk at Oconee Nuclear Station. 1-6
TABLE 1-1 External Initiating Events Core Damage Frequency IPE Report (.12/90) IPEEE Report (12/95) Core Damage Percent of Core Damage Percent of Frequency Total Frequency Total (per year) (per year) Initiating Event Seismic 5.0E-05 57.5% 3.6E-05 58.9% Fires
- 2.2E-05 25.3% 5.0E-06 8.2%
Tornadoes 9.7E-06 11.1% l.3E-05 21.3% Ext. Flooding 4.9E-06 5.6% 7.0E-06 ' 11.5% Transportation -------- -------- ---*---- --------
& Nearby Facilities
- Tota) External 8.7E-05 6.lE-05 1-7
- 2. EXAMINATION DESCRIPTION
2.1 INTRODUCTION
The Individual Plant Examination Of External Events (lPEEE) for Oconee Nuclear Station was performed on the basis of the original Oconee PRA and its subsequent update. This report summarizes the examination process for external events performed from 1980
- 1984 for the original Oconee PRA (NSAC-60), the continuing process of updating the risk model which resulted in the updated PRA issued in 1990, and the results of the latest update to support the IPEEE.
The method of examination of external events used in the Oconee PRA and the subsequent updates is the standard PRA method, with the enhancements described in Section 4 of the Generic. Letter 88-20, Supplement 4.. State-of-the-art probabilistic risk assessment (PRA) methods and current plant information were used in the original Oconee PRA and in the subsequent updates. The specific external events identified in .GL 88-20, Supplement 4 have been addressed and arc disc~ssed in the , pertinent sections. Comprehensive plant walkdowns have been performe~ !to investiga~ and tQ incorporate the actual plant conditions in the examination. The basic event valu~s involving random equipment failure, human error probabilities, and test and maintenance unavailabilities
. . are compiled in the IPE analysis.
2.2 CONFORMANCE WITH GENERIC LETTER AND SUPPORTING. MATERIAL Generic Letter 88-20, Supplement 4 identified four ge,ieral purposes for each utility in performing the IPEEE. Duke Power Company has satisned these as fo,Uows: 1, Develop .an Appreciation of Severe *Accident Behavior - Duke Power Company's initial staffing to enable large scale PRA and reliability studies in-house began in 1980. A severe accident analysis group was organized and charged with the responsibility to plan, conduct, and coordinate all proposed PRA studies and to maint:::1 and update the plant PRA models as appropri::1t*P.. In addition to PRA studies, this group is also utilized for engineering *support involving severe accident input in such areas as emergency planning, plant deiign changes.and plant operational problems. *
- In conducting,a full-scope .PRA, personnel from the Severe Acciqent Analysis Section perform a majority of the PRA-related tasks. This core group is augmented by specialized expertise in mechanical, electrical and civil disciplines from other areas of the Nuclear Generation Department. In addition, the expertise of an operations engineer, assigned to support the PRA *effort, is:* utilized to .factor I
in operational insights on initiating events, accident sequence modeling, human reliability analysis and recovery actions. In the case of some specialized inputs, such as site seismology and equipment fragilities, outside expertise is utilized to complete the tasks. 2-1
The IPEEE effort was completed primarily in-house, with limited contract support for seismic studies.
- 2. Understand the Most Likely Severe Accident Sequences - lbe Oconee PRA report and . the IPEEE ~valuation have consistently ~~ ,1w~1 the same dominant accident sequences from external events. Seismic events, mternal fires, tornadoes and external flocxfing events are identified to be the most significant external event contributors t c e dama e risk. Seismic events com rise a ma *ori of the external event CDF (bX7)(F), (b)(3):16 U.S C. § 8240- l (d)
SRVCEif
- 3. Gain a More Qualitative Understanding of the Probabilities of Core Damage and Releases - The plant systems have been analyzed with detailed fault trees, generally to the component level. The CAFTA computer code (Ref. 2:1) was used to solve the plant models and generate accident sequences in response to various ~ternal and external events. Once the accident sequences have been determined, they are categorized, or 'binned', according to the severity of the systems failures, LOCAs, etc. A complete set of computer runs using the Modular Accident Analysis Program (MAAP) code (Ref. 2.2) *has been developed for each 'bin' and provides *an estimate of time to core damage. The resulting releases from external- event core damage accidents are discussed fully in the Oconee PRA report (Ref. 1.2).
- 4. Reduce, if Necessary, the Overall Probabilities of Core Damage and Releases -
Whereas mis examination of external events* did not result in any major actions or modifications which could potentially reduce the overall core damage probability, several plant enhancements were identified during the development of the internal events portion of the IPE. These may be found in Section 6.0 of the Oconee IPE submittal report. The detailed IPEEE walkdown effort identified a few repairs and modifications that are minor in scope to enhance the seismic adequacy of several components. These are listed in Table 3-3 and Section 4.9. 6J;;N6ITIVJ;; 6J;;GUR,1TY ~bATJ;;D nJPORUATION Rff1AL EHEROYfELECTRiCAL HffRAS1' RUCTURE HffOf~MAHOH 2-2
The Generic Letter Supplement also identified the issu~ of ensuring tl,te _technical adequacy of the IPEEE and validating its results. These are addressed as follows: .
* . The pre-IPEEE analyses, original PRA study and subsequent update, have received several stages of 1.11ternal review. First, each of the major analytical tasks went through a peer review within the project team. Subsequently. it was reviewed by the project.manager/ engineering supervisor to ensW"F that the analyst had perfonned an adequate analysis and that it had gone through an .appropriate peer review. Following
- the two levels of review performed within' the. project team, engineering personnel outside the PRA project team familiar with plant systems and accident sequences conducted a review of system models, underlying assumptions, system level results, and overall results. In parallel with the engineering review, the PRA draft repon was reviewed by selected station personnel. The _ focus of this review was the reasonableness of the underlying assumptions for system operation and operator actions. Besides the technical review of the PRA, management briefings were given to apprise key management personnel of the results and conclusions.
1
- The results of the IPEEE effon were given approximateiy the same level of review as the previous studies.
- Independent Review Teams (seismic and fi~e) were formed to perform a review of the IPEEE process and results. These teams consisted of senior level employees with experience in PRA methodology, seismic equipment qualification, fire_protection, and systems engineering. The seismic team included experts from outside the company.
Thus, Duke Power has satisfied the objectives of the generic letter by its original PRA, subsequent updates, and the latest IPEEE effort. The )Duke Power_staff_has realized the maximum benefits from the program by their involvement in all aspects of the examination. 2.3 GENERAL MEIBODOLOOY The general methodology for examining external events is consistent with the methods
. presented in _NUREG/CR-2300. The general approach used to develop the external event PRA *is as *follows:
- Natural and man-made external events of interest were identified using other PRAs, NSAC/60, ANSI/ANS-2.12 (Ref. 2.3), and the aforementioned NUREG/CR-2300.
- The resulting events were screened in order to sel~ct significant events requiring funher review. Twenty events were identified.
- A scoping analysis was perfonned on the remaining events. Four were identified that warranted a detailed quantification: earthquakes, floods, tornadoes, and fires.
2-3
This approach is presented in greater detail in the Oconee PRA report. (Note that this revised external events analysis also includes an updated review of transportation and nearby facilities accidents per NUREG-1407.) The specific methodology for each hazard is discussed ir, Sections 3.0, 4.0, and 5.0. 2.4 INFORMATION ASSEMBLY Many sources of information were used during the IPEEE process. These include the Oconee FSAR (Ref. 2.4), Oconee SER (Ref. 2.5), vendor seismic qualification design reports, vendor seismic qualification test reports, equipment spedfications, plant drawings, vendor drawings, dynamic analyses of structures, in-structure response spectra, Oconee Probabilistic Seismic Hazard Evaluation (Ref. 2.6), structural design calculations, equipment anchorage design calculations, flow diagrams, computer codes, air traffic infonnation, evacuation plans, operating procedures; National Weather Service data, and various other NRC and EPRI technical reports. Additional sources of information related to the fire review are listed in Section 4.12. The original PRA report included the then-current plant design documents, operating procedures, Tech. Specs., and plant configuration. The subsequent revision to the PRA used updated information as appropriate. Coordination activities of the IPEEE teams among the external events are handled by Duke Power's Severe Accident Analysis Section which is responsible for the Oconee PRA. Individuals from this group were on all the teams and were responsible for coordination and the final results . . As an example, any potential for seismically-induced fires was communicated between the fire and seismic teams.
- 2-4
S. HIGH WINDS, FLOODS, AND OTHERS A detailed *list of natural and man-made external events was reviewed and screened for applicability to Oconee. A listing of these events is given in Table 5-1 and may also be found in Section 3. I of the Oconee PRA report. Of these, four were identified that warranted a detailed quantification: earthquakes, fires, tornadoes, and floods. Transportation and nearby facility accidents were also evaluated in the original PRA report and its revision, but their probabilities of occurrence were found to be very low. Nevertheless, tQ meet the specifications of NUREG-1407, an evaluation using updated information is also presented for these events. 5.l HIGH WINDS 5.1. I ' Overview This section describes the process of assessing potential plant vulnerabilities induced by high winds and tornadoes. Initially, three* types of winds were initially considered for this study: Hurricanes, Tornadoes, and Non-torriadic (Straight) Windstorms. However, Oconee' s inland location makes the probability of severe wind damage due to hurricanes very unlikely and the probability of damage to importarit components or structures from non-tornadic (straight) winds .is low compared to that of tornadoes. The Oconee *FSAR
. reports the maximum 100 year wind velocity at the site to be 95 mph. All class 1 structures at Oconee are designed for at least 95 mph wind or to a higher standard. For these reasons, hurricanes and "straight windstonns" arc not considered any further. The primary purpose of this.assessment is focused only on tornado damage _events and the resulting core damage frequency.
- Only tornado events which cause damage to plant structures or equipment in conjunction with a loss .o f off-site power are*considered in this assessment. The switchyard and Kcowee overhead path are assumed unavailable following a tornado strike. The risk associated with tornadoes that result in only a loss of off-site power but no damage to plarit structures or equipment is implicitly covered by the T5W (LOOP due to weather) initiating event in the IPE Study.
This assessment is an update to an earlier tornado study .for the Oconee PRA (Ref. 1.2).
.This previous study also relied heavily on a tornado assess)nent perfonried for NSAC/60.
Consistent with the Oconee PRA, Unit 3 is used as the reference unit for this study; An. event tree is conscructed to delineate core damage sequences caused by probable missile damage and tornado-wind effects on vulnerable structures. The analysis considers two categories of tornado events: 5-1
ath of the most robable tornado direction and thus is more susce tible to dama e. (bX7)(F), (bX3):16 U.S.C. § 8240-l(d) 5.1.8 Insights nee Tornado Core-Melt Fre (bX7XF), (bX3):16u.s.c. § 8240-l(d)
. Damage caused by . tornado-generated missiles are an insignific~t contributor to the probability of core damage.
-5.1.9 Conclusions The Oconee tornado core damage frequency of 1.29E-05 is of the same magnitude as other potential severe accidents such as seismic. events, fires, floods, and other events. Thus,
- Oconee plant risk due to tornado does not_pose a severe accident vulqerability.
5.1.10 Recommendations *
~ ~~ .._,which has the highest impact on tornado ris~(bX7XF). (bX3)16 u.s.c. § 8240-1<d)
~ .........__......It is recommended that station rsonnel stud enhancements to the natural rocedure (bX7)(F), (bX3):16U.S.C. § 8240-l (d) 5.2 'EXTERNAL FLOODS
_The details of the Oconee flooding analysis are presen~d in Section 3.3 of the PRA repon. Flooding from both internal and external sources was reviewed. External flooding occurs
- from heavy rains or breaches of dams.
- Two potential events were found that ~ould lead to external flooding of the Oconee site.
The first is a general ~ooding of the rive:s and reservoirs in the area due to a rainfall in excess of the probable 'maximum precipitation (PMP). Since the Oco,nee site is well inland, 1 the effects of hurricanes were not considered. The relative
' ' size of the reservoirs around the plant, and the distance of the site from the coast, are considered ~jor *impediments to 5-17
hurricane-induced surge flooding of a *severity approaching that which is caused by runoff-type flooding. During review of simil_arly _located sites, the NRC staff found that surge
. producing winds would be significantly reduced when land mass frictional effects are encountered; therefore, surge flooding is negligible at Oconee Nuclear Station.
The second source of external flooding is a possible random failure of the Jocassee Dam. Random dam failures include all causes other than a rain-induced failure (which will be discussed below) or an earthquake-induced failure (see Section 3.0 of this report). 5.2.1 Methodology 5.2.1.1 External Floodinc from Precipitation The PMP postulated for the Oconee site would be 26.6 inches within 48 hours. The effects of this PMP on reservoirs and spillways were evaluated in a study performed by Duke Power Company in 1966 (Ref. 5.22). The results of this study demonstrated that the Keowee and Jocassee reservoirs are designed to contain and control* the floods that could result from a PMP. Thus, in order to flood the plant site, rainfall exceeding the PMP must occur. The frequency of exceeding the PMP was obtained from the analysis presented in Ref. 5.23 for the Oconee site and was used as a bounding estimate of the frequency of core damage due to rain-induced external flooding. The analysis yields the following frequencies of a PMP ass~iated with the lower, median, and upper bounds of the probability distribution: Cumulative PMP frequency probability (J)er yr) 0.05 4.9E-8 0.50 2.9E-7 0.95 8.9E-7 The cumulative probability for a particular frequency interval is to be interpreted as the degree of cenainty that the PMP frequency observed over a long period of time will be less than or equal to _the upper value of that frequency interval. 0,Xl)()'), 0,)()) 16 U s C, § 82'0. J(a) SRVC£H . 1 Applying the SSF as a response to exceeding the PMP results in a calculated core damage frequency appro~imately an order of magnitude lower than the mean PMP frequency. In addition, the calculated mean.frequency of the PMP is more than an order of magnitude less than that due to a random failure of Jocassee Dam, which would also flood the site. For both these reasons, it was concluded that precipitation-induced external flooding is a S£HSITIY£ SECURITY RELATED Ht POP"1 t ATIO~+ GIUTIGAL E~HiRGY}ELEGTRJGAL nrPRA~TRUGTURE l~+fQR;p4ATIO~t 5-18
negligible con.tributor to core damage frequency and p~blic risk. 5.2.1.2 External Flooding From Dam Failure 7-: : Oconee site _has a yard grade elevation a few ~rt r t c: J W the full-pond level of Lake Keowee, which serves as the source of its condenser circulating water. Lake Jocassee has a full-pond.elevation about 300 feet above Lake Keowee. If a sudden failure of the Jocassee Dam were to occur, and a rapid enough release of the impounded water from Lake Jocassee into Lake Keowee resulted, the flood wave generated in Lake Keowee would overtop the Keowee Dam and the Oconee intake dike, flooding the plant This section presents the analysis performed to estimate the frequency of such a flood. Frequency of Dam Failure . The Jocassee Dam is an earth-rockfill structure approximately 400 feet high. The dam was completed in 1972, and the reservoir was filled by April 1974. The spillway lies-along one of the abutments, about one-quarter of a mile from the dam, and is a concrete structure founded on granite. An analysis was performed to determine an annual frequency of failure-for earth, earth-
.rockfill, and rockfill dams due to events other than ovenopping and earthquake ground shaking, which were considered in separate analyses. Also, based on dam design
- information, structural failure of the spillway- during discharge and failure associated with seepage along an outlet works have been eliminated as a possible failure mechanism. The following principal modes of failure were considered:
*I. Piping.
- 2. Seepage.
- 3. Embankment slides.
- 4. Structural failure of the foundation or abutments.
These failure mechanisms are referred to collectively as random failures. Only" failures resulting in the complete collapse of the structure .and the uncontrolled release of the reservoir's contents were considered to have the potential for flooding the Oconee plant Previous investigations into the frequency of dam failure indicate that it decreases with later years of construction (Ref 5.24). This is generally attributed to improvements in the methods of design and construction. Therefore, another criterion considered in developing a data base and *failure-frequency estimate was the period of construcµon. The age of a darn is another factor that has been identified as having an effect on the rate of dam failure. Approximately half the darn failures occur during the first 5 years of operation (Ref. 5.31). Therefore, age was also considered in developing a data base. Size, type of construction, realistic failure modes, .Pcrio.d of construction, and age were the 5-19
major considerations used to define a data base for use in estimating the failure frequency of the Jocassee Dam. The data base characteristics that were attributed to the Jocassee Dam are: Characteristic Jocassee Dam Location (country) United States Year completed 1972 Age (years in operation) 21 Height (feet) 400 Type Earth-rockfill Various catalogs were used to develop the data groups that were studied (Ref. 5.25). Each group consisted of large earth, earth-rockfill, or rockfill dams (more than 45 feet high - Ref. 5.26) in the United States that were in operation 6 or more years when they failed. Of the references used in this *study, none were a complete catalog, and therefore they were used collectively. At present, these references represent the best . readily available information. From the various listings offailures, cross-checks were made when possible. A data base uniquely suited in every major respect to the Jocassee Dam was unattainable because of a scarcity of the number of the earth-rockfill type. The data base ultimately developed reflects discussions with Duke Power engineers familiar with the characteristics of the Jocassee Dam. It was decided that the data biise should include only the failure modes that could occur at Jocassee. The two major failure types excluded from the data set w~re failures resulting from piping at a conduit passing through the dam and structural failures of the spillway during the flood discharge. Neither of these failures can* occur because the necessary physical conditions do not exist at_'Jocassee. (Note, however, that dams in the data base do include those that can fail in either or both of these modes, This is proper because the experience from these dams represents realizations of non-failure for other failure modes, such as embankment piping, foundation failure, and slope failure.) Because of limitations in the historical record, it is possibly only* to develop a data set that takes into account a limited number of the specific propenies of the Jocassee Dam. . Since Jocassee is a structure designed and constructed in recent times, it,can be assumed that state-of-the-art technology was used in its design. In addition, because of its role as a critical facility of large size and importance, other aspects of ,the dam, such as seepage monitoring and inspection programs, are important factors that decrease the likelihood that the dam will fail. The following specific characteristics o( Jocassee are identified as relevant factors that will affect the frequency of failure: 5-20
- 1. Quality maintenance and inspection programs.
- 2. Monitoring of the dam (i.e., seepage, *settlement, etc.).
- 3. Presence of personnel at the site.
- 4. Responsiveness of the owner to potential problems (i.e., implementation of emergency plans). . *
- 5. Detailed geologic investigations conducted before site selection. .
- 6. Experience of ~arth-rockfill dams in Jocassee's class (with respect to random failures).
- 7. Design techniques.
. These factors notwithstanding, the data were examined, and the best availab~e data base for application to Jocassee Dam was extracted and used. The data base covered the period of dam construction from 1940 to 1987. During this period, U.S. dams in operation 6 or more years at the time of failure and 45 feet or more in
. height were considered. The dams were of three types--earth, earth-wckfi.11, or rockfiU--and only catastrophic failures were included. Table 5-15 lists the failures considered in the analysis.
The number of *dam-years of operation was .determined fro*m d1ata on the rate of construction provided in Refs. 5.26 and 5.27. Table 5-16 lists chronologically for the
, I period of construction the year a failure occurred, the interval between'.each _failure in years, the cumulative number of dam-years to the year of failure, and *the number of dam-years between failures.
Ref. 5.28 updated this information by taking into account the additional amount of dam-years from 1988 through 1993. As shown therein, ther~ were no additional dam failures meeting the above criteria during this period. The re~ised analysis indibates that the revised random failure frequency for the class of large U.S. built earthen dams meeting the above criteria.is l.3E-05. This number is a point estimate using the 2 failures 'shown in Table 5-15 and the estimated 154,380 dam-years of operation from Ref. 5.28 and Table 5-16 (i.e., 2 / 154,380 = 1.3E-05). To the extent that this class is representative *of the Jocassee Dam, these results can be interpreted as the predicted annual random failure frequency of the Jocassee Dam from causes other than earthquakes or ovenopping.
- In order to evaluate the contribution of randon:i failure o( Jocassee D~ to the frequency of core damage at Oconee Unit 3, three factors must be quantified: The first factor was the frequency of random dam failures calculated above. The remaining two factors arc:
- 1. The conditional probability of flooding of. the Oconee site given a failure of the
( . Jocassee Dam. * .
- 2. The conditional probability of core damage given flooding at the Oconee site.
The conditional probability of flooding at the Oconee site given a f~ure of the Jocassee Dam is a complex function of several variables. The level of the Joca~see Lake at the time 5-21
of failure determines the amount of impounded water that .w ill be released into Lake Keowee; the level (?f Lake Keowee determines how much flow can be received from Lake Jocassee before Keowee Dam and *the Oconee intake dike are ovenopped. The time
*available for warning of an impending dam failure will determine the likelihood that
. =ffective action can be taken to lower the levels of the Jocas~ee and Keowee Lakes. The conditional probability of flooding given a dam failure also depends on the mode of failure, the rate of erosion (time to failure), the vertical depth to which the failure penetrates (fraction of the impounded water released), and whether either. Keowee Dam or the east intake dike fails rapidly when ovenopped. Previous memos have been written (Ref 5.29) to address this phenomenon. There is evidence, based upon rock-filled dams that have either failed or have been saved from failure, that pre-failure damage in the form of seepage would be observable for some time before significant failure occurs. Even though significant warning times would be needed to prevent Keowee ovenopping, the overall resulting flood levels could be reduced by lowering lake levels as quickly as possible via the spillway and the generators. The data base includes only catastrophic failures by modes believed applicable to Jocassee. Most of the catastrophic failures reported in the literature for earth or earth-rockfill dams were total (i.e., the entire .reservoir emptied), and most times to failure were in the range of 1 to 2 hours. However, the failures in the data base (Table 5-15) occurred only in earthen dams; thus, there is some question as to how applicable their rates of erosion and depths of failure are to the Jocassee Dam, an earth-rockfill structure.
- The Hell Hole Dam, an earth-rockfill' structure, failed during construction in 1964 when extreme precipitation caused ovenopping. Since construction had not been completed and since the dam was ovenopped, it did not satisfy the data- base characteristics and was not included in the failure set. However, its material of construction and size were very similar to those of Jocassee, and its failure behavior can therefore be used as one point of reference in judgments about the possible failure behavior of Jocassee. The ovenopping of this partly constructed dam lasted for more than 40 hours before a catastrophic failure occurred. This suggests that a long warning time may be ayailable, at least in some cases, before the failure of an earth-rockfill dam. Once the dam was breached, however, the breach propagated the .
full depth of the dam, down to the foundation, .in about 2 hours. Thus, though more warning time may have been available, once failure began, the time and depth to complete breach.were quite similar to those observed for earthen dams. On the basis of the information to date, it is obvious that the potential exists for a complete . spectrum of flood levels. More exhaustive studies could be undenaken to address this problem, but were deemed inappropriate from a cost / benefit perspective. Given this lack of information, a bounding value of 1 was used for the conditional probability of flooding of the Oconee site given a catastrophic failure of the Jocassee Dam. The probability of core damage given flooding at the Oconee ~ite depends on .the warning time, actions taken by operators, the depth of the flooding and other factors. The 5-22
discussion of the possible role of the SSF in Section 5.2.1.1 above would also apply to this set of seque~ces, given the discussion of the time to complete failure of the Hell Hole Dam.
. 5.2.2 Event Tree
- 5.2.2.1 Event Tree Structure The external flooding event tree is shown* in Figure 5-6. It is based upon the internal initiator tree and contains many of the same functional top events. The applicable portions of the SSF fault tree, as mentioned above, arc brought in at the appropriate places.
Event H: Flood Height is Less Thanlib~~~~ ul . (b)(7)(F), (bX3)16 U.S.C § 8240-l(d) SfH/CEII Event K: RPS Trips the Reactor This event is used to represent an A1WS event. In the event of an *external flood, it is assumed that off-site and station power will be lost due to flooding of the switchyard. Thus, the nonnal Reactor Protection System is assumed inoperable, and alternative reactor scram methods must be employed. Event B: Secondazy Side Heat Removal Maintaine~ In the event of an external flood, it is assumed that off-site and station ower will be lost floodin of the switch ar CbX7)(F), (bX3)-!6 U s.c. § 8240-l(d) Event Qr: Pressurizer Relief Valves Close After Opening l(b)(7XF), (b)(3):16 u.s.c § 8240-l(d)
. Event Os: RCP Seat'lntesrity Maintained r l)(F), OXJ),16 u.s.c. § m~l(d)
~E~+~ITP'la )laCIIJUTY REX 4TFD 1NFQRM4IION CPITIC AI. li)HH2,G¥/J;;IsEGTI.UG A,I,, l~U*RA~TRUGifUR~ IHrOR~4ATJON 5-23
r X3) 16 U.S C. § 8240-l(d). (bX7XF) IThe SSF RCM System is designed to provide RCP seal cooling flow to all three Oconee units in the event of a total Joss of HPI and a loss of thermal barrier coolin from CC. (bX7)(F), (b)(3):16 U.S.C § 82-lo-l(d) Event U: High Pressure Irijection Established (b)(7XF), (bX3).16 U .S.C § 8240-l(d) s.2.2.2 Event Tree Sequences Sequence XQsU l(bX')(J),~)())16 U .s C. § 82'0, I(d) Sequence XBU Sequence XBOsU (b)(7)(F), (bX3)!6 U.S C. § 8240- l (d) 8Itl/C£H Sequence XBQrU (bX7XF), (b)(3) 16 U S.C. § 8240-l(d) 8t:HSf'FfYE ~ECURITY Rfil::~.Tim 1Nr0R~4ATIO~l CBJTJCA J ENE RGY/fl ECIBICA J INER ASIBJTCIIJBE INFORM 4TION 5-24
5.2.3 Fault Tree Analysis (bX7)(F). (bX3)1 6 U .S C. § 8240-l(d)
*I
[ )()XF), 0)(7)'6 U.S C § 82'0->(d) -=- St<I/GEII- ltl
.el (bX7)(F). (b)(3):16 U.S.C . § 8240-l(d)
.. (b)(7)(F), (bX3):16 U.S C § 8240-l(d) r )(7)(F), (bX3)16 U.S C. § 8240-l(d)
(bX7)(F), (bXJ):16 U.S.C. § 8240-l(d) SeveraJ maintenance events for system components are included .in the fault tree. SpecificaJly, these include: SEHSrFIYE SECURl'fY-RfLA'.'fff) fW?ORMA'.'ffOH CR,ITICAL EHERGY/ELEC'f'RtCA~ l~ RA'.S'FRUC'fUR£ fN't<OlH\11A'.'ft01q
- SSF Unit 3 RCM Pump Train
- SSF ASW Pump Train
- 4160 V ac SSF Switchgear OTSI
- 600 V ac SSF MCC XSF Bus
- 600 V ac SSF MCC 3XSF Bus
- 125 V de SSF Distribution Center DCSF
- SSF Diesel Generator A complete tis.ting of the basic events used in this analysis may be found in Table 5-12.
5.2.4 Containment Performance The external flooding analysis assumes that a failure of the Jocassee Dam floods the site to the extent that tile switc *
- c rendered ino rable. CbX7)(F), (b)(3)'. !6 USC . § 8240-l(d)
External flooding events were judged to have no unique impact on the containment performance model. That is to say, the containment response does not reflect any ne uncommon cut sets that e not realize (bX7XF), (bX3)16 USC. § 8240-l(d) (bX7)(F), CbX3)16 U.S C. § 8240-l(d) 5.2.5 Limitations of the Analysis 1* X7)(FJ, (>JO) 16 U S C. § 82'*<(aJ 8R:ffC£H As also discussed previously, the random failure frequency of the Jocassee Dam is based upon known failures of similarly constructed dams. To the extent that the set of criteria specified is representative of the Jocassee Dam, this value can be interpreted as the predicted annual random failure frequency of the Jocassee Dam from causes other than earthquakes or overtopping. . SEHSFfiYE S£CU:EHTY RELATED INFORMATIO~J CRITICAL ENERGY/ELEGTJUGt'rb HffRASTRUGTURE HffOHMATlOl>l 5-26
TABLE 5-12
- (pg. 1 of 6)
External Flooding Model Reliability Data EVENT FAil..URE NAME EVENT DESCRIPTION RATE FACTOR PROBABILITY (b)(7)(F), (b)(3):16 lJ.S.C. § ~24<>- l(d) 5-74 r
TABLE 5-12 (pg. 2 of 6) External Flooding Model Reliability Data EVENT FAil..URE NAME EVENT DESCRIPTION RATE FACTOR PROBABILITY l(b)(7)(F), (b)(3):16 u.s.c. § 8240-l(d) 5-75
TABLE 5-12 (pg. 3 of 6) External Floodim? Model Reliabilitv Data EVENT FAil..URE NAME EVENT DESCRlPTION RATE J;Af'"TOI? Pl?ORARn ITV l(h)(7)(F), (h)(3) 16 (J.S.C § 8240-l(d) 5-76
TABLE 5-12 (pg. 4 of 6) External Flooding Model Reliability Data EVENT FAILURE NAME EVENT DESCRIPTION *RATE FACI'OR PROBABILl1Y !(b)(7)0'), (b)(3): 16 U.S.C. § 8240- l(J) 5-77
TABLE 5-12 (pg. 5 of 6) External Flooding Model Reliability Data EVENT FAILURE NAME EVENT DESCRlPTION RATE FACTOR PROBABCLITY (b)(7)(F), (b)(3):16 U. S,C *8240-l (d) 5-78
. TABLE 5-12 (pg. 6 of~)
External Flooding Model Reliability Data EVENT FAll..URE NAME EVENT DESCRIPTION RATE l=Acro~ PROBABILITY l(h)(7)(F), (b)(3):J 6 u.s.c. S 8240-l(d) SRlrGEi::I S£HSf'FIY£ S£CURf'FY R£b\:'f£D IHfORMA'fIOH GR4TIGAL ENERGY/ELECTR4G-A:L IJ>i!F:R:}rS'fRUC'fUR£ INFORM:A'flOH 5-79
TABLE 5-13 (pg. l of 6) Extema-1 Flood Cut Sets With Sequence Desismations Plant Sequence *Damage Cut Set Percent Accident Seque~ce Cut Sets Name State Frequency of Total Event Name I Probability I Event Description (h)(7)0'), (h)(3): JG IJ .S,C. § 8240- l (J)
,r,r-
..,,~ ~ ~T SENSITIVE SECURITY RELATED INFORMATION ClHTICi\L ENERGY/ELECTRICAL INF&AS'f'RUCfUR£ fNFOR:t'dA:'fiON 5-80
TABLE 5-13 (pg. 2 of 6) _External Flood Cut Sets With Sequence Designations Plant Sequence Damage Cut Set Percent Accident Sequence Cut Sets Name State Frequency of Total Event Name I Probability I Event Description (b)(7J(FJ, (b)(3):16 U.:,;.c. § 8240- l(d) 5-81
TABLE S-13 (pg. 3 of 6) External Hood Cut Sets With Sequence Designations Plant
- Sequence Damage Cut Set Percent Accident Sequence Cut Sets Name Slate Frequency of Total Event Name I Probability I Event Description (b)(7)(1'). (h)(3):16 U X C. *8240-l(J) 5-82
TABLE 5-13 * \ ,,g. 4 of 6) External Flood Cut Sets With Sequence Designations Plant Sequence Damage Cut Set* Percent Accident Sequence Cut Sets Name State Frequency of Total Event Name I Probability I Event_Descriotion (h)(7)(F), (b)(3): 16 U.S C. § 8240-l(d) 5-83
TABLE S-13 {pg. 5 of 6) External Flood Cut Sets With Sequence Designations Plant Sequence Damage Cut Set Percent Accident Sequence Cut Sets Name State Frequ~ncy of Total Event Name I Probability I Event ~cription (h)(7)(F), (h)(3):16 TJ.S.C. *8240-l(tl) S 84
TABLE 5-13 (pg. 6 of 6) External Flood Cut Sets With Sequence Designations Plant Sequence Damage Cut Set Percent Accident Sequence Cut Sets Name State Frequency o(TotaJ Event Name I Probability I *- Event Description (b)(7)(FJ, (b)(3):16 tLS.C. § 8 240- l (d) 5-85
TABLE 5-14 External Flood Results By S.rn.~ Sequence Name Sequence Probability ~1U/CEH FLOOD >t(b)\lj(XBQsU) Q2:_ (b 2.60E-06
.bXt)(F). (b)
(3):16 U.S.C. 2.49E-06
§ 8240-l(d) l .04E-06 8.21E-07 5.54E-08 Total Ext. Flood CMF = 7.0lE-06 3EH'3f'flVE 3ECUftf'fY-ftEtA:'fEt) IH'l" O'.K':fvf A:'ftrnq:
CR:f'ffC,'tL ENER'GY/ELECfRiCiltL lNrRA:S'f RUC'fU'R::E rNrOftMJl!:'ffOH' 5-86
Table S-15 Dam Failures Used in This Study Year Year Dam
- completed failed Baldwin Hills a 1951 1963 Walter Boudin b 1967 1975 a Data from Babb and Mennel (1968) and USCOLD (1975).
b Data from Jansen ( I 980).
- 5-87
Table 5-16 . Chronological Order of Dam Failures Year of Years Cumulative Dam-years* failure between failures dam-years between failures Period of Construction* 1940-1993 1963 23 32,207 32,207 1975 12 74,782 42,575 1987 No failure 126,435 No failure 1993 No failure 154,380 No failure 5-88
. ifh)(7)(F), (h)(3): 1(, fJ. S C. § X24o-l (d)
*Oconee External Flooding Event Tree FIGURE 5-6 5-101
- 8.
SUMMARY
This report details the methodology, implementation; and results *of the supplemental
*examination of external events for severe accident v\tlnerabilities at Oconee Nuclear Station. This work ha:, been completed by using the exis~g Oconee PRA, which already included external events, updating it as appropriate and performing . the additional enhancements recommended in NUREG-1407.
The Oconee PRA model
- is based on Unit 3. However, walkdo.wns and supponing _:
evaluations were conducted on all three units. For the IPE submittal report (Ref. 1;4),
- which included external events, an analysis was performed to determine the applicability of the PRA results to Units 1 and 2. Any differences were analyzed to determine their effect on risk. The conclusion was that unit differences do not measurably change the calculated annual core damage frequency or risk ~tween units at Ocoriee.
The major finding from this examination is that* there are no yulnerabilities to severe accident risk from external events. Seismic events, internal fires, tornadoes and external flooding events are identified to be the most significant external event contributors to core damage risk.
..___ _ _ ___. Hooding events (due to the seismically-induced failure .of the Jocassce Dam) are also dominant contributors to the seismic CDF.
(b)(7)(F), (bX3):16 U S.C. § 8240-l(d) CbX )(F). SRI/CEH Finall for external floodin events the dominant cut set involves floods that exceed the CbX3) 16 (bX7)(F), (b)(3):16 U.S.C. § 8240-l(d) There were no plant changes identified that would significantly reduce the risk from external events. Some enhancements to the plant were identified during the review. They are currently being reviewed and some have been implemented. The IPEEE effort was completed using in-house expertise with limited outside consultant support, resulting in maximum benefit to the company staff iri (1 ) developing an appreciation of severe accident behavior, (2) understanding ' the most 'likely severe accident SEHSl'f lVE SECURf'f7t'*REUc'fED IHflORMA'flOH CR:t'ffCAL EHERO'i/ELECTRlCAL IHFlbr\STRUCTURE HffORMATTOn 8-1
sequences, and (3) gaining a qualitative understanding of the overall likelihood of core damage and radioactive material release. Several generic issues and unresolved safety issues were addressed and considered closed out as a result of the previous PRA work and the IPEEE effort, including:
- USI A-45, "Shutdown Decay Heat Removal Requirements"
- Eastern U.S. Seismicity Issue
- USI A-17, "Sy~tem Interactions in Nuclear Power Plar.ts"
- NUREG/CR-5088, "Fire Risk Scoping Study"
- GI 57, "Effects of Fire Protection System Actuati_on on Safety-Related Equipmc;nt" *
- GI 103, "Design for Probable Maximum Precipitation (PMP)"
Thus, the examination for external event severe accident vulnerabilities, as requested by
- the NRC via supplement 4 of G.L. 88-20, has been completed for Oconee Nuclear Station, Units . 1, 2 & 3. The objectives of this program have also been satisfied for Oconee.
8-2
- 9. REFERENCES Section 1.0 l.1 EPRI, "NSAC-6U, Oconee PRA, A Probabilistk r.isk -'\ssessment of Oconee Unit 3," Palo Alto, CA, June 1984.
1.2 Duke Power Company, "Oconee Nuclear Station Unit 3 Probabilistic Risk Assessment." December 1990. 1.3 USNRC, Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50-54(f)," November 23, 1988. 1.4 Duke Power .Company, "Oconee Nuclear Station IPE'* Submittal Report," December 1990. 1.5 H. B. Tucker, Letter to USNRC, "Response to Generic Letter 88-20, Supplement 4," Duke Power Company, December 18, 1991.
- 1.6 R. E. Martin, Letter to M. S. Tuckman, "Review of Response to Generic Letter 88-20, Supplement4," USNRC, June 16, 1992.
1.7 USNRC, Generic Letter 88-20, Supplement 4, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50-54(t)," June 28, 1991. 1.8 USNRC, NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," June 1991. 1.9 USNRC, NUREG/CR~2300, "PRA Procedures Guide," January 1983. Section 2.0 2.1 Science Applications International Corporation, "CAFTA_:Manual," Palo Alto, California, September 1987. 2.2 MAAP Modular Accident Analysis Program User's Manual, "IDCOR Technical Report 16.2-3," Fauske and Associates, Inc., Burr Ridge, IL; Februany 1987. 2.3 ANS, "Guidelines for Combining Natural and External Man-Made Hazards at Power Plant Sites," an American National Standard, ANSI/ANS-2.12, La Grange Park, Illinois, 1978. 9-1
2.4 Duke Power Company, "Oconee Nt1clear Station Final Safety Analysis Report," 1994 Revision.
- 2.5 USNRC, "Safety Evaluation Report, Oconee Nucle~r Statiqn, Units I 2, & 3,"
Original and Supplements 1 - 3. 2.6 EPRI, "RPI0l-53, Probabilistic Seismic Hazard Assessment for Oconee Nuclear Station," Palo Alto, California, April 1989. Section 3.0 3.1 EPRI, NP-6041 , Rev. 0 and Rev. 1, "A Methodology of Assessment of Nuclear Power Plant Seismic Margin," October 1988 and August 1991. 3.2 EPRI, NP-4726-A, '.'Seismic Hazard Methodology for the Central and Eastern United States," July 1986. 3.3 SQUQ, "Generic Implementation Procedure (GIP) For Seismic Verification Of Nuclear Plant Equipment," Revision 2, Corrected 2/14/92. 3.4 OSC-6040, "Seismic Qualification of Equipment for A46/IPEEE for Oconee." 3.5 KC-2026, Seismic Qualification of Equipment for A46/IPEEE for Keowee and Switchyard." 3.6 USNRC, NUREG/CR-0098, "Development of Criteria for Seismic Review of Selected Nuclear Power Plants," 1978. 3.7 OSC-5724, "Dynamic Reanalysis of the Auxiliary Buildings for IPEEE, Units 1, 2, and 3." 3.8 OSC-5789, "Scaling of Existing Spectra For The IPEEE." 3.9 Structural Mechanics Associates, SMA 12904.01, "Conditional Probabilities Of Seismic Induced Failures For Structures And Components For Oconee Generating Station Unit 3," September 1981. 3.10 Veneziano, "Seismic Fragility Curves For Jocassee Dam and Oconee Dikes," June 1981 . 3.11 Letter from R. V. Hester, Oconee Engineering Division, to T. F. Wyke, Engineering Support Division, Attention: K.. S. Canady, July 16, 1990, File No. OS-203. 9-2
3.12 Letter from NTS Engineering, Long Beach, CA, to T.F. Wyke, Duke Power Compa~y. August 27, 1986. 3.13 Documentation of the Seismic Event Impact Sequence \.1odel' (SEISM) Computer
- Code, PSA-84-17, Duke Power Company, September 1984.
3.14 Commonwealth Edison, "Zion Probabilistic Safety Study," 198l.
- 3.15 USNRC, NUREG/CR-3263, '.'A Comparison of Methods for Uncertainty Analysis of Nuclear Power Plant Safety System Fault Tree Models," April 1983.
3.16 OSC-6219, "LLNL Seismic Hazard Curve :Sensitivity Study For The Oconee IPEEE." 3.17 OSC-6048, "Miscellaneous IPEEE Seismic and Fire/Seismic Issues." Section 4.0 4.1 USNRC, NUREG/CR-5088, "Sandia Fire Risk Scoping Study," January 1989. 4.2 ' OSC-5995, "Fire Protection For The IPEEE"* 4.3 Berry, D. L. and Minor, E. E., NUREG/CR-0654, "Nuclear Power Plant Fire Protection - Fire-Hazard Analysis" (Subsystems Study Task 4), Sandia National Laboratory, September 1979. 4.4 Correspondence To Conrad . E. McCraken, USNRC, from Raymond N. Ng, NUMARC, dated August 4,_1989. Section 5.0 5.1 "Tornado Occurrences Within 125 NM Radius Of Oconee Nuclear Station," National Severe Storms Forecast Center, Kansas City, MO, August, 1994. 5.2 Minor, J. E., "Applications Of Tornado Technology In '.Professional Practice," Proceedini:s of the Symposium on Tornadoes; Assessment of Knowledi:e and lmpljcatiops for Map. June 22-24, 1976, Texas Tech Universi'ty, Lubbock, Texas, pp 375-392. 5.3 McDonald, J. R., "Tornado-Generated Missiles and The~ E(fects," £rQceedipi:s of the Symp*osjum on Tornadoes: Assessment of Knowledi:e a,nd Implications for Man, June 22-24, 1976, Texas Tech University, Lubbock,'Texas, pp 331-348. 9-3
5.4 Golden, J. H., "Comments in Session l," ProceedinKs of the Symposium on Tornadoes: Assessment of KnowledKe and Implications for Man, June 22-24, 1976, Texas Tech University, Lubbock, Texas, pp 483. 5.5 Fujita, T. T., *"Comments in Session 7," ProceedinKs of the Symposium on Tornadoes; Assessment of KnowledKe and Implications for Man, June 22-24, 1976, Texas Tech University, Lubbock, Texas, p. 673. 5.6 Oconee Nuclear Station Procedure AP/3/Nl700/l 1, Change 11, "Loss of Power." 5.7 Oconee Nuclear Station Procedure AP/3/Nl700/19, Change 4, "Loss of Main Feedwater." 5.8 Oconee Nuclear Station Procedure AP/3/N1700/06, Change 0, "Natural Disaster." 5.9 Ramsdell, J.V. and Andrews, G. L., "_Tornado Climatology of the Contiguous United States," NUREG/CR-4461, U. S. Nuclear Regulat9ry Commission, Washington, DC, May, 1986. 5.10 Ramsdell, J. V., et al., "Methodology for Estimating Extreme Winds for Probabilistic Risk Assessments," NUREG/CR-4492, U.S. Nuclear Regulatory Commission, Washington, DC, October 1986. 5.11 McDonald, J.R., "A Methodology for Tornado Hazard Probability Assessment," NUREG/CR-3058, U. S. Nuclear Regulatory Commission, Washington, DC, October 1983. 5.12 OSS-0254.00-00-1000, "Design Basis Specification for the Emergency Feedwater and Auxiliary Service Water Systems," Rev. 12, May 1. 1995. 5.13 Berket,::e, B. H., Memo To File, "Wind Load Capacity }f West Penetration Room Exterior Walls," May 31, 1990, Duke File No: 0S-203.
- 5.14 Kanipe, L. M., ,;Calculation Of Tornado Strike Probabilities For Oconee Nuclear Station," SAAG File# 175, Dl;lke Power Company, Charlotte, N.C., March 1995.
5.15 *McCann, M. W. Jr., Jack Benjamin & Associates, "Wind Capacity of Oconee Nuclear Station Borated Water Storage Tanlc," July 26. 1982. 5.16 Twisdale, L.A., et al., "Tornado Missile Simulation and Design Methodology," _NP-2005, Electric Power Research Institute, Palq Alto, CA, August 1981. 5.17 Twisdale, L. A., et al., "Tornado Missile Risk Analysis," NP-768 and NP-769, Electric Power Research Institute, Palo Alto, CA, May 1978. 9-4
- 5.18 Deskevich, S. A.* "Verification of Computer Progra_m TORMIS;" COM-0204.C6-11-0038 Revision 1, Duke Power Company, Charlotte, NC, October, 199~.
5.19 Deskevich, S. A., "VeJ'.ification of TORMIS Enhancement," COM-0204.C6-l 1-0039 Revision 1, Duke Power Company, Charlotte, NC, ~tober 1993. 5.20 Kanipe.* L. M., "Damage Frequency of the Oconee Nuclear Station Emergency Feedwater System *By Tornado-Generated Missiles," osc~3361 Rev. 1, Duke Power Company, Charlotte, NC, November 1993.
- 5.21 Kanipe, L. M .* " Keowee Tornado Path Simulation Model," SAAG File # 174, Duke Power Company, Charlotte,"N.C.* April 1995.
5.22 Duke Power Company, "Aood Study, Jocassee and Keowee Reservoirs," Charlotte, N.C., 1966. 5.23 . Oconee PRA, "A Probabilistic Risk Assessment of Oconee Unit 3," NSAC-60, Electric Power Research Institute, Palo Alto, CA, June, 1984.
- 5.24 1;3aecher, G. B., M. E. Pate, and R. _De Neufville, 1980. "Risk of Dam Failure in Benefit-Cost Analysis," Water Resources Research, Vol. 16, No. 3, pp. 449-456.
5.25 Benjamin, Jack R., and Associates, 1981. "Statistical Evaluation of the Frequency of Random Dam Failure," Prepared for NSAC, Palo Aho, Calif. 5.26 USCOLD, 1988, "Lesson from Dam Incidents USA-II," American Society of Ovil Engineers. 5.27 Nash.* J. A., Memo to File, "Update of the Random Failure Frequency of the Jocassee Dam," File No. OS-203, October 3, 1989. 5.28
- Farish, P. T., Memo to File, "Update of the Jocassee Dam Random Failure Frequency," File No. OS-203, March 15, J995 *
- 5.29 Lewis, S. R., Memo to File; "Evaluation of Jocassee Dam Failure," 7/2/82 5.30
- Farish, P. T., Memo to File; "Jocassee Dam Flooding Factors:" Ftle No. OS-203; December 16, 1994 '
5.31 Benjamin, Jack R., and Associates, 1982, "A Database for the Evaluation of the Frequency of Random Dam Failure," Report 120-010-01,
, Palo Alto, CA.
5.32 USNRC, NUREG-0800, "Standard Review Plan," Rev. 2, dated 7/81. 9-5
5.33 Atlanta Sectional Aerial Nautical Chart, 52nd Edition, 3/31/94 5.34 Greenville / Spartanburg Air Traffic Control Tower (Traffic .Management Unit); 1993 Traffic Su111Mary. 5.35 Asheville Air Traffic Control Tower (Traffic Management Unit); 1993 Traffic Summary. 5.36 NTSB-ARC-83-1: Annual Review of Aircraft Accident Data: U. S. Air Carriers - Calendar Year 1980; National Transponation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 1/14/83
- 5.37 NTSB-ARC 1; Annual Review of Aircraft Accident Data; . U. S. Air Carriers -
Calendar Year 1981; National Transponation Safety Board; Washington, D.C.: Bureau of Accident Investigation; 2/ 1/85 5.38 NTSB-ARC-86-1: Annual Review of Aircraft Accident Data; U. S. Air Carriers -
.Calendar Year 1982; National Transponation Safety Board; Washington, D.C.;
Bureau of Accident Investigation; 1986 5.39 NTSB-ARC-87-1; Annual Review of Aircraft Accident Data; U. S. Air Carri~rs - Calendar Year 1983; National Transponation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 2/13/87
- 5.40 NTSB-ARC-87-2; Annual Review of Aircraft Accident Data; U. S. Air Carriers -
Calendar Year 1984; National Transponation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 4/15/87 5.41* NTSB-ARC-87-3; Annual Review of Aircraft Accident Data; U. S. Air Carriers - Calendar Year 1985; National Transponation Safety Board; Washington, D.C.;
*Bureau of Accident Investigation; 11/27/87 5.42 NTSB-ARC-89-1; Annual Review of Aircraft _Accident Data; U. S. Air Carriers -
Calendar Year 1986: National Transponation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 2/3/89 5.43 NTSB-ARC-90-1; Annual Review of Aircraft Accident Data; U. S. Air Carriers - Calendar Year 1987; National Transportation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 11/29/90 5.44 NTSB-ARC-91-1; Annual Review of Aircraft Accident Data; U. S. Air Carriers - Calendar Year 1988; National Transponation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 4/18/91 9-6
APPENDIX A
- OCONEE SEISMIC FAULT TREE
APPENDIXD OCONEE EXTERNAL FLOOD FAULT TREE
(h)(7)(F), (h)(3):16 U S.C, § 8240-l (d) ~
~y External_ Flood Fault Tree I APP. DI Page 1
~l!t~~ffl v1! ~1!CU1UT i -~tRTl!tJ lNPCIUVIRTlCt~
GR.-{TIGAL E~maGY/EHiGTRlG/rL UffRASTRUGTURE INFORi,M:TION
loss at SSF RCM Loss ol SSF ASW (ASW Sua:eal*: PZR {RCM S1.11:cMdsJ: PZR Rulial \lalvN Relial Valves Co Res*I) Nol ResMI P111111* 1 RCS S..f111y RaUal SSF RCM Fall1 lo E ilhar Primary SSF ASW Fails lo ValYa Ooa1 Nol Pl'ovkle RCP S.!ely Ruliel Yaiva Provide Sa:landary Slick Opa, Alls lnjaalcn Fl!Jls To CloM Sida Heal R8m0Yal RaliB"ting Liquid All* Lh;u,d Relial Paga B External Flood Fault Tree APP . D Page 2
SSF RCM Fllill 10
. Pro¥1da RCP lnjac!illn Paga 2 Paga 12
------=======J.======:.---,----'J "'----,--;:::::::::::::::==------
Any One ol Four SSF No SSF RCM Flow M:llor-Op-19d SSF RCM Sr11_,, la Op*alar1 Fall Ta RCM Chadl Vllllvn ~ h Fill"' SSF- Yaiva 3HP-31111 Oa* Lift Unavailabla Align Tha SSF RCM FBil Ta Opan 3F-1 Nae Func:11an Air* Tasr Or Sy11.-ii For ap ..uan Mairm1nanca N¥RCMULHE Paga 4 Lm.a ol Pow* ID MDu-C)p-tad t.biar-Oparaltd MD10r-Oparala:I Valve 3HP*lm Falla Yaiva 3HP-398 Y11hl1 3HP-3911 To Open TrB111!1r1 Cloud All* Op.-.ing NHP339BMYT SSF 600 V ac MCC SSF 6011 Y ac MCC 3XSF BrealUlf. 2C 3XSF Braek* 2C Tr11111I** Open {3HP- Fi11 Ta Cusa j3HP-
. 398) . 311111 NAC3X2(:CLC External Flood Fault Tree APP. D Page 3
r-------------------------------------------*--*-***--~
,,.,.,, On ot Fmr SSF Lota at SSF ASW ACM Chad!. Vlv 1 (RCM Sutil;Nds; PZR Fail To Opn AIMiI VaJv1 Rn al}
Paga 3 Chu V!v aHP-3911 Cha Y""' 3H,-*401 RCS Sa111y R l I SSF ASW Farr, la Transhlfl Closed FaJl1 To 0J)ll'1 Valve 0091 '-101 "'°'Ida Secanda,y Slick Open All* Sict Haat RIIITIDVal Reli ving Liquid NHP3399CVT NHP~1CYO JRCSRVOOEX Paga e Child! Yaiva 3HP-399 Chacil Yahl 3HP-401 Fait Ta Opan Trans!* Closad
~HP.l~VO '-!Hf';MC1 C'fl Check Valv 3H P-400
- Chadl Yaiva 3HP-402 Transl** Closed Tr1n1I** Closed
'[ :vr Chadl. Valve 3HP-40D Chadl Valwa 3HP-402 Fab To C,,an Falls To Open VO NI<
External Flood Fault Tree APP. D Page 4
No SSF RCM Flow Thnlugll FIii* SSF-3F-1 No F..,_ To 1119 SSF U..o l RCM Pu"1' SSF UP>I 3 RCM Pllffll
.u.......... -T*--~
RIii! Vain JHP. SSF Uni 3 Rell Fil* SSF-SF1 CIDgl
- p. . . .
Uni! 3 SSF RCM """11 \A'ol S SSF !ICM P'-"11 SSF Uni 3 RCW P1m10 L - OI P - TD SSF SIICIIIDn Ille M. . . PUITp Fal* To SIM Fall Ta Rui, Tru, II In Th9 SSF Ur,R :, ACM ~ F a.. p-~ MPII.....- P.ITp hll
~
SSFa,VacWCC SSF 100 V _, MCC 3XSF-4C 3XSf-4C Trnnra ~ l'11ff111 CACM r* To ClaM IACM Pu11111 External Flood Fault Tree APP. D Page-s
cc CD C> C0'
- a..
C n.: a.. a, a, I- ~
- I m
LL. "80 u:::: n, C: CD )( w
Lou Ct Paw* On 208 V ac MCC 3XSF-1 SSF 2011 V ac MCC LON 01 PD,ra, On SSF 211B V IE MCC 3XSF-1 8u1 Flllll 21111 V ac MCC 3XSF 3XSF Breaker 2BL Tr.,,11*1 Open (To 3XSF-1J F LIISII 01 Pow* To SSF 208 V ac MCC 2C8 V ac MCC 3XSF 3XSF 11w F I From eao V IIC MCC JXSF (l'IOlmal Feed) SSF 2011 V s; MCC SSF Tran1lorm* 3XSF e,...,., IA 3XSF Fail* TrM l*1 Opan (Fram Xhn. 3XSFI SSF IIOO V 11C MCC 3XSF 9r<IBII* 4A Tran1len Opan {TD Xlmr. 3XSF) External Flood Fault Tree APP. D Page 7
SSF ASW FaJ1 IO l'rowlda 5-xlndary Skit HBBi RBmDWal SSF ASW Sys!um Lift SSF ASW Fellt Ta C)llar.,an Fail To u,,.,vailabla Ahar Pruv~a &dflcl-,1 Align Tha SSF ASW Tes! Or Main1anan01 Row Syal'"' For Oparaiian ln1uffld.-.1 FI- Manual Yaiva CCW- lnsutfld "11 Fl- lnlllfficlefll Flow Thraugfl Tiit SSF ASW 292 T1an1ter, CloHd Fram TIit SSF ASW Tivcugh Tha EFW Pump Pump To Tha EFW Una Una Ta Th* Steam G-,llia1ar Haadar1 P111111e 10 Loll OI Suppon SSF ASW PUmp Fells lnsulllcianl Fro. lnsufficianl Flaw SJ'l!ams To The SSF io Sran an Demand Tllfaugh The EFW Fra-n Tha Cr01lla AS# Pump Una Ta Th Craa11, To Tha Slaam Gan-l<lr Haadars NSfPU02Af'S Pag1 SSF ASW P ~ Fails SSF ASW Pump Train lo RI.In 11 In Malnt......,. NSfPUD2APM External Flood Fault Tree APP. D. Page 8
L011 Of Suppan lnsuffld..t Flow Srs1am1 ro Tha SSF Through Th EFW ASW Pl.imp Lin* To Th C1011slie Paa* 8 LOH or Pow* To. Mam. v..-., CCW* Chedl Valv 3FOW* Cha Vat.,1 3FOW-T!'!I SSF ASW Pump 343 Tna,,1lara Cloud 442 Flh To Opa,i 442 Tranll** Clollad NCWW"3VVT NMFGM~VO 4160 V ac SSF 41110 V .-: SSF Cha \lalv1 FDW-348 Chia; Vlv 3FDW-Slirilct,g., ors, _Swild',gBBI C'TS1 Falls To Opal 348 T111nll*1 CIClsad Br** 2r,-,.. Brak* 2 Fail1 To Close [SSF ASW Pump) Open (SSF ASW Pllmpl NAQQTS2C4C NMF0346CVO External Flood Fault Tree APP. D Page 9
11-.uf!....,..F...., From Tha SSF ASW P*ff11 Ta 'The EfW LN Pap I MO\I CCW-217 II Ma11..al y- CCW- c- v..-.. ocw-2* Clllod< YIW OCW-281 r,.,..,. MOV CCW-2811 II u...... - ,25 T - ~ f-TQ~ ~ u......,. MOV :JCCW-:1!117 SSF 811D Y ea MCC MOY :ICCW-2111 SSF 811D Y _, MCC r.....,.. Cia.d 3XSF e..u, FOHi.. T......... ~ USF e..u. FOIBA AA* q.,,;"8 T,.,..,.,. q.,, (:ICCW-Z81) M*~ T,-.. ap., (::lCCW-21111 MCV :JOCW-1117 F... MOY 30CW-281 F.- T110,.,, 0,, DlrnMd To ap., OIi ~ External Flood Fault Tree APP. D Page 10
lnsufflciontAow From The Crosllf* To Tha SI..,, G..-..- H-1.,.. Ptog, II lnsu Nlci9nl Flow I11su111cier,1 Pow Ftm1 Th* Cron!M F,om Th* Croutia To s1-, c.,.. ICI' To S1-,i G- *!ar 3A Hald* 38 H* det w:N CCW-2118 It Chad< Valwe J FDW- M)V J FOW-347 Chad! Yaiva 3m W-Cha Valv* 3FOW-Ul'aYdalll* 2'32 Flllls To Ops, T111nlf*1 Closed 233 Fa!/1 To Open Zl2 T,an,111 Cloud On o.n&ncl Ahat Opaning On 0...-..,,c! WOV CCW-299 FaU SSF 2011 V c MCC 0 . - Vllo've J FOW- P,<<JV 3F OW*J
- 7 Fails To Open 3llSFI BrMI!* 10 233 T,.,. 1.,. Cloud To Ops, Alie, Being T,anllan Opa,, Thrcn!ad
{C CW*2118l NCWIJ298ltii!\IO Y1- NMF034TMVO wov CCW-:zs r,11m1.. C1oMcl Alt* Opening N.P External Flood Fault Tree APP. D Page 11
u:,q or SSF ASW .... RCM (F>ffl Rlllllf ValVH RaBMI) AfM 1111d ACM Fail RCS S.laty Rlllal Dua 10 Sys1am ar Valve Do.. Nol Common Cau* Slide C,,an Aher Failure Aaliwlng l..lquid
- SSF ASW and ACM ConaJrrant Faiure Fan tnlaptndan!ly ol SSF ASW 1111d SSF RCM SSF ASW Fails IO SSF RCM Fails IO SSF HVAC Air 0p. .1a, Fall To Puw1da Secondary PrD'lida RCP Condilloning To Oapior To Tha Sda HHI R...,CMII lnjdon Cantrel Reem Falls StancltiJ Shutdotm Fa;,'lily In Tlma Paga 8 Paga 13 I...OH of flow* M l..oum F'owson SSF l!OOV .: MCC XSF 800V .: MCC 3XSF Paga 17 Paga 22 External Flood Fault Tree APP. D Page 12
SSF HYAC Air Condhlanlng Ta Canrml Alxnl Fus HVAC Air H*nllllna Bath HYAC S.1'¥11:9 1100 Y a: SSF MCC Ei!hllf Trllin ot UrMI Falls Wal* TralM F911 XSF Br-* F058L T1anat111"1 Ope,, Rafr\glll'anl Feila Paa* 15 HVAC Air Hlll'ldH na HVAC Air Handling Ret~11*an1 Train 1* Rat1ige1ar11 Train 2 Uriil Fan Fai11 Ta Uni! Fil* Fm Falla Falla Run NSFAHUFFNR Paga 14 HVAC Air Handling Train 1 RatTlgeranl Samoa Wa11r To Un~ Cooling CDill Campi -or FIii!* Ta Ralrlg*anl Train 1 Fail Run Fallt NSFCON1CMR External Flood Fault Tree APP. D Page 13
S..rvDI Wa.tar To R11higar.-1t Train 2 Refrigatant Tfalrl 1 Faio Fail s XCONSERVI P.,ga 13 Page 13 Manual Valve CCW* Train 1 Aelrig*nrn T raln 2 Re~ erant SlfYlce Wat* To Train 2 Retrigaram 21e Tran,hws Closed Conden~r Fail1 Compusaot Fab To Relr1gara,I Train 2 Canprn5a Fah Tc Siar1 Fail* Run l'fCW027_8VVT N~fCONHiXF NSFg:)N2CMR Manual Valve CCW - Flow Cc:mll'DI y_.,., ,_.., Yt!Ne CCW- TraJn 2 Relrtgaranl ea-.c,.,,.., Faits 276 Translers Cloted CCW-V7 Tra,,slar1 291 Transl.,.. OOMd Clo"'d NCWU27_6WT NCWll:!!!_IWT IIMnlal Va!va CCW- Flaw Con lr0I VtJNe 279 Tran51en Cloud CCW-2BO Translars Cmad Mei N~DAVl External Flood Fault Tree APP. D Page 14
Balh l-4VAC Sr.101 wa1er Train FIii HVAC Sarwt01 Waler HVAC Saw:e. Wat* Trllln 1 F1il1 Train 2 fall Page ,a Cooimon Valves Fa Mlnuad Valv CCW- HVAC Sarwt01 Waler Manual Valve CCW- Chad! Val\1'11 CCW-21'1 HVAC &niaa Waler 270 Tr11n11t** Ca* PlfflP 1 Fall* 272 Tn1n1ln Cloled Trai1re11 CIMed Pi.imps Fail XSERVWATV HCW027}CVT Pag* 16 HVAC s.,...,_ WIil* &OD V m: SSF MCC Pump 1 Feil Ta Run XSF Braaka F02B Transl** Open HCWPMP1GPI{ HACF02BCLT External Flood Fault Tree APP. D Pag~ 15
camman Vain* For HVAC Sarvlca Wal* HVAC Service Wal* Pump 2 Fail Pumps Flil Paga 15 Page 18 Man~ Ylllve CCW- SSF HVAC SIMC8 HVAC Servioa Wat* 60a V ac SSF MCC 282 Transl--. CIOllld Wa1,r Fin* F~T flu'np 2 Fallt To Run XSF Braakar F04B Clclg1 Trena!eni Open NCWIJ282WT !'A r Mlln~ V.iYII CCW- HVAC Setvk:a W!81' 2611 Transl* Cloud Pump 2 Fails To Slar'I NCWD2B6VVl 2 External Flood Fault Tree APP. D Page 16
~ G I ~ 11111 SSF IIXIV c MCC XSF ID:J V lie SSF" MCC -LOH ol "-°la 11X1 V ac SSF MCC X.SF Bui In lllllV c MCC XSF XSF eu. F"lla Maint....nca Fl'OIII f/lJaV ai: LC OllSF" [E.mll!V. Fa.II SSF IIXI V a: MCC SSF ICID V a: LC Lcmol"-"11111 SSF 8ll0 V ac MCC XSF BrNka' 11A DllSF'Br...-4C SSF llllllV a: LC OXSF XSF a,__, IU.
y,..,.. .... ap., 1...1... c:ii-, rra F* Ta C:Ue (Fl'OIII DXSF) llSF) jFram DXSFJ SSF 4160 Va: SSF ax, V c LC
~OTSI DX.SF Bua Falll en.a-31.......
Opan {Ta xrrn-. OXSF) NACOTS:IOIT NAOOn:=.._FBLF SSFTIWW1ufns Lm at P - 11111 DTSI Fllill 4l110V11eS~ OT$1 IOI V m: $SF LC OX.Sfllr--'q T.-ln Dpar, er..,, xrm,, _QlCS_fl External Flood Fault Tree APP. D Page 17
*WAC Servic W 11I* Laa of PCIIOa en T111in 2 fah 4160V ac S1'ilctQ-OTS1 Common Vlvn Fo, Chad! Vlv CCW*274 SSF 41110 V ac Lou ot Pow* To HVAC s.r.toe Wat* Flllll To Op9'I Swtlchg*r O TS1 ~a 4 160 V ac P\Jmpt F-. Fall Swild1g- OTS1 Fram SSF O.G.
XSERVWAN Paci- 18
"""1uI V.tv* CCW* Chad! Vlv* CCW*V4 4160 VIC SSF 273 Trnat..-. Cloud Tr*nl*
- Closed Stll!c:t,g_, OTS1 Is In Mlllnl..-.nce HCW'02J4C'{L
~ I Valvl CCW* "HVAC Sarvtce Wal" 275 Trmf..-. Clotal Pump 2 Fdt HCWO:Z7!iVVT
"-II* 18 External Flood Fault Tree . APP. D Page 18 I
a: a.. CD ....~ ca u. -g 0 u. as C: ~ w
Lo11 ot semca Wal* Cnoltng b' Oinal Ja:11:111 SSF HVAC &nice Vava Faill** ii LOM 01 Eilh* Diesel G111t11a1or Wal* FDI* F~1 Dies191 Ja:kal Oi1sel Jed\al Heal Seriica Wlll r Pump Clcgs Se!vica Wal* Flaw E1d1111,g.- Fails Palh Paga 21 Paga 21 Manual Valra CCW- Cha Valve CCW*:1114 JIM Transl** Tr1n1I** Cloud Cloud All* Opailrig Alls Opening NCW0084WT NCW02MCVT Manual Valra CCW- Chack Vahla CCW-314 2flll Trar11ls1 CIOHd Fail - To Op_, N.CW021,!§_WT NCW02iicvo 2 Mamllll Valwe CCW- Mania Va1¥a CCW-283 Tran1lsa Cloled 285 Tran1l r11 Clolled NCWD26SVVT External Flood Fault Tree APP. D Page 20
! -~
N a> CJ> m a.. C a: 0.. g~* 8 ~;
- llfi.l~ :110-t !j!i
**r*
> 0 I ~i.
,~....i lj t tii "'.. ...1.1 ... m a, D
.D .!::
m ii§ I.... It~ I~<< LL
'C I .
0 0 u: m C I! r~ Q) w 11
L""* cl f'0w9f a, 125V de SSF L0111 cl p,,... en 800V IIC MCC 3XSF Ols?ribolion Cent* DCSF Page 19 Paga 21 BIi.nary DCSF Fail1 125 V de SSF 600 V a:: SSf MCC Lo51 cl P""'91' 1D 600 V ac SSF MCC Oll lribUtion CIWII* 3XSF l!<J1 F*II 6aN a:: MCC 3XSF 3XSF 811!1 Is In OCSF I* In From f!CfN 11C LC Main1.,arce
,._,l....erc;a OXSF tEll!a'll. FNd)
NACJXSFBLr.t N_Q_C~SFBVF 125 V de SSF OIi!. 800 V m: SSF MCC SSf 1100 V a:: "'1CC Sanery OCSF Br ea.lier 38 c-,1er DCSF e,.,.., JXSf s,.ica 3A Tramr.s Open JXSF Brealler JA Tr8llsl..-. Open (To U. Traristar ap.,
- Fa.II Ta Clos*
(F...S Frum CSF) (f'rnm OXSf) (frcm OXSF) OiSI. C""tar) NA.c:Jlf;:,ACLC "1QCS_f3BCO_T SSF 800 V m: LC
- 125 V de SSF OXSF BrMlt* 5C Dislritlulian Canl
- l ,-,1!ar1 Open OCSF Bus Fa.ii (F-.1 To JXSF)
,OF NACOX~CL1.
~ - -
External Flood Fault Tree APP. D Page 22 I
- }}