ML23109A078

NRC-2022-000160 - Resp 2 - Final, Agency Records Subject to the Request Are Enclosed, Part 2 of 7

ML23109A078
Person / Time
Issue date:	04/13/2023
From:	NRC/OCIO
To:
Shared Package
ML23109A075	List: ML23109A076 ML23109A077 ML23109A078 ML23109A079 ML23109A080 ML23109A082 ML23109A083 ML23109A084
References
NRC-2022-000160
Download: ML23109A078 (1)

Text

{{#Wiki_filter:II. Duke Pou:er Compum Oconee.\\uclea, Generation Deour.n:,tr;; Pd B()X N];J

• I

i\\.' JI, \\f/'7(;_1

• , *e Prt!.11d~nr

",_'/;,.,.i.J./.'1:' (jfftff ,:;J :-.~~5-35,;.1 Fu.r ' e DUKE POWER December 28, 1995 U. S. Nuclear Regulatory Commission Attention : Document Control. Desk Washington, DC 20555

Subject:

Oconee Nuclear Stat ion, Unit~ 1 and 2

• Gentlemen:

Docket Nos.: 50-269, 50-270 and 50-287 Individual Plant Examination of External Events (IPEEE) Submittal In response to Generic Letter 88-20, Supplement 4, Duke Power Company has completed the Individual Plant Examina.tion of External * ~vents * (IPEEE) for severe accident vulnerabilities at t he Oconee Nuclear Station ; The* attached report presents *the

• results.' The Ocon~e IPEEE program was conducted in accordance with the* appx;oacr and methodology described in our December 18; 1991, 180. day response letter,
• with one exception.

The relay review, being done in conjunction with the USI A-46 relay review, has not been completed. The 180 day response was accepted by the NRC by its letter of June 16, 1992. The scope.* of

• the relay. chatter re:view for Oconee is
• consistent with the s i te's seismic :margin r~v~3w level earthqua ke classification as defined in Table 3.1 of NUREG-
• 1407. Oconee is in the "full s9ope " :bin. The full _scope evaluation requires a relay chatter review for all essential relays in *accordance wit h the procedures outlined iri the Generic Implementation Procedure (GIP). A simila*r *review of relays i s required for resolution of USI A-46. The relay
• review is in progress but has not been completed.

Approximately 5500 relays are being reviewed. To date, apprc ximately. 3860 of these relays ha~e been evaluat~d and determined not to be a concern.

• By letter dated Octobe~ 3,

1995, Duke -Power requested a revised submit~al date of

• Decembe3: 31, 1996 for USI A-46 in order to. c'?mplete this wor!c. In order to *meet the December 31,
• 1595 IPE~E submittal date, relay chatter *is accounted for in the IPEEE report

~~ -~ ~9 .. ~*-.. *.. *.,:.. *.. - 020 C~Cl

Document Control Desk December 21, 1995 Page 2 using the same fragilities as listed in the existing Oconee* PRA. It is ou!" expectation that the core damage frequency* for seismic events reported in this_ submittal w.i..11 not be significantly affected by the remaining relay analysis. An

• a.ddendum to the submittal _report will be submitted by December 31, 1996 if the relay evaluation indicates any significantly new results in the existing relay chatter fragilities and seismic core damage frequency.

This Oconee IPEEE Submittal Report contains a ~ummary of the

methods, results and conclusions of the Oconee IPEEE program. The IPEEE process and supporting Ocone~ PRA include a comprehensive, systematic examination of severe. accident potential resulting from external initiating events. The Oconee IPEEE has identified the severe accident sequences *of significance resulting from the external initiating events with quantitative perspectives on their likelihood.

The insights from this study prompted some plant enhancements, as discussed in Section 7 of the enclosed repo_rt. The examination process and the accompanying dialogue have improved our understanding of these types of accidents. The integrated safety profile evident from the risk results confirms that the Oconee Nuclear Station poses no undue risk to the public health and safety. Therefore, the objectives of GL 88-20 are fully satisfied. Several. generic issues and unresolved saf~+:y

• issues were addressed and are considered closed out as a result of the previous PRA work and the IPEEE effort. These are: USI A-45, USI A-17, GI 57, GI 103, the Eastern U.S. Seismicity Issue, and NUREG/CR~5088.

+n conclusion, the Oconee IPEEE completes all the studies requested by Generic Letter 88-20. This IPEEE submittal along with *the previous IPE submittal contains adequate information to resolve the severe accident vulnerability issue for Oconee.

Document Controi Desk December 21, 1995 Page 3 I declare under penal ties of per,ury that the statements set forth herein are true and correct to the best of my kn9wledge. . Very truly yours, 1!}f1!1};_f.r J. W. Hampton Attachment (IPEEE Submittal Report) xc:

• (with attachment):

Mr. S. D. Ebneter, Regional Administrator U. S. Nuclear Regulatory Commission, Region II Mr. Patrick D. Milano Office of Nuclear Reactor Regul ation Mr. P. E. Harmon Senior Resident Inspector Oconee Nuclear Site

Duke Power Compauy OCONEE NUCLEAR. STATION IPEEE SUB.MITT AL REPORT December 21, 1995

2.

TABLE OF CONTENTS EXECUTIVE

1.1 BACKGROUND

AND OBJECTIVES 1.2 PLANTFAMILIARIZATION 1.3 OVERALL METHODOLOGY 1.3. l External Events Methodology 1.3.2 Plant Model 1.4

SUMMARY

OF MAJOR FINDINGS 1.4.1 Core Damage Frequency Results 1.4.2 Containment Performance Results 1.4.3 Vulnerability Findings EXAMINATION DESCRIYfION

2.1 INTRODUCTION

2.2 CONFORMANCE WITH GENERIC LEITER AND SUPPORTING MATERIAL 2.3 GENERAL METHODOLOGY 2.4 INFORMATION ASSEMBLY 1-1 1-1 1-1 1-2 1-2 1-3 1-3 1-3 1-4 1-6 2-1. 2-1 2-1 2-3 2-4

3.

SEISMIC ANALYSIS 3-1 3.0 METIIODOLOGY SELECTION 3-1 3.1 SEISMIC PRA 3-1 3.1.1 Hazard Analysis 3-f 3.1.2 Review of Plant Information and Wallcdown 3-2 3.1.2. l Plant Information 3-2 3.1.2.2 Information Sources

• 3-4 3.1.2.3 Wallcdowns 3-6
• 3.1.3 Analysis of Plant System and Structure Respom,~

3-10 3.1.4 Evaluation of Component Fragilities and Failure Modes 3~ 13 3.1.5 Analysis of Plant Systems and Sequences 3-*15 3.1.5.1 Seismic Event Tree 3-15 3.1.5.2 Supporting Fault Tree Logic 3-18 3.1.5.3 Event Tree Sequences 3-25 3.1.5.4 Seismic Fault Tree Solution 3-27 3.1.5.5 Sequence Distribution and Timing of Core Damage 3-29 3.1.5.6 Sensitivity of the Auxiliary Building Surrogate 3-29

• 3.1.5.7 Extrapolation Beyond l.02g* Acceleration Levels 3-30 3.1.6 Analysis of Containment Perfor:mance*

3-30 3.2 USI A-45, GI-131, AND OTHER SEISMIC SAFETY ISSUES 3-32

Section ~

4.

INTERNAL FIRE ANALYSIS 4-1 METI-JOOOLO~YSELECTION 4-1 4.1 FIRE HAZARD ANALYSIS 4-1 4.2 REVIEW OF PLANT INFORMATION AND WALKDOWN 4-2 4.3 FIRE GROWTJ::1 AND PROPAGATION 4-2 4.3.1 Cable Shaft Fire 4-2 4.3.2 Turbine Building Fire 4-3 4.4 EVALUATION OF COMPONENT FRAGILITIES AND FAILURE MODES 4-3 4.5 FIRE DETECTION AND SUPPRESSION 4-4 4.6 ANALYSIS OF PLANT SYSTEMS, SEQUENCES, AND PLANT RESPONSE 4-4 4.7 ANALYSIS OF CONTAINMENT PERFORMANCE 4-5 4.8 TREATMENT OF FIRE RISK SCOPING STUDY ISSUES 4-5 4.8.1 Strategy 4-5 4.8.2 Walkdown Team 4-5 4.8.3 PRA Assumptions, Input and Verification 4-5 4.8.4 Smoke Generation/Migration Effects 4-6 4.8.5 Water Spray and Migration Effects 4-7 4.8.6 Seismic/Fire Interaction 4-7 4.8.7 Control System Interactions 4-9 4.8.8 Compartment Interaction Analysis 4-9 4.8.9 Walkdown Conclusions 4-10 4.9

SUMMARY

OF RECOMMENDATIONS 4-10 4.10 USI-45 AND OTHER SAFETY ISSUES 4-11 4.11 SENSITIVITY STUDIES 4-11 4.12. DOCUMENTS 4-11

s.

HIGH WINDS, FLOODS AND OTHERS 5-1 5.1 HIGH WINDS 5-1 5.1.1 Overview 5-1 5.1.2 Methodology 5-2 5.1.2.1 Tornado Occurrence Frequencies 5-2 5.1.2.2 Tornado Wind Effects 5-3 5.1.2.3 Tornado Missile Simulation Analysis 5-8 5.1.2.4 Keowee Tornado Path 5-9 5.1.3' Tornado Event Tree 5-10 5.1.3.1 Event Tree Structure 5-10 5.1.3.2 Top Event Failure Logic 5-11 5.1.3.3 Event Tree Sequences 5-13 5.1.4 Containment Performance 5-15 5.1.4.1 Containment Isolation 5-15 5.1.4.2 Containf!lent Safeguards 5-15 ii*

Section fue 5.1.5 Limitations of the Analysis 5-15 5.1.6 Resu'.:s 5-16 5.1.7 Unit Differencies 5-16 5.1.8 Insights 5-17 5.1.9 Conclusions 5-17 5.1.10 Recommendations 5-17 5.2 EXTERNAL FLOODS 5-17 5.2.1 Methodology 5-18 5.2.1.1 External Flooding From Precipitation 5-18 5.2.1.2 External Flooding From Dam Failure 5-19 5.2.2 Event Tree 5-23 5.2.2.1 Event Tree Structure 5-23 5.2.2.2 Event Tree Sequences 5-24 5.2.3 Fault Tree Analysis 5-25 5.2.4 Containment Performance 5-26 5.2.5 Limitations of the Analysis 5-26 5.2.6 Results . 5-27

• 5.2.7 Insights 5-27 5.2.8 Conclusions 5-27 5.3 TRANSPORTATION AND NEARBY FACil...ITY ACCIDENTS 5-27 5.3.1 Aircraft Crashes 5-27 5.3.2 Transponation Events 5-30 5.3.3 Impact of Nearby Military and Industrial Facilities 5-31 5.3.4 On-Site Storage of Toxic Materials 5-31 5.3.5 On-Site Storage of Explosive Materials 5-32 5.3.5.1 Propane Tanks 5-32 5.3.5.2 Hydrogen Storage 5-33 5.3.6 Gas Pipeline Ruptures 5-35 5.3.6.1 Natural Gas Pipelines 5-35 5.3.6.2 Off-Site Propane Storage Facilities 5-35 5.4 OTHERS 5-35

6.

LICENSEE PARTICIPATION AND INTERNAL REVIEW TEAM 6-1 6.1 IPEEE PROGRAM ORGANIZATION 6-1 6.2 COMPOSITTON OF INDEPENDENT REVIEW TEAM 6-1 6.3 AREAS OF REVIEW AND MAJOR COMMENTS 6-1 6.4 RESOLUTION OF COMMENTS 6-2

7.

PLANT IMPROVEME~TS AND UNIQUE SAFETY FEATURES 7-1

8.

SUMMARY

AND CONCLUSIONS 8-1

9.

REFERENCES 9-1 iii

APPENDIX A APPENDIXB APPENDIXC APPENDIXD OCONEE SEISMIC FAULT TREE OCONEE PRA REV. 2, SECTION 3.5 OCONEETORNADOFAULTTFEE OCONEE EXTERNAL FLOOD FAULT TREE EiiYJC Number Figure 3-1 Figure 3-2 Figure 5-1. Figure 5-2 Figure 5-3 Figure 5-4 Figure 5-5 Figure 5-6 Table Number Table l* l Table 3-1 Table 3-2 Table 3-3 Table 3-4 Table 3-5 Table 3-6 Table 3-7 Table 5-1 Table 5-2 LIST OF FIGURES .Oconee Seismic Hazard Curves Oconee Seismic Event Tree Oconee Tornado Event Tree Diagram of Tornado Origins Layout of Oconee Nuclear Station

• TORMIS Analysis Plant Site Model Oconee Nuclear Station Missile Origination Zones Oconee External Flooding Event Tree LIST OF TABLES External Initiating Events Core Damage Frequency Component Fragilities Used In The Oconee Seismic Analysis Additional Seismic Plant Model Basic Event Data Enhancements Resulting from the IPEEE Seismic Verification Walkdown Dominant Seismic Event Sequences Dominant Seismic Event Sequences - LLNL Curve Seismically-Induced Core-Melt Results By Sequence Timing of Seismic Core D_amage Sequences Preliminary External Initiating Event List Tornado Data and Frequency iv 3-68 3-69 5-95 5-96 5-97 5-98 5-100 5-101

~ 1-7 3-34 3-36 3-39 3-44 3-63 3-66 3-67 5-36 5-37

Table Number Table 5-3 Table 5-4 Table 5-5 Table 5-6 Table 5-7 Table 5-8 Table 5-9 Table 5-10 Table 5-11 Table 5-12 Table 5-13 Table 5-14 Table 5-15 Table 5-16 Table 5-17 Table 5-18 Table 5-19 Table 5-20 Table 6-1 Table 6-2 Piping Damaged by Tornado-Induced *west Penetration Room Failure Oconee Nuclear Station Missile Distribution Conditional Probability *of Damage By Tornado-Generated Missile Keowee Conditional Failure Probabilities CAFf A TornadoBasic Event Data Event Tree Failure Modes Considered Tornado Cut Sets Tornado Results By Sequence Oconee Tornado Event Importance Measures External Aooding Model Reliability Data External Flood Cut Sets With Sequence* Designations External Flood Results By Sequence Dam F~lures Used in This Study Chronological Order of Dam Failures 1993 Greenville / Spartanburg Air Traffic Summary 1993 Asheville Air Traffic Summary Accident Rate For U.S. Air Carriers; 1980 - 1991 Screening Justification for Other External Initiating Events Peer Review Team Members Peer Review Team Comments and Resolutions V 5-38 5-39 5-41 5-42 5-43 5-44 5-47 5-72 5-73 5-74 5-80 5-86 5-87 5-88 5-89 5-90 5-91 5-92 6-3 6-4

1.

EXECUTIVE

1.1 BACKGROUND

AND OBJECTIVES In l ~ov, the Nuclear Safety Analysis Center (NSAC). uigested that ' a plant-specific. probabilistic risk assessment (PRA) be undenaken by the nuclear industry. on its own initiative. The proposal for an industry PRA project, managed by NSAC and performed in cooperation with a utility, was reviewed with the NSAC utility advisors and. approved. Duke Power Company and Oconee Nuclear Station were chosen. for the project The NSAC study was published in June 1984 as NSA~-60 (Ref. 1.1). Soon after embarking on the NSAC-60 effort, Duke organized a Severe Accident Analysis Group to facilitate large scale PRA and reliability stu~ies. This group was charged with the responsibility to plan, conduct and coordinate. iill proposed *PAA studies, and to maintain and update the plant PRA models as appropriate. In January 1987, Duke Power initiated a large-scale review and update of the original study. The major objectives of the review and update were to (1) incorporate plant changes made since the time ofthe original study, (:Z) improve on asswnptions made in the original study, (3) make use of plant experience/data from the 1980s, and ( 4) make use of improvements in PRA methodology and up-to-date techniques. In December 1990, Duke submitted this updated PRA (Ref. 1.2) to meet the requirements of Generic Letter 88-20 {Ref. 1.3) concerning the Individual. Plant Examination (IPE) covering internal events. The IPE submittal {Ref. 1.4) explained that the Oconee PRA is a full-scope, level 3 PRA with complete analysis of external e_vents in addition to internal

• events. External events have been included in the Oconee PRA studies beginning with the original study.

Consistent with the IPEEE submittal plans outlined in the December 18, 1991.Duke letter (Ref. i.5), and approved by the NRC letter of June 16, 1992 (Ref. 1.6), Duke Power Company provides herein the response to GL 88-20, Supplement 4 {Ref. 1.7). Included in this report (designated as the IPEEE Submittal Report) is a revisi~n of certain sections of the Oconee PRA report. To facilitate the NRC staff review, the IPEEE information has been presented using the standard table of contents given in Table C. l of NUREG-1407 (Ref. 1.8)... 1.2 PLANT FAMILIARIZATION Oconee Nuclear Station, located in Oconee County in northwestern South Carolina, is sited on the shore of Lake Keowee, a Duke impoµndment on the Keowee River, a tributary of the Savannah River. The station was buiit during the 1967 to 1974 period. Unit 1 began commercial operation in 1973, and the last unit (Unit 3) began commercial operation in 197 4. The station con~ists of three Babcock & Wilcox pressurized water reactors, each designed to. generate 2568 MWt. The balance of plant station was designed 1-1

and constructed by Duke Power Company, with Bechtel Corporation designing the Reactor Building. The station consists of three. reactor buildings, a common turbine building for all three units, and two auxiliary buildings; one servicing units I and 2, and the other servicing unit 3: The nuclear steam supply system has two loops with two cold legs each. Each unit has two "once-through" steam generators that produce superheated steam at constant pressure. The reactor and nuclear steam supply system are contained within the reactor building, a prestressed, post-tensioned reinforced concrete cylinder and dome with a ste~I liner. Emerg~ncy power for the Oco*nee systems is provided by the two units of the Keowee hydroelectric station, which is located at the Keowee Darn, about a mile away from the plant. In addition to a large grid network, backup power is also available through a dedicated line from three. combustion turbine units at the _Lee Stearn Station, approximately 30 miles away. The piant design incorporates the Standby Shutdown Facility (SSF), a totally independent means of achieving and maintaining safe shutdown conditions if the normal plant safety systems are unavailable. 1.3 OVERALL METHODOLOGY 1.3.1 External Events Method<?logy The evaluation of external events was performed in the original Oconee PRA repon and its subsequent update with four events identified for a detailed review: Seismic Activity Fires Tornadoes Floods In addition, NUREG-1407 requires a review of transportation and nearby facility accidents. (It should be noted that thes_e events were also evaluated in the original PRA repon, but their probabilities of occurrence were determined to be very low - <lE-08. Nevertheless, an evaluation using updated information is presented.) A variety of methodologies were employed to derive the overall event frequencies for these events, as explained in detail in Sections 3'.0, 4.0, a_nd 5.0 of this repon. The findings from the original PRA studies have been updated as necessary to suppon this examination. 1-2

, 1.3.2 Plant Model The Oconee PRA is a full-scope analysis comprised of three pans and use*s methods consistent with the PRA Procedures Guide (NUREG-2300) (Ref. 1.9). The Level I or "front end" analysis determines core damage sequences as a result of various internal and external events and places ihese sequences into plant-damage state bins. The Level II and III or "back end" analyses determine the effect of the acddent sequences on containment and the resulting radiological releases to the public. The basic models used for accident sequence de':'eloprrient are event trees and fault trees. The event trees used in this analysis are functional e\\*ent trees, with the top* events defining the functions needed to protect the.core. The end states of the functional event tree represent functional sequences. The event tree end states are also used to place accident sequences into plant-damage state bins. These bins are the transition from the front end analysis to the back end analysis. The plant systems have been analyz.ed with detailed fa ult trees, generally to the component level. The level of detail in the model is defined by the level.at which data is available. This IPEEE study is primarily a Level I analysis which determines the event frequencies of external events. As with internal ~vents, external events are input to the Levei I plant model and their contribution to core damage risk is detennined. The Level II analysis involves the containment response to various accidents and core damage progression thereof and, _thus, is not expressly influenced by external events. Rather, the external event impacts on active systems that affect containment performance (e.g., containment ventilation, spray, isolation, etc.) arc addressed in this examination. ~-4

SUMMARY

OF MAJOR FINDINGS. The major findings from this examination are that there are no unduly significant sequences (vulnerabilities) from external events. Seismic events are the most significant external event contributors to core damage risk. There were no pl~nt cha:1ges identified that would significantly reduce the risk from external events. 1.4.1 Core Damage Frequency Results The results of the Oconee PRA report provide an estimate of. plant severe accident risk and an understanding of the basis for this risk. The Core Damage Frequency (CDF) from external events as a result of the IPEEE evaluation is 6.1 E-05 / yr., compared to 8.7E-05 / yr. estimated in the Oconee IPE report. These results are applicable to all three units of the plant 1-3

&RVC£H The contribution of the external events to the CDF and their comparison with the IPE values is shown in Table 1-1. Seismic events comprise approximately 59% of the calculated external event CDF. The primary accident sequences involve Joss of power events coupled with SSF failures. Flooding events (due to the seismically-induced failure of the focassee Dam) are also dominant contributors to the seismic CDF. The mean seismic hazard curve, generated by EPRI specific~y for the Oconee site, is used as the basis for this analysis. A sensitivity study was perfQrmed using the January 1989 Lawrence Livermore National Lab (LLNL) hazard curves for Oconee. The dominant accident sequences are ~omparable in their ranking with the EPRI curve results and do not add to or alter any of the insights of this analysis. Tornado events make uo annroxirnatelv 21% of the calculated external event CDF. (b)(7)(F), (bX3) 16 U.S.C. § 8240-l(d) Internal fire events account for approximately 8% of the calculated external events CDF. The dominant fire sequences occur in the Turbine Building; however, there were no unacceptable risks or outliers identified.*

• External flooding events (caused by a random failure of Jocassee com rise l 12% f the total external event CDF (bX7)(F), (bX3):16 U.S.C. § 8240-l(d) 1.4.2
• Containment Performance Results External event impact on containment performance has been examined from several perspectives, as follows:

Containment Structure - The Reactor Building and containment internal structures were found to be seismically *rugged based upon an evaluation of their median seismic fragilites. These structures are also designed to withstand tornado and other high wind effects. The consequences of airplane crashes and turbine~generated missiles were determined to be insignificant. No other hazard was identified that could challenge the containment structure. SENSITIVE SEGUIHTY R£UrTED INfOIH,f1rTf ON Cftl'flCAL ENERGYIELECTRf GAb INF RASTil:UCTUEUs 1Nr0~,4ATIO~J 1-4.

Containment Isolation - A screening analysis of containment penetrations was performed in the PRA report to detennine which penetrations, if failed, could kad to significant release pathways. The sei~mic impact on containment isolation was evaluated by analyzing t:, : ;~ p.:netrations along with their associated piping and valves. They were found to

• be sufficiently rugged to withstand a seismic event. The probability of damage to penetrations and valves due to a tornado were judged to be low.

The containment isolation signals are generated via the Emergency Safeguards Features Actuation System (ESFAS). The cabinets housing this equipment were evaluated for functional ruggedness. Likewise. the respective panelboards and motor control centers providing *power to actuate the valve solenoids and motors were analyzed and evaluated via plant wallcdowns. The motor control centers, load centers, and panelboards were modeled as a group due to their similarity of design. Thus, specific equipment of this nature used to actuate containment isolation was evaluated on this basis. Two failure modes were identified for this equipment. Structural failures are modeled by the Auxiliary Building surrogate. The other failure mode for these items is unrecovered ~lay chatter. Reviews are currently being conducted to detennine (and replace, as necessary) any 'bad actor' relays found within the systems identified under the IPEEE scope of review. The ES FAS is included in this scope. External flooding events will result in a loss of all power to the containment* isolation valves. The plant response at this point would. be the same as other station blackout events. Motor-operated valres are designed to fail in their "as . is" position. Air-operated valves are designed to fail in the closed position upon a loss of instrument air. (b)(7)(F), (b)(3):16 U S.C. § 8240-l(d) ....._ ________ ___,J,Each of these is designed to fail close upon e1 er a loss of power or air. Failures of the remaining penetrations were detennined to be probabilistically insignificant Containment Safe&uards - External events were *ud ed to have no Wli ue irn act on the containment safe uards. (b)(7)(F), (b)(3):!6 U.S.C § 8240-l(d) In general, the containment safeguards systems are well rotected from the effects of tornado wind and missile dama e (b)(7)(F), (b)(3):16 U.S.C. § 8240-l(d) 1-5

r X7XF), (b)(3) 16 U.S.C. § 8240-l(d) The* containment safe uards com nents were evaluated for seismic ru edness: (bX7)(F). (bX3) 16 U.S C. § 8240-l(d) l(b)(7XF), (bX3) 16 U.S.C. § 82-fo-l (d) 1.4.3 Vulnerability Findings The basic finding of the evaluations summariz.ed in this report is that there are no fundamental weaknesses or vulnerabilities with regard to severe accident risk at Oconee Nuclear Station. 1-6

TABLE 1-1 External Initiating Events Core Damage Frequency IPE Report (.12/90) IPEEE Report (12/95) Core Damage Percent of Core Damage Percent of Frequency Total Frequency Total (per year) (per year) Initiating Event Seismic 5.0E-05 57.5% 3.6E-05 58.9% Fires

• 2.2E-05 25.3%

5.0E-06 8.2% Tornadoes 9.7E-06 11.1% l.3E-05 21.3% Ext. Flooding 4.9E-06 5.6% 7.0E-06 ' 11.5% Transportation & Nearby Facilities

• Tota) External 8.7E-05 6.lE-05 1-7

2.

EXAMINATION DESCRIPTION

2.1 INTRODUCTION

The Individual Plant Examination Of External Events (lPEEE) for Oconee Nuclear Station was performed on the basis of the original Oconee PRA and its subsequent update. This report summarizes the examination process for external events performed from 1980 - 1984 for the original Oconee PRA (NSAC-60), the continuing process of updating the risk model which resulted in the updated PRA issued in 1990, and the results of the latest update to support the IPEEE. The method of examination of external events used in the Oconee PRA and the subsequent updates is the standard PRA method, with the enhancements described in Section 4 of the Generic. Letter 88-20, Supplement 4.. State-of-the-art probabilistic risk assessment (PRA) methods and current plant information were used in the original Oconee PRA and in the subsequent updates. The specific external events identified in.GL 88-20, Supplement 4 have been addressed and arc disc~ssed in the, pertinent sections. Comprehensive plant walkdowns have been performe~ !to investiga~ and tQ incorporate the actual plant conditions in the examination. The basic event valu~s involving random equipment failure, human error probabilities, and test and maintenance unavailabilities are compiled in the IPE analysis. 2.2 CONFORMANCE WITH GENERIC LETTER AND SUPPORTING. MATERIAL Generic Letter 88-20, Supplement 4 identified four ge,ieral purposes for each utility in performing the IPEEE. Duke Power Company has satisned these as f o,Uows: 1, Develop.an Appreciation of Severe *Accident Behavior - Duke Power Company's initial staffing to enable large scale PRA and reliability studies in-house began in 1980. A severe accident analysis group was organized and charged with the responsibility to plan, conduct, and coordinate all proposed PRA studies and to maint:::1 and update the plant PRA models as appropri::1t*P.. In addition to PRA studies, this group is also utilized for engineering *support involving severe accident input in such areas as emergency planning, plant deiign changes. and plant operational problems. In conducting,a full-scope.PRA, personnel from the Severe Acciqent Analysis Section perform a majority of the PRA-related tasks. This core group is augmented by specialized expertise in mechanical, electrical and civil disciplines from other areas of the Nuclear Generation Department. In addition, the expertise of an operations engineer, assigned to support the PRA

• effort, is:* utilized to factor in operational

. I insights on initiating events, accident sequence modeling, human reliability analysis and recovery actions. In the case of some specialized inputs, such as site seismology and equipment fragilities, outside expertise is utilized to complete the tasks. 2-1

SRVCEif The IPEEE effort was completed primarily in-house, with limited contract support for seismic studies.

2.

Understand the Most Likely Severe Accident Sequences - lbe Oconee PRA report and. the IPEEE ~valuation have consistently ~~,1w~1 the same dominant accident sequences from external events. Seismic events, mternal fires, tornadoes and external flocxfing events are identified to be the most significant external event contributors t c e dama e risk. Seismic events com rise a ma *ori of the external event CDF (bX7)(F), (b)(3):16 U.S C. § 8240-l(d)

3.

Gain a More Qualitative Understanding of the Probabilities of Core Damage and Releases -The plant systems have been analyzed with detailed fault trees, generally to the component level. The CAFT A computer code (Ref. 2: 1) was used to solve the plant models and generate accident sequences in response to various ~ternal and external events. Once the accident sequences have been determined, they are categorized, or 'binned', according to the severity of the systems failures, LOCAs, etc. A complete set of computer runs using the Modular Accident Analysis Program (MAAP) code (Ref. 2.2) *has been developed for each 'bin' and provides *an estimate of time to core damage. The resulting releases from external-event core damage accidents are discussed fully in the Oconee PRA report (Ref. 1.2).

4.

Reduce, if Necessary, the Overall Probabilities of Core Damage and Releases - Whereas mis examination of external events* did not result in any major actions or modifications which could potentially reduce the overall core damage probability, several plant enhancements were identified during the development of the internal events portion of the IPE. These may be found in Section 6.0 of the Oconee IPE submittal report. The detailed IPEEE walkdown effort identified a few repairs and modifications that are minor in scope to enhance the seismic adequacy of several components. These are listed in Table 3-3 and Section 4.9. 6J;;N6ITIVJ;; 6J;;GUR,1TY ~bATJ;;D nJPORUATION Rff1AL EHEROYfELECTRiCAL HffRAS1'RUCTURE HffOf~MAHOH 2-2

The Generic Letter Supplement also identified the issu~ of ensuring tl,te _technical adequacy of the IPEEE and validating its results. These are addressed as follows:.

• . The pre-IPEEE analyses, original PRA study and subsequent update, have received several stages of 1.11ternal review. First, each of the major analytical tasks went through a peer review within the project team. Subsequently. it was reviewed by the project.manager/ engineering supervisor to ensW"F that the analyst had perfonned an adequate analysis and that it had gone through an.appropriate peer review. Following
• the two levels of review performed within' the. project team, engineering personnel outside the PRA project team familiar with plant systems and accident sequences conducted a review of system models, underlying assumptions, system level results, and overall results. In parallel with the engineering review, the PRA draft repon was reviewed by selected station personnel. The _ focus of this review was the reasonableness of the underlying assumptions for system operation and operator actions. Besides the technical review of the PRA, management briefings were given to apprise key management personnel of the results and conclusions.

1 The results of the IPEEE effon were given approximateiy the same level of review as the previous studies. Independent Review Teams (seismic and fi~e) were formed to perform a review of the IPEEE process and results. These teams consisted of senior level employees with experience in PRA methodology, seismic equipment qualification, fire_ protection, and systems engineering. The seismic team included experts from outside the company. Thus, Duke Power has satisfied the objectives of the generic letter by its original PRA, subsequent updates, and the latest IPEEE effort. The )Duke Power_ staff_ has realized the maximum benefits from the program by their involvement in all aspects of the examination. 2.3 GENERAL MEIBODOLOOY The general methodology for examining external events is consistent with the methods . presented in _NUREG/CR-2300. The general approach used to develop the external event PRA *is as *follows: Natural and man-made external events of interest were identified using other PRAs, NSAC/60, ANSI/ANS-2.12 (Ref. 2.3), and the aforementioned NUREG/CR-2300. The resulting events were screened in order to sel~ct significant events requiring funher review. Twenty events were identified. A scoping analysis was perfonned on the remaining events. Four were identified that warranted a detailed quantification: earthquakes, floods, tornadoes, and fires. 2-3

This approach is presented in greater detail in the Oconee PRA report. (Note that this revised external events analysis also includes an updated review of transportation and nearby facilities accidents per NUREG-1407.) The specific methodology for each hazard is discussed ir, Sections 3.0, 4.0, and 5.0. 2.4 INFORMATION ASSEMBLY Many sources of information were used during the IPEEE process. These include the Oconee FSAR (Ref. 2.4), Oconee SER (Ref. 2.5), vendor seismic qualification design reports, vendor seismic qualification test reports, equipment spedfications, plant drawings, vendor drawings, dynamic analyses of structures, in-structure response spectra, Oconee Probabilistic Seismic Hazard Evaluation (Ref. 2.6), structural design calculations, equipment anchorage design calculations, flow diagrams, computer codes, air traffic infonnation, evacuation plans, operating procedures; National Weather Service data, and various other NRC and EPRI technical reports. Additional sources of information related to the fire review are listed in Section 4.12. The original PRA report included the then-current plant design documents, operating procedures, Tech. Specs., and plant configuration. The subsequent revision to the PRA used updated information as appropriate. Coordination activities of the IPEEE teams among the external events are handled by Duke Power's Severe Accident Analysis Section which is responsible for the Oconee PRA. Individuals from this group were on all the teams and were responsible for coordination and the final results.. As an example, any potential for seismically-induced fires was communicated between the fire and seismic teams. 2-4

S. HIGH WINDS, FLOODS, AND OTHERS A detailed *list of natural and man-made external events was reviewed and screened for applicability to Oconee. A listing of these events is given in Table 5-1 and may also be found in Section 3. I of the Oconee PRA report. Of these, four were identified that warranted a detailed quantification: earthquakes, fires, tornadoes, and floods. Transportation and nearby facility accidents were also evaluated in the original PRA report and its revision, but their probabilities of occurrence were found to be very low. Nevertheless, tQ meet the specifications of NUREG-1407, an evaluation using updated information is also presented for these events. 5.l HIGH WINDS 5.1. I ' Overview This section describes the process of assessing potential plant vulnerabilities induced by high winds and tornadoes. Initially, three* types of winds were initially considered for this study: Hurricanes, Tornadoes, and Non-torriadic (Straight) Windstorms. However, Oconee' s inland location makes the probability of severe wind damage due to hurricanes very unlikely and the probability of damage to importarit components or structures from non-tornadic (straight) winds.is low compared to that of tornadoes. The Oconee *FSAR . reports the maximum 100 year wind velocity at the site to be 95 mph. All class 1 structures at Oconee are designed for at least 95 mph wind or to a higher standard. For these reasons, hurricanes and "straight windstonns" arc not considered any further. The primary purpose of this.assessment is focused only on tornado damage_events and the resulting core damage frequency. Only tornado events which cause damage to plant structures or equipment in conjunction with a loss.of off-site power are*considered in this assessment. The switchyard and Kcowee overhead path are assumed unavailable following a tornado strike. The risk associated with tornadoes that result in only a loss of off-site power but no damage to plarit structures or equipment is implicitly covered by the T5W (LOOP due to weather) initiating event in the IPE Study. This assessment is an update to an earlier tornado study.for the Oconee PRA (Ref. 1.2). . This previous study also relied heavily on a tornado assess)nent perfonried for NSAC/60. Consistent with the Oconee PRA, Unit 3 is used as the reference unit for this study; An. event tree is conscructed to delineate core damage sequences caused by probable missile damage and tornado-wind effects on vulnerable structures. The analysis considers two categories of tornado events: 5-1

ath of the most robable tornado direction and thus is more susce tible to dama e. (bX7)(F), (bX3):16 U.S.C. § 8240-l(d) 5.1.8 Insights nee Tornado Core-Melt Fre (bX7XF), (bX3):16 u.s.c. § 8240-l(d) . Damage caused by. tornado-generated missiles are an insignific~t contributor to the probability of core damage. -5.1.9 Conclusions The Oconee tornado core damage frequency of 1.29E-05 is of the same magnitude as other potential severe accidents such as seismic. events, fires, floods, and other events. Thus,

Oconee plant risk due to tornado does not_pose a severe accident vulqerability.

5.1.10 Recommendations * ~~~ .._,which has the highest impact on tornado ris~(bX7XF). (bX3)16 u.s.c. § 8240-1<d) It is recommended that station rsonnel stud enhancements to the natural ~ ......... __...... rocedure (bX7)(F), (bX3):16 U.S.C. § 8240-l (d) 5.2 'EXTERNAL FLOODS _The details of the Oconee flooding analysis are presen~d in Section 3.3 of the PRA repon. Flooding from both internal and external sources was reviewed. External flooding occurs

• from heavy rains or breaches of dams.

Two potential events were found that ~ould lead to external flooding of the Oconee site. The first is a general ~ooding of the rive:s and reservoirs in the area due to a rainfall in excess of the probable 'maximum precipitation (PMP). Since the Oco,nee site is well inland, the effects of hurricanes were not considered. The relative size of the 1 reservoirs around the plant, and the distance of the site from the coast, are considered ~jor *impediments to 5-17

hurricane-induced surge flooding of a *severity approaching that which is caused by runoff-type flooding. During review of simil_arly _located sites, the NRC staff found that surge . producing winds would be significantly reduced when land mass frictional effects are encountered; therefore, surge flooding is negligible at Oconee Nuclear Station. The second source of external flooding is a possible random failure of the Jocassee Dam. Random dam failures include all causes other than a rain-induced failure (which will be discussed below) or an earthquake-induced failure (see Section 3.0 of this report). 5.2.1 Methodology 5.2.1.1 External Floodinc from Precipitation The PMP postulated for the Oconee site would be 26.6 inches within 48 hours. The effects of this PMP on reservoirs and spillways were evaluated in a study performed by Duke Power Company in 1966 (Ref. 5.22). The results of this study demonstrated that the Keowee and Jocassee reservoirs are designed to contain and control* the floods that could result from a PMP. Thus, in order to flood the plant site, rainfall exceeding the PMP must occur. The frequency of exceeding the PMP was obtained from the analysis presented in Ref. 5.23 for the Oconee site and was used as a bounding estimate of the frequency of core damage due to rain-induced external flooding. The analysis yields the following frequencies of a PMP ass~iated with the lower, median, and upper bounds of the probability distribution: Cumulative probability 0.05 0.50 0.95 PMP frequency (J)er yr) 4.9E-8 2.9E-7 8.9E-7 The cumulative probability for a particular frequency interval is to be interpreted as the degree of cenainty that the PMP frequency observed over a long period of time will be less than or equal to _the upper value of that frequency interval. 1 0,Xl)()'), 0,)()) 16 U s C, § 82'0.J(a) SRVC£H. Applying the SSF as a response to exceeding the PMP results in a calculated core damage frequency appro~imately an order of magnitude lower than the mean PMP frequency. In addition, the calculated mean. frequency of the PMP is more than an order of magnitude less than that due to a random failure of Jocassee Dam, which would also flood the site. For both these reasons, it was concluded that precipitation-induced external flooding is a S£HSITIY£ SECURITY RELATED Ht POP"1 tATIO~+ GIUTIGAL E~HiRGY}ELEGTRJGAL nrPRA~TRUGTURE l~+fQR;p4ATIO~t 5-18

negligible con.tributor to core damage frequency and p~blic risk. 5.2.1.2 External Flooding From Dam Failure 7-: : Oconee site_ has a yard grade elevation a few ~rt r tc: J W the full-pond level of Lake Keowee, which serves as the source of its condenser circulating water. Lake Jocassee has a full-pond.elevation about 300 feet above Lake Keowee. If a sudden failure of the Jocassee Dam were to occur, and a rapid enough release of the impounded water from Lake Jocassee into Lake Keowee resulted, the flood wave generated in Lake Keowee would overtop the Keowee Dam and the Oconee intake dike, flooding the plant This section presents the analysis performed to estimate the frequency of such a flood. Frequency of Dam Failure . The Jocassee Dam is an earth-rockfill structure approximately 400 feet high. The dam was completed in 1972, and the reservoir was filled by April 1974. The spillway lies-along one of the abutments, about one-quarter of a mile from the dam, and is a concrete structure founded on granite. An analysis was performed to determine an annual frequency of failure-for earth, earth- .rockfill, and rockfill dams due to events other than ovenopping and earthquake ground shaking, which were considered in separate analyses. Also, based on dam design

• information, structural failure of the spillway-during discharge and failure associated with seepage along an outlet works have been eliminated as a possible failure mechanism. The following principal modes of failure were considered:
• I. Piping.

2. Seepage.

3. Embankment slides.

4. Structural failure of the foundation or abutments.

These failure mechanisms are referred to collectively as random failures. Only" failures resulting in the complete collapse of the structure.and the uncontrolled release of the reservoir's contents were considered to have the potential for flooding the Oconee plant Previous investigations into the frequency of dam failure indicate that it decreases with later years of construction (Ref 5.24). This is generally attributed to improvements in the methods of design and construction. Therefore, another criterion considered in developing a data base and *failure-frequency estimate was the period of construcµon. The age of a darn is another factor that has been identified as having an effect on the rate of dam failure. Approximately half the darn failures occur during the first 5 years of operation (Ref. 5.31). Therefore, age was also considered in developing a data base. Size, type of construction, realistic failure modes,.Pcrio.d of construction, and age were the 5-19

major considerations used to define a data base for use in estimating the failure frequency of the Jocassee Dam. The data base characteristics that were attributed to the Jocassee Dam are: Characteristic Location (country) Year completed Age (years in operation) Height (feet) Type Jocassee Dam United States 1972 21 400 Earth-rockfill Various catalogs were used to develop the data groups that were studied (Ref. 5.25). Each group consisted of large earth, earth-rockfill, or rockfill dams (more than 45 feet high - Ref. 5.26) in the United States that were in operation 6 or more years when they failed. Of the references used in this *study, none were a complete catalog, and therefore they were used collectively. At present, these references represent the best. readily available information. From the various listings off ailures, cross-checks were made when possible. A data base uniquely suited in every major respect to the Jocassee Dam was unattainable because of a scarcity of the number of the earth-rockfill type. The data base ultimately developed reflects discussions with Duke Power engineers familiar with the characteristics of the Jocassee Dam. It was decided that the data biise should include only the failure modes that could occur at Jocassee. The two major failure types excluded from the data set w~re failures resulting from piping at a conduit passing through the dam and structural failures of the spillway during the flood discharge. Neither of these failures can* occur because the necessary physical conditions do not exist at_ 'Jocassee. (Note, however, that dams in the data base do include those that can fail in either or both of these modes, This is proper because the experience from these dams represents realizations of non-failure for other failure modes, such as embankment piping, foundation failure, and slope failure.) Because of limitations in the historical record, it is possibly only* to develop a data set that takes into account a limited number of the specific propenies of the Jocassee Dam. Since Jocassee is a structure designed and constructed in recent times, it,can be assumed that state-of-the-art technology was used in its design. In addition, because of its role as a critical facility of large size and importance, other aspects of,the dam, such as seepage monitoring and inspection programs, are important factors that decrease the likelihood that the dam will fail. The following specific characteristics o( Jocassee are identified as relevant factors that will affect the frequency of failure: 5-20

1.

Quality maintenance and inspection programs.

2.

Monitoring of the dam (i.e., seepage, *settlement, etc.).

3.

Presence of personnel at the site.

4. Responsiveness of the owner to potential problems (i.e., implementation of emergency plans).

5.

Detailed geologic investigations conducted before site selection.

6.

Experience of ~arth-rockfill dams in Jocassee's class (with respect to random failures).

7.

Design techniques. . These factors notwithstanding, the data were examined, and the best availab~e data base for application to Jocassee Dam was extracted and used. The data base covered the period of dam construction from 1940 to 1987. During this period, U.S. dams in operation 6 or more years at the time of failure and 45 feet or more in . height were considered. The dams were of three types--earth, earth-wckfi.11, or rockfiU--and only catastrophic failures were included. Table 5-15 lists the failures considered in the analysis. The number of *dam-years of operation was.determined fro*m d 1ata on the rate of construction provided in Refs. 5.26 and 5.27. Table 5-16 lists chronologically for the I period of construction the year a failure occurred, the interval between'. each _failure in years, the cumulative number of dam-years to the year of failure, and

• the number of dam-years between failures.

Ref. 5.28 updated this information by taking into account the additional amount of dam-years from 1988 through 1993. As shown therein, ther~ were no additional dam failures meeting the above criteria during this period. The re~ised analysis indibates that the revised random failure frequency for the class of large U.S. built earthen dams meeting the above criteria.is l.3E-05. This number is a point estimate using the 2 failures'shown in Table 5-15 and the estimated 154,380 dam-years of operation from Ref. 5.28 and Table 5-16 (i.e., 2 / 154,380 = 1.3E-05). To the extent that this class is representative* of the Jocassee Dam, these results can be interpreted as the predicted annual random failure frequency of the Jocassee Dam from causes other than earthquakes or ovenopping.

• In order to evaluate the contribution of randon:i failure o( Jocassee D~ to the frequency of core damage at Oconee Unit 3, three factors must be quantified: The first factor was the frequency of random dam failures calculated above. The remaining two factors arc:

1. The conditional probability of flooding of the Oconee site given a failure of the

( Jocassee Dam.

2.

The conditional probability of core damage given flooding at the Oconee site. The conditional probability of flooding at the Oconee site given a f~ure of the Jocassee Dam is a complex function of several variables. The level of the Joca~see Lake at the time 5-21

of failure determines the amount of impounded water that.will be released into Lake Keowee; the level (?f Lake Keowee determines how much flow can be received from Lake Jocassee before Keowee Dam and

• the Oconee intake dike are ovenopped. The time
• available for warning of an impending dam failure will determine the likelihood that

. =ffective action can be taken to lower the levels of the Jocas~ee and Keowee Lakes. The conditional probability of flooding given a dam failure also depends on the mode of failure, the rate of erosion (time to failure), the vertical depth to which the failure penetrates (fraction of the impounded water released), and whether either. Keowee Dam or the east intake dike fails rapidly when ovenopped. Previous memos have been written (Ref 5.29) to address this phenomenon. There is evidence, based upon rock-filled dams that have either failed or have been saved from failure, that pre-failure damage in the form of seepage would be observable for some time before significant failure occurs. Even though significant warning times would be needed to prevent Keowee ovenopping, the overall resulting flood levels could be reduced by lowering lake levels as quickly as possible via the spillway and the generators. The data base includes only catastrophic failures by modes believed applicable to Jocassee. Most of the catastrophic failures reported in the literature for earth or earth-rockfill dams were total (i.e., the entire.reservoir emptied), and most times to failure were in the range of 1 to 2 hours. However, the failures in the data base (Table 5-15) occurred only in earthen dams; thus, there is some question as to how applicable their rates of erosion and depths of failure are to the Jocassee Dam, an earth-rockfill structure. The Hell Hole Dam, an earth-rockfill' structure, failed during construction in 1964 when extreme precipitation caused ovenopping. Since construction had not been completed and since the dam was ovenopped, it did not satisfy the data-base characteristics and was not included in the failure set. However, its material of construction and size were very similar to those of Jocassee, and its failure behavior can therefore be used as one point of reference in judgments about the possible failure behavior of Jocassee. The ovenopping of this partly constructed dam lasted for more than 40 hours before a catastrophic failure occurred. This suggests that a long warning time may be ayailable, at least in some cases, before the failure of an earth-rockfill dam. Once the dam was breached, however, the breach propagated the. full depth of the dam, down to the foundation,.in about 2 hours. Thus, though more warning time may have been available, once failure began, the time and depth to complete breach.were quite similar to those observed for earthen dams. On the basis of the information to date, it is obvious that the potential exists for a complete. spectrum of flood levels. More exhaustive studies could be undenaken to address this problem, but were deemed inappropriate from a cost / benefit perspective. Given this lack of information, a bounding value of 1 was used for the conditional probability of flooding of the Oconee site given a catastrophic failure of the Jocassee Dam. The probability of core damage given flooding at the Oconee ~ite depends on.the warning time, actions taken by operators, the depth of the flooding and other factors. The 5-22

SfH/CEII discussion of the possible role of the SSF in Section 5.2.1.1 above would also apply to this set of seque~ces, given the discussion of the time to complete failure of the Hell Hole Dam. . 5.2.2 Event Tree* 5.2.2.1 Event Tree Structure The external flooding event tree is shown* in Figure 5-6. It is based upon the internal initiator tree and contains many of the same functional top events. The applicable portions of the SSF fault tree, as mentioned above, arc brought in at the appropriate places. Event H: Flood Height is Less Thanlib~~~~ ul. (b)(7)(F), (bX3)16 U.S.C § 8240-l(d) Event K: RPS Trips the Reactor This event is used to represent an A 1WS event. In the event of an *external flood, it is assumed that off-site and station power will be lost due to flooding of the switchyard. Thus, the nonnal Reactor Protection System is assumed inoperable, and alternative reactor scram methods must be employed. Event B: Secondazy Side Heat Removal Maintaine~ In the event of an external flood, it is assumed that off-site and station ower will be lost floodin of the switch ar CbX7)(F), (bX3)-!6 U s.c. § 8240-l(d) Event Qr: Pressurizer Relief Valves Close After Opening l(b)(7XF), (b)(3):16 u.s.c § 8240-l(d) . Event Os: RCP Seat'lntesrity Maintained r l)(F), OXJ),16 u.s.c. § m~l(d) ~E~+~ITP'la )laCIIJUTY REX 4TFD 1NFQRM4IION CPITIC A I. li)HH2,G¥/J;;IsEGTI.UG A,I,, l~U*RA~TRUGifUR~ IHrOR~4ATJON 5-23

8Itl/C£H r X3) 16 U.S C. § 8240-l(d). (bX7XF) I The SSF RCM System is designed to provide RCP seal cooling flow to all three Oconee units in the event of a total Joss of HPI and a loss of thermal barrier coolin from CC. (bX7)(F), (b)(3):16 U.S.C § 82-lo-l(d) Event U: High Pressure Irijection Established (b)(7XF), (bX3).16 U.S.C § 8240-l(d) s.2.2.2 Event Tree Sequences Sequence XQsU l(bX')(J), ~ )())16 U.s C. § 82'0, I( d) Sequence XBU Sequence XBOsU (b)(7)(F), (bX3)!6 U.S C. § 8240-l (d) Sequence XBQrU (bX7XF), (b)(3) 16 U S.C. § 8240-l(d) 8t:HSf'FfYE ~ECURITY Rfil::~.Tim 1Nr0R~4ATIO~l CBJTJCAJ ENERGY/fl ECIBICAJ INER ASIBJTCIIJBE INFORM 4TION 5-24

5.2.3 Fault Tree Analysis (bX7)(F). (bX3)1 6 U.S C. § 8240-l(d)

• I

-=- St(d) (bX7)(F). (b)(3):16 U.S.C. § 8240-l(d) (b)(7)(F), (bX3):16 U.S C § 8240-l(d) r )(7)(F), (bX3)16 U.S C. § 8240-l(d) (bX7)(F), (bXJ):16 U.S.C. § 8240-l(d) SeveraJ maintenance events for system components are included.in the fault tree. SpecificaJly, these include: SEHSrFIYE SECURl'fY-RfLA'.'fff) fW?ORMA'.'ffOH CR,ITICAL EHERGY/ELEC'f'RtCA~ l~ RA'.S'FRUC'fUR£ fN't<OlH\\11A'.'ft01q

SSF Unit 3 RCM Pump Train SSF ASW Pump Train 4160 V ac SSF Switchgear OTSI 600 V ac SSF MCC XSF Bus 600 V ac SSF MCC 3XSF Bus 125 V de SSF Distribution Center DCSF SSF Diesel Generator A complete tis.ting of the basic events used in this analysis may be found in Table 5-12. 5.2.4 Containment Performance The external flooding analysis assumes that a failure of the Jocassee Dam floods the site to the extent that tile switc c rendered ino rable. CbX7)(F), (b)(3)'.!6 USC. § 8240-l(d) External flooding events were judged to have no unique impact on the containment performance model. That is to say, the containment response does not reflect any ne uncommon cut sets that e not realize (bX7)(F), CbX3)16 U.S C. § 8240-l(d) 5.2.5 Limitations of the Analysis 1* X7)(FJ, (>JO) 16 U S C. § 82'* < ( aJ 8R:ffC£H (bX7XF), (bX3)16 USC. § 8240-l(d) As also discussed previously, the random failure frequency of the Jocassee Dam is based upon known failures of similarly constructed dams. To the extent that the set of criteria specified is representative of the Jocassee Dam, this value can be interpreted as the predicted annual random failure frequency of the Jocassee Dam from causes other than earthquakes or overtopping.. SEHSFfiYE S£CU:EHTY RELATED INFORMATIO~J CRITICAL ENERGY /ELEGTJUGt'rb HffRASTRUGTURE HffOHMATlOl>l 5-26

r EVENT NAME (b)(7)(F), (b)(3):16 lJ.S.C. § ~24<>- l(d) TABLE 5-12 (pg. 1 of 6) External Flooding Model Reliability Data EVENT DESCRIPTION 5-74 FAil..URE RATE FACTOR PROBABILITY

EVENT NAME l(b)(7)(F), (b)(3):16 u.s.c. § 8240-l(d) TABLE 5-12 (pg. 2 of 6) External Flooding Model Reliability Data EVENT DESCRIPTION 5-75 FAil..URE RATE FACTOR PROBABILITY

EVENT NAME l(h)(7)(F), (h)(3) 16 (J.S.C § 8240-l(d) TABLE 5-12 (pg. 3 of 6) External Floodim? Model Reliabilitv Data EVENT DESCRlPTION 5-76 FAil..URE RATE J;Af'"TOI? Pl?ORARn ITV

EVENT NAME !(b)(7)0'), (b)(3): 16 U.S.C. § 8240- l(J) TABLE 5-12 (pg. 4 of 6) External Flooding Model Reliability Data EVENT DESCRIPTION 5-77 FAILURE

• RATE FACI'OR PROBABILl1Y

EVENT NAME (b)(7)(F), (b)(3):16 U.S,C

• 8240-l(d)

TABLE 5-12 (pg. 5 of 6) External Flooding Model Reliability Data EVENT DESCRlPTION 5-78 FAILURE RATE FACTOR PROBABCLITY

SRlrGEi::I EVENT NAME . TABLE 5-12 (pg. 6 of~) External Flooding Model Reliability Data EVENT DESCRIPTION FAll..URE RATE l(h)(7)(F), (b)(3):J 6 u.s.c. S 8240-l(d) S£HSf'FIY£ S£CURf'FY R£b\\:'f£D IHfORMA'fIOH GR4TIGAL ENERGY/ELECTR4G-A:L IJ>i!F:R:}rS'fRUC'fUR£ INFORM:A'flOH 5-79 l=Acro~ PROBABILITY

~ ~T,r,r- ..,,~ TABLE 5-13 Extema-1 Flood Cut Sets With Sequence Desismations Plant Sequence *Damage Cut Set Percent Accident Seque~ce Cut Sets Name State Frequency of Total Event Name I Probability I Event Description (h)(7)0'), (h)(3):JG IJ.S,C. § 8240-l(J) SENSITIVE SECURITY RELATED INFORMATION ClHTICi\\L ENERGY/ELECTRICAL INF&AS'f'RUCfUR£ fNFOR:t'dA:'fiON 5-80 (pg. l of 6)

TABLE 5-13 (pg. 2 of 6) _External Flood Cut Sets With Sequence Designations Plant Sequence Damage Cut Set Percent Accident Sequence Cut Sets Name State Frequency of Total Event Name I Probability I Event Description (b)(7J(FJ, (b)(3):16 U.:,;.c. § 8240- l(d) 5-81

TABLE S-13 (pg. 3 of 6) External Hood Cut Sets With Sequence Designations Plant Sequence Damage Cut Set Percent Accident Sequence Cut Sets Name Slate Frequency of Total Event Name I Probability I Event Description (b)(7)(1'). (h)(3):16 UX C.

• 8240-l(J) 5-82

TABLE 5-13

• \\,,g. 4 of 6)

External Flood Cut Sets With Sequence Designations Plant Sequence Damage Cut Set* Percent Accident Sequence Cut Sets Name State Frequency of Total Event Name I Probability I Event_Descriotion (h)(7)(F), (b)(3): 16 U.S C. § 8240-l(d) 5-83

TABLE S-13 {pg. 5 of 6) External Flood Cut Sets With Sequence Designations Plant Sequence Damage Cut Set Percent Accident Sequence Cut Sets Name State Frequ~ncy of Total Event Name I Probability I Event ~cription (h)(7)(F), (h)(3):16 TJ.S.C.

• 8240-l(tl)

S 84

TABLE 5-13 (pg. 6 of 6) External Flood Cut Sets With Sequence Designations Plant Sequence Damage Cut Set Percent Accident Sequence Cut Sets Name State Frequency o(TotaJ Event Name I Probability I Event Description (b)(7)(FJ, (b)(3):16 tLS.C. § 8240-l (d) 5-85

TABLE 5-14 External Flood Results By S.rn.~ Sequence Name Sequence Probability ~1U/CEH FLOOD >t(b)\\lj(XBQsU) Q2:_ (b 2.60E-06 .bXt)(F). (b) 2.49E-06 (3):16 U.S.C. § 8240-l(d) l.04E-06 8.21E-07 5.54E-08 Total Ext. Flood CMF = 7.0lE-06 3EH'3f'flVE 3ECUftf'fY-ftEtA:'fEt) IH'l" O'.K':fvf A:'ftrnq: CR:f'ffC,'tL ENER'GY/ELECfRiCiltL lNrRA:S'f RUC'fU'R::E rNrOftMJl!:'ffOH' 5-86

Dam Baldwin Hills a Walter Boudin b Table S-15 Dam Failures Used in This Study Year

• completed 1951 1967 a Data from Babb and Mennel (1968) and USCOLD (1975).

b Data from Jansen ( I 980).

• 5-87 Year failed 1963 1975

Year of failure 1963 1975 1987 1993 Table 5-16. Chronological Order of Dam Failures Years between failures Cumulative dam-years Period of Construction* 1940-1993 23 12 No failure No failure 5-88 32,207 74,782 126,435 154,380 Dam-years* between failures 32,207 42,575 No failure No failure

. ifh)(7)(F), (h)(3): 1(, fJ. S C. § X24o-l (d)

• Oconee External Flooding Event Tree FIGURE 5-6 5-101

8.

SUMMARY

This report details the methodology, implementation; and results *of the supplemental

• examination of external events for severe accident v\\tlnerabilities at Oconee Nuclear Station. This work ha:, been completed by using the exis~g Oconee PRA, which already included external events, updating it as appropriate and performing. the additional enhancements recommended in NUREG-1407.

The Oconee PRA model

• is based on Unit 3. However, walkdo.wns and supponing _:

evaluations were conducted on all three units. For the IPE submittal report (Ref. 1;4), which included external events, an analysis was performed to determine the applicability of the PRA results to Units 1 and 2. Any differences were analyzed to determine their effect on risk. The conclusion was that unit differences do not measurably change the calculated annual core damage frequency or risk ~tween units at Ocoriee. The major finding from this examination is that* there are no yulnerabilities to severe accident risk from external events. Seismic events, internal fires, tornadoes and external flooding events are identified to be the most significant external event contributors to core damage risk. ..__ ____ __. Hooding events (due to the seismically-induced failure. of the Jocassce Dam) are also dominant contributors to the seismic CDF. (b)(7)(F), (bX3):16 U S.C. § 8240-l(d) CbX )(F). SRI/CEH Finall for external floodin events the dominant cut set involves floods that exceed the CbX3) 16 (bX7)(F), (b)(3):16 U.S.C. § 8240-l(d) There were no plant changes identified that would significantly reduce the risk from external events. Some enhancements to the plant were identified during the review. They are currently being reviewed and some have been implemented. The IPEEE effort was completed using in-house expertise with limited outside consultant support, resulting in maximum benefit to the company staff iri (1) developing an appreciation of severe accident behavior, (2) understanding the most likely severe accident SEHSl'f lVE SECURf'f7t'*REUc'fED IHflORMA'flOH CR:t'ffCAL EHERO'i/ELECTRlCAL IHFlbr\\STRUCTURE HffORMATTOn 8-1

sequences, and (3) gaining a qualitative understanding of the overall likelihood of core damage and radioactive material release. Several generic issues and unresolved safety issues were addressed and considered closed out as a result of the previous PRA work and the IPEEE effort, including: USI A-45, "Shutdown Decay Heat Removal Requirements" Eastern U.S. Seismicity Issue USI A-17, "Sy~tem Interactions in Nuclear Power Plar.ts" NUREG/CR-5088, "Fire Risk Scoping Study" GI 57, "Effects of Fire Protection System Actuati_on on Safety-Related Equipmc;nt"

• GI 103, "Design for Probable Maximum Precipitation (PMP)"

Thus, the examination for external event severe accident vulnerabilities, as requested by

• the NRC via supplement 4 of G.L. 88-20, has been completed for Oconee Nuclear Station, Units. 1, 2 & 3. The objectives of this program have also been satisfied for Oconee.

8-2

9. REFERENCES Section 1.0 l.1 EPRI, "NSAC-6U, Oconee PRA, A Probabilistk r.isk -'\\ssessment of Oconee Unit 3," Palo Alto, CA, June 1984.

1.2 Duke Power Company, "Oconee Nuclear Station Unit 3 Probabilistic Risk Assessment." December 1990. 1.3 USNRC, Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50-54(f)," November 23, 1988. 1.4 Duke Power.Company, "Oconee Nuclear Station IPE'* Submittal Report," December 1990. 1.5 H. B. Tucker, Letter to USNRC, "Response to Generic Letter 88-20, Supplement 4," Duke Power Company, December 18, 1991. 1.6 R. E. Martin, Letter to M. S. Tuckman, "Review of Response to Generic Letter 88-20, Supplement4," USNRC, June 16, 1992. 1.7 USNRC, Generic Letter 88-20, Supplement 4, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50-54(t)," June 28, 1991. 1.8 USNRC, NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," June 1991. 1.9 USNRC, NUREG/CR~2300, "PRA Procedures Guide," January 1983. Section 2.0 2.1 Science Applications International Corporation, "CAFTA_: Manual," Palo Alto, California, September 1987. 2.2 MAAP Modular Accident Analysis Program User's Manual, "IDCOR Technical Report 16.2-3," Fauske and Associates, Inc., Burr Ridge, IL; Februany 1987. 2.3 ANS, "Guidelines for Combining Natural and External Man-Made Hazards at Power Plant Sites," an American National Standard, ANSI/ANS-2.12, La Grange Park, Illinois, 1978. 9-1

2.4 Duke Power Company, "Oconee Nt1clear Station Final Safety Analysis Report," 1994 Revision. 2.5 USNRC, "Safety Evaluation Report, Oconee Nucle~r Statiqn, Units I 2, & 3," Original and Supplements 1 - 3. 2.6 EPRI, "RPI0l-53, Probabilistic Seismic Hazard Assessment for Oconee Nuclear Station," Palo Alto, California, April 1989. Section 3.0 3.1 EPRI, NP-6041, Rev. 0 and Rev. 1, "A Methodology of Assessment of Nuclear Power Plant Seismic Margin," October 1988 and August 1991. 3.2 EPRI, NP-4726-A, '.'Seismic Hazard Methodology for the Central and Eastern United States," July 1986. 3.3 SQUQ, "Generic Implementation Procedure (GIP) For Seismic Verification Of Nuclear Plant Equipment," Revision 2, Corrected 2/14/92. 3.4 OSC-6040, "Seismic Qualification of Equipment for A46/IPEEE for Oconee." 3.5 KC-2026, Seismic Qualification of Equipment for A46/IPEEE for Keowee and Switchyard." 3.6 USNRC, NUREG/CR-0098, "Development of Criteria for Seismic Review of Selected Nuclear Power Plants," 1978. 3.7 OSC-5724, "Dynamic Reanalysis of the Auxiliary Buildings for IPEEE, Units 1, 2, and 3." 3.8 OSC-5789, "Scaling of Existing Spectra For The IPEEE." 3.9 Structural Mechanics Associates, SMA 12904.01, "Conditional Probabilities Of Seismic Induced Failures For Structures And Components For Oconee Generating Station Unit 3," September 1981. 3.10 Veneziano, "Seismic Fragility Curves For Jocassee Dam and Oconee Dikes," June 1981. 3.11 Letter from R. V. Hester, Oconee Engineering Division, to T. F. Wyke, Engineering Support Division, Attention: K.. S. Canady, July 16, 1990, File No. OS-203. 9-2

3.12 Letter from NTS Engineering, Long Beach, CA, to T.F. Wyke, Duke Power Compa~y. August 27, 1986. 3.13 Documentation of the Seismic Event Impact Sequence \\.1odel' (SEISM) Computer

• Code, PSA-84-17, Duke Power Company, September 1984.

3.14 Commonwealth Edison, "Zion Probabilistic Safety Study," 198l.

• 3.15 USNRC, NUREG/CR-3263, '.'A Comparison of Methods for Uncertainty Analysis of Nuclear Power Plant Safety System Fault Tree Models," April 1983.

3.16 OSC-6219, "LLNL Seismic Hazard Curve :Sensitivity Study For The Oconee IPEEE." 3.17 OSC-6048, "Miscellaneous IPEEE Seismic and Fire/Seismic Issues." Section 4.0 4.1 USNRC, NUREG/CR-5088, "Sandia Fire Risk Scoping Study," January 1989. 4.2 ' OSC-5995, "Fire Protection For The IPEEE"* 4.3 Berry, D. L. and Minor, E. E., NUREG/CR-0654, "Nuclear Power Plant Fire Protection - Fire-Hazard Analysis" (Subsystems Study Task 4), Sandia National Laboratory, September 1979. 4.4 Correspondence To Conrad. E. McCraken, USNRC, from Raymond N. Ng, NUMARC, dated August 4,_ 1989. Section 5.0 5.1 "Tornado Occurrences Within 125 NM Radius Of Oconee Nuclear Station," National Severe Storms Forecast Center, Kansas City, MO, August, 1994. 5.2 Minor, J. E., "Applications Of Tornado Technology In '.Professional Practice," Proceedini:s of the Symposium on Tornadoes; Assessment of Knowledi:e and lmpljcatiops for Map. June 22-24, 1976, Texas Tech Universi'ty, Lubbock, Texas, pp 375-392. 5.3 McDonald, J. R., "Tornado-Generated Missiles and The~ E(fects," £rQceedipi:s of the Symp*osjum on Tornadoes: Assessment of Knowledi:e a,nd Implications for Man, June 22-24, 1976, Texas Tech University, Lubbock,'Texas, pp 331-348. 9-3

5.4 Golden, J. H., "Comments in Session l," ProceedinKs of the Symposium on Tornadoes: Assessment of KnowledKe and Implications for Man, June 22-24, 1976, Texas Tech University, Lubbock, Texas, pp 483. 5.5 Fujita, T. T., *"Comments in Session 7," ProceedinKs of the Symposium on Tornadoes; Assessment of KnowledKe and Implications for Man, June 22-24, 1976, Texas Tech University, Lubbock, Texas, p. 673. 5.6 Oconee Nuclear Station Procedure AP/3/Nl700/l 1, Change 11, "Loss of Power." 5.7 Oconee Nuclear Station Procedure AP/3/Nl700/19, Change 4, "Loss of Main Feedwater." 5.8 Oconee Nuclear Station Procedure AP/3/N1700/06, Change 0, "Natural Disaster." 5.9 Ramsdell, J.V. and Andrews, G. L., "_Tornado Climatology of the Contiguous United States," NUREG/CR-4461, U. S. Nuclear Regulat9ry Commission, Washington, DC, May, 1986. 5.10 Ramsdell, J. V., et al., "Methodology for Estimating Extreme Winds for Probabilistic Risk Assessments," NUREG/CR-4492, U.S. Nuclear Regulatory Commission, Washington, DC, October 1986. 5.11 McDonald, J.R., "A Methodology for Tornado Hazard Probability Assessment," NUREG/CR-3058, U. S. Nuclear Regulatory Commission, Washington, DC, October 1983. 5.12 OSS-0254.00-00-1000, "Design Basis Specification for the Emergency Feedwater and Auxiliary Service Water Systems," Rev. 12, May 1. 1995. 5.13 Berket,::e, B. H., Memo To File, "Wind Load Capacity }f West Penetration Room Exterior Walls," May 31, 1990, Duke File No: 0S-203.

• 5.14 Kanipe, L. M.,,;Calculation Of Tornado Strike Probabilities For Oconee Nuclear Station," SAAG File# 175, Dl;lke Power Company, Charlotte, N.C., March 1995.

5.15 *McCann, M. W. Jr., Jack Benjamin & Associates, "Wind Capacity of Oconee Nuclear Station Borated Water Storage Tanlc," July 26. 1982. 5.16 Twisdale, L.A., et al., "Tornado Missile Simulation and Design Methodology," _NP-2005, Electric Power Research Institute, Palq Alto, CA, August 1981. 5.17 Twisdale, L. A., et al., "Tornado Missile Risk Analysis," NP-768 and NP-769, Electric Power Research Institute, Palo Alto, CA, May 1978. 9-4

• 5.18 Deskevich, S. A.* "Verification of Computer Progra_m TORMIS;" COM-0204.C6-11-0038 Revision 1, Duke Power Company, Charlotte, NC, October, 199~.

5.19 Deskevich, S. A., "VeJ'.ification of TORMIS Enhancement," COM-0204.C6-l 1-0039 Revision 1, Duke Power Company, Charlotte, NC, ~tober 1993. 5.20 Kanipe.* L. M., "Damage Frequency of the Oconee Nuclear Station Emergency Feedwater System *By Tornado-Generated Missiles," osc~3361 Rev. 1, Duke Power Company, Charlotte, NC, November 1993. 5.21 Kanipe, L. M.* "Keowee Tornado Path Simulation Model," SAAG File # 174, Duke Power Company, Charlotte,"N.C.* April 1995. 5.22 Duke Power

Company, "Aood Study, Jocassee and Keowee Reservoirs,"

Charlotte, N.C., 1966. 5.23. Oconee PRA, "A Probabilistic Risk Assessment of Oconee Unit 3," NSAC-60, Electric Power Research Institute, Palo Alto, CA, June, 1984.

• 5.24 1;3aecher, G. B., M. E. Pate, and R. _De Neufville, 1980. "Risk of Dam Failure in Benefit-Cost Analysis," Water Resources Research, Vol. 16, No. 3, pp. 449-456.

5.25 Benjamin, Jack R., and Associates, 1981. "Statistical Evaluation of the Frequency of Random Dam Failure," Prepared for NSAC, Palo Aho, Calif. 5.26 USCOLD, 1988, "Lesson from Dam Incidents USA-II," American Society of Ovil Engineers. 5.27 Nash.* J. A., Memo to File, "Update of the Random Failure Frequency of the Jocassee Dam," File No. OS-203, October 3, 1989. 5.28

• Farish, P. T., Memo to File, "Update of the Jocassee Dam Random Failure Frequency," File No. OS-203, March 15, J995
• 5.29 Lewis, S. R., Memo to File; "Evaluation of Jocassee Dam Failure," 7/2/82 5.30
• Farish, P. T., Memo to File; "Jocassee Dam Flooding Factors:" Ftle No. OS-203; December 16, 1994 5.31 Benjamin, Jack R., and Associates, 1982, "A Database for the Evaluation of the Frequency of Random Dam Failure," Report 120-010-01, Palo Alto, CA.

5.32 USNRC, NUREG-0800, "Standard Review Plan," Rev. 2, dated 7/81. 9-5

5.33 Atlanta Sectional Aerial Nautical Chart, 52nd Edition, 3/31/94 5.34 Greenville / Spartanburg Air Traffic Control Tower (Traffic. Management Unit); 1993 Traffic Su111Mary. 5.35 Asheville Air Traffic Control Tower (Traffic Management Unit); 1993 Traffic Summary. 5.36 NTSB-ARC-83-1: Annual Review of Aircraft Accident Data: U. S. Air Carriers - Calendar Year 1980; National Transponation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 1/14/83 5.37 NTSB-ARC-85-1; Annual Review of Aircraft Accident Data;. U. S. Air Carriers - Calendar Year 1981; National Transponation Safety Board; Washington, D.C.: Bureau of Accident Investigation; 2/1/85 5.38 NTSB-ARC-86-1: Annual Review of Aircraft Accident Data; U. S. Air Carriers - .Calendar Year 1982; National Transponation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 1986 5.39 NTSB-ARC-87-1; Annual Review of Aircraft Accident Data; U. S. Air Carri~rs - Calendar Year 1983; National Transponation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 2/13/87 5.40 NTSB-ARC-87-2; Annual Review of Aircraft Accident Data; U. S. Air Carriers - Calendar Year 1984; National Transponation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 4/15/87 5.41* NTSB-ARC-87-3; Annual Review of Aircraft Accident Data; U. S. Air Carriers - Calendar Year 1985; National Transponation Safety Board; Washington, D.C.;

• Bureau of Accident Investigation; 11/27 /87 5.42 NTSB-ARC-89-1; Annual Review of Aircraft _Accident Data; U. S. Air Carriers -

Calendar Year 1986: National Transponation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 2/3/89 5.43 NTSB-ARC-90-1; Annual Review of Aircraft Accident Data; U. S. Air Carriers - Calendar Year 1987; National Transportation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 11/29/90 5.44 NTSB-ARC-91-1; Annual Review of Aircraft Accident Data; U. S. Air Carriers - Calendar Year 1988; National Transponation Safety Board; Washington, D.C.; Bureau of Accident Investigation; 4/18/91 9-6

APPENDIX A

• OCONEE SEISMIC FAULT TREE

APPENDIXD OCONEE EXTERNAL FLOOD FAULT TREE

- ~y *--- ~ (h)(7)(F), (h)(3):16 U S.C, § 8240-l(d) External_ Flood Fault Tree ~l!t~~ffl v 1! ~1!CU1UT i -~tRTl!tJ lNPCIUVIRTlCt~ GR.-{TIGAL E~maGY/EHiGTRlG/rL UffRASTRUGTURE INFORi,M:TION I APP. DI Page 1

loss at SSF RCM (ASW Sua:eal*: PZR Rulial \\lalvN Res*I) RCS S..f111y RaUal ValYa Ooa1 Nol Slick Opa, Alls RaliB"ting Liquid SSF RCM Fall1 lo Pl'ovkle RCP lnjaalcn External Flood Fault Tree Loss ol SSF ASW {RCM S1.11:cMdsJ: PZR Relial Valves Co P111111* 1 E ilhar Primary S.!ely Ruliel Yaiva Fl!Jls To CloM All* Lh;u,d Relial Nol ResMI SSF ASW Fails lo Provide Sa:landary Sida Heal R8m0Yal Paga B APP.. D Page 2

Paga 2 Paga 12 SSF RCM Fllill 10 . Pro¥1da RCP lnjac!illn

---

=======J.======:.---,----'J "'----,--;:::::::::::::::==------

M:llor-Op-19d Yaiva 3HP-31111 Oa* Nae F unc:11an SSF RCM Sr11_,, la Lift Unavailabla Air* Tasr Or Mairm1nanca Any One ol Four SSF RCM Chadl Vllllvn FBil Ta Opan Paga 4 No SSF RCM Flow ~h Fill"' SSF-3F-1 Lm.a ol Pow* ID MD10r-Oparala:I Y11hl1 3HP-3911 MDu-C)p-tad Valve 3HP*lm Falla To Open SSF 600 V ac MCC 3XSF BrealUlf. 2C Tr11111I** Open {3HP- . 398) SSF 6011 Y ac MCC 3XSF Braek* 2C Fi11 Ta Cusa j3HP- . 311111 NAC3X2(:CLC External Flood Fault Tree N¥RCMULHE t.biar-Oparaltd Yaiva 3HP-398 TrB111!1r1 Cloud All* Op.-.ing NHP339BMYT Op*alar1 Fall Ta Align Tha SSF RCM Sy11.-ii For ap.. uan APP. D Page 3

r-------------------------------------------*--*-***--~ ,,.,.,, On ot Fmr SSF ACM Chad!. Vlv1 Fail To Opn Paga 3 Chu V!v aHP-3911 Transhlfl Closed NHP3399CVT Child! Yaiva 3HP-399 Fait Ta Opan ~HP.l~VO Check Valv 3H P-400

• Transl** Closed

'[ Chadl. Valve 3HP-40D Fab To C,,an VO Cha Y""' 3H,-*401 FaJl1 To 0J)ll'1 NHP~1CYO Chacil Yahl 3HP-401 Trans!* Closad '-!Hf';MC1 C'fl Chadl Yaiva 3HP-402 Tr1n1I** Closed

vr Chadl Valwa 3HP-402 Falls To Open NI<

External Flood Fault Tree Lota at SSF ASW (RCM Sutil;Nds; PZR AIMiI VaJv1 Rn al} RCS Sa111y R l I Valve 0091 '-101 Slick Open All* Reli ving Liquid SSF ASW Farr, la "'°'Ida Secanda,y Sict Haat RIIITIDVal JRCSRVOOEX Paga e APP. D Page 4

No F..,_ To 1119 SSF U..o l RCM Pu"1' p.... Uni! 3 SSF RCM """11 Fal* To SIM ~ \\A'ol S SSF !ICM P'-"11 Fall Ta Rui, No SSF RCM Flow Thnlugll FIii* SSF-3F-1 SSF UP>I 3 RCM Pllffll .u.......... RIii! Vain JHP. -T*--~ SSF Uni 3 RCW P1m10 Tru, II In MPII.....- L-OI P-TD Th9 S SF Ur,R :, ACM P.ITp SSF SIICIIIDn ~Fa SSFa,VacWCC 3XSF-4C Trnnra ~ CACM l'11ff111 SSF 100 V _, MCC 3XSf-4C r* To ClaM IACM Pu11111 External Flood Fault Tree SSF Uni 3 Rell Fil* SSF-SF1 CIDgl Ille M... PUITp p-~ hll APP. D Page-s

cc CD C> C0' a.. C n.: a.. < a, a,... I- ~

I m

LL. "8 0 u:::: n, C: CD )( w

SSF 2011 V ac MCC 3XSF-1 8u1 Flllll F Lou Ct Paw* On 208 V ac MCC 3XSF-1 LON 01 PD,ra, On 21111 V ac MCC 3XSF SSF 211B V IE MCC 3XSF Breaker 2BL Tr.,,11*1 Open (To 3XSF-1J LIISII 01 Pow* To 2C8 V ac MCC 3XSF From eao V IIC MCC JXSF (l'IOlmal Feed) SSF 208 V ac MCC 3XSF 11w FI SSF 2011 V s; MCC 3XSF e,...,., IA TrM l*1 Opan (Fram Xhn. 3XSFI SSF IIOO V 11C MCC 3XSF 9r<IBII* 4A Tran1len Opan {TD Xlmr. 3XSF) SSF Tran1lorm* 3XSF Fail* External Flood Fault Tree APP. D Page 7

SSF ASW Sys!um Lift u,,.,vailabla Ahar Tes! Or Main1anan01 SSF ASW FaJ1 IO l'rowlda 5-xlndary Skit H BBi RBmDWal SSF ASW Fellt Ta Pruv~a &dflcl-,1 Row C)llar.,an Fail To Align Tha SSF ASW Syal'"' For Oparaiian ln1uffld.-.1 FI-Thraugfl Tiit SSF ASW Pump Manual Yaiva CCW-292 T1an1ter, CloHd lnsutfld "11 Fl-Fram TIit SSF ASW Pump To Tha EFW Una lnlllfficlefll Flow Tivcugh Tha EFW Una Ta Th* Steam G-,llia1ar Haadar1 Loll OI Suppon SJ'l!ams To The SSF AS# Pump SSF ASW P~ Fails lo RI.In SSF ASW PUmp Fells io Sran an Demand NSfPU02Af'S SSF ASW Pump Train 11 In Malnt......,. NSfPUD2APM P111111e 10 lnsulllcianl Fro. Tllfaugh The EFW Una Ta Th Craa11, lnsufficianl Flaw Fra-n Tha Cr01lla To Tha Slaam Gan-l<lr Haadars Pag1 External Flood Fault Tree APP. D. Page 8

L011 Of Suppan Srs1am1 ro Tha SSF ASW Pl.imp LOH or Pow* To. Mam. v..-., CCW* 343 Tna,,1lara Cloud T!'!I SSF ASW Pump 4160 V ac SSF Slirilct,g., ors, Br** 2r,-,.. Open (SSF ASW Pllmpl 41110 V.-: SSF _Swild',gBBI C'TS1 Brak* 2 Fail1 To Close [SSF ASW Pump) NAQQTS2C4C NCWW"3VVT External Flood Fault Tree lnsuffld..t Flow Through Th EFW Lin* To Th C1011slie Paa* 8 Chedl Valv 3FOW* 442 Flh To Opa,i NMFGM~VO Cha \\lalv1 FDW-348 Falls To Opal NMF0346CVO Cha Vat.,1 3FOW-442 Tranll** Clollad Chia; Vlv 3FDW-348 T111nll*1 CIClsad APP. D Page 9

MO\\I CCW-217 II u...... - Ma11..al y-CCW- ,25 T-~ MOV :JCCW-:1!117 r.....,.. Cia.d AA* q.,,;"8 SSF 811D Y ea MCC 3XSF e..u, FOHi.. MCV :JOCW-1117 F... T110,.,, 0,, DlrnMd T,.,..,.,. q.,, (:ICCW-Z81) Pap I 11-.uf!....,..F...., From Tha SSF ASW P*ff11 Ta 'The EfW LN c-v..-.. ocw-2* f-TQ~ External Flood Fault Tree Clllod< YIW OCW-281 r,.,..,. ~ MOY :ICCW-2111 T......... ~ M*~ MOV CCW-2811 II u......,. SSF 811D Y _, MCC USF e..u. FOIBA T,-.. ap., (::lCCW-21111 MOY 30CW-281 F.- To ap., OIi ~ APP. D Page 10

Cha Valv* 3FOW-Zl2 T,an,111 Cloud lnsu Nlci9nl Flow F tm1 Th* Cron!M To s1-, c.,.. ICI' 3A Hald* w:N CCW-2118 It Ul'aYdalll* Ptog, II lnsufflciontAow From The Crosllf* To Tha SI..,, G..-..- H-1.,.. Chad< Valwe JFDW-2'32 Flllls To Ops, On o.n&ncl WOV CCW-299 FaU To Open SSF 2011 V c MCC 3llSFI BrMI!* 10 T,anllan Opa,, N CWIJ298ltii!\\IO wov CCW-:zs r,11m1.. C1oMcl Alt* Opening N.P {CCW*2118l External Flood Fault Tree M)V J FOW-347 T111nlf*1 Closed Ahat Opaning I11su111cier,1 Pow F,om Th* Croutia To S1-,i G-

• !ar 38 H* det Chad! Yaiva 3m W-233 Fa!/1 To Open On 0...-..,,c!

0.- Vllo've J FOW-233 T,.,.1.,. Cloud P,<<JV 3FOW*J

• 7 Fails To Ops, Alie, Being Thrcn!ad Y1-NMF034TMVO APP. D Page 11
• SSF ASW and ACM Fan tnlaptndan!ly SSF ASW Fails IO Puw1da Secondary Sda HHI R...,CMII Paga 8 SSF RCM Fails IO PrD'lida RCP lnjdon u:,q or SSF ASW....

AfM 1111d ACM Fail Dua 10 Sys1am ar Common Cau* Failure RCM (F>ffl Rlllllf ValVH RaBMI) RCS S.laty Rlllal Valve Do.. Nol Slide C,,an Aher Aaliwlng l..lquid ConaJrrant Faiure ol SSF ASW 1111d SSF RCM SSF HVAC Air Condilloning To Cantrel Reem Falls Paga 13 I...OH of flow* M SSF l!OOV.: MCC XSF Paga 17 0p.. 1a, Fall To Oapior To Tha StancltiJ Shutdotm Fa;,'lily In Tlma l..oum F'owson 800V.: MCC 3XSF Paga 22 External Flood Fault Tree APP. D Page 12

HVAC Air Hlll'ldH na Uriil Fan Fai11 Ta Run NSFAHUFFNR HVAC Air H*nllllna UrMI Falls HVAC Air Handling Un~ Cooling CDill Fail HVAC Air Handling Uni! Fil* Fm SSF HYAC Air Condhlanlng Ta Canrml Alxnl Fus Bath HYAC S.1'¥11:9 Wal* TralM F911 Paa* 15 1100 Y a: SSF MCC XSF Br-* F058L T1anat111"1 Ope,, Ret~11*an1 Train 1

• Falla Train 1 RatTlgeranl Campi -or FIii!* Ta Run NSFCON1CMR External Flood Fault Tree Ei!hllf Trllin ot Rafr\\glll'anl Feila Samoa Wa11r To Ralrlg*anl Train 1 Fallt Rat1ige1ar11 Train 2 Falla Paga 14 APP. D Page 13

S..rvDI Wa.tar To Refrigatant Tfalrl 1 Fails P.,ga 13 Manual Valve CCW* 21e Tran,hws Closed l'fCW027_8VVT Manual Valve CCW-276 Translers Cloted NCWU27_6WT XCONSERVI Train 1 Aelrig*nrn Conden~r Fail1 N~fCONHiXF Flow Cc:mll'DI y_.,., CCW-V7 Tra,,slar1 Clo"'d T raln 2 Re~ erant Compusaot Fab To Siar1 Page 13 R11higar.-1t Train 2 Faio SlfYlce Wat* To Relr1gara,I Train 2 Fail* ,_.., Yt!Ne CCW-291 Transl.,.. OOMd NCWll:!!!_IWT IIMnlal Va!va CCW-279 Tran51en Cloud Mei External Flood Fault Tree Train 2 Retrigaram Canprn5a Fah Tc Run TraJn 2 Relrtgaranl ea-.c,.,,.., Faits Flaw Con lr0I V tJNe CCW-2BO Translars Cmad N~DAVl NSFg:)N2CMR APP. D Page 14

Cooimon Valves Fa HVAC &niaa Waler Pi.imps Fail XSERVWATV Pag* 16 Mlnuad Valv CCW-270 Tr11n11t** Ca* Balh l-4VAC Sr.101 wa1er Train FIii HVAC Sarwt01 Waler Trllln 1 F1il1 HVAC Sarwt01 Waler PlfflP 1 Fall* HVAC Saw:e. Wat* Train 2 fall Page,a Manual Valve CCW-272 Tn1n1ln Cloled HVAC s.,...,_ WIil* Pump 1 Feil Ta Run &OD V m: SSF MCC XSF Braaka F02B Transl** Open HCWPMP1GPI{ HACF02BCLT External Flood Fault Tree Chad! Val\\1'11 CCW-21'1 Trai1re11 CIMed HCW027}CVT APP. D Pag~ 15

Paga 15 Page 18 camman Vain* For HVAC Service Wal* Pumps Flil Man~ Ylllve CCW-282 Transl--. CIOllld SSF HVAC SIMC8 Wa1,r Fin* F~T Clclg1 NCWIJ282WT Mlln~ V.iYII CCW-2611 Transl* Cloud NCWD2B6VVl 2 External Flood Fault Tree HVAC Sarvlca Wal* Pump 2 Fail HVAC Servioa Wat* flu'np 2 Fallt To Run 60a V ac SSF MCC XSF Braakar F04B Trena!eni Open !'A HVAC Setvk:a W!81' Pump 2 Fails To Slar'I r APP. D Page 16

ID:J V lie SSF" MCC X.SF Bui In Maint....nca SSF IIXI V a: MCC XSF BrNka' 11A y,..,...... ap., (Fl'OIII DXSF) ~GI~ 11111 SSF IIXIV c MCC XSF -LOH ol "-°la lllllV c MCC XSF Fl'OIII f/lJaV ai: LC 11X1 V ac SSF MCC XSF eu. F"lla OllSF" [E.mll!V. Fa.II SSF ICID V a: LC DllSF'Br...-4C 1... 1... c:ii-, rra Lcmol"-"11111 SSF llllllV a: LC OXSF SSF 8ll0 V ac MCC XSF a,__, IU. F* Ta C:Ue jFram DXSFJ llSF) SSF 4160 Va: ~OTSI en.a-31....... SSF ax, V c LC DX.SF Bua Falll Opan {Ta xrrn-. OXSF) NACOTS:IOIT SSFTIWW1ufns DTSI Fllill NAOOn:=.._FBLF Lm at P-11111 4l110V11eS~ OT$1 IOI V m: $SF LC OX.Sfllr--'q T.-ln Dpar, er..,, xrm,, _QlCS_fl External Flood Fault Tree APP. D Page 17

I

• WAC Servic W 11I*

T111in 2 fah Common Vlvn Fo, HVAC s.r.toe Wat* P\\Jmpt F-. XSERVWAN Paci-18 """1uI V.tv* CCW* 273 Trnat..-. Cloud ~I Valvl CCW* 275 Trmf..-. Clotal H CWO:Z7 !iVVT Chad! Vlv CCW*274 Flllll To Op9'I Chad! Vlv* CCW*V4 Tr*nl*

• Closed HCW'02J4C'{L "HVAC Sarvtce Wal" Pump 2 Fdt

"-II* 18 External Flood Fault Tree. Laa of PCIIOa en 4160V ac S1'ilctQ-OTS1 SSF 41110 V ac Swtlchg*r OTS1 ~a Fall Lou ot Pow* To 4 160 V ac Swild1g-OTS1 Fram SSF O.G. 4160 VIC SSF Stll!c:t,g_, OTS1 Is In Mlllnl..-.nce APP. D Page 18

a: a.. < CD ~ ca

u.

-g 0 u. as C:... ~ w

Lo11 ot semca Wal* Cnoltng b' Oinal Ja:11:111 SSF HVAC &nice Wal* FDI* F~1 Clcgs Vava Faill** ii Dies191 Ja:kal Se!vica Wal* Flaw Palh LOM 01 Eilh* Oi1sel Jed\\al Heal E1d1111,g.- Manual Valra CCW-JIM Transl** Cloud All* Opailrig NCW0084WT Manual Valra CCW-2flll Trar11ls1 CIOHd N.CW021,!§_WT 2 Mamllll Valwe CCW-283 Tran1lsa Cloled Cha Valve CCW*:1114 Tr1n1I** Cloud Alls Opening NCW02MCVT Chack Vahla CCW-314 Fail-To Op_, NCW02iicvo Mania Va1¥a CCW-285 Tran1l r11 Clolled NCWD26SVVT External Flood Fault Tree Paga 21 Diesel G111t11a1or Seriica Wlll r Pump Fails Paga 21 APP. D Page 20 -~

g~*

llfi.l~ >

0 t I ~i. tii t,~i lj D... ii§ I.... I I! r~ 11 8 ~;

110-

!j!i

• • r*

.. 1.1... D.. It~ I~<< N a> CJ> m a.. C a: 0.. < m a,

, m LL

'C 0 0 u: m C._ Q) - w

I. L""* cl f'0w9f a, 125V de SSF Ols?ribolion Cent* Page 19 Paga 21 BIi.nary DCSF Fail1 N_Q_C~SFBVF Sanery OCSF Brea.lier 38 Tr8llsl..-. Open (To OiSI. C""tar) "1QCS_f3BCO_T DCSF 125 V de SSF Oll lribUtion CIWII* OCSF I* In ,._,l....erc;a 125 V de SSF OIi!. c-,1er DCSF e,.,.., U. Traristar ap., * (F...S Frum CSF) 125 V de SSF Dislritlulian Canl* OCSF Bus Fa.ii ,OF L0111 cl p,,... en 800V IIC MCC 3XSF 600 V a:: SSf MCC 3XSF l!<J1 F*II Lo51 cl P""'91' 1D 6aN a:: MCC 3XSF From f!CfN 11C LC OXSF tEll!a'll. F Nd) 600 V ac SSF MCC 3XSF 811!1 Is In Main1.,arce 800 V m: SSF MCC JXSf s,.ica 3A Tramr.s Open (f'rnm OXSf) SSf 1100 V a:: "'1CC JXSF Brealler JA Fa.II Ta Clos* (frcm OXSF) NA.c:Jlf;:,ACLC SSF 800 V m: LC

• OXSF BrMlt* 5C l,-,1!ar1 Open (F-.1 To JXSF)

NACOX~CL1. NACJXSFBLr.t ~ - - External Flood Fault Tree APP. D Page 22

}}