ML23109A080

NRC-2022-000160 - Resp 2 - Final, Agency Records Subject to the Request Are Enclosed, Part 4 of 7

ML23109A080
Person / Time
Issue date:	04/13/2023
From:	NRC/OCIO
To:
Shared Package
ML23109A075	List: ML23109A076 ML23109A077 ML23109A078 ML23109A079 ML23109A080 ML23109A082 ML23109A083 ML23109A084
References
NRC-2022-000160
Download: ML23109A080 (28)

Text

I I'(: ;J,.,, .

('lluriMI< ,\ '( ~*,,;!iJ/ . /ilfl;

'P]tis file co11tah1s SRI/C~Il.

0: DUKE POWER November 30, 1990 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, O.C . 20555

Subject:

Oconee Nuclear Station Docket Nos. 50-269, 50-270, and 50-287 Generic Letter 88-20

Dear Sir:

By letter of Novmber 1, 1989 to the NRC, Duke Power Company identified its plans, methodology, and schedule for completing the Individual Plant Examination (IPE) Program, as required by GL 88-20, for Oconee Nuclear Station. The NRC staff accepted the approach, methodology, and schedule by its letter of January 24, 1990. Consistent with these approaches, Duke Power Company is providing herein the complete response to GL 88-20 for Oconee Nuclear Station.

This response includes the enclosed IPE Submittal Report and the accompanying three volume Oconee Unit 3 Probabilistic Risk Assessment Report. The IPE Submittal Report swmnarizes the methods and results of the IPE, addresses the various elements of the generic* letter, and confirms that the objectives of the generic letter are fully satisfied for Oconee Nuclear Station.

The Oconee PRA study and the IPE process have resulted in a comprehensive, systematic examination of the Oconee reactors in regard to potential severe accidents . This examination has identified the most likely severe accident sequences, both internally and externally induced, with quantitative perspectives on their likelihood and fission product release potential. The results of the study have prompted several changes in equipment, plant configuration and enhancements in plant procedures to reduce the vulnerability of the plant to some accident sequences of concern, as discussed in Sections 3.0 and 4.0 of the IPE Submittal Report. The examination process

• and the accompanying dialogue with operations, technical, and management personnel have created a level of appreciation for the varied mechanisms, complexity and severity of this type of accident. The final results, which take into account detailed in-plant and ex-plant consequence analysis, significant plant operating experience, and plant design features as of December 31, 1989, portray the integrated safety profile of Oconee.

These results confirm that Oconee Nuclear Station poses no undue risk to the public health and safety. Accordingly, the objectives of Generic Letter 88-20 are fully satisfied. ~

Aull ,.~,~

U. S. Nuclear Regulatory Commission November 30, 1990 Page 2 The IPE process and results have been applied to examine *USI A-45 and A-17. it has been concluded that these iss~es can be considered adequately resolved for Oconee. In addition 1 safety issues GI-23, GI-105, and GI-130 have been evaluated in relation to the IPE results, plant experience and current system configuration. The evaluation s upports resolution of these issues for Oconee .

In as much as the Oconee PRA const itutes a complete level 3 PRA with a systematic treatment of i nternal and external events, and containment response, fission product release and risk calculations, adequate i nformation is available in this IPE submittal to consider the severe accident vulnerability issue to be resolved for Oconee.

I declare under penalty of perjury that the statements set forth herein are true and correct to the bes t of my knowledge.

Very truly yours, H. S. Tuckman, Vice President Nuclear Operations RLG/ 119/ lcs Attachment (4 Sets) xc: (W/0 Attachment)

Hr. S. D. Ebneter Regional Administrator, RII U.S. Nuclear Regulatory Commission 101 Marietta St . , NW., Suite 2900 Atlanta, Georgia 30323 Hr. P. H. Skinner NRC Resident Inspector Oconee Nuclear Station Hr. L.A. Wiens, Project Manager .

Office of Nuclear Regulatory Regulation U. S. Nuclear Regulatory Co11DDission One White Flint North, Mai l Stop 9H3 Washington, D.C. 20555

Duke Power Company OCONEE NUCLEAR STATION rPE SUB MITT AL REPORT

• .~'f.:_,;.;~';_ ~-~~~t~~~(t;~~'

DUKE POWER COMPANY

• OCONEE NUCLEAR STATION UNITS 1,2,3 IPE SUBMITTAL REPORT DECEMBER 1990

TABLE OF CONTENTS Section Page

1.0 INTRODUCTION

1-1 1.1 BACKROUND 1-1 1.2 METHODOLOGY 1-3 1.2.1 Organizational Elements 1-3

• ,1 .2 .2 Front End 1-4

1. 2*. 3 Consequence Analysis 1-5 1.2.4 Walkdown 1-7 1.2 . 5 PRA Review Process 1-8 1.2 .6 Review Of Industry PRAs 1-9 2.0 IPE RESULTS 2-1 2.1 FRONT ENO RESULTS 2-1 2.1.1 Internal Event Analysis 2-1

2. J. 2 External Event Analysis 2-7 2.1.3 Conclusions 2-15 2.2 CONSEQUENCE ANALYSIS RESULTS 2-20 2.2. 1 Containment 2-20 2.2.2 Source Term 2-21 2.3 RISK RESULTS 2-27 3.0 ACTIONS TAKEN DUE TO NSAC-60 STUDY 3-1 4.0 ACTIONS UNDER INVESTIGATION DUE TO OCONEE PRA 4-1 5.0 ACTIONS INVESTIGATED AND NOT TAKEN DUE TO OCONEE PRA 5-1

6. 0 ACCIDENT MANAGEMENT 6-1 7.0 CONTAINMENT PERFORMANCE IMPROVEMENT (CPI) PROGRAM ISSUES 7-1 8.0 SHUTDOWN DECAY HEAT REMOVAL ANALYSIS (formerly USI A-45) 8-1 9.0 SYSTEMS INTERACTION DUE TO INTERNAL FLOODING (USI A-17) 9-1

9.1 INTRODUCTION

9-1

9. 2 WATER INTRUSION ANO FLOODING FROM INTERNAL SOURCES 9- 1 9 . 3* REVIEW OF EVENTS AT NUCLEAR POWER PLANTS 9-2 ro.o RESOLUTION OF OTHER SAFETY ISSUES 10-1 10 .1 SCREENING PROCESS 10-1

5ection Page 10.2 GI-130, ESSENTIAL SERVICE WATER PUMP FAILURES AT 10-3 MULTIPLANT SITES 10.2.1 Introduction 10-3 10.2.2 Oconee LPSW Description 10-3 10.2 .3 Contribution To Core Damage 10-4 10.2.4 Uncertainties 10-5 10.2.5 Conclusions 10-6 10.3 GI-23, REACTOR COOLANT PUMP SEAL FAILURES 10-7 10.-3 .1 Introduction 10-7 10.3. 2 Oconee Reactor Coolant Pump Seal Design 10-7 10.3.3 Contribution To Core Damage 10"."9 10.3. 4 Uncertainties 10-10 10.3.5 Conclusions 10-11 10.4 GI-105, INTERFACING-SYSTEMS LOCA IN PWRs 10-13 10.4.1 Introduction 10-13 10.4.2 Significant Contributors To Oconee ISLOCA Frequency 10-13

. 10.4.3 Contribution To Internally-Initiated Core Damage 10-15 And Plant Risk 10.4.4 Uncertainty 10-15 10.4.5 Conclusions 10-16 11.0 UNIT DIFFERENCES, APPLICABILITY OF IPE RESULTS 11-1 12.0 CONFORMANCE WITH GENERIC LETTER 12-1 APPENDIX A SHUTDOWN DECAY HEAT REJll>VAL REQUIREMENTS A-1 APPENDIX B LPSW ANALYSIS 8-1 APPENDIX C UNIT DIFFERENCES C-1 iv

• I

LIST OF TABLES Table No. Page 1.2-1 Cross-Reference of NUREG-1335 Top1cs and Oconee PRA Sections 1-11 1.2-2 Oconee Consequence Analysis Data 1-12 2.1-1 Sull'lllary of IPE Results 2-18 2.2-1 Summary of Containment Analysis Resul~s 2-24 2.2-2 Oconee Release Catagory Cross-Reference 2-25

• 2.2-3 Important Oconei PRA Release Catagories 2-26 2.3-1 Summary of Oconee PRA Risk Results For Internal Initiators 2-29 2.3-2 Summary of Oconee PRA Risk Results For External Initiators 2-30 2.3-3 Summary 9f Oconee PRA Risk Results For All Initiators 2-31 A.4-1 Sull'lllary of A-45 Results A-14

• B.4-1 LPSW Sensitivity Base Case B-5 B.4-2 LPSW Sensitivity Case 1 B-7 B.4-3 LPSW Sensitivity Case 2 B-9 8.4-4 LPSW Sensitivity Case 3 B-11 B.4-5 LPSW Sensitivity Case 4 B-13 V

1.0 INTRODUCTION

1.1 BACKROUND Following the completion of the Reactor Safety Study (WASH-1400) in 1975, the NRC undertook smaller scale analyses in the research program known as the Reactor Safety Study Methodology Applications Program (RSSMAP) . One of the plants examined as part of this program was the Oconee Nuclear Station (NUREG/CR- 1659). In late 1979, the NRC started another series of such studies, now called the Interim Rel i ability Evaluation Progr am (IREP). The purpose of this program was to predict the likelihood of a core damage accident for each operating reactor in the United States . The results were to be examined and compared to identify any significant weaknesses that might exist.

It was in 1980, in this setting, that the Nuclear Safety Analysis Center (NSAC) suggested that a plant-speci fic probabilistic risk. assessment (PRA) be undertaken by the nuclear industry on its own initiative. The proposal for an industry PRA project, managed by NSAC and performed in cooperation with a utility, was reviewed with the NSAC utility advisors and approved. Duke Power Company and Oconee Nuc 1ear Station were chosen based on: (l) .. the ab i 1 i ty and wi 11 ingness of Duke Power to provide strong. di.rect support to the study, (2) the availability, at Duke Power , of detailed design information (Duke is its own architect-engineer), (3) Oconee's operating experience, (4) the existence of an Oconee RSSMAP study as a guide and point of comparison, and (5) the NRC's intent to choose Oconee as one of the first plants in the IREP . (In order to make better use of its resources, the NRC later decided not to include Oconee in the first group of IREP analyses) . Oconee Uni t 3 was chosen as the subject of the study because it is relatively independent of Units 1 and 2, and, as it was the most recent of the three Oconee units to begin operation, detailed information on its design was more readily available .

The NSAC study was published in June 1984 as NSAC-60. In January 1987, Duke Power initiated a large- scale review and update* of the original study . The major objectives of the review and update were to (1) incorporate plant changes made since the time of the original study, (2) improve on assumptions 1-1

made in the original study, (3} make use of plant experience/data from the 1980s, and (4) make use of improvements in PRA methodology and up-to-date techniques. This updated report is now the Oconee _PRA and is i ncluded as to this submittal .

1-2

1.2 METHODOLOGY '

1. 2.1 Organizational Elements In an October 30, 1989 letter to NRC, Duke informed the NRC of its plans to utilize the *updated Oconee PRA (Attachment 1) to meet the requirements of Generic Letter 88-20 (Individual Plant Examination). This information was submitted to the NRC, as required, within 60 days of the issuance of supplement 1 to the generic letter. By letter dated. January 24, 1990, NRC accepted Duke ' s approach, methodology and schedule.

The Oconee PRA is a full-scope, level 3 PRA with external events. To fa~ilitate NRC staff review, a cross reference of the information requested in NUREG-1335 to the appropriate sections in the Oconee PRA is provided in Table 1.2-1. Although Generic Letter 88-20 requires the examination of internal events and internal flooding events only at this time, the Oconee PRA results provide .the more complete perspective on the risk of severe accidents for Oconee . No further effort should be required for Oconee in regards to external events.

Soon after embarking on the NSAC-60 effort, Duke organized a Severe Accident Analysis Group to facilitate .large scale PRA and reliability studies. This group was charged with the responsibility to plan, conduct __and coordinate all proposed PRA studies, and to maintain and update the plant PRA models as appropriate. In addition to ,PRA studies, this group is also utilized *for engineering support involving severe accident input in such areas as emergency planning, plant design changes and plant operational problems .

In conducting a full-scope PRA, personnel from the Severe Accident Analysis Group perform a majority of the PRA-related tasks. This core group is augmented by specialized expertise in mechanical , electrical and civil discipl~nes from other areas of Design Engineering Department. In addition, the expertise of an operations engineer, assigned to support the PRA effort ,

is utilized to factor in operational insights on initiating events, accident sequence modeling, human reliabi lity analysis and recovery actions . In the

case of some specialized .inputs, such as site seismology and equipment fragilities, outside expertise is utilized to complete the tasks .

1.2. 2 Front End The front end analysis for the Oconee PRA utiHzes a method that is consistent with the PRA Procedures Guide {NUREG-2300). The basic models used for

• accident sequence development are event trees and fault trees .. The event trees used in this analysis are functional event trees, with top events defining the functions needed to *protect the core. The end states of the

• .fun ct i ona 1 event tree represent f uncti ona l sequences. The event tree end states are also used to place accident sequences into plant-damage bins . .

These bins a~e the transition from front end analysis to back end analysis.

The translation of event tree functions to top events for system fault trees is accomplished using event tree top logic. Each event tree top event is described with a fault tree logic model that depicts the ways the plant systems can perform the needed function. The top event of the top logic is the event tree top event; the bottom events of the top logic are the plant system fault tree top events . A more detailed discussion, for internal events analysis, can be found in Section 2.0 of the Oconee PRA.

The plant systems have been analyzed with detailed fault trees, generally to the component level. The level of detail in the model is defined by the level at which data is available. Fault trees have been developed for both

'front-line and support systems. A front-line system (e.g., Low Pressure Injection) is modeled down through its support systems (e.g ., Low Pressure Service Water) and the support systems are modeled down through their support systems (e.g., AC Power System) . In this manner, support system fault trees are directly linked to front-line system fault trees and to each other .

The plant system models .have been fully assembled into accident sequence models and solved using the CAFTA computer code . Plant-specific data has been used for many of the accident initiators, as described in Section 2.1 and Appendix C of the Oconee PRA. Plant-specific data has also been used for 1-4

maintenance unavailabilities and component failure rates in many system models, as described in Appendices A and C of the Oconee PRA.

The result of these activities is a list of accident sequence cut sets. These cut sets have been analyzed for recovery; *and grouped by both initiator and functional sequence in Appendix O of the Oconee PRA.

The external events analysis (described in detail in Section 3.0 of the Oconee PRA} draws upon the information and logic models developed for the internal events analysis. The seismic event tree uses the fault trees and top logic, and includes only those components with high random failure rates coupled with fragility information for the major components. The tornado* analysis considers the same logic in terms of plant functions and systems but focuses on the -effects of wind loadings and missiles . . The flood and fire analyses use the same models generated for the transient event tree.

One other area of front end analysis is the development of models for the containment *safeguards event tree (Section 4.0 of the Oconee PRA). The systems which affect radiological release but which are not critical to core protection are modeled here. The accident sequence cut sets for core damage are coupled with the possible containment safeguards states, resulting in plant damage states for the beginning of the back end analysis.

The Oconee PRA front end analysis is consistent with the objectives of the front end analysis requested by Generic Letter 88-20 and NUREG-1335 .

1.2.3 Consequence Analysis The back end (consequence) analysis for the Oconee PRA utilizes a method t~at is consistent with the PRA Procedures Guide (NUREG-2300) and NUREG-1150. The consequence analysis consists of five main tasks :

l. Plant Damage State Definition and Quantification - Core-melt sequences from the front end analysis are grouped into bins identified as plant damage states (PDS). These POSs have similar characteristics concerning either 1-5

containment event tree quantification or fission product release behavior .

The PDS frequency is the sum of the individual sequence frequencies.

2. Contairnent Event Tree Development - Duke Power's approach to containment event tree {CIT) development is to include only those events or questions which have a direct impact on the release category definition. Then, large decision trees are used to quantify the probability for each event in the event tree. This method a~lows each CIT endpoint to represent a separate release category but also allows the same level of detail in quantification as NUREG-1150.

3. Containment Event Tree Quantification* The CIT is quantified by propagating .each POS through the CET. CIT branch probabilities are determi~ed either directly from the PDS or from the solution to the appropriate decision tree. Basic event probabilities ~re assigned based on a combination of:

- PDS characteristics

- Hand calculations

- Computer code analyses

- Experiments and research results

- Plant data

4. Release Category Definition* Since the CET*contains only questions related to fission product release characteristics, the release categories are defined by the CIT endpoints and their paths through the tree. The MAAP code is used to determine release magnitudes by modeling the sequence defined by this path.

5. Off-Site Consequence Analysis - Release _category defini:tions and other Oconee plant-specific information are used as *input to the CRAC2 computer code

. which calculates the public health consequences for eac~ release category.

The results are provided in the form of conditional CCOFs as well as the mean values.

Since the Oconee PRA is a full-scope, level 3 PRA, the consequence analysis goes beyond the objectives of the back end analysis requested by Generic Letter 88-20 and NUREG-1335. To *assist the NRC in .i ts review of this 1-6

submittal, Table 1.2-2 provides a listing of plant parameters important to the back end analysis . A more detailed discussion of the Oconee PRA consequence analysis is included in .Sections 6.0 and 7.0 of the Oconee PRA .

1.2.4 Walk.down As part of the plant familiarization process, Duke PRA analysts perform plant walk.downs. The PRA analysts are usually guided by plant personnel, often from the Operations department or the Oe~ign Engineering site office who have some involvement or understanding of the PRA. These walk.downs supplement the information contained in various engineering documents. Walk.downs are invaluable in determining location dependent effects such as:

- potential systems interaction and corrmon cause failures due to flooding, fire and other externally-induced failures

- the ease or difficulty of various operator actions that may be modeled as recovery events The plant walk.down is also used to provide a general understanding .of the arrangement of plant systems.

Plant walk.downs , performed in support of Oconee PRA activities , have occurred over the last ten years on five different occasions-:

l. During the performance of the NSAC-60 analysis (discussed in Section 1.1

• of this submittal), PRA analysts conducted walkdowns as necessary to assist in system and accident sequence modeling. *These walkdowns resulted in numerous iterations on the sequence modeling as the dominant contributors to core-melt frequency became clear and understanding of plant response improved.

2. During the NRC review of the NSAC-60 analysis, NRC and Brookhaven National Lab ( NRC I s contractor) visited Oco_nee during May 1985. The agenda for the site visit, documented in an NRC letter to Duke prior to the visit, identified numerous buildings, areas and components with which the review teams would familiarize themselves .

3. During the IDCOR program, a preliminary evaluation of Oconee was performed as part of the Safe Stable States task. IDCOR contractors and Duke 1-7

personnel walked down specific features of the plant, such as containment layout and possible compartmentalization, which were initially identified as important.

4. During the Oconee PRA update effort, PRA analysts perfomed walkdowns of plant systems and areas to confirm certain modificati ons which had taken place since the NSAC-6O analysis.

5. Following completion of the updated Oconee .PRA, a few key plant features received a follow-up walkdown. These features played a major role in the PRA

• results due to assumptions made about the response of these features to various accident sequences.' Plant personnel, PRA analysts and engineering personnel with specialized expertise reviewed the areas and components of concern to detemine if the accident sequences were being modeled appropriately.

1. 2.5 PRA Review Process Duke PRA studies typically undergo four stages of internal review. First ,

each of the major analytical tasks goes through a peer review within the project team. Subsequently, it is reviewed by the project manager/engineering supervisor to ensure that the analyst has perfomed an adequate analysis and that is has gone through an appropriate peer review. Following the two levels of review performed within the project teui, engineering personnel outside the PRA project team familiar with plant systems and accident sequences conduct a review of system models, underlying assumptions and results of system level and overall results. In parallel with the engineering review, the PRA draft report i's reviewed by selected station person~el . The focus of this review is the reasonableness of underlying assumptions for system operation and operator actions.

Besides the technical review of the PRA, management briefings are given to appraise key management personnel of the results and conclusions.

1-8

1.2.6 Review Of Industry PRAs As discussed in Section* 1.2.1 of this submittal, Duke organized a Severe Accident Analysis Group in the early 1980 1 s. *.This group reviews industry and NRC studies and participates in industry organizations (such as IOCOR, EPRI and NUMARC) dealing with severe accident and PRA issues . These organizations provide a forum for exchanging information and staying abreast of the latest developments. Through these efforts, insights gained by other organizations have been factored into Duke's analyses. Many of the reports listed in to Generic Letter No. 88-20 have been reviewed for insights and lessons learned. NUREG/CR-4405, nProbabilistic Risk Assessment (PRA)

Insights", has also been reviewed. Since a discussion of the insights gleaned from each and every document would be too voluminous, only a few, key reviews and insights are discussed below.

Duke has connented extensively on the draft NUREG-1150 analysis and its supporting documentation. By reviewing the expert judgement information provided in *the documentation, insights have been gained in such areas as the potential for reactor coolant pump seal LOCAs and the likelihood of direct containment .heating.

Duke PRA analysts are intimately familiar with the NSAC-60 study.

• This analysis not only provided the initial identification of the important issues at Oconee, it has become a reference for other industry studies . The NSAC-60 study has been extensively reviewed by NRC and their contractors. Duke personnel are very familiar with this review. (NUREG/CP.-4374) and the issues and insights contained within.

Duke was an active participant in IDCOR and reviewed in detail the many reports published as a result of this effort. In particular, the reference plant analyses provided insight into such areas as best-estimate, thermal-hydraulic success criteria .

1-9

The NRC contractor's review of tKe Three Mile Island-1 PRA .(NUREG/CR-5457) has been reviewed, since lMI-1 is a B&W plant similar to Oconee. Issues raised in this report, and other similar reports, have been assessed for applicability to Oconee. The Zion Probabilistic Safety Study, and the NRC's review _of the analysis, are examples of reports similarly assessed.

1-10

TABLE 1.2-1 Cross-Reference of NUREG-1335 Topics and Oconee PRA Sections.

NUREG 1335 OCONEE PRA Section Topic Section Topic 2.1 .1 General Methodology Vol 1 Sect 1.4 Project Plan Vol 1 Sect 1.5 Methodology 2.1 .2 Information Assembly Vol 1 Sect 1.1 General Plant Description 2.1 .3 Accident Sequence Vol 1 Sect 2.0 Internal Events Analysis Delineation Vol l Sect 3.0 External .Events Analysis 2.1 .4 Systems Analysis Vol 2 &3 Fault Trees Appendix A Vol 3 System Modeling Guidelines Appendix B 2.1.5 Quantification Vol 1 Section 5 Human Interact. Assessment Vol 3 Appendix C* Data Base Vol 1 Sect 3.3 Flood Analysis Vol 1 Sect 1.5 Methodology Vol l Sect 8.3 Uncertainty 2.1.6 Front End Results & Vol *1 Sect 8.1 Results and Conclusions Screening Process Vol 3 Appendix 0 - Cut Sets 2.2 Consequence Submittal Vol 1 Sect 1.4 Project Plan Containment Response Vol 1 Sect 1.5 Methodology Vol 1 Sect 6.2 Containment Event Tree 2.2.2 Specific Guidelines Vol 1 Sect 4.0 Containment Safeguard Anal.

Vol 2 Sect 6.0 In-Plant Consequence Anal.

Vol 3 Appendix G Containment Capacity Anal .

2.2.2 . 7 Radionuclide Release Vol 1 Sect 6.3 Source Term Calculations Characterization and Release Category Defn.

2.3 Submittal of Specific IPE Su~mittal Results and Actions Safety Features and Sect 2. 0 &4.0 Under Investigation Potential Plant Improvements 2.4 IPE Utility Team IPE Submittal Description of IPE and Internal Review Section 1.2 Methodology 2.5 Consideration of Voll Sect 3.0 External Events Analysis External Events 1-11

TABLE 1:2-2 Oconee Consequence Analysis Data Reactor Power 2568 MWt

• Steam Generators Vertical, straight tube Pressurizer PORV 1, capable of 1.07E5 lbm/hr at 2465 psia (setpoint pressure)

Pressurizer Safety 2, capable of 3.18E5 lbm/hr each Valves at 2514.7 psia (setpoint pressure)

SRVCEH Core Zircaloy Mass bs.

Containm~mt Type Large, dry; post-tensioned, reinforced concrete Containment Liner 0.25 in . steel Containment Radius 56.98 ft Containment Volume 1.86£6 ft 3 Containment Design 59 psig Pressure Containment Ultimate Mean 145 psig Failure Pressure Containment Cavity 203 ft 2 Floor Area Containment Baseinat 8. 5 ft Thickness Containment Basemat Siliceous with no carbon Concrete (b)(7XF), (bX3):16 U .S.C. § 8240-l(d)

Unique Features Important to Containment Analysis 1-12

• I srn,srrIYE SEGUR:ITY REL1rTED INFOIH,t1rTION CRITICAL t~mRO\'/ELECTRf6 6rL IHFRASTRUGTUR£ UffORMATlON

loadings on the Turbine Buildi,ng *metal walls cause them to buckle and blow in.

(b)(7)(F), (b)(3):16 U.S.C § 8240-l(d)

Also contributing .to this sequence are F-4 tornados which, in

_a_d_d_it_i_o_n- to fa; 1i ng power to the 1Cb)(7)(F), CbX3) 16 us c § 8240-l(d) r )(7)(F), CbX3):l 6 u.s.c. § 8240*l(d) I Secondary side heat remova1 succeeds when feedwater is provided by either the turbine-driven EFW pump (via the upper surge tanks) or the ASW pump (via the buried CCW piping). The frequency of this sequence is 4 . 4E-06 per year*.

TQsX Secondary side heat removal is successful. The contribution from this functional sequence is less than l.0E-06 per year.

TBQsU SeiSlli C - A sei smi ca1ly-i nduced failure r )(7)(F), (b)(3):l 6 U.S.C. § 8240* 1(d) 1 ICbX7)(F), (b)(3):16 U.S.C. § 8240-l(d) I are the 1ead.ing .

cause of MFW and EFW failure in this scenario . I (bX7)(F), (bX3):16 U.S.C. § 8240-l(d)

\ In addition, a seismically-induced failure of Jocassee Dam would cause eventual s*ite flooding, failing (b)(7)(F), (b)(3):16 U.S C. § 8240-l(d) nd Externa1 Fl oodfog - As discussed ear 1i er for sequences ~~:i~)CbX3>:16 u.s c. § 2-10

(b)(7)(F), (bX3):16 U.S.C. § 8240-l(d) l A catastrophic** failure of Jocassee Dam is

'-----------~--

expected to inundate the site within a few hours, probably failing all station power. /

(bX7)\1'), (bX3):16 U.S.C. § 8240-l (d)

Tornado - This sequence is dominated by F-2 tornados that impact the *Turbine

. Building and components at ground level or higher in the Turbine Building are susceptible to damage from flying debris when wind loadings on the Turbine Building metal walls cause them to buckle and blow in .

Also contributing to this se uence are F-4 tornados which

• in addition to fa i1 i ng power to the ,__ ___________________

(bX7XF). (bX3)16 u.s.c. § s2-10-t(d)

(bX7)(F), (b)(3):16 U .S.C. § 8240-l(d)

Secondary side *heat removal is unsuccessful due to (bX7)(F). (bX3):16 u.s.c. § s24o-l(d)

(bX7)(F), (b)(3):16 U.S.C. § 8240-l(d)

The wind loadings on the West Penetration Room exterior wall, from an F-4 (or F-5) tornado, will buckle the wall and is conservatively assumed to fail the r

3 6

)(7XF), (bX ).l u.s.c. § Sl-lo-l(d) I Tornados with wind speeds under 200 mph ( F-2 and F-3) require an independent failure of the SSF to fail all secondary side heat removal. The frequency of this sequence i's 2.BE-06 per year.

TBQsX (b)(7)(F), (bX3):16 U.S.C. § 82-lo-l(d)

I The contribution from this functional sequence is less than l . OE-06 per year .

2-11

APPENDIX A

• *A.O SHUTDOWN DECAY HEAT REMOVAL REQUIREMENTS A. l INTRODUCTION USI A-45 , entitled "Shutdown Decay Heat Removal Requirements", had as its objective the determination -of whether the decay heat removal function at operating plants is adequate and if cost beneficial improvements could be identified.

• It was concluded by the NRC that a generic resolution to the issue is not cost effective* and that resolution could only be achieved on a pla11t-specific basis. Therefore, the NRC has subsumed A~4s into Generic Letter 88-20 and has requested an evaluation of decay heat removal .

vulnerabil i ties during power operation and hot standby. To this end, this part of the IPE response provides an evaluation of shutdown decay heat removal for Oconee Nuclear Station.

Duke Power Company is aware of the NRC case studies and has participated in industry efforts to review and resolve this issue . The Oconee PRA models all plant systems involved in the decay heat removal (OHR) function, including those th~t provide "feed and bleed" cooling. Support systems such as AC and DC power, cooling water systems, etc., which influence proper functioning of OHR systems are also modeled . Initiating events which challenge the OHR systems and thereby contribute to core damage s,quences of interest have been identified and quantified. Fault tree models of the systems include the relevant equipment failure modes and human elements. Particular attention is given to identify c011111on cause failure events such as flood, fire, etc., which could impose extraordinary stress on OHR systems.

A.2 OVERVIEW OF OCONEE DECAY HEAT REMOVAL SYSTEMS The frontline OHR systems .consist of the following :

- Main Feedwater (MFW) System and Emergency Feedwater (EFW) System for steam generator feedwater .

- Auxiliary service water (ASW), from ASW pump in Auxiliary Building basement, for steam generator feedwater .

A-1

- Standby Shutdown Facility Auxiliary Service Water (SSF ASW) System for steam generator feedwater

- Safety valves, turbine bypass valves and atmospheric dump valves for steam generator steam release.

- High Pressure Injection (HPI) System for Reactor Coolant System (RCS) makeup and for feed and bleed cooling.

- Low 'Pressure Injection (LPI) for latent* heat removal.

- Pressurizer safety relief valves and power-operated relief valve (PORV) for RCS pressure relief and feed and bleed cooling .

The ; *upport systems for OHR consist of the following:

- Low Pressure Service Water (LPSW) System and High Pressure Service Water (HPSW) System for HPI and EFW pump cooling and LPI heat exchanger cooling.

- AC Power System for pumps and valves motive power.

- DC Power System for system instrumentation and control

- Instrument Air System for some valves.

An additional OHR capability is the Standby Shutdown Facility (SSF).

Operators .are directed by the emergency operating procedure to activate the SSF if HPI, EFW or AC Power Systems become or are likely to become unavailable.

Greater detail on the above systems can be found in Appendix A of the Oconee PRA.

A.3 DISCUSSION OF A-45 ANALYSIS A. 3. l Initiating Events The initiating events of interest for A-45 are a subset of those analyzed in the PRA. Initiating events which are analyzed in the PRA but are not in* the scope of this analysis are large break LOCA, medium break LOCA, reactor pressure vessel failure, interfacing-systems LOCA, and ATWS. The resulting set of initiators are the following:

A-2

I .

Internal Initiating *E~ents Reactor/Turbine Trip

- Loss of Main Feedwater Fault on Bus 3TC Loss of Condenser Vacuum Loss of Off-Site Power: Electrical Grid l*oss of Off-Site Power: Switchyard

- Loss of Off-Site Power: Severe Weather

- Loss of Instrument Air Excessive Feedwater

- Spurious Engineered Safeguards Signal /:.;

- Steamline Break

- Feedwater/Condensate Line Break

- Loss of Power From Bus 3KI

- Loss of LPSW

- Small Break LOCA

- Steam Generator Tube Rupture (SGTR)

- Internal Flooding Events External Initiating Events

- Seismic Events

- External Flooding (from Failure of Jocasse Dam)

- Fire

- Tornadoes A.3.2 Accident Sequences Accident sequences were developed for exter.nal and internal events . Section 2.0 of the Oconee PRA develops and describes accident sequences initiated by internal events. Section 3. 0 of the Oconee PRA develops and describes accident sequences initiated by external events. As described in these sections, cut sets represent the final form of accident sequences. Appendix D of the Oconee PRA lists cut sets grouped by internal events, external events, and functional sequences.

A-3

• A.4 .2 External Events Introduction Table A.4-1 displays the results of the external events analysis in terms of functional seQuences and initiators. A key is provided to assist in understanding the nomenclature . The contribution of each external initiator group to each functional sequence is given and then sunmed in the column labeled EXTERNAL TOTAL for a calculated annual core-melt frequency of 3.BE-05 due to loss of DHR. The total core-melt frequencies from each initiator group are given in the bottom row. The percent values shown in Table A.4-1 of this submittal represent the percent contribution to the total (internal plus external) calculated annual core-melt frequency of 4.7E-05 due to loss of DHR.

If the contribution from any particular category is less than l.OE-06 per year . a'<' sign has been used. Only thos~ functional .sequences with J

frequencies greater than 1.0E-06 per year are discussed here. A detailed discussion of external events analysis can be found in Section 3.0 of the Oconee PRA. A detailed listing of all cut sets contributing to these functional sequences can be found in Appendix D of the Oconee ?RA.

TSU r )(7)(F), 0)(7tl6 USC.§ 8240-l(d)

Seismic - Seismically-induced failures of the feedwater heaters, and to a lesser extent the condensers,!

(bX7)(F), (bX3).16 U.S C § 8240-l (d)

\ In addition. a seismically*induced fa i 1ure of Jocassee Dam would cause eventual site flooding, (b)(7)(F), (bX3) 16 U .S.C. § 8240-l(d)

A-7

r (b)(3): I 6 U S C W---,

s24o-J(dJ:{bx,c=....J And External Flooding -

I (F)

(bX7)(F), (b)(3)16 U .S.C. § 8240-l(d)

I~

1..---------------------------------'

catastrophic failure of Jocassee Dam is expected to inundate the site within a few hours, probably failing all power . External flooding events leading to core melt are discussed with fire events leading to core melt since they are functionally the same. /

CbX7)(F), (bX3) 16 U.S.C. § 8240-l(d)

I Tornado - This sequence is dominated by F-2 tornados that impact the Turbine Building

' - - - - - - - - - - - - - - - - ' Power components* at ground level or higher in the Turbine Building are susceptible to damage fro~ flying debris when wind loadings on the Turbine Building metal walls cause them to buckle and blow in.

(bX7)(F), (bX3):16 U.S.C. § 8240-l(d)

.____ \ ...., The frequency of this sequence is 3.0E-06 per year .

A-8

to the slow progression of the sequence, significantly reduce the calculated SGTR core-melt frequency . Operators taking necessary action to cooldown to OHR upon loss of HPI, in particular, has reduced the calculated core-melt frequency . Therefore, it can* be concluded that these sequences do not demonstrate any unique plant vulnerability.

A.5. 2 External Events Seismic events contribute approximately 21 percent to the total calculated annual core-melt frequency due to . loss of OHR. The dominant sequence .i s ""'l~"""' ~i"~""'"

"" ~.....

other seismically-induced core-melt sequences are only modest .contributors .

As discussed in Section 2.1.2, many of the ac power components have been judged .to have relatively low fragility values. This can be attributed to the fact that Oconee is an older plant and not designed to all -of the same criteria as newer plants. Upgrading any one particular component would have an insignificant effect on the calculated core-melt frequency since no single ac component plays a dominant role. In addition,!

(b)(7XF), (b)(3) 16 U.S.C § 8240-l(d)

---

\ This requires seismically-induced failures above station blackout. Therefore, it can be concluded that these sequences do not and beyond the demonstrate any unique plant vulnerability.

Fire events have been calculated to contribute approximately 40 percent to the total annual core-melt frequency due to loss of DHR. The predominant, fire initiated sequence involves an /

(bX7XF), (bX3):16 u.s.c. § 8240-l(d)

,___ ________ __,\ Other fire-induced core-melt sequences are only modest contributors . Core melts induced by external flooding are functionally the same as fire events and are also only modest. contributors (approximately 9 percent of the total frequency). Section 4.0 of this submittal descr-ibes actions currently being evaluated to improve SSF operator performance. In addition, measures are currently being taken to address fire detection and

_prevention in the Turbine Building. Given the extent of damage assumed to occur and the large uncertainty associated with the frequency of fires and dam failures of this type, it is s:afe to say that PRA modeling assumptions are A-12

driving these results . Therefore. it . can be concluded that these sequences do not demonstrate any unique plant vulnerability.

Tornado events have been calculated to contribute approximately_11 percent to the total annual core-melt frequency due to, loss of OHR. The majority of this contribution is distributed between functional sequencies TBU and TBQrU with no sequence dominating. The probabilities assigned to the failure modes discussed are highly subjective and uncertain but are believed to be conservative. The susceptibility of certain pieces of equipment to damage

. from tornados can be attributed to the fact that Oconee is an older plant and was not necessarily designed to the same. criteria as newer plants . ,Procedural guidance ,is in place to assist operators in dealing with the potential damage from these scenarios. In addition. the resulting core-melt frequencies are low and, _depending on the sequence. allow significant time for repair and restoration. Therefore, it can be concluded that these sequences do not demonstrate any unique plant vulnerability.

A.6 CONCLUSIONS The Oconee decay heat removal systems are robust and do not demonstrate any particular vulnerability to internally-initiated severe accident sequences.

The diversity of feedwater systems at Oconee make secondary side heat removal particularly reliable. Plant changes made as a result of flooding analyses have reduced the vulnerability of decay heat removal to both internal and external flooding events. During externally-initiated flooding events and fire events, SSF ASW provides decay heat removal independent of the systems fa i 1ed by these events. Ouri ng tornado events, the ASW pump ~11:~\F~ (bX3):1 5 u.s.c. § r )(?Xf), (bX3):l 5 u.s C. § 8240*1(d) I 0 provi des 1ake wate~ to the steam generators. thereby removing decay heat. Seismic events can cause widespread damage but the calculated failure modes and frequencies do not indicate any unique plant vulnerability. In addition. to fail all decay heat removal capability during a seismic event requires ground acceleration significantly greater than the safe shutdown earthquake for Oconee. Therefore, it can be concluded that Oconee does not exhibit any particular vulnerability to loss of decay heat removal and that this issue is resolved . .

A-13