05000259/LER-2013-001
| Browns Ferry Nuclear Plant (Bfn), Unit 1 | |
| Event date: | 02-06-2013 |
|---|---|
| Report date: | 06-12-2013 |
| 2592013001R01 - NRC Website | |
I. Plant Operating Condition(s) Before the Event At the time of discovery, the Browns Ferry Nuclear Plant (BFN), Units 1, 2, and 3, were in Mode 1 at approximately 100 percent rated thermal power.
II. Description of the Event(s)
A. Event
On July 28, 2009, Tennessee Valley Authority (TVA) identified latent computer modeling inconsistencies that adversely affected probable maximum flood (PMF) analyses.
Specifically, TVA identified the potential to overtop and fail earthen embankments at Cherokee, Fort Loudoun, Tellico and Watts Bar Dams. The potential to overtop and fail earthen embankments was identified based on an ongoing effort at that time to update, revalidate and verify the design basis flooding calculations for TVA nuclear plants.
The updating of the affected calculations included (1) unit hydrograph changes, (2) software code errors, (3) dam rating curve changes, (4) median reservoir level changes, (5) flood operation changes, (6) Dallas Bay omission (impacting BFN only), (7) and overflow areas at Watts Bar Dam. The overtopping and failure of the specified earthen embankments could have resulted in an increase in the PMF elevation at Watts Bar Nuclear Plant (WBN), Sequoyah Nuclear Plant (SQN) and BFN. This condition also had the potential to affect systems required for safe shutdown. At the time, this condition represented an unanalyzed condition at all three sites. This exposure existed for some period of time prior to the identification of the unanalyzed condition in 2009.
Upon discovery, TVA implemented interim and immediate corrective actions to ensure the Fort Loudoun, Cherokee, Tellico and Watts Bar Dams would not overtop during an assumed PMF event.
On May 30, 2013, a new analysis regarding PMF elevations at BFN, Units 1, 2, and 3 was completed. This analysis shows that the resulting PMF elevation of 571.5 feet for BFN, which remains below the current BFN licensing and design basis PMF elevation of 572.5 feet.
B. Status of Structures, Components, or Systems that were Inoperable at the Start of the Event and that Contributed to the Event There were no inoperable structures, components, or systems that contributed to the event.
C. Dates and Approximate Times of Occurrences Date Description 1960-1970s The WA develops hydrology modeling software (Simulated Open Channel Hydraulics (SOCH)).
1982 The TVA begins dam safety program consistent with Federal Guidelines for Dam Safety.
1985 The TVA's Engineering Laboratory issues the spillway coefficient report, "Method for Estimating Discharge at Overflow Spillways with Curved Crests and Radial Gates." TVA estimates orifice discharges using a single curve in the United States Army Corps of Engineers' Hydraulic Design Criteria.
1998 The TVA reassesses effects of dam safety modifications on PMF using SOCH.
2003 The TVA Water Management initiates River Operations Study Environmental Impact Statement to evaluate impacts of potential changes to operation of the TVA reservoir system.
October 30, 2007 The TVA submits the Bellefonte Nuclear Plant (BLN) Units 3 and 4 Combined License Application (COLA). The 1998 flood reassessment calculation is used as the basis for Final Safety Analysis Report section 2.4.
March 19, 2008 The NRC issues Notice of Violation for failure to implement the quality assurance program for the SOCH modeling.
March 2008 to September 2012 During verification and validation of SOCH inputs and codes, latent inconsistencies and necessary changes in PMF calculations are identified. The cumulative effects of these inconsistencies and changes predict potential dam overtopping at Fort Loudoun, Cherokee, Watts Bar and Tellico Dams during a PMF.
July 28, 2009 The TVA determines that based on certain PMF modeling concerns the Fort Loudoun Dam could be overtopped and fail and the resulting PMF elevations could exceed the original design and licensing basis elevations.
August 14, 2009 The TVA determines that if the Cherokee Dam were to overtop and fail, the PMF elevations could exceed the original design and licensing basis elevations.
September 24, 2009 The TVA determines that if the Tellico and Watts Bar Dams were to overtop and fail, the PMF elevations could exceed the original design and licensing basis elevations.
December 30, 2009 The HESCO modular flood barrier installation at affected dams to raise earthen embankments completed.
February 6, 2013 The TVA notified the NRC that due to the potential to overtop and fail earthen embankments at four dams, BFN was in an unanalyzed condition that could have resulted in an increased PMF elevation at BFN.
May 30, 2013 Hydrologic Engineering Centers River Analysis System (HEC-RAS) Simulations for BFN were completed using conditions prior to dam safety modifications and during a worse case storm event.
D. Manufacturer and Model Number (or other identification) of Each Component that Failed During the Event There were no failed components associated with this condition.
E. Other Systems or Secondary Functions Affected
There were no other systems or secondary functions affected by this condition.
F. Method of Discovery of Each Component or System Failure or Procedural Error On July 28, 2009, as part of an ongoing validation of SOCH model and sub-codes, TVA concluded that the spillway discharge coefficient previously used in the Fort Loudoun Dam Rating Curve was inconsistent with more recent model test data. Additional research revealed that the same was true for Cherokee, Tellico and Watts Bar Dams.
G. The Failure Mode, Mechanism, and Effect of Each Failed Component There were no failed components.
H. Operator Actions
There were no operator actions.
I. Automatically and Manually Initiated Safety System Responses There were no safety system responses.
Ill. Cause of the event A. The cause of each component or system failure or personnel error, if known:
There were no component or system failures or personnel errors associated with this event.
B. The cause(s) and circumstances for each human performance related root cause:
The TVA identified two root causes for this condition, each having human performance related aspects.
1. An organizational behavior, rooted in over-confidence that TVA was the industry hydrology expert, resulted in the input errors (latent computer modeling inconsistencies) during the development of the SOCH model going undetected.
2. The TVA Nuclear management's failure to provide oversight of the impact of changes to the river system on the calculated PMF at BFN and failure to apply safety-significant conservative decision-making for those changes demonstrated that nuclear safety was not the overriding priority.
Two relevant contributing factors were indentified.
1. Formal process controls were not established that ensure the flood protection program protects critical safety systems for the TVA nuclear sites.
2. The TVA demonstrated less than adequate shared understanding of the applicable regulatory requirements under which the nuclear sites, as integral components of the river system, must operate.
In 1998 and again in 2004, significant changes to the design of the dams and operation of the river system were implemented. In both cases, the model was used to calculate the impact to the nuclear sites. The Nuclear organization acted upon those results without questioning the validity of the model, the calculations that it supported, or its conclusions.
TVA Nuclear remained over-confident in the belief of the accuracy of the model throughout this period.
Since they had been used to license the nuclear stations, the software and model were believed to be correct. The over-confidence in the model continued to exist as late as 2008 when the model was employed in support of the BLN COLA submittal.
It was not until 2009, during validation of the hydrology model, that TVA realized that there were inconsistencies in the model inputs which, when corrected, resulted in the realization that some upstream dams could overtop and fail. The failure of the dams would overwhelm the planned flood protection actions to protect the safety systems at the TVA nuclear stations.
In summary, the latent design input inconsistencies, and a lack of rigor and oversight due to the overconfidence in the evaluation of changes in the operation of the river system over time, resulted in unrecognized inaccuracies in the PMF calculations.
IV. Analysis of the event:
Reportability Analysis The TVA originally reported this condition in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50.73(a)(2)(ii)(B) as any event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.
On May 30, 2013, a new analysis regarding PMF elevations at BFN, Units 1, 2, and 3 was completed. Although this condition was considered to be unanalyzed, the analysis concluded that it did not result in BFN being in a condition that significantly degraded plant safety with respect to the PMF elevation prior to the HESCO modular flood barriers being placed on top of the dams. Therefore, TVA is submitting this supplemental LER to reflect the details of the completed PMF analysis at BFN.
Operational Analysis As allowed by the NRC Inspection Manual 9900: Technical Guidance, Operability Determinations & Functionality Assessments For Resolution of Degraded or Nonconforming Conditions Adverse to Quality or Safety, guidance in section C.4 was used to complete the analysis using an alternate analysis method, i.e. HEC-RAS simulation software, instead of the licensing basis software SOCH. Both programs have been validated and verified in accordance with TVA's procedures regarding computer software control. Additionally, the HEC-RAS code is controlled under TVA's quality assurance program. The TVA Nuclear Civil Engineering Organization has evaluated several cases with both programs and has determined that the two programs produce similar results. The HEC-RAS simulation software is being used in this application because the results were able to be obtained in a much more expedient manner than those produced by SOCH.
The HEC-RAS simulations were performed to determine if there was a nonconformance issue or an unanalyzed condition with respect to resulting maximum flood elevations at BFN prior to the HESCO modular flood barriers being put into place. The analysis was performed with the licensing basis assumptions that were in place prior to December 2009. December 2009 is the date when the PMF calculation was completed for WBN, SQN and BLN; no results were available for BFN at that time. In addition, the HESCO modular flood barriers were put in place on the embankments of these four dams by the end of December 2009.
Prior to December 2009, the licensing basis PMF analysis did not credit modifications to upstream dams that were made from 1982 to 1997. In 1998, an analysis was completed after those modifications were made that would have allowed the PMF elevation at BFN to be decreased. However, BFN chose to not change any licensing basis assumptions and not change the design and licensing basis PMF elevations of 572.5 feet. Therefore, in order to address the impact of this new information regarding the overtopping of the four dams upstream from WBN with respect to the PMF elevation at BFN, model simulations were completed on May 30, 2013, with the dams in the configuration as they were prior to the 1982 to 1997 modifications.
The 7980 square-mile March storm centered at Bulls Gap was used in the HEC-RAS simulations because the breach of dams located in the upper watershed tributary reaches have the potential to cause cascading dam failures and is considered the worse case analysis for overtopping and breaching.
The flood elevation at BFN determined by the recent HEC-RAS simulations, but without HESCO modular flood barriers and without the 1982 to 1997 dam modifications, is 571.5 feet. The licensing basis PMF elevation continues to be 572.5 feet at BFN. The conclusion resulting from TVA's review is that although this condition was considered unanalyzed, the analysis concluded that it did not result in BFN being in a condition that significantly degraded plant safety with respect to the PMF elevation prior to the HESCO modular flood barriers being placed on top of Cherokee, Fort Loudoun, Tellico, and Watts Bar Dams.
V. Assessment of Safety Consequences
Upon the discovery of the potential to overtop upstream dams during a PMF event, it was immediately recognized by TVA that interim measures were required to maintain operability of BFN, SQN, and WBN. If overtopping of earthen embankments occurred, the design basis flood was projected to increase to an unacceptable level beyond what SQN and WBN could reasonably protect against. The current analysis of PMF conditions prior to implementation of dam safety modifications and the HESCO modular flood barrier installation shows that the resulting PMF elevation of 571.5 feet at BFN would have remained below the current BFN licensing and design basis PMF elevation of 572.5 feet.
In addition, with the installation of the HESCO modular flood barriers, analysis performed in April 2012 shows that the PMF elevations at BFN remain within the current design and licensing basis limitations.
A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event:
Based on current analysis of PMF conditions prior to implementation of dam safety modifications and installation of the HESCO modular flood barriers, there are no components or systems that would have failed during a postulated PMF event.
B. For events that occurred when the reactor was shut down, availability of systems or components needed to shutdown the reactor and maintain safe shutdown conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident:
Based on current analysis of PMF conditions prior to implementation of dam safety modifications and installation of the HESCO modular flood barriers, there are no components or systems needed to shutdown the reactor and maintain safe shutdown conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident that would have failed during a postulated PMF event.
C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from discovery of the failure until the train was returned to service:
Based on current analysis of PMF conditions prior to implementation of dam safety modifications and installation of the HESCO modular flood barriers, there are no components or systems that would have rendered a train of a safety system inoperable during a postulated PMF event.
Therefore, TVA concluded that there was minimal safety significance for this event.
VI. Corrective Actions - Corrective Actions are being managed by TVA's corrective action program under Problem Evaluation Report (PER) 682212.
A. Immediate Corrective Actions:
In July and August 2009, TVA implemented interim measures to mitigate impacts of the potential increase in PMF elevations. River Operations procedures were modified to require site notifications if greater than or equal to five inches of average rainfall over 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> occurs over the Fort Loudoun/Tellico Dam watershed area. At the same rainfall threshold, TVA would mobilize the necessary heavy equipment at the Fort Loudon Marina Saddle Dam to effect the saddle dam removal to preserve the integrity of Fort Loudon Dam.
During this period, TVA also began installation of HESCO modular flood barriers on the Cherokee, Fort Loudoun, Tellico, and Watts Bar Dams. Installation of the HESCO modular flood barriers were completed in December 2009. The resulting PMF elevations, after the installation of the HESCO modular flood barriers, at BFN are within current design and licensing basis limitations reflected in the Updated Final Safety Analysis Report.
B. Corrective Actions to Prevent Recurrence or to reduce probability of similar events occurring in the future:
1. Revise the Conduct of the Engineering Organization procedure, to include a Flood Protection Program within the Corporate Nuclear Engineering Organization with the primary function to ensure that the nuclear plant critical safety systems are protected from all postulated flooding conditions.
2. Develop a formal Flood Protection Program Management Implementing procedure or procedures. This procedure would (for example) define the Flood Protection Program policy, ownership of the procedures, roles and responsibilities; identify nuclear regulatory requirements; establish governance and oversight expectations, periodic program reviews, training and qualification requirements; and implement flood protection change control board process, and program health reports.
3. Develop a Flood Protection Program Design Standard(s) or Design Guide(s) in accordance with engineering programs and processes to control flood protection calculations.
4. Formalize the elements of engineering technical rigor in the Conduct of the Engineering Organization procedure.
5. Create a formal documented risk management process for all engineering products, informed by Institute of Nuclear Power Operations (INPO)12-008, Excellence in Integrated Risk Management, which includes flood related issues to evaluate including river system operation changes, nuclear plant design changes, design input changes, procedure changes impacting flood protection, Environmental and/or National Environmental Policy Act (NEPA), and Project Management.
6. The TVA Nuclear Organization will implement an upper tier integrated risk management process, informed by INPO 12-008.
VII. Additional Information
A. Previous Similar Events at the Same Plant A search of BFN Licensee Event Reports (LERs) for Units 1, 2, and 3 for the last several years did not identify any similar events.
A search was performed on the BFN corrective action program. Similar PERs related to the condition reported in this LER are PERs 147337, 158381, and 212253. These PERs involve conditions related to PMF calculations. A review of the corrective action for these PERs concluded that the corrective actions associated with these PERs would not have prevented this event.
B. Additional Information
There is no additional information.
C. Safety System Functional Failure Consideration
In accordance with Nuclear Energy Institute (NEI) 99-02, this condition is not considered a safety system functional failure.
D. Scram with Complications Consideration
This event did not result in an unplanned scram with complications.
VIII. Commitments There are no commitments.