ML090570117
Text
OFFICIAL USE ONLY - SECURITY RELATED INFORMATION August 12, 2009 MEMORANDUM TO: Bruce A. Boger, Associate Director for Operating Reactor Oversight & Licensing Office of Nuclear Reactor Regulation Victor M. McCree, Deputy Regional Administrator of Operations Region II Michele G. Evans, Acting Associate Director for Engineering and Safety Systems Office of Nuclear Reactor Regulation FROM: Mark A. Cunningham, Director /RA/
Division of Risk Assessment Office of Nuclear Reactor Regulation Patrick L. Hiland, Director /RA/
Division of Engineering Office of Nuclear Reactor Regulation Joseph G. Giitter, Director /RA by Allen Howe for/
Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation
SUBJECT:
TECHNICAL BASIS FOR ALLOWING OCONEE NUCLEAR STATION TO REMAIN IN OPERATION THROUGH NOVEMBER 2010 The NRC conveyed a basis for allowing continued operation of the Oconee Nuclear Station (ONS) to Duke Power in a management meeting on November 5, 2008. The purpose of this memorandum is to document that basis. As stated at the meeting, the basis for allowing continued operation of the station through November 2010 was based on the low level of risk associated with operating the site for 2 years as supported by deterministic information regarding current dam conditions and monitoring, and the time available to perform mitigating CONTACT: Antonios Zoulis, NRR/DRA (301)415-1209 OFFICIAL USE ONLY - SECURITY RELATED INFORMATION
OFFICIAL USE ONLY - SECURITY RELATED INFORMATION actions against containment failure in the event of an external flooding event.
We have concluded that continued operation during this time period is not inimical to the public health and safety.
If you have any questions, please contact us.
Enclosure:
Technical Basis for Allowing Oconee Nuclear Station to Remain in Operation Through November 2010 OFFICIAL USE ONLY - SECURITY RELATED INFORMATION
OFFICIAL USE ONLY - SECURITY RELATED INFORMATION actions against containment failure in the event of an external flooding event.
We have concluded that continued operation during this time period is not inimical to the public health and safety.
If you have any questions, please contact us.
Enclosure:
Technical Basis for Allowing Oconee Nuclear Station to Remain in Operation Through November 2010 ADAMS Accession Number: ML090570117 OFFICE NRR/DRA/APOB NRR/DRA NRR/DRA NRR/DORL NRR/DE R-II/DRP NAME AZoulis MGalloway MCunningham JGiitter PHiland LWert A Howe for via e-mail DATE 03/30/2009 8/12/2009 08/12/2009 08/12/2009 08/12/2009 08/06/2009 OFFICIAL RECORD COPY OFFICIAL USE ONLY - SECURITY RELATED INFORMATION
OFFICIAL USE ONLY - SECURITY RELATED INFORMATION Technical Basis for Allowing Oconee Nuclear Station to Remain in Operation Through November 2010
- 1. PURPOSE The purpose of this assessment is to document the basis for the Nuclear Regulatory Commission (NRC) allowing continued operation of the Oconee Nuclear Station (ONS) through November 2010. The basis, as stated at the November 5, 2008, meeting, was that the risk of continued operation of the Oconee units for this period is sufficiently low as supported by the deterministic factors of the ongoing condition monitoring and current health of the Jocassee Dam and the relatively long timelines until containment failure in the event of flooding at the Oconee site. In preparing this document, the staff consulted the Office of Nuclear Regulatory Regulation (NRR) Office Instruction LIC-504, Integrated Risk-Informed Decision-Making Process for Emergent Issues, Revision 2.
- 2. BACKGROUND On August 15, 2008, the NRC issued a request pursuant to 10 CFR 50.54(f) for information regarding the external flooding vulnerability at ONS, including failure of the Jocassee Dam. The issue revolves around the adequacy of the standby shutdown facility (SSF) to withstand and to mitigate an external flood given that the only assessment of the flood height that the licensee had available predicted flood levels that exceed the existing SSF flood protection barriers. The Jocassee Hydro Project, Dam Failure Inundation Study1, postulated flood levels at the Oconee site which would render the SSF non-functional and fail the capability of the station to maintain residual heat removal and containment cooling functions.
The SSF provides capability to achieve and maintain hot shutdown of the Oconee units from outside the control room in the event of a fire, internal flood, or sabotage-related emergency.
Under loss of offsite power conditions, the Keowee Dam provides backup AC power. The SSF is credited as the alternate AC (AAC) power source and the source of decay heat removal to support safe shut down in the event of a station blackout. It provides additional "defense-in-depth" by serving as a backup to safety-related systems. The SSF has the capability of maintaining Mode 3 (hot shutdown) in all three units for approximately three days following a loss of normal AC power. It is designed to maintain reactor coolant system (RCS) inventory, maintain RCS pressure, remove decay heat, and maintain shutdown margin. The SSF requires manual activation and would be activated under adverse fire, flooding or sabotage conditions when existing redundant emergency systems are not available.2 In April 2006, the staff concluded that the licensee failed to effectively control maintenance activities associated with removing a fire suppression refill access cover (a passive NRC-committed flood protection barrier) in the SSF south wall to facilitate installation of temporary 1
Jocassee Hydro Project, Dam Failure Inundation Study, Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.
2 UFSAR Revision 15, Oconee Nuclear Station, December 2005, Chapter 9 Section 9.6.1.
OFFICIAL USE ONLY - SECURITY RELATED INFORMATION
OFFICIAL USE ONLY - SECURITY RELATED INFORMATION electrical power cables. The staff identified the issue during a periodic risk-informed flood inspection under the NRCs Reactor Oversight Process (ROP). During its ROP Significance Determination Process, the staff discovered that the licensee did not adequately address the potential consequences of flood heights predicted at the Oconee site based on the 1992 Duke Hydro/FERC Inundation Study. The inundation study was not performed to calculate flooding levels at the SSF but did raise questions as to the potential vulnerability of the SSF to an external flood.
The inundation study analyzed two dam failure scenarios:
- sunny day dam failure - assumes that the reservoir is at normal operating levels (determined by reviewing historical reservoir levels approximately 17 feet below the top level of the dam) and a catastrophic failure of the dam occurs (piping breach)
- probable maximum flood (PMF) dam failure - assumes that the reservoir is at 3 feet below the top level of the dam and a catastrophic failure of the dam occurs (piping breach).
The dam failures under these scenarios assumed that the flood waters would also fail the Keowee Dam. The Keowee Dam is assumed to fail as the direct result of the water forces cutting a breach in the homogeneous earth fill. Given the postulated break size and the subsequent failure of the Keowee Dam, the flood levels at ONS were calculated to be 12.5 feet and 16.8 feet for the sunny day and PMF dam failures, respectively. Flood heights of this magnitude would submerge the SSF such that it would not be able to perform its mitigating functions. Once the SSF is submerged, without mitigating actions, core damage and containment failure would ensue.
In 2007 as part of the SDP, the staff conducted an independent review of the Jocassee Dam failure frequency that Duke had used in the Oconee Probabilistic Risk Assessment (PRA).
From that review, the staff concluded that a higher frequency estimate of Jocassee Dam failure was more accurate and that the licensees estimate was not adequately supported by operating experience and actual performance data of similar rock-filled dam structures. The licensee excluded failure data related to earthen dams while including the dam years related to those dams thus inappropriately reducing the failure frequency by an order of magnitude. The staff also concluded that Duke had an inadequate basis for applying a reduction factor to further lower the risk estimate (i.e., an engineering judgment assumption that only 20 percent of floods would exceed the 5-foot walls protecting the SSF access points).
- 3. EVALUATION 3.1 Evaluation Criteria The staff conducted an assessment to delineate the arguments regarding continued operation of the three Oconee units. The staff consulted NRR Office Instruction LIC-504 guidelines; however, a full LIC-504, (Integrated Risk-Informed Decision-Making Process for Emergent Issues), evaluation was not performed. The office instruction provides criteria for considering OFFICIAL USE ONLY - SECURITY RELATED INFORMATION
OFFICIAL USE ONLY - SECURITY RELATED INFORMATION when an immediately effective order should be issued to place or maintain a plant in a safe condition. The staff determined the following criteria were most applicable to this issue:
- Defense in depth is significantly degraded
- Significant loss of safety margins
- Risk impact is high, as determined using risk metrics:
o Conditional core damage frequency greater than or on the order of 1x10-3/yr o Conditional large early release frequency greater than or on the order of 1x10-4/yr 3.2 Deterministic Assessment Based on the 1992 inundation studys estimated flood heights, the postulated flood would render the SSF inoperable; the site would lose its last permanent line of defense designed to mitigate the flood and prevent core damage and containment failure. Once the SSF is submerged, without mitigating actions, core damage would ensue within a few hours, and containment failure would subsequently ensue within a few days. As noted in the background section, the 1992 inundation study was not performed to calculate flooding levels at the SSF.
Subsequent to the November 5, 2008, meeting, Duke committed to perform more sophisticated flood studies to reduce uncertainties in predicted flood heights at the Oconee site.
As noted in the November 5 meeting, one of the NRCs bases for allowing continued operation of the Oconee units was the timelines until containment failure. Subsequent to the November 5 meeting, the licensee developed Technical Support Center (TSC) guideline, Engineering Manual E.M. 5.3, Beyond Design Basis Mitigation Strategies, to utilize B.5.b and other equipment to take mitigating actions to provide core cooling and spent fuel pool cooling in the event of a loss of the SSF due to external flooding. The guidelines provide additional information and strategies on what measures the site may take to address such a scenario.
The efficacy of these procedures has not yet been demonstrated.
Additional factors, in support of allowing operation through November 2010, are the current apparent health of the dam and the regular monitoring of its condition:
- Duke constantly surveils the performance of the dam by means of on-site cameras and performs offsite monitoring of the observed data from its headquarters office.
- Duke performs biweekly inspection and monitoring of the condition of the dam, as required by FERC.
- FERC personnel inspect the dam annually; the 2007 and the 2008 inspections did not identify any adverse trends in the condition of the dam. Further, the NRC regularly interacts with FERC and receives inspection information regarding the Jocassee dam.
OFFICIAL USE ONLY - SECURITY RELATED INFORMATION
OFFICIAL USE ONLY - SECURITY RELATED INFORMATION While the current health of the dam supported by condition monitoring is sufficient to support the staffs assessment to allow a slight increased risk through November 2010, the overall defense-in-depth and adequate safety margins for protecting ONS are deterministic pending completion of ongoing flood analysis work.
3.3 Risk Assessment The staff conducted a partial probabilistic risk assessment to inform its conclusions regarding continued operation of the three Oconee units. The staff estimated the conditional core damage frequency (CDF) and conditional large early release frequency (LERF) and compared those results against conditional CDF and LERF criteria in NRR Office Instruction LIC-504.
3.3.1 Estimated Conditional Core Damage Frequency To estimate the Jocassee dam-break frequency, the staff performed a Bayesian statistical analysis on eight categories of dams including rockfill dams. The staff used the National Performance of Dams Program Database developed and maintained by Stanford University in conjunction with the Army Corps of Engineers Dam Database to estimate the generic frequency of rockfill dam failures. The staffs calculation consisted of reviewing historical failure data and past operating history of rockfill dams to develop a failure frequency. The failure frequency reflects the current population of dams similar to the Jocassee Dam.
This analysis retained as much data in the failure rate estimates as is consistent with Bayesian analysis philosophy for rare event frequency estimation. The staff used a Jeffreys non-informative prior distribution and Gamma distribution in accordance with NUREG/CR-6823, Handbook of Parameter Estimation for Probabilistic Risk Assessment. This assumption has a minor effect on the mean value of dam failures by not significantly skewing the mean value when compared to the point estimate. However, it does yield a conservative estimate with a wider range of parametric uncertainty than estimates obtained using other statistical methods.
This approach is used to illustrate for the Jocassee case that when using a conservative parametric uncertainty analysis combined with understanding of other sources of uncertainty, the staffs recommendations remain consistent with LIC-504 guidance of 1x10-3/yr for conditional CDF.
Using rockfill dam failures occurring between 1940 and 2000, dams whose structural height were greater than 50 feet, and discounting infant mortality failures (i.e., pre-operations failures and those failures within the first year of operation), the staffs best-estimate of the mean failure rate is approximately 2x10-4/yr with a 90 percent credible interval [5th and 95th percentile]
between 4x10-5/yr and 4x10-4/yr. The ability of the NRC to accept this likelihood of dam failure through November 2010 is supported by the current apparent health of the dam and the regular monitoring of its condition as noted in the deterministic section of this assessment As stated in the deterministic assessment, a flood exceeding the height of the SSF flood protection would render the SSF non-functional. In this case, without mitigating actions, the conditional probability of failure of the SSF is 1.0. The staff notes the assumption that the SSF OFFICIAL USE ONLY - SECURITY RELATED INFORMATION
OFFICIAL USE ONLY - SECURITY RELATED INFORMATION will be flooded based on the 1992 inundation study may be conservative pending the staffs final evaluation of the ongoing hydrologic site inundation analysis and sensitivities studies. Given the generic frequency of a dam failure, and assuming no other mitigation, the estimated conditional CDF is 2x10-4/yr (2x10-4/yr
- 1.0). This estimated CDF in reality represents any of several values within a range of values because of uncertain model parameters upon which PRAs are dependent. Therefore, it is not possible to predict which value is the true or actual CDF. The validity of these uncertain results is dependent on the validity of assumptions and data used in this assessment; however, the staff used a conservative range of possible CDF values to illustrate that there is significant margin to the CDF metric cited in LIC-504. Also, the conditional CDF metric provided in LIC-504 is not an absolute threshold (i.e., a single value) but rather in the range of 10-3/yr and comparison of a CDF to it requires informed judgment. Certainly, regulatory concern increases as CDF increases toward the 10 -3/year range. In this instance, the staffs estimated conditional CDF is well below the 10-3/yr conditional CDF guideline in LIC-504 by approximately an order of magnitude.
Overall, given the staffs understanding of the dams health, inspection regime, condition monitoring activities as noted in the deterministic section, and the conservative risk assessment approach, the staff is confident that the estimated conditional CDF is no greater than low 10-4/yr for the interim period till November 2010.
3.3.2 Estimated Conditional Large Early Release Frequency and Accident Sequence Progression The licensee has estimated accident sequence progression timelines from an external flood, without mitigating actions, as follows: core damage would occur in approximately 8 to 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> after the dam break and containment failure would occur in about 59 to 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br /> after the Jocassee dam failure. The estimated time to containment failure reflects the fact that each Oconee reactor unit is contained in a large-dry type containment building that severe accident research and tests have generally demonstrated are robust structures. Accident management strategies under consideration by the licensee include use of fire trucks to maintain spent fuel pool levels, controlled venting of the reactor buildings to maintain integrity, stationing and use of portable pumping equipment to spray the containment structures, and securing additional equipment for mitigation as directed by the Emergency Response Organization (ERO).
Under these site flooding circumstances, the ONS Emergency Plan would be in effect, the ERO activated, and offsite agencies notified. The licensee would declare a General Emergency if offsite releases can be reasonably expected to exceed EPA Protective Action Guidelines exposure levels outside the Exclusion Area Boundary. The declaration of a General Emergency could be made if actual/imminent substantial core degradation with the potential loss of containment conditions exists. The licensee would provide recommendations to state and local authorities regarding protective action recommendations (PARs) for public protection. Given that the estimated time between core damage and time to containment failure is greater than two days, this would give ONS time to implement the site Emergency Plan and allow sufficient time for offsite agencies to implement PARs as appropriate (e.g., evacuate the people in the surrounding vicinity). Furthermore, it is assumed, this additional time could allow recovery of OFFICIAL USE ONLY - SECURITY RELATED INFORMATION
OFFICIAL USE ONLY - SECURITY RELATED INFORMATION flooded roadways after flood recession (estimated to occur in approximately 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> following dam failure) and the potential for alternate water sources or equipment to mitigate the accident.
Subsequent to the November 5, 2008 meeting, Duke has augmented its TSC guidelines as of February 2009 to include mitigating actions to address loss of the SSF due to external floods.
The efficacy of these procedures has not yet been demonstrated. Given the above, the staff estimates that the conditional LERF is in the 10-5/yr range and therefore below the 10-4/yr conditional LERF guidelines in LIC-504.
- 4. CONCLUSIONS The staff has determined that continued operation of the Oconee units through November 2010 is acceptable because the Jocassee Dam is not likely to suffer a catastrophic failure, and accident sequence progression timelines to containment failure are on the order of days. Given the short duration to resolve this issue (November 2010), the staff has concluded, as noted at the November 5, meeting with the licensee, that the risk of Oconee continued operations is sufficiently low for this time period, as supported by the deterministic factors of continued condition monitoring and current health of the Jocassee dam and timelines until containment failure.
Further, the staff's conclusion that short-term continued operation of the Oconee units is acceptable was based principally on risk consideration. Specifically, the conditional CDF and conditional LERF for the external flooding of the Oconee units are substantially below the conditional CDF and conditional LERF guidelines of 10-3/yr and 10-4/year, respectively, that are noted in LIC-504. In evaluating the applicable LIC-504 criteria, the increased risk over the short term when balanced against the defense in depth and safety margin criteria of LIC-504 over the same period was deemed acceptable. Therefore, continued operation during this time period is not inimical to the public health and safety.
OFFICIAL USE ONLY - SECURITY RELATED INFORMATION