ML101900305
| ML101900305 | |
| Person / Time | |
|---|---|
| Issue date: | 07/19/2010 |
| From: | Lois James NRC/NRR/DRA/APOB |
| To: | Benjamin Beasley NRC/RES/DRA/OEGIB |
| Ferrante, Fernando, NRR/DRA/APOB, | |
| Shared Package | |
| ML24324A069 | List: |
| References | |
| FOIA/PA-2013-0009A, FOIA/PA-2013-0126, FOIA/PA-2015-0348 | |
| Download: ML101900305 (9) | |
Text
This document is a redacted publicly available version. In November 2024, the NRC staff identified information within this document that may be Critical Electric Infrastructure Information (CEII) as defined by the Federal Energy Regulatory Commission (FERC). The original file is non-public, designated as CEII, in ADAMS ML24324A067.
NRC staff actions were taken in accordance with:
The Memorandum of Understanding Between US NRC and FERC Regarding Treatment of Critical Energy/Electric Infrastructure Information found at:
https://www.nrc.gov/reading-rm/doc-collections/memo-understanding/2024/
index.html.
The FERC definition of CEII found at: https://www.ferc.gov/ceii, and, https://
www.ferc.gov/enforcement-legal/ceii/designation-incoming-dam-safety-documents.
OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION July 19, 2010 MEMORANDUM TO: Benjamin Beasley, Chief Operating Experience and Generic Issues Branch Division of Risk Analysis Office of Nuclear Regulatory Research FROM:
Lois James, Chief /RA/
Probabilistic Risk Assessment Operational Support Branch Division of Risk Assessment Office of Nuclear Reactor Regulation
SUBJECT:
IDENTIFICATION OF A GENERIC EXTERNAL FLOODING ISSUE DUE TO POTENTIAL DAM FAILURES INTRODUCTION The NRCs primary function is to license and regulate the safe use of radioactive materials for civilian purposes to ensure adequate protection of public health and safety and the environment.
In performing this function, the Office of Nuclear Reactor Regulation (NRR) identified during a recent review of a regulatory action associated with an operating nuclear power plant (NPP) a higher than expected potential for both the external flooding hazard due to a potential dam failure and its associated consequences to the public health and safety and the environment.
Based on these findings, the Division of Risk Assessment (DRA) and the Division of Engineering (DE) at the Office of Nuclear Reactor Regulation (NRR) began evaluating the potential implications of these findings to other operating NPP sites by:
(i) evaluating the extent to which this hazard has been considered in the past via US NRCs regulatory framework (e.g., 10 CFR 50, Regulatory Guides, Standard Review Plan),
(ii) examining current design flood bases regarding dam-related external flooding issues, (iii) interacting with other federal agencies involved in oversight and risk assessment of dams, and (iv) considering whether this additional knowledge may translate into an increase in risk when compared to the previous understanding of this issue.
TECHNICAL ISSUE External flooding considerations involve a series of hydrological and non-hydrological factors that may impact a NPP site. Hydrological factors include site-specific extreme phenomena characteristics (e.g., high tides, severe storms, wave action) potentially causing flooding, while non-hydrological events include seismic activity and other causes. In both cases, there is a potential hazard due to the effect of hydrological and non-hydrological phenomena on man-made structures such as dams, levees, and dikes as contributors to flooding. Available guidance on dams from entities such as the Federal Energy Regulatory Commission (FERC),
OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION 2
US Bureau of Reclamation (USBR), and the US Army Corps of Engineers (USACE) indicate mechanisms that may trigger the uncontrolled release of the reservoir impounded by a dam.
These generally include (i) overtopping of a dam due to severe precipitation-induced flooding, (ii) seismically-induced failures, (iii) breaches caused by internal erosion/piping phenomena, (iv) operational errors or mechanical failures, and (iv) combinations of these various mechanisms.
Failures other than severe storm and seismic events can be grouped into a subset often referred to as sunny-day failures, which can occur during normal operations (e.g., internal erosion and operational failures). Guidance from USBR clearly indicates that these sunny day failures may be higher contributors to risk when compared to low-frequency extreme events such as severe storms and earthquakes (USBR, 2010). Additionally, when compared to severe weather events, sunny day failures may provide less warning time for mitigating actions to take place. From discussions with these multiple agencies involved in dam risk assessment, it was concluded that the current state-of-art has evolved sufficiently to provide better risk estimates of such contributors.
REGULATORY FRAMEWORK The regulatory requirements for issues related to external flooding are found in Appendix A to 10 CFR 50 (CFR, 1971), where the General Design Criteria (GDC) is described. The GDC was developed to establish minimum requirements for the principal design criteria (i.e., set of necessary requirements to ensure public health and safety) for NPP sites similar to those already licensed. The General Design Criteria 2 (GDC 2) explicitly discusses considerations on the appropriate design bases for structures, systems, and components (SSCs) important to safety expected to withstand the effects of natural phenomena such as flooding. In some cases where the license for a specific reactor site was issued prior to the development of GDC 2, licensees have used criteria similar to GDC 2 to cover natural phenomena considerations in their original license submittals. GDC 2 states that:
The design bases for these SSCs shall reflect: (1) Appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and the surrounding area, with sufficient margin for the limited accuracy, quantity and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena, and (3) the importance of the safety functions to be performed.
In terms of regulatory guidance, four Standard Review Plans (SRPs) in NUREG-0800 (ML003740388, ML062260222, ML070730405) and Regulatory Guide 1.59, Design Basis Floods for Nuclear Power Plants, (ML003740388) include specific guidance on external flooding at NPPs due to potential dam failures. The guidance provided in Regulatory Guide 1.59 explicitly covers hydrologic and seismic-induced dam failures, as well as considerations for combinations of lesser events.
Upon review by NRR staff of the above references, it has been concluded that existing NRC requirements and guidance is ambiguous on whether certain failure mechanisms such as internal erosion or operational errors should be explicitly considered, which have commonly not been the focus of safety analyses performed for operating sites. In part, an assessment of the risk contribution due to sunny day failures may have not been consistently performed due to a lack of understanding of its impact on the safety margins of existing NPP sites. Further guidance can be developed with additional understanding of the actual contribution to NPP risk due to sunny day failures individually and in combination with other mechanisms.
OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION 3
CURRENT DESIGN FLOOD BASES A detailed analysis of dam-related flooding potential and its consequences in the licensing of operating NPPs is limited in the available documentation, which consists primarily of the Final Safety Analysis Reports (FSARs) and the Individual Plant Examinations for External Events (IPEEEs) for individual sites. It is clear however, that emphasis has been placed on the use of conservative screening assumptions to eliminate this flooding hazard from further consideration based on either bounding characteristics of other flooding phenomena, low initiating event frequency and/or sufficient advance warning in case a dam failure does occur.
In multiple FSARs and IPEEEs, dam failures are described as not credible (Fort Calhoun Station, Cooper Nuclear Station), highly unlikely (McGuire Nuclear Station), or extremely unlikely (Arkansas Nuclear One, Sequoyah Nuclear Plant, Watts Bar Nuclear Plant) by taking into account individual or combinations of severe events hydrologic and seismic events. From a preliminary review, at least four sites have considered quantitative dam failure rate: Oconee Nuclear Station (South Carolina), Cooper Nuclear Station (Nebraska), Fort Calhoun Station (Nebraska), and H.B. Robinson (South Carolina). All four sites considered failure rates in the range between 5 x 10-5/year and 1 x 10-5/year. Flooding requirements are considered for a number of sites, including the use of sandbagging and other mitigative actions which assume ample lead time for implementation. However, a preliminary review of the IPEEEs indicates that, since dam failures were excluded from consideration in most FSARs, its risk contribution has not been addressed to date.
RISK SIGNIFICANCE Due to the limited risk considerations available, NRR further evaluated the dam failure rates considered in the subset of IPEEEs mentioned above. As there were few reliable dam failure data sources when most estimates where derived, it was found that these analyses relied mainly on an estimate published in NUREG/CR-5042, Evaluation of External Hazards to Nuclear Power Plants in the United States (ML062260222). In turn, the data source for the dam failure estimate in NUREG/CR-5042 is "NSAC-60 Oconee PRA: A Probabilistic Risk Assessment of Oconee Unit 3 (NSAC/EPRI, 1984). Upon detailed review by NRR staff, it was concluded that the failure frequency value used for large dams in this publication was incorrectly underestimated by an order of magnitude which propagated to the other analyses (e.g.,
IPEEEs). This large difference was in part due to a commingling of different types of large dam population data and a restricted choice of failure data.
From this observation and the fact that most external flooding screening analysis were based on combinations of severe phenomena to screen out this initiating event without significant consideration of the sunny day dam failure mechanisms, NRR staff performed two additional actions: (i) examined current NPP vulnerabilities to dam failure hazards and performed a qualitative assessment of sites more or less likely to be impacted based on available information (mostly FSAR and IPEEE information), and (ii) estimated a generic dam failure rate calculation based on the most up-to-date historical data for the specific subset of embankment dams which the NSAC-60 study was intended for (i.e., large rockfill dams).
In the first effort, a study was produced that resulted in a coarse screening and ranking of sites more vulnerable to this hazard (due to both upstream and downstream dam failures). U.S.
commercial nuclear reactors are located in 65 sites adjacent to streams, lakes/reservoirs, or coastal areas. A number of information sources were used to ascertain the location of dams and the corresponding impact to NPPs based on distance to the site and reservoir volume
OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION 4
impounded. Due to the lack of more up-to-date independent information, this study had to primarily consider design bases flooding elevation, historical flooding records, and flood routing results available from FSARs and IPEEEs submitted by licensees. From the 65 sites available, 45 sites were considered to be less vulnerable to potential dam failures while 20 sites were considered to have a higher vulnerability. Of the remaining 20 sites, a qualitative assessment was applied to evaluate sites which could have high, medium, or low impact due to a dam failure (see Table 1). Particular challenges observed are: (i) lack of independent up-to-date assessments of dam breach analysis and subsequent flood elevations at a site, (ii) the extensive use of theoretical upper bounds used to approximate the frequency of extreme events such as severe storms and earthquakes (e.g., events with frequencies of 1 in 10,000 years or less), (iii) the complexity involved in evaluating flood routing at specific watersheds, including estimating dam breach size and time for the corresponding flood wave to impact a site, and (iv) the effectiveness of the flooding protection barriers and site response due to uncertainties in the information above. The scope of this study was preliminary in nature and could greatly benefit from additional short term analysis to evaluate the overall risk at individual sites, since it is recognized that not all dam failures may be sufficiently large to impact a NPP and that significant distances between a site and the impounding structure(s) may attenuate the flood wave and increase the response time available. However it also provided an overview of the generic nature of this issue with a defined subset for further focused analyses.
In the second effort, a generic dam failure rate analysis applicable to a large rockfill dam of modern construction was performed to assess a point estimate and a range that can be supported by available historical data, along the lines of those performed in a subset of IPEEE submittals (ML100780084). Input information included (i) an assessment of the overall US dam population for those with features corresponding to a large rockfill dam, and (ii) a study of U.S.
dam performance information for failure events that may be applicable to this subset of the overall population. The best available databases were used to obtain the total number of dam-years for large dams and documented failures, which also provided insights into limitations and challenges involved in deriving failure rates using this approach. A point estimate calculation produced a value of 2.8 x 10-4/dam-year, providing a further check on the estimate previously used in the industry. Simple sensitivity analysis indicates that significantly lower estimates cannot be reasonably supported by the use of historical data alone. Hence, while limitations in historical data represent a challenge to ascertain a more precise estimate, it is clear that screening this hazard exclusively via this methodology is not justified. Additionally, a Bayesian updating analysis with the subset of dam-years and failures corresponding to rockfill dams was performed using an assumed prior distribution for large dams. This resulted in a posterior distribution with a mean of 2.8 x 10-4/dam-year, a 5th percentile of 1.3 x 10-4/dam-year, and a 95th percentile of 4.8 x 10-4/dam-year (i.e., a narrow distribution around the mean value).
Additionally, a literature review of similar published statistical studies of dam failures corroborated the conclusion that a generic dam failure rate for large dams is in the order of magnitude of 1 in 10,000 dam-years.
From these two efforts, NRR staff has concluded that (i) there is an increase in the estimated frequency of a potential dam failure of an order of magnitude from the additional preliminary analysis performed, (ii) prior estimates used in the industry underestimated dam failure rates, (iii) multiple sites can be affected by the impact of dam failures, and (iv) the overall risk to NPP sites may not have been fully addressed due to inconsistencies in identifying and appropriately addressing significant failure modes for dams.
OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION 5
RECENT EXPERIENCE On April 28, 2006, NRC staff identified a performance deficiency involving the Oconee Nuclear Station (ONS) maintenance activities associated with the Standby Shutdown Facility (SSF) to facilitate installation of temporary electrical power cables. The importance of this finding is that ONS is located immediately downstream from two large dams in Seneca, South Carolina:
Keowee Dam and Jocassee Dam. The SSF contains the only means to shut down all three existing units following a station blackout induced by a potential catastrophic flood, since the site does not have emergency diesel generators (on-site emergency AC power is provided by two hydro-electric generators at the Keowee Dam).
ONS was issued operating licenses in 1973 (Units 1 and 2) and 1974 (Unit 3), prior to the publication of significant regulation (e.g., GDC 2) and guidance on external flooding hazards applicable to most of the industry. The licensing basis of ONS did not originally evaluate the consequences of a failure of the Jocassee Dam in the plant design flooding analysis. Flooding protection for the SSF was later added as a risk assessment enhancement obtained via insights the IPEEE submittal for ONS. However, after interactions with licensee, it was established that the original elevation (
) to which the SSF flood protection was designed for would be exceeded based on more recent studies. These studies indicate that approximately of water could occur at the site in as little as after a breach of Jocassee Dam. In this case, the licensee has indicated that a loss of the switchyard, loss of the emergency power supply (hydro units), loss of the SSF, and the loss of other mitigation equipment would take place (ML082750106). With the loss of the above equipment, the licensee estimates that core damage for all three units at the site would occur in
, followed by containment failure in (ML082750106). Hence, based on the varying plant configurations and the loss of the mitigating equipment listed above, the conditional core damage probability (CCDP) given a dam failure for ONS could be as high as 1. Given that ONS had originally used the NSAC-60 study which incorrectly derived a dam failure rate an order of magnitude lower than the NRR analysis indicates, additional reviews, analysis, and actions are expected to affect the licensee on this issue.
Additionally, an NRC inspection on March 2010 at the Fort Calhoun Station (FCS) identified an apparent violation for failure to maintain adequate procedures for flood protection at the site, as stated in its licensing basis (ML101670034). Since FCS is located in close proximity to the Missouri River, and its base plant elevation (1004 feet mean seal level (MSL)) is not far above the normal river levels, NRR is currently evaluating the flooding licensing basis with respect to severe precipitation events. Current NRC assessments of external flooding vulnerabilities indicates that all normal plant equipment fails when floods reach 1010 MSL, and that essential safety-related components fail between 1010 MSL and 1014 MSL. Review of flooding extrapolation updates performed by USACE for the FCS region indicate an increase in potential elevation for floods with a return period of up to 500 years, not previously considered by the licensee (ML101670034). FCS is also located downstream from several large dams, and its IPEEE submittal states that failure of the larger dam would cause a flood wave that would reach the site in
, which would reach a peak elevation of MSL in
. Based on the increase in estimated flood levels, the use of NSAC-60 dam failure rates, and the recent experience with flood routing analysis in the ONS dam failure studies; a potential for an increase in risk due to this hazard is also expected at the FCS site (attenuated only by the distance to the set of dams located upstream). Furthermore, the original FSAR and IPEEE submittals for Cooper Nuclear Station (CNS) formed the basis for the external flooding analysis performed at FCS. As indicated above, CNS (which is further downstream from FCS) has also used NSAC-60 as a basis and screened this hazard as not credible.
OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION 6
Since additional information is limited for other sites, there is a potential that additional regional flooding studies and improvement in the state-of-art assessments of the impact of dam failures at NPP sites may also indicate an overall change in risk not previously considered in other original studies, applying to more than the facilities identified above.
RECOMENDATION NRCs primary function is to license and regulate the safe use of radioactive materials for civilian purposes to ensure adequate protection of public health and safety and the environment.
Considering the existing regulatory framework, the safety significance of the issue, the risk increase considerations, and the generic implications provided; the recent information and experience with dam-related external flooding vulnerabilities indicates an issue that needs to be properly addressed to support NRCs mission.
Under these considerations, we recommend that you initiate expeditious action to examine the dam-related external flooding issue under your Generic Issue Program. NRR/DE and NRR/DRA will maintain interaction with your staff, as needed, during the resolution process, and initiate appropriate action in accordance with the findings from the final resolution of this generic issue.
If you have any questions, your staff may contact George Wilson (301-415-1711), Lois James (301-415-3306) or Meena Khanna (301-415-2150).
REFERENCES Baxter, Dave, Duke Energy Carolinas, LLC, letter to Joseph G. Giiter, U.S. Nuclear Regulatory Commission, September 26, 2008, ADAMS Accession No. ML082750106.
Nuclear Safety Analysis Center/Electric Power Research Institute, NSAC-60 Oconee PRA: A Probabilistic Risk Assessment of Oconee Unit 3, Palo Alto, CA, 1984.
US Bureau of Reclamation, Dam Safety Risk Analysis Best Practices Training Manual, Version 2.0, U.S. Department of the Interior, Technical Service Center, Denver, CO, 2010.
U.S. Code of Federal Regulations, Criterion 2--Design bases for protection against natural phenomena, Part 50, Appendix A, Chapter I, Title 10, Energy.
U.S. Nuclear Regulatory Commission, Design Basis Floods For Nuclear Power Plants, Regulatory Guide 1.59, Rev. 2, 1977, Agencywide Document Access and Management System (ADAMS) Accession No. ML003740388.
U.S. Nuclear Regulatory Commission, "Evaluation of External Hazards to Nuclear Power Plants in the United States," NUREG/CR-5042, Lawrence Livermore National Laboratory, December 1987, ADAMS Accession No. ML062260222.
U.S. Nuclear Regulatory Commission, Probable Maximum Flood (PMF) on Streams and Rivers, NUREG-0800, Standard Review Plan, Chapter 2, Section 2.4.3, Rev. 4, 2007, ADAMS Accession No. ML070730405.
OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION 7
U.S. Nuclear Regulatory Commission, Floods, NUREG-0800, Standard Review Plan, Chapter 2, Section 2.4.2, Rev. 4, 2007, ADAMS Accession No. ML070100647.
U.S. Nuclear Regulatory Commission, Potential Dam Failures, NUREG-0800, Standard Review Plan, Chapter 2, Section 2.4.4, Rev. 3, 2007, ADAMS Accession No. ML070730417.
U.S. Nuclear Regulatory Commission, Generic Failure Rate Evaluation for Jocassee Dam, March 15, 2010, ADAMS Accession No. ML100780084.
U.S. Nuclear Regulatory Commission, EA-10-084, Fort Calhoun Station, Failure to Maintain External Flooding Procedures, May 27 2010, ADAMS Accession No. ML101670034.
OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION 8
Table 1. Qualitative preliminary assessment of dam hazard vulnerabilities for operating NPPs Site Name State Area Body of Water Screening Arkansas Nuclear AR Stream Arkansas River HIGH Fort Calhoun NE Stream Missouri River HIGH McGuire NC Stream/ Lake Catawba River/ Lake Norman HIGH Oconee SC Stream/ Lake Keowee River/ Keowee Lake HIGH South Texas TX Lake Cooling Pond HIGH Watts Bar TN Stream Tennessee River HIGH Beaver Valley PA Stream Ohio River MEDIUM Browns Ferry AL Stream Tennessee River MEDIUM Columbia WA Stream Columbia River MEDIUM Cooper NE Stream Missouri River MEDIUM Peach Bottom PA Stream Susquehanna River MEDIUM H.B. Robinson SC Lake Lake Robinson MEDIUM Sequoyah TN Stream/ Lake Tennessee River/
Chickamauga Lake MEDIUM Three Mile Island PA Stream Susquehanna River MEDIUM Vermont Yankee VT Stream Connecticut River MEDIUM Hope Creek/Salem DE Stream Delaware River LOW Indian Point NY Stream Hudson River LOW Prairie Island MN Stream Mississippi River LOW Surry VA Stream James River LOW Waterford LA Stream Mississippi River LOW
OFFICIAL USE ONLY - SECURITY-RELATED INFORMATION 9
Table 1. Qualitative preliminary assessment of dam hazard vulnerabilities for operating NPPs Site Name State Area Body of Water Screening Arkansas Nuclear AR Stream Arkansas River HIGH Fort Calhoun NE Stream Missouri River HIGH McGuire NC Stream/ Lake Catawba River/ Lake Norman HIGH Oconee SC Stream/ Lake Keowee River/ Keowee Lake HIGH South Texas TX Lake Cooling Pond HIGH Watts Bar TN Stream Tennessee River HIGH Beaver Valley PA Stream Ohio River MEDIUM Browns Ferry AL Stream Tennessee River MEDIUM Columbia WA Stream Columbia River MEDIUM Cooper NE Stream Missouri River MEDIUM Peach Bottom PA Stream Susquehanna River MEDIUM H.B. Robinson SC Lake Lake Robinson MEDIUM Sequoyah TN Stream/ Lake Tennessee River/
Chickamauga Lake MEDIUM Three Mile Island PA Stream Susquehanna River MEDIUM Vermont Yankee VT Stream Connecticut River MEDIUM Hope Creek/Salem DE Stream Delaware River LOW Indian Point NY Stream Hudson River LOW Prairie Island MN Stream Mississippi River LOW Surry VA Stream James River LOW Waterford LA Stream Mississippi River LOW Accession Number: ML101900305 OFFICE NRR/DRA/APOB NRR/DE/EMCB NRR/DE/EEEB NRR/DRA/APOB NAME FFerrante MKhanna GWilson LJames DATE 7/9/2010 7/15/2010 7/12/2010 7/19/2010 OFFICIAL RECORD COPY