ML13056A106
| ML13056A106 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 02/06/2013 |
| From: | Cunningham M NRC/NRR/DRA |
| To: | Leeds E Office of Nuclear Reactor Regulation |
| References | |
| FOIA/PA-2012-0325 | |
| Download: ML13056A106 (8) | |
Text
MEMORANDUM TO: Eric Leeds, Director Office of Nuclear Reactor Regulation THRU: John A. Grobe, Associate Director for Engineering and Safety Systems Office of Nuclear Reactor Regulation FROM: Mark A. Cunningham, Director Division of Risk Assessment Office of Nuclear Reactor Regulation
SUBJECT:
OCONEE FLOOD PROTECTION AND THE JOCASSEE DAM HAZARD JUSTIFICATION FOR CONTINUED OPERATION DECEMBER 2010, LIC-504 ASSESSMENT, INTEGRATED RISK-INFORMED DECISION MAKING PROCESS FOR EMERGENT ISSUES The purpose of this memorandum is to document the decision making process used to determine the Justification for Continued Operation of the Oconee Nuclear Power Station for a period of two years to resolve issues related to their Safe Shutdown Facility (SSF) and potential vulnerabilities due to external floods.
The Office of Nuclear Reactor Regulation issued Office Instruction LIC-504, "Integrated Risk-Informed Decision Making Process for Emergent Issues," Revision 2, on February 12, 2007.
The decision making process described in this document was used to formulate the basis for the staff's conclusions. The purpose of this memorandum is to document the integrated risk-informed assessment of the options considered. The LIC-504 assessment for this decision is provided in Enclosure 1.
Enclosures:
- 1. LIC-504 Assessment on the Justification for Continued Operation of the Oconee Nuclear Power Station
Oconee Flood Protection and the Jocassee Dam Hazard Justification for Continued Operation December 2010 Office Instruction LIC-504 Integrated Risk-Informed Decision-Making Process for Emergent Issues Date LIC-504 Initiated: October 21, 2008 Date of Report: February 2, 2009 [ x] draft []final Summary Description of Issue:
It has come to the attention of the agency that the Oconee Nuclear Station does not have adequate protection and defense-in-depth to meet the requirements of General Design Criteria 2 "Design Bases for Protection against Natural Phenomena," such as a flood of the Jocassee Dam. Specifically, available information regarding postulated flood levels at the Standby Shutdown Facility (SSF) of the licensee suggests that the capability of the station to maintain needed residual heat removal functions would be compromised. The NRC has concluded that an immediate shutdown of the Oconee units is not warranted because the Jocassee Dam is not likely to suffer a catastrophic failure during the next 2 years and accident sequence progression timelines are on the order of days. The information and analysis to support this conclusion is documented using Office Instruction LIC-504 "Integrated Risk-Informed Decision-Making Process for Emergent Issues."
Decision Authority Name/Title Organization Telephone Eric Leeds Director NRR 301-415-1270 Evaluation Team: Name/Title Organization Telephone Management Lead Mark Cunningham Director NRR/DRA 301-415-2884 Technical Lead Melanie Galloway Deputy Director NRR/DRA 301-415-2884 DRA Technical Integrator/ Melanie Galloway Deputy Director NRR/DRA 301-415-2884 Team Facilitator Team Members Mike Franovich Branch Chief NRR/DRA/APOB 301-415-1185 Jeff Circle Senior Risk & Reliability Analyst NRR/DRA/APOB 301-415-1152 James Vail Risk & Reliability Analyst NRR/DRA/APOB 301-415-2005 Jeff Mitman Senior Risk & Reliability Analyst NRR/DRA/APOB 301-415-2843 Fernando Ferrante Risk & Reliability Analyst NRR/DRA/APOB 301-415-8385 Antonios Zoulis Risk & Reliability Analyst NRR/DRA/APOB 301-415-1209 Communication Team: Name/Title Organization Telephone Communication Lead Melanie Wong Branch Chief NRR/DORL/LPL2-1 301-415-2911 Team Members John Stang Project Manager NRR/DORL/LPL2-1 301-415-1345 ADAMS Accession No.
- 1. PURPOSE The purpose of this assessment is to determine the appropriate regulatory action to resolve issues related to the Oconee Nuclear Station (ONS) Safe Shutdown Facility (SSF) and potential vulnerabilities from external floods.
- 2. BACKGROUND It has come to the attention of the agency that the Oconee Nuclear Station does not have adequate protection and defense-in-depth to meet the requirements of General Design Criteria 2 "Design Bases for Protection against Natural Phenomena," such as a flood of the Jocassee Dam. Specifically, available information regarding postulated flood levels at the Standby Shutdown Facility (SSF) of the licensee suggests that the capability of the station to maintain needed residual heat removal functions would be compromised.
In April of 2006 the Nuclear Regulatory Commission (NRC) concluded that the licensee failed to effectively control maintenance activities associated with removing a fire suppression refill access cover (a passive NRC committed flood protection barrier) in the SSF south wall to facilitate installation of temporary electrical power cables. The staff identified the issue during a periodic risk-informed flood inspection under the NRC's Reactor Oversight Process (ROP).
Using the ROP Significance Determination Process, the staff discovered that the licensee may not have adequately addressed the potential consequences of flood heights predicted at the Oconee site based on the 1992 Duke Hydro/FERC Inundation Study. In 2007, the staff conducted an independent review of the Jocassee Dam failure frequency that Duke had used in the Oconee Probabilistic Risk Assessment (PRA). From that review, the staff concluded that a higher frequency estimate of Jocassee Dam failure was more appropriate and that the licensee's estimate was not adequately supported by operating experience and actual performance data of similar rock-filled dam structures. The staff also concluded that Duke had an inadequate basis for applying a reduction factor to further lower the risk estimate (i.e., the assumption that only 20 percent of floods would exceed the existing 5 foot walls).
Degree of conservatism in the regulatory analysis of this issue In evaluating the Jocassee Dam Failure frequency, there is a large variation of dam types and designs that adds uncertainty to the calculation of a dam-specific failure frequency. An analyst can derive very optimistic values as well as very conservative values depending on the desired outcome. In addition, there is a large degree of uncertainty and variation in the calculation and determination of the flood breach size. The flood breach size determines the speed and magnitude of the flooding down stream of the dam. Furthermore, the staff also understands the complexity of determining an accurate flood inundation study' to determine the height of the water at the SSF. Therefore, addressing the issue from a risk-based approach would not be appropriate or an acceptable method under NRC guides and standards.
The Atomic Energy Act Section 182a (1) provides the primary statutory standard relating to the Commission's mandate to ensure the safe operation of nuclear power plants. That section requires the Commission to ensure that "the utilization or production of special nuclear material will ... provide adequate protection to the health and safety of the public," 42 U.S.C. Sec. 2232(a). Based on this standard, and supported by the Atomic Safety and Licensing Appeal Board case of 1973 (2), there is a presumption by the Commission of adequate protection of public health and safety when a licensee is in compliance with the regulations and other license requirements (3). From this deterministic aspect, the staff has concluded that the Oconee
Nuclear Power Station is not in compliance with the regulations and does not have adequate protection to mitigate an external flood. From this aspect, it would warrant the immediate shutdown of the facility to resolve this lapse and assure adequate protection is met.
However, the staff understands the non-conservatisms and conservatisms of the above methods and has determined a blended approach to safety would be beneficial to both the public and the licensee in question.
- 3. EVALUATION AND ASSESSMENT OF REGULATORY OPTIONS CONSIDERED BY THE STAFF AGAINST THE FIVE KEY PRINCIPLES OF RISK INFORMED REGULATION The staff has determined three possible options related to this issue:
Option Description of Regulatory Option 1 Base Case - No change to existing SSF and continued operation.
2 Continued operation of the plant for a period of 2 years until flooding issues to the SSF are resolved.
3 Issue orders for immediate plant shutdown until flooding issues to the SSF are resolved.
Using the five key principles of risk informed regulation (4), the staff will determine the best strategy to address these issues without undue burden to the licensee and without jeopardizing the health and safety of the people and the environment.
3.1 Option 1 - Base Case: Oconee Nuclear Station will continue to operate as licensed with no modifications to the current SSF.
3.1.1 Compliance with Regulations General Design Criterion 2 "Design bases for protection against natural phenomena," states:
Structures, systems, and components important to safety shall be designed to withstand the effects of naturalphenomena such as earthquakes,tornadoes, hurricanes,floods, tsunami, and seiches without loss of capability to perform their safety functions. The design bases for these structures,systems, and components shall reflect: (1) Appropriate considerationof the most severe of the naturalphenomena that have been historically reportedfor the site and surroundingarea, with sufficient margin for the limited accuracy, quantity, and period of time in which the historicaldata have been accumulated, (2) appropriatecombinations of the effects of normal and accident conditions with the effects of the naturalphenomena and (3) the importance of the safety functions to be performed.
Under current licensing conditions, ONS does not meet the general design criteria for a worst case flood that can be postulated from the surrounding area. In addition, if adequate protection is not met by the licensee, the licensee is obligated under 10 CFR 50.109 "Backfitting" to resolve this issue without requiring a regulatory analysis be performed.
3.1.2 Defense-in-Depth The issue related to the SSF and external floods results in an increased vulnerability to failure of multiple components and degrades multiple barriers. The flood will render emergency core cooling systems inoperable due to the loss of onsite and offsite power as well as flooding and
will result in core damage and finally containment failure. Without a SSF to mitigate the external flood there is not defense-in-depth to prevent core damage and a large release to the environment.
3.1.3 Safety Margins The safety margins would be unchanged under this option.
3.1.4 Risk Assessment A Bayesian analysis of dam failures using the National Performance of Dams Program Database developed and maintained by Stanford University in conjunction with the Army Core of Engineers Dam Database shows most dam failure frequencies are on the order of 1.OE-04 failures per dam year:
Dam-Failures years apost bpost Mean 5% 50% 95%
1 All Arch Dams 2 9101 2.5 12134 2.060E-04 4.720E-05 1.793E-04 4,562E-04 2 All Buttress Dams 2 9819 2.5 12852 1.945E-04 4.456E-05 1.693E-04 4.307E-04 3 All Concrete Dams 10 110227 10.5 113260 9.271E-05 5.117E-05 8.978E-05 1.442E-04 4 All Earth Dams 366 2233693 366.5 2236726 1.639E-04 1.500E-04 1.637E-04 1.782E-04 5 All Gravity Dams 28 122798 28.5 125831 2.265E-04 1.615E-04 2.239E-04 3.005E-04 6 All Masonry Dams 5 21692 5.5 24725 2.224E-04 9.251E-05 2.091E-04 3.979E-04 7 All Multi-Arch Dams 0 240 0.5 3273 1.528E-04 6.006E-07 6.949E-05 5.868E-04 8 All Rockfill Dams 7 55872 7.5 58905 1.273E-04 6,163E-05 1.217E-04 2.122E-04 9 All Stone Dams 2 11365 2.5 14398 1.736E-04 3.978E-05 1.511E-04 3.844E-04 10 All Timber Crib Dams 3 6536 3.5 9569 3.658E-04 1,132E-04 3.316E-04 7.350E-04 T Total 425 2581343 0.5 3033 1.648E-04 6.482E-07 7.499E-05 6.332E-04 Further review of dams above 50 ft provides similar results:
Dam-Failures years apost bpost Mean 5% 50% 95%
1 Buttress Dams Over 50 Feet High 0 1876 2.4026 11971 2.007E-04 4.410E-05 1.736E-04 4.497E-04 2 Arch Dams Over 50 Feet High 2 5667 4.4026 15762 2.793E-04 1.01 8E-04 2585E-04 5.280E-04 3 Concrete Dams Over 50 Feet High 0 19215 2.4026 29310 8.197E-05 1.801E-05 7.092E-05 1.837E-04 4 Earth Dams Over 50 Feet High 56 144810 58.4026 154905 3.770E-04 2.997E-04 3.749E-04 4.617E-04 5 Gravity Dams Over 50 Feet High 7 19542 9.4026 29637 3.173E-04 1.683E-04 3.061E-04 5.044E-04 6 Masonry Dams Over5O Feet High 0 1987 2.4026 12082 1.989E-04 4.370E-05 1.721E-04 4.456E-04 7 Multi-Arch Dams Over 50 Feet High 0 77 2.4026 10172 2.362E-04 5.190E-05 2.044E-04 5.293E-04 8 Rockfill Dams Over 50 feet high 4 19900 6.4026 29995 2.135E-04 9.603E-05 2.025E-04 3.684E-04 T Total 69 213074 2.4026 10095 2.380E-04 5.230E-05 2.059E-04 5.333E-04 Given this analysis and the lack of redundant safety equipment to mitigate the external flood, the risk to core damage from an external event is above 1.OE-05 which is potentially risk significant.
Accident sequence progression timelines for the subsequent containment failure would be in order of days. This would give ONS adequate time to implement the site Emergency Action Plan to mitigate the impact on-the people in the surrounding vicinity. Furthermore, this additional time would allow recovery of flooded roadways after flood recession and the potential
for alternate water sources or equipment to mitigate the accident. In addition, ONS has committed to augment their Severe Accident Management Guidelines (SAMGs) by February 2009 to include potential loss of the SSF due to external floods.
3.1.5 Performance Measurement ONS continually monitors the dam as follows:
- Duke has a diverse program of constant surveillance of the performance of the dam by means of on-site cameras and also offsite monitoring of the observed data from its headquarters office.
- Duke is performing biweekly inspection and monitoring of the condition of the dam, as required by FERC.
- FERC personnel inspect the dam annually, and the 2007 inspection did not identify any adverse trends in the condition of the dam.
The monitoring helps in determining the health of the dam and in preventing unanticipated failures of the dam.
3.2 Option 2 - Continued operation of the plant for a period of 2 years until flooding issues to the SSF are resolved.
3.2.1 Compliance with Regulations Resolving the SSF issues would put the site back in compliance with General Design Criterion 2 "Design bases for protection against natural phenomena," and eliminate the vulnerability from external flooding.
3.2.2 Defense-in-Depth Resolving the SSF issues would provide a barrier to core damage and large release that does not currently exist. In addition, present level of the Jocassee Lake is about 23 feet below the lake's full pond level due drought conditions. This temporarily reduces the loading that is imposed on the dam. These levels can change but there is a window of opportunity to provide some additional time until the SSF issues a permanently addressed.
3.2.3 Safety Margins Given the limited time of this option, the safety margin is increased and a permanent modification to the SSF would be installed.
3.2.4 Risk Assessment The risk to the site is contained due to the limited exposure time and the continued monitoring of the dam. However, allowing the plant to continue to operate under these conditions does not provide a reasonable assurance that the health and safety of the public would be protected.
3.2.5 Performance Measurement
The assessment of performance measurement for Option 1 in Section 3.1.5 is unchanged for Option 2.
3.3 Option 3 - Issue orders for immediate plant shutdown until flooding issues to the SSF are resolved.
3.3.1 Compliance with Regulations Resolving the SSF issues would put the.site back in compliance with General Design Criterion 2 "Design bases for protection against natural phenomena," and eliminate the vulnerability from external flooding.
3.3.2 Defense-in-Depth Resolving the SSF issues would provide a barrier to core damage and large release that does not currently exist.
3.3.3 Safety Margins The plant would be in cold shutdown should an accident occur that would render the SSF inoperable thus increasing the time to core damage and containment failure substantially.
3.3.4 Risk Assessment The risk to the public is minimized given the plant would be in cold shutdown. However, the uncertainty and conservatisms in the analysis do not justify and immediate shutdown of the facitlity.
3.3.5 Performance Measurement The assessment of performance measurement for Option 1 in Section 3.1.5 is unchanged for Option 3.
- 4. CONCLUSIONS Based on a review of the current condition of the Jocassee Dam, the NRC staff believes that it is unlikely to suffer a catastrophic failure during the next two years for the following reasons:
The initiating event frequency, supported by ongoing FERC and Duke monitoring and inspection of the dam, is relatively low.
" The initiating event frequency for a random failure is on the order of 1 E-4/yr and for a large seismic event is 1 E-5/yr.
" The present level of the Jocassee Lake is about 23 feet below the lake's full pond level due to the drought conditions. This reduces the loading that is imposed on the dam.
" Duke has a diverse program of constant surveillance of the performance of the dam by means of on-site cameras and also offsite monitoring of the observed data from its headquarters office.
" Duke is performing biweekly inspection and monitoring of the condition of the dam, as required by FERC.
- FERC personnel inspect the dam annually, and the 2007 inspection did not identify any adverse trends in the condition of the dam.
Accident sequence progression timelines to containment breach and/or fuel pool boil off at Oconee are on the order of days, allowing time to implement onsite mitigating actions and offsite emergency response actions.
" The staff assumes that recovery of flooded roadways after floodwater recession will allow for providing an alternate source of water for containment and spent fuel pool cooling.
" Duke has committed to augmenting its Severe Accident Management Guidelines (SAMGs) in February 2009 to include potential loss of the SSF due to external flood.
" The current drought level of the lake provides additional time within which any needed actions could be taken.
Therefore, based on the above information and review of all options, the staff has concluded that Option 2 is the best option to ensure both the safety of the public and to allow the licensee a period of two years to permanently resolve the issue without undue burden or resources.
REFERENCES
- 1. The Atomic Energy Act of 1954. Pub. L. 83 - 703, 68 Stat. 919 (1954).
- 2. Maine Yankee Atomic Power Company (Maine Yankee Nuclear Power Plant, Unit 2). ALAB-161, 6 AEC 1003. US Atomic Energy Commission: Washington, DC. 1973.
- 3. NUREG-0800, "Standard Review Plan for the Review of Safety Analyses for Nuclear Power Plants, Section 19.2 Appendix D, Use of Risk Information in Review of Non-risk-informed License Amendment Requests," June 2007.
- 4. U.S. Nuclear Regulatory Commission, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"
Regulatory Guide 1.174, Revision 1, November 2002.