ML13066A319

From kanterella
Jump to navigation Jump to search
Email from J. Mitman, NRR to M. Pohida, NRO on Dam Failure Frequency
ML13066A319
Person / Time
Site: Oconee  Duke Energy icon.png
Issue date: 02/16/2010
From: Jeffrey Mitman
Office of Nuclear Reactor Regulation
To: Marie Pohida
Office of New Reactors
References
FOIA/PA-2012-0325
Download: ML13066A319 (7)


Text

Mitman, Jeffrey From: Mitman, Jeffrey! -

Sent: Tuesday, FebrUary 16, 2010 6:09 PM To: Pohida, Marie

Subject:

Dam failure frequincy - SENSITIVE INFORMATION - NOT FOR PUBLIC DISCLOSURE Marie, I was reviewing old correspondence and came across this email thread. It may supply some background information that is of interest to you on STP.

Jeff From: Mitman, Jeffrey Sent: Wednesday, December 16, 2009 8:43 PM To: Galloway, Melanie Cc: James, Lois; Ferrante, Fernando

Subject:

RE: Oconee Melanie, below is my complete response to your questions. I've parsed through you email and addressed each question/concern as it occurs in the order that it occurred.

1. Concern: Dave has stated that the PMP event is a 10-5 event and that overtopping can't occur (Duke and DE views). DE then has raised the question as to whether overtopping should be considered probabilistically as an initiating event.

Response: Per Ken See (this is based on a conversation that I had with him several months ago), the frequency of a PMP is undefined or unclear. The technical community has not been able to hand a frequency on it. It may ranges between 1 in 10,000 to 1 in 1 million years. In any case the predicted PMP has been exceeded several times in the past several decades for several areas in the Northeast US.

This is corroborated by the Book "Risk and Uncertainty in Dam Safety" D.N.D Hartford et al, 2004 which states: "The Joint Report of Utah State University and Bureau of Reclamation (1999) contains a guide for various limits depending on the kind of data used for analysis ... with an interval of 40,000 to 100,000 years as the limit for the combination of all of the above. Although the limits are characterized as 'credible' there is no scientific (i.e. mathematical) theory supporting the claim?"

The bottom line is that DE has no basis for claiming the PMP is a 1 E-5 per year event.

2. Concern: DE then has raised the question as to whether overtopping should be considered probabilistically as an initiating event.

Response: DRA has never claimed and does not now claim that overtopping needs to be addressed probabilistically. Yes, one of the four failure events that make up our 2E-4 per year failure frequency is an overtopping event. Our claim is that the failure frequency of a dam like Jocassee from all hazards is to the best of our judgment based on the available data a credible event in the range of 2E-4 per year.

If for some reason we decide that overtopping of Jocassee is not a credible event, the failure frequency is still approximately 2E-4 per year.

In my opinion the reason that overtopping should not be ruled out is not because it has any substantial effect on the dam failure frequency, it does not. It needs to be considered because if it cannot be ruled out and if it does occur, it will substantially increase the flood depth at ONS and specifically at the SSF.

In other words, what flood depth does the ONS need to be protected to? In the 2D analysis performed to date the maximum flood depth calculated at the SSF is 19.5 feet. During an overtopping event there will be at least 10% more volume in the Jocassee Reservoir (due to the increased reservoir elevation of

> 1125 ft.). It may also mean that the failure of the Jocassee Dam may occur more rapidly, Both of these may have the effect of more water at the ONS more quickly.

The bottom line is what flood depth does the ONS needs to be protected against.

3. Concern: They think Duke will try to make the case that Oconee dam failure is a 10-6 event and that part of that reason is because overtopping is not credible and therefore not part of the probabilistic consideration.

Response: Neither DRA, RES nor Duke has ever claimed that a sunny day failure of Jocassee is a.not a credible event. In fact, Duke stated in a phone call on January 27, 2009: "The failure of the Jocassee Dam is not an incredible event."

This topic is what I want to discuss. Specifically, the following starting points are what we need to understand to develop DRA input further on adequate protection. (Remember from Geary Mizuno that an adequate protection issue needs to include a significant risk and NRR agrees that a 10-4 event with a CDF of 1 is an adequate protection issue so the agency needs to either (1) clearly demonstrate that we are at 10-4 or (2) demonstrate that even is overtopping (or other initiating events) is not credible that the resulting probability of flooding is still of significant enough risk to put it in adequate protection space.)

1. Verify (with Ken See or the RG 1.59 workshop notes) the frequency of PMP events--can this be narrowed to the SE US?

Response: I have not yet verified my recollections with Ken regarding the frequency of the PMP (see above for further discussion). To the best of my knowledge there is no basis for hanging a frequency on a PMP. Thus there is not basis for narrowing a PMP frequency for any region in the US.

2. Deterministically PMPs need to be considered per our regs. So even if a PMP event is a 10-6 event, a licensee still needs to consider it. True or false?

Response: The deterministic requirement comes from GDC-2 which requires licensees to address hazards from naturally occurring phenomenon. The industry recognizes that a large storm is a naturally occurring phenomenon.

The above answers where the deterministic requirement comes from. To go further, RG 1.59, Design Basis Floods for NPPs," supplies guidance on how to characterize a large storm. One method for estimating the PMF is the PMP and this is described in RG 1.59 Appendix B.

ANSI/ANS 2.8, "Determining design Basis Flooding at Power Reactor Sites." This standard does not supply guidance on performing a flood PRA. It does recommend a target annual exceedance probability of less than 1 E-6 for selecting events that comprise the design basis floods. It does address dam failures ANSI/ANS 2.12, "Guidelines for Combining Natural and External Man-made Hazards at Power Reactor Sites" requires that designers address combination of hazards whose combination exceeds 1E-6 per year. This standard also says: "As existing standards d not cover all of the individual external man-made hazards, this standard can also serve as a reference which a designer can use in examining a specific site for protection against external man-made hazards."

The above are all deterministic requirement and/or methods. In additions, ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency PRA for NPP Applications" also supplies some useful guidance. It allows (in Table 2-2.14(c) Supporting Requirements for HLR-IE-C on page 47) the analyst to screen out initiating events with 1) a frequency less than 1 E-7 per year, or 2) a frequency less than 1E-6 ifthere are at least two core damage mitigating systems.

3. How does any dependency between a PMP event and overtopping come into play in determining probability of overtopping?

2

Response: To the best of my knowledge there are two ways Jocassee can be overtopped: Over-pumping and a PMP.

According to Duke and DE, a PMP event will not cause overtopping. They make this argument deterministically. I am amenable to a valid deterministic argument; I have not yet seen one. I have also not seen any analysis that defends the premise that over-pumping to the point of overtopping cannot occur.

As discussed above, there is no basis in the literature to put a frequency on a PMP event.

I'm not sure that this addresses all of your questions.

4. How can overtopping be eliminated from consideration as a source of dam failure?

Response: A well reasoned deterministic analysis using 1) the latest model of the watershed above Jocassee, 2) reasonable dam operator actions (including addressing training, procedures and past operating experience), and 3) reasonable availability and reliability of the spillway gates and the hydro units, that shows that water level does not exceed 1125 ft. (MSL).

Does the probability of PMP plus the probability of overtopping matter here (see question 3)?

Response: If they can make a good deterministic argument, they don't have to make a probabilistic one. Even if they can rule out overtopping, it has no bearing on the adequate protection issue. The remaining frequency is too high to rule that there is no adequate protection issue. It should be noted that, if we allow this reasoning we have just started to parse the initiating event frequency probabilistically, something that we have told Duke repeatedly they cannot due with this deterministic issue.

As stated above, my main concern with ruling out overtopping is that not what it does to the initiating event frequency or the adequate protection argument. Instead, it is: What is the flood height that the ONS needs to be protected against? I believe that a PMP leading to overtopping of Jocassee will lead to a significantly higher flood height at ONS and the SSF.

5. Does the fact that a PMP event gets to within 1-2 feet of the top of the dam come into play in our view that deterministically we can't say overtopping is incredible?

Response: Based on my conversations with Ken See, I believe that if the predicted flood height is within 1 foot of the Jocassee Dam's crest, the uncertainty in the model of the Jocassee headwaters and in the modeling techniques brings into question whether the dam will overtop. At 2 feet below the crest I'm comfortable.

There is one other concern that you raised previously. The Jocassee Dam has never been filled above 1110 ft. Thus if a PMP raised the water level above 1110 feet (even if it does not overtop the dam), this would stress the Jocassee Dam in potentially new ways or to higher level then every before. It would be reasonable to treat a PMP that cause reservoir levels to increase above the normal operating limit (1110 feet) but below overtopping (1125 feet) using a failure frequency of an infant structure. I have not seen a failure frequency for such a failure. This type of failure occurred at the Gouhou Dam in China in 1993.

That is, how does uncertainty in the calculations come into play? Or said yet another way, if the licensee's and Rex's PMP calculations showed the reservoir level raising only to say 1115', would we be able to agree that overtopping is not credible?

Response: As discussed above with a credible analysis showing that the peak stage elevation above the Jocassee at 1115, I don't believe that there is enough uncertainty to warrant challenging the assumption that Jocassee will not overtop.

3

6. If overtopping is not credible for Jocassee, how does that affect the initiating event frequency?

Response: As discussed above, eliminating overtopping from consideration does not substantially decrease the event frequency.

Would we still be in adequate protection space? (See parenthetical before list above.)

Response: Yes, in my opinion we still have a frequency in the 2E-4 range which is the range we were in when we made the initial argument that Duke had not demonstrated adequate protection. In fact we have a better substantiated frequency, as we have effectively had a peer review by RES.

Etc. What other issues do you all think need to be discussed?

Response: DE has initiated a revision to the "Adequate Protection Backfit Documented Evaluation" which I authored. The only substantial change that they are attempting to make is to use this document to substantiate the removal of overtopping and seismic failure from the failure modes of interest. If it can be shown that these issues are not a concern, this is not the document to make this argument. We should discuss how to proceed with this document review.

DE is anxious to get this issue addressed and move forward and we will do our part to support them. I request that you not engage DE folks individually on these issues but assure them that we will get back to them after we have considered the probabilistic aspects involved. Knowing that there is a Jan. deadline (ambitious but trying to be reached none the same), we will need to move expeditiously. As such, I am also trying to schedule a meeting with Mark for the afternoon of this day.

It should be noted that Fernando has helped me significantly with these responses.

Jeff From: Mitman, Jeffrey Sent: Wednesday, December 16, 2009 7:24 PM To: Galloway, Melanie Cc: James, Lois

Subject:

RE: Oconee I

1) The four events are our number of events, not Duke's. To the best of my knowledge Duke has never given us what they think is the correct number of events or the right frequency. If you recall the phone call APOB had with Duke in January 2009, Duke refused to answer this question. Instead, they claimed that a single initiating event frequency based on failure data was too conservative.
2) Jim, must have miss-remembered. The data that APOB believes is as stated in my original email.
3) As I will layout in my response to your directions, events with frequencies below 1E-7 do not have to be designed for. Between 1 E-6 and 1 E-7 is a gray area. Events above 1E-6 must clearly be designed against.

My recollection is that G. Mizuno indicated that previously the Commissioners attempted to place a probabilistic value on adequate protection, but they were unsuccessful. Thus, AP remains undefined probabilistically and deterministically.

Jeff From: Galloway, Melanie Sent: Wednesday, December 16, 2009 4:58 PM To: Mitman, Jeffrey 4

Cc: James, Lois

Subject:

RE: Oconee Thanks, Jeff. I appreciate what you have outlined below.

Couple followups: 1. Is the 4 our number or Duke's? I think ours, right?

2. Jim told me yesterday that overtopping was about half of the initiating event frequency. That doesn't seem to coincide with what you have below.
3. The below regulatory concern number (less than 10-7) is lower than the adequate protection number (arguable what this number is but I would say easily with a CCDF of 10-4, likely justifiable at 10-5, possible at 10-6).

Observation: our strong case for supporting 10-4 will serve us well in the adequate protection case (I haven't read for a while so will have to revisit) and thus in supporting the Order (which by the way I agree with rather than the letter that DE was suggesting so Jack's direction in this regard I think is right on--but this is only valuable if we get it out quickly)

Ifper Lois, Fernando is available, I have no problem with him attending. It may then be best to see if Mary can get us a conference room--I will make the request.

From: Mitman, Jeffrey \*\,j\*,

Sent: Wednesday, Decembr 16, 2009 3:46 PM To: Galloway, Melanie Cc: James, Lois

Subject:

Oconee Melanie, I understand the task and will work to put together detailed answers to your questions by tomorrow.

However, the bottom line is that if we exclude overtopping and seismic failures (which DE believes are not a concern), it changes the numeric frequency only a little. Our -2E-4 per year frequency point estimate (the precise number is 2.9E-4 per dam-year) is calculated as follows:

IEF = Number of events/ number of dam years Where:

number of events =4, between 1940 and 2008 number of dam years = 13,889 years, between 1940 and 2008 Ifwe use Bayesian statistics instead of point estimates, the numbers change a little. But more significantly Bayes tells us the uncertainty in our estimate. The Bayesian results are (based on data from 1900 to 2008):

5th = 1.4E-4 per dam-year median = 2.6E-4 per dam-year mean = 2.7E-4 per dam-year 95th = 4.3E-4 per dam-year Aresult with this little uncertainty tells us that the statistics are good. As a point of comparison, in PRAs we often see results with +/-an order of magnitude.

One of the four failure events used in the calculation is an overtopping event, none are seismically induced. Ifwe recalculate using 3 events instead of 4 the answer is: 2.2E-4 per dam-year. Ifwe eliminate all of the failures, which is what many non-PRA engineers tend to want to do because the precise event that did occur could not happen precisely 5

that way at Jocassee (or some other dam of interest), then using simple Bayesian methods we must assume one half of one failure in the next operating year. This gives the following calculate value:

IEF = 0.5 failures / (13,889 + 1) dam-years

= 3.6E-5 per dam-year Even though this calculation does not yield a frequency that is below regulatory concern (it is still significantly greater than 1E-6 per year) it is wrong! It ignores all of the available information. We know that dams fail and this calculation assumes that there have been no past failures that are applicable to Jocassee. There is no reason to believe that Jocassee is a perfect dam.

We (APOB) have tried to analyze the data in a way that gets a lower number, RES has also looked hard at this number. If Duke had an easy way to calculate this number so that it was lower than regulatory concern they would have shown us our error. There simply is no way to take the available data and get numbers significantly less than what we have caluculated.

I would like to invite Fernando to our meeting tomorrow. He has done a lot of the hard looking at the data and the failures in the data and will thus add significantly to our discussions.

Jeff When: Thursday, December 17, 2009 8:30 AM-9:30 AM (GMT-05:00) Eastern Time (US & Canada).

Where: 010E4 Note: The GMT offset above does not reflect daylight saving time adjustments.

I attended a meeting yesterday in Jack's office along with Dave Skeen, Allen Howe, Meena and George to discuss path forward with Duke on Oconee flooding. Bottom line is that Jack wants an Order to them sent by Jan. 31 which defines their committed dates to us so that the issue would be part of their design basis and will prevent issue resolution from extending well into the future.

To support this, DE will need DRA's assistance in completing the adequate protection documentation to support the Order. In discussions with DE folks after the above meeting, DE indicated a need to better understand probability and adequate protection. Dave has stated that the PMP event is a 10-5 event and that overtopping can't occur (Duke and DE views). DE then has raised the question as to whether overtopping should be considered probabilistically as an initiating event. They think Duke will try to make the case that Oconee dam failure is a 10-6 event and that part of that reason is because overtopping is not credible and therefore not part of the probabilistic consideration.

This topic is what I want to discuss. Specifically, the following starting points are what we need to understand to develop DRA input further on adequate protection. (Remember from Geary Mizuno that an adequate protection issue needs to include a significant risk and NRR agrees that a 10-4 event with a CDF of 1 is an adequate protection issue so the agency needs to either (1) clearly demonstrate that we are at 10-4 or (2) demonstrate that even is overtopping (or other initiating events) is not credible that the resulting probability of flooding is still of significant enough risk to put it in adequate protection space.)

1. Verify (with Ken See or the RG 1.59 workshop notes) the frequency of PMP events--can this be narrowed to the SE US?
2. Deterministically PMPs need to be considered per our regs. So even if a PMP event is a 10-6 event, a licensee still needs to consider it. True or false?

6

3. How does any dependency between a PMP event and overtopping come into play in determining probability of overtopping?
4. How can overtopping be eliminated from consideration as a source of dam failure? Does the probability of PMP plus the probability of overtopping matter here (see question 3)?
5. Does the fact that a PMP event gets to within 1-2 feet of the top of the dam come into play in our view that deterministically we can't say overtopping is incredible? That is, how does uncertainty in the calculations come into play? Or said yet another way, if the licensee's and Rex's PMP calculations showed the reservoir level raising only to say 1115', would we be able to agree that overtopping is not credible?
6. If overtopping is not credible for Jocassee, how does that affect the initiating event frequency? Would we still be in adequate protection space? (See parenthetical before list above.)

Etc. What other issues do you all think need to be discussed?

DE is anxious to get this issue addressed and move forward and we will do our part to support them. I request that you not engage DE folks individually on these issues but assure them that we will get back to them after we have considered the probabilistic aspects involved. Knowing that there is a Jan. deadline (ambitious but trying to be reached none the same), we will need to move expeditiously. As such, I am also trying to schedule a meeting with Mark for the afternoon of this day.

7