ML13106A168

Evaluation of Duke September 26, 2008 Response Related to External Flooding at Oconee - NRC Form 757

ML13106A168
Person / Time
Site:	Oconee
Issue date:	04/27/2009
From:	Giitter J Office of Nuclear Reactor Regulation
To:
References
FOIA/PA-2013-0128
Download: ML13106A168 (19)

Text

NRC FORM 757 U.S. NUCLEAR REGULATORY COMMISSION NRC MD 10.158 (3-S) NON-CONCURRENCE PROCESS TITLE OF DOCUMENT ADAMS ACCESSION NO.

Evaluation af Duke September 26, 2008 Response Related to External Flooding at Oconee ML090570779 SECTION C - TO BE COMPLETED BY DOCUMENT SPONSOR NAME Joseph Glitter TITLE PHONE NO.

Director Division of Operating Reactor Licensing _301-415-1453 ORGANIZATION NRR ACTIONS TAKEN TO ADDRESS NON-CONCURRENCE (This section should be revised, as necessary, to reflect the final outcome of the non-concurrence process, Including a complete discussion of how individual concerns were addressed.)

See the attached response.

- CONTINUED IN SECTION

/

D

ýýGATURE -D0PNO ET IDATE O.UET--'-f TA ,

NO CONCURRING INDIVIDUAL (To be completed by cxume nsnor when process It complete, I.e., after document l signed):

F-]CONCURS* WANTS NcP FORM PUBLIC NON-CONCURS WANTS NCP FORM NON-PUBLIC D WITHDRAWS NON-CONCURRENCE (i.e.. discontinues process)

NRC FORM 757 (3-2009) Use ADAMS Template NRC-006 PReJTEDON RECYCLED PAPER A-'

NRC FORM 757 U.S. NUCLEAR REGULATORY COMMISSION NRC MD 10.A58

)3.2009) NON-CONCURRENCE PROCESS TITLE OF DOCUMENT ADAMS ACCESSION NO.

ML090570779 SECTION B - TO BE COMPLETED BY NON-CONCURRING INDIVIDUAL'S SUPERVISOR (THIS SECTION SHOULD ONLY BE COMPLETED IF SUPERVISOR IS DIFFERENT THAN DOCUMENT SPONSOR.)

NAME Mark Cunningham TITLE PHONE NO.

Director, Division of Risk Assessment 301-415-2884 OGANIZATION N FRR________

COMMENTS FOR THE DOCUMENT SPONSOR TO CONSIDER

-,I HAVE NO COMMENTS 1[HAVE THE FOLLOWING COMMENTS

1. I believe that the main points needing to be made in the document of concern were that:

a.The probabilistic evaluation being performed by the licensee could not demonstrate that dam failure was an "incredible" event, and thus such a failure had to be considered in the licensee's response to the 50.54(f) letter.

b.The licensee, therefore, had to perform deterministic evaluations of flood height. These had to consider a defensible range of key parameters affecting the predicted flood height.

2. In my judgment, other issues noted in Ms. Galloway's non-concurrence statement could be addressed in subsequent correspondence. That is, I judged it more important that this letter be sent to make the points noted above, rather than further delay its issuance to include discussion of these other issues.

3. I have encouraged and will continue to encourage Ms. Galloway to communicate her thoughts on this challenging issue. I believe her thoughts will help NRC to make appropriate and defensible decisions.

CONTINUED IN SECTION D SIGNATURE - DATE SUBMIT THIS PAGE TO DOCUMENT SPONSOR NR OR 57(.2II sIAA S eplt IR-0 PRNEIOIE~LE A NRC FORM 757 (3.2009) Use ADAMS Template NRC-006 PRINTED ON RECYCLED PAPER

Oconee NRC Reply Non-concurrence (9) final.doc 4/6/2009 I am non-concurring on the NRC response letter entitled "Evaluation of Duke Energy Carolinas, LLC (Duke) September 26, 2008, Response to Nuclear Regulatory Commission (NRC) Letter Dated August 15, 2008, Related to External Flooding at Oconee Nuclear Station, Units 1, 2, and 3 (Oconee) (TAC Nos. MD8224, MD8225, and MD8226)"

(ML090570779) for the following two overarching reasons:

(1) We do not require the licensee to perform its inundation analysis in a way that will allow the NRC to conclude with high confidence and sufficient safety margins that adequate protection is provided.

(2) As a result, the letter does not clearly define a success path to timely resolution consistent with the significance of the issue.

The adequate protection issue arises from no defense in depth should the Standby Shutdown Facility (SSF) be inundated-with resultant core damage, containment failure, and damage to fuel in the spent fuel pool-and the lack of safety margin in the licensee's current analyses.

Background and explanation of significance of the issue

• No other potential initiating event at Oconee is as risk significant.

(b)(7)(F)

\ Thus, for a Jocassee Dam failure frequency ofl

' (b)(7)(F)

• For a Jocassee Dam failure, using poten-aI4f1or ttimistic assumptions, Duke estimates that containment will fail approximately (b)(7(F) hours after dam failure without mitigating actions.

" Under the dam break conditions, resultant flood waters and infrastructure damage would affect public evacuation and potentially affect Emergency Operations Facility response capability. Duke has not demonstrated that its radiological emergency plan actions can be adequately implemented under these conditions.

" To reduce risk from other, unrelated initiators, Duke is currently performing several modifications to the Oconee site. As the table below indicates, these modifications will improve risk less than improvements that would mitigate a Jocassee Dam failure.

~,E- E~E~.DU*~E~ j,.j~ ~JIUL. I - ~E.&~.#~JE~E I U ~ mJ *u~i ~ . .~ru 1 of 3

Oconee NRC Reply Non-concurrence (9) final.doc OFICALI~OLY - SECURITY-R'ELATEu IWrFOR,;,ATIC;,1 Risk Reduction from Ongoing Modifications Initiating Decrease Event in CCDF Tornado 6.8E-6 Internal Events 1.4E-5 HELB 1.OE-5 Fire 5.OE-5 Total of above 8.1 E-5 (b)(7)(F)

Explanation of specific reasons for non-concurrence The overarching reasons for my non-concurrence above are supported by the following specific points. The specific points explain why I believe that the letter does not clearly communicate that information needed by NRC to resolve adequate protection of the Oconee units against external flooding.

1. NRC's regulations and guidance documents consistently convey the need to assess the most severe flooding, worst-case occurrences, highest water surface elevation, etc. (Refer to the attached document entitled "Applicable Regulatory Guidance Documents to External Flooding Issues Related to the Oconee Nuclear Site.") This letter does not communicate this information which would guide the licensee's assessment and appropriately define the regulatory criteria that will be used to ensure a sufficient and timely decision is rendered. Duke does not currently plan to perform an analysis which would ensure that such boundaries are considered consistent with NRC's deterministic licensing requirements, use current, state-of-the-art practices (probable maximum precipitation assumptions) nor does the letter as written request Duke to do so.

2. The letter does not take into account the insights gained by NRC technical experts nor insights conveyed to us by another Federal agency (Federal Energy Regulatory Commission) that would allow the licensee to be better positioned to provide the information we need to resolve this adequate protection issue. (Refer to the draft memo, "Transmittal of NRO Staff Technical Evaluation of Duke Power Company's Assessment of Postulated Jocassee Dam Failure Impacts on Oconee Nuclear Station" (ML090570570) for documentation of insights.) I have attached an e-mail dated March 11, 2009, and include excerpts from the two attachments to that e-mail to include two alternate paragraphs, either of which could be added to the letter to address this point.

3. The letter does not request Duke to consider more current information related to whether an overtopping event can occur at Jocassee Dam. The current Duke analysis of the probable maximum precipitation does not consider an antecedent storm or the saturated soil conditions that would result from an antecedent storm. Doing so is current practice and could impact whether the dam overtops. Given the greater volume of water, dam overtopping results in the most significant inundation, and, given OFFICIAL USE OLY -l'-CUP.ETY-Rt=LATED INFORM.TIAN 2 of 3

Oconee NRC Reply Non-concurrence (9) final.doc

.J2FFICIAL U;SE VINLY - SECURITY-RELATED lIr-uRM'ATiGi4 the significance of the issue, needs to be considered to ensure demonstration of adequate protection. I recommend that the letter be modified such that the phrase "reservoir levels" read as "reservoir levels including overtopping."

4. The letter does not request that Duke answer questions on the seismic capability of the Jocassee Dam. Questions in the seismic arena were raised by an agency seismology expert as a result of his review of a 2007 fragility study that Duke submitted in relation to the Reactor Oversight Process issue regarding the hole in the SSF wall. The seismic issue needs to be resolved before NRC can conclude that adequate protection against external flooding is provided. The letter should include the seismic questions that were conveyed at the December 4, 2008, meeting or refer to another communication with an indication that an adequate response is expected as part of our adequate protection determination.

5. The letter, by not requesting a due date for the analyses, implies that we will accept November 2009 as a submittal date. I recommend that the letter reflect our statement at the November 5, 2008, management meeting that technical resolution be achieved within one year. As such, the letter should reflect a date for Duke to submit-its inundation/sensitivity studies consistent with practicality in use of the HEC-RAS code (2-4 months from date of letter) that will support and more likely assure agreed-upon technical resolution by November 2009.

Summary Given the high safety significance of the issue, it behooves the NRC to ensure the most efficient path to resolution; my concerns surround the fact that the letter does not achieve that objective. Given the significant staff expertise in flood analysis, seismic engineering, and probabilistic risk assessment, I believe that the technical analysis done by these staff to date is sound and supports a clear communication to the licensee regarding our needs to resolve this issue. The staff's expertise in these areas was augmented through face-to-face meetings with representatives of FERC. The analysis done by these staff and the interactions need to be brought to bear in this letter. Further, the letter as currently written, may result in more than one iteration of analysis with the licensee which will burden both staff and licensee resources and add months of additional time to reach resolution. Results of the staff's flooding and seismic analyses were presented to the licensee at meetings on November 5 and December 4, 2008, so not doing so now seems to imply that we are backing away from our earlier positions. I also am concerned that an approach that does not seek the most efficient path is not one that the agency can defend well to outside stakeholders. In conclusion, I remain concerned that this approach is not in the best interest of public health and safety and security, regulatory stability, and our role as a strong regulator.

• LY ~~-SECURITY-RELATED IIOJ 3 of 3

APPLICABLE REGULATORY GUIDANCE DOCUMENTS TO EXTERNAL FLOODING ISSUES RELATED TO POTENTIAL DAM FAILURES EXECUTIVE

SUMMARY

The following text provides a summary of applicable regulatory guidance on external flooding issues related to potential dam failures, with emphasis on failures due to causes other than severe precipitation and seismic activity (i.e., covering random dam failures).

The references covered include General Design Criterion (GDC) 2, per 10CFR Part 50, Regulatory Guides, Standard Review Plans, and applicable industry standards.

Four Standard Review Plans (SRPs) are directly related to the issue of external flooding.

Evaluation of flooding analysis to appropriate postulations of the "worst-case flooding scenario" is mentioned for sites on streams and rivers. For flood waves resulting from a dam breach or failure, the resulting "highest water surface elevation" affecting an SSC important to safety is indicated as an area for review, where failure of a single upstream dam that has the "most severe impact on the site" should be evaluated using conservative assumptions. All four SRPs make explicit reference to Regulatory Guide 1.59 to be used as guidance by the staff "as supplemented by best current practices."

Regulatory Guide (RG) 1.59 indicates that the conditions resulting from the "worst site-related flood probable" at the reactor site (plus attendant wave-activity) constitutes the design basis flood conditions that safety-related SSCs "should be designed to withstand and retain capability for cold shutdown and maintenance thereof." The specific guidance provided in RG 1.59 for such cases indicates that combinations where the probability of occurrence is "at least comparable" to the most severe hydrometeorological or seismically induced flood should be considered. Appendix A to RG 1.59 incorporates by reference the standard N1 70-1976, "Standards for Determining Design Basis Flooding at Power Reactor Sites" (for which the most recent revision is ANSI/ANS-2.8-1992). This 1992 revision of the standard is also referred to in the SRPs mentioned above.

ANSI/ANS-2.8-1992 states that "Nuclear reactor safety from flooding needs to be ensured not only in floods from extreme precipitation but in floods from other causes as well. Surges from upstream dam failures from nonhydrologic causes constitute potential threats." ANSI/ANS-2.8-1992 includes in the events that shall be considered to determine the controlling flood elevations (single or in combination) the failures of upstream dams from "hydrologic, seismic, or other causes."

Regulatory Issue Summary (RIS) 2001-02 also delineates a process that can be used when NRC's responsibility to ensure reasonable assurance of adequate protection at a site needs to go beyond the regulation.

F3Ll:~~~~~*.iA~~I

- 0lfL~l2LE~3 ,,Ai,

17. 1

APPLICABLE REGULATORY GUIDANCE DOCUMENTS TO EXTERNAL FLOODING ISSUES RELATED TO POTENTIAL DAM FAILURES GDC 2 and Pre-GDC 2 Oconee UFSAR Commitments The Oconee Nuclear Site (ONS) UFSAR Section 3.1.2 contains a description of the station's design criterion titled "Criterion 2 - Performance Standards (Category A)," which is hereafter called "Pre-GDC 2 Criterion." Oconee's Pre-GDC 2 criterion requires that:

Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be designed, fabricated and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. The design bases so established shall reflect: (a) appropriate consideration of the most severe of these natural phenomena that have been recorded for the site and the surrounding area and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.

The Oconee UFSAR Section 3.1.2 includes "earthquake" as one of the natural phenomena, which the SSCs should be able to withstand, without loss of capability to protect the public, the additional forces that might be imposed by natural phenomena. It further states that the designs are based upon the most severe of the natural phenomena recorded for the vicinity of the site, with an appropriate margin to account for uncertainties in the historical data.

The Oconee Station's pre-GDC 2 requirements appear to be quite similar, in their scope, to those of the current GDC 2 criterion included in 10 CFR Part 50 Appendix A:

SSCs important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions. The design bases for these SSCs shall reflect: (1) Appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and the surrounding area, with sufficient margin for the limited accuracy, quantity and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena, and (3) the importance of the safety functions to be performed.

Applicable Standard Review Plans (SRPs)

Four SRPs are directly related to the issue of external flooding: 2.4.2, 2.4.2, 2.4.3, 2.4.4, and 2.4.10. All four SRP make the following reference to RG 1.59:

Appropriate sections of the following Regulatory Guides are used by the staff for the identified acceptance criteria: ... Regulatory Guide 1.59, as supplemented by best current practices, provides guidance for developing the hydrometeorological design bases ...

PL ARY DRAFT -- NOT FOR PUBLIC RELEASE - 2

03/25/2000 Furthermore, all SRPs reference the standard ANSI/ANS-2.8-1992 in either the main text or the reference list. In particular, SRP 2.4.2 states the following:

ANSI/ANS-2.8-1992 provides guidance for determination of appropria te combinations of flooding mechanisms along with their relative severity within the combined events. The staff uses the recommendations of ANSI/ANS-2.8-1992, supplemented with best current practices, to review the applicant's submittal in order to ensure that the most severe flood at the plant site has been determined.

A brief summary is provided below, followed by additional excerpted main statements (blue italic) from the individual SRPs:

SRP 2.4,2 "Floods" This SRP provides guidance in performing safety reviews of historical flooding bases with respect to individual types of flood-producing phenomena and combinations thereof. Guidance related to dam failure includes consideration of stream flooding with review of the PMF with coincident wind-induced waves due to dam failure potential.

The flood history and the potential for flooding are reviewed for the sources and events listed below. ... The review covers the following specific areas:

Section 2 Stream Flooding The application should include documentation of the potential sources of flood and flood response characteristics. Depending on the hydrology in the watershed where the proposed site is located, estimates of tributary contributing area, PMF, coincident wind-induced waves, floods produced due to dam failures, and combinations of less severe river floods with coincident surges and seiches should be provided.

Section 6 Seismically Induced Dam Failures(or Breaches)

The application should include the flooding hazard at the plant site resulting from seismically induced dam failure upstream of the site location.

Section 9 Combined Events Criteria The staff reviews the combinations of individual flooding mechanisms that are reasonably possible. It is possible that a combination of two or more flooding mechanisms that individually result in floods less severe than their respective worst-case occurrences may combine due to dependence among themselves and result in a more severe flood than the worst case of any one of the mechanisms occurring in isolation.

SRP Section 2.4.3, "Probable Maximum Flood (PMF) on Streams and Rivers" "Probable Maximum Flood (PMF) on Streams and Rivers" describes the procedures for determining the PMF using the information related to the reservoirs in the region available from the US Army Corps of Engineers, U.S. Geological Survey and the National Inventory of Dams.

P4,4- 3

The staff's review should include evaluation of pertinent information to determine if these criteria are appropriately used in postulation of the worst-case flooding scenario at the proposed plant site and in the adjacent streams and rivers.

SRP Section 2.4.4, "Potential Dam Failures" This SRP section deals directly with guidance on the review of potential failure of onsite, upstream, and downstream water control structures. Specific areas identified with respect to dam failure include dynamic effects (flood waves), cascading failures, and failure of onsite water control or storage structures.

Flood Waves from Severe Breaching of an Upstream Dam: Flood waves resulting from a dam breach or failure, including those due to hydrologic failure as a result of overtopping for any reason, routed to the site and the resulting highest water surface elevation that may result in flooding of SSC important to safety.

Flood Waves from Severe Breaching of an Upstream Dam: The location of dams and potentially "likely" or severe modes of failure are identified. Failure of a single upstream dam that has the most severe impact on the site should be evaluated using a conservative mode of dam failure, consideration of reservoir level at full pool, and appropriate combination of antecedent flows as described by ANSI/ANS-2.8-1992.

Domino-Type or Cascading Dam Failures; To meet the requirements of GDC 2, 10 CFR 52.17, 10 CFR Part 100, and 10 CFR 100.23(d), an appropriate configuration of the cascade of dam failures and its potential to produce the largest flood adjacent to the plant site is needed. Several possible cascading dam failures should be investigated, including those induced by seismic and hydrological failures.

SRP Section 2.4.10, "Flooding Protection Requirements" SRP 2.4.10 provides guidance on the comparison between the information reviewed in previous sections regarding the design-basis flood conditions and the potential effects on safety-related facilities for a given location and elevation. Also included in the guidance are considerations of types of flood protection (e.g., "hardened facilities", sandbags, bulkhead, etc.) and emergency procedures, as outlined in RG 1.102.

In this section of the safety analysis report (SAR), the hydrological design basis is developed to ensure that any potential hazard to the safety-related facilities due to the failure of onsite, upstream, and downstream water control structures are considered in plant design.

Regulatory Guides The following two Regulatory Guides provide guidance directly related to external flooding issues:

Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants", Rev. 2, 1977 FRtzLIIvlsr.JAR y LJkAI- I - i-us h'UbLiO F~ELE.A3E 4

This Regulatory Guide describes acceptable methods of determining design basis floods.

referencing.the American National Standards Institute (ANSI) Standard N1 70-1976 (ANS 2.8),

"Standards for Determining Design Basis Flooding at Power Reactor Sites" almost in its entirety as the source for estimating Probable Maximum Floods (PMF), with the exception of specific portions related to the evaluation of erosion failure. GDC 2 is explicitly mentioned in RG 1.59.

Nuclear power plants should be designed to prevent the loss of capability for cold shutdown and maintenance thereof resulting from the most severe flood conditions that can reasonably be predicted to occur at a site as a result of severe hydrometeorological conditions, seismic activity, or both.

The conditions resulting from the worst site-related flood probable at the nuclear power plant (e.g., PMF, seismically induced flood, seiche, surge, severe local precipitation) with attendant wind-generated wave activity constitute the design basis flood conditions that safety-related structures, systems, and components identified in Regulatory Guide 1.291 should be designed to withstand and retain capability for cold shutdown and maintenance thereof.

For sites along streams, the PMF generally provides the design basis flood. For sites along lakes or seashores, a flood condition of comparable severity could be produced by the most severe combination of hydrometeorological parameters reasonably possible, ...

or a reasonable combination of less severe phenomenologically caused flooding events should be considered in arriving at design basis flood conditions comparable in frequency of occurrence with a PMF on streams.

The material previously contained in Appendix A has been replaced by American National Standards Institute (ANSI) Standard.N1 70-1976, "Standards for Determining Design Basis Flooding at Power Reactor Sites," with the following exception:

Sections 5.5.4.2.3 and 5.5.5 of ANSI N170-1976 contain references to methods for evaliating the erosion failure of earth fill or rock fill darns and determining the resulting outflow hydrographs. The staff has found that some of these methods may not be conservative because they predict slower rates of erosion than have historically occurred. Modifications to the modeis may be made to increase their conservatism. Such modifications will be reviewed by the NRC staff on a case-by-case basis.

Regulatory Guide 1.102, 'Flood Protection for Nuclear Power Plants", Rev. 1, 1976, describes the acceptable types of flood protection for the structures, systems and components (see also SRP 2.4.10).

For purposes of this guide. the Design Basis Flooding Level (DBFL) is defined as the maximum water elevation attained by the controlling flood, including coincident wind-generated wave effects. The wind-generated wave component of elevation is generally controlled by fetch and water depth and may differ at locations around the plant. Further distinction must be made between estimates of "structural" effects (i.e., static and dynamic forces) and flooding or inundation effects. Additionally, the controlling flood event may be different for evaluating structural effects than for evaluating inundation effects. For example, the Probable Maximum Flood (PMF) may produce the highest water level and static forces on a given structure. but the total static and dynamic forces on the structure may be greater during a smaller (in elevation) flood wave from the seismically induced failure of an upstream dam.

• - _ . ,, * ,2,...

. ,' -i ..... ... 5

03/25/2009 Applicable Standards The following two standards provide guidance directly related to external flooding issues:

ANSI/ANS-2.8-1992, "Determining Design Basis Flooding at Power Reactor Sites" This standard was prepared by the American Nuclear Standard (ANS) Working Group ANS-2.8.

It was first revised in 1981 (and published as ANSI/ANS-2.8-1981), with a second and latest revision performed in 1992 (ANSI/ANS-2.8-1992), being withdrawn in 2002. ANSI/ANS-2.8-1992 provides guidance on plant safety related to flooding; including considerations of hydrological and nonhydrological dam failures; and evaluation criteria for combinations of events.

Section 4.2.1 Flood-CausingEvent No single flood causing event is an adequate design base for a power reactor. Usual principal factors are precipitation, antecedent moisture, and wind, but special factors include dam failures from differing causes. Events that shall be considered to determine the controlling flood elevations are one, or appropriate combination of any, of the following as outlined in Section 9, Combined Events Criteria: (2) Failure of dams and other man-made structures from hydrologic, seismic, or other causes upstream, downstream, and on site.

Analyses of dam failures are complex, many failures not being completely understood.

The principal uncertainty involves likely mode and degree of failure. Uncertainties can be circumvented in situations where it can be shown that the complete and sudden disappearance of a dam or dams will not endanger the nuclear plant. Otherwise, reasonable failure postulations shall be used.

Section 5.5.4.2.3 Earth and Rockfill Earth and rock embankments shall be evaluated for breaching from overtopping. If there are two or more independent embankments, it may be necessary to fail only one if it produces the most critical flood wave. ... If no overtopping is demonstrated, the evaluation may be terminated and the embankment may be declared safe from hydrologic failure. ... Caution shall be exercised in the selection of the method to be used for each site-specific problem. Additionally, the sensitivity to parameter changes and event timing shall be thoroughly investigated for each analysis.

Section 6.3 Dam Failuresfrom Other Causes Potential dam failures from earthquakes are associated with sharply defined natural events of a few moments' duration and failures from extreme floods with natural events of a few hours', days', or weeks' duration. Dam failures from other onsite causes might result from gradual changes in, under, and adjacent to the dam. With proper inspection and monitoring, gradual changes threatening dam safety might be detected and adequate corrective measures can be taken.

PPELINIINIAP.Y DRAFT NC~T ~OP PUBLIC RELF~ 6

Section 6.3.2 Failure Causes On-site potential causes of partial or complete dam failure include the following:

(1) Deterioration of concrete due to cracking, weathering, or chemical growth.

(2) Deterioration of embankment protection such as riprap or grass cover.

(3) Excessive saturation of downstream face or toe of embankment.

(4) Excessive embankment settlement.

(5) Cracking of embankment due to uneven settlement.

(6) Erosion or cavitation in waterways and channels, including spillways.

(7) Excessive pore pressure in structure, foundation, or abutment.

(8) Failure of spillway gates to operate during flood because of mechanical or electrical breakdown or clogging with debris.

(9) Buildup of silt load against dam.

(10) Excessive leakage through foundation (11) Leakage along conduit in embankment.

(12) Channels from tree roots or burrowing (13) Excessive reservoir rim leakage.

(14) Landslide in reservoir.

Section 9.2.4 Nonhydrologic and Nonseismic Dam Failures No specific guidance or specific event combinations are provided in this standard because of uncertainty in postulating a realistic dam failure from nonhydrologic and nonseismic causes. Refer to 6.3 ANSI/ANS-2.12-1978, "Guidelines for Combining Natural and External Man-Made Hazards at Power Reactor Sites," withdrawn While no ONS reference was found to RG 1.59 or ANS-2.8 standards, ANSI/ANS-2.12-1978 is referenced in Oconee's Unit 1 & 2 IPEEE submittal (December, 1995) under the General Methodology section: "Natural and man-made external events of interest were identified using other PRAs, NSAC/60, ANSI/ANS-2.12 (Ref. 2.3), and the aforementioned NUREG/CR-2300."

The purpose of this standard, as stated, is "to establish a methodology for identifying combinations of natural hazards and external man-made hazards for consideration in plant design. As existing standards do not cover all of the individual external man-made hazards, this standard can also serve as a reference which a designer can use in examining a specific site for protection against individual external man-made hazards." Although mentioned in ANSI/ANS-2.8, no specific guidance is provided for combinations including flooding due to dam failures from causes other than seismic and severe precipitation in ANSI/ANS-2.8 itself. A particular type of hazard identified in ANSI/ANS-2.12 is a "retaining structure failure" which encompasses failure of a dam due'to causes "other than flood, earthquake or tsunami" as a man-made hazard "which occurs external to a nuclear power generating station" with the potential to affect safety-related structures.

ANSI/ANS-2.12 uses 106 per year as a screening threshold, in order to "establish a division between combinations of natural hazards and external manmade hazards which must be considered in the plant design and those which need not be considered." Additionally, ANSI/ANS-2.12 explicitly cautions that "overall safety risk to the public due to a hazard is Yf %r 7

concerend (sic) not only with the probacility of occurrence of the hazardous event but aiso with the probability that an essential safety furction is significantly impairec by the event such that there is release of radioactivity. Specific evaujation of such consequences is beyond the scope of this standard. but should be considered -n the final selection of com:bined events to be used for plant design.' In other words, the designer must consider not only the probability of occurrence (i.e.. initiating event frequC n y) out also the consequence of ine occurrence (i.e..

conditional core dam a age ro :abilitiAL (b)(7)(F) I Thls standard provides a conservative dam failure screening frequency of 10': per 'am-years. It further states that it would be up to :ne "plan designer to further investigate the lailure probabilities for dams and other water retaining structures ir. h.s area to determine whether lower hazarc probabilities are jus::fiable.

STATUTORY AUTHORITY ABOVE AND BEYOND EXISTING REGULATION The Regulatory Issue Summary (RIS) 2001-02. 'Guidance on Risk-lnformec Decisionmaking in L:cense Amendmen, Review's." describes the use of risk information in license amendment acuivities. It states in part:

"When a license amendment request comp:-es with the regulations and other license requirements. there is a presumption by the Commission of acequate protection of pubiic health and safety (Ma~ne Yankee, ALAB-161. 6 AEC 1003 (1973)). However. circumstances may ar:se in which new information reveals an- unforeseen hazard or a subsantially greater potentia, for a known hazard to occur, such as identification of a design vulnerability or an issue that substantially increases risk. In such silualtions, the NRC has the statutory authority to require h~censee action above and beyond existing regulations to nmaintain the level of protection necessary to avoid undue r~sk to public health anc safety.

The above guidance clearly d.rects the NRC to look beyon.d the existing regulao.on to ensure adequate protection in license applications. In a draft Davis Besse order on reactor head nozzles circunlferewnat cracking sen. to the Commissioners dated November 2', 2001 (ML022700327). the EDO states:

Regulatory Issue Summary 2001-02. provices a process for the staff to consider whether a

• special circumstance exists which may rebut the presumption that compliance with the regulations provides adequate protection of puolic health and safety. Although developed as a tool for staff reviews of i:cense amendment requests. the process in Regulatory Issue Sumimary 2001-02 is appropriate for otner regulatory decision.maKing purposes because itaddresses a fundamen:al requirement for operation of a nuclear reactor. i.e., reasonable assurance of acequate protection of public health and safety.

This RIS delineates a process and the EDO's memo requires the NRC needs to look beyond the regulation to ensure compliance w.th the Atomic Energy Act adequate protection mandate it a licensee is found to meet all the appiicab.e regulation but a significant safety issue stil:

persists.

8

O-C,FFICIAL UE ."FMT From: Melanie Galloway Sent: Wednesday. March 11, 2009 313 PM To. Mark Cunningham: David Skeen; Patrick Hiland; Joseph Giitter; Jack Grobe: Bruce Boger Cc: Allen Howe; Nilesh Chokshi; Scott Flanders; Brian Holian

Subject:

two versions reflecting 2 options on sensitivity study All:

I've attached two versions illustrating two different options for requesting the sensitivity studies.

V2 includes the request that I understood came from the 2126 meeting with Joe, Pat, Dave. Jack and Brian.

V3 includes the request that I worked on with NRO.

Both versions have the same result in that they provide clearer expectations to the licensee in terms of the bounds of the sensitivity analysis and resolve several issues I see with the current wording. Namely,

1. Either version will provide a higher degree of likelihood that the licensee's analyses will meet our expectations with only one request, creating efficiency for both the licensee in their analysis and us in review.

2. As a result of item 1.. we should have a quicker path to resolution and thus put this issue behind us.

3. The +/- 50% is an arbitrary request and one we are hard pressed to explain. By contrast, the two versions rely on current methods and/or FERC guidelines (depending on which version you look at) that provide a defensible basis we can rely on when asking Duke to perform sensitivity analysis.

Also, note that I have included a request for Duke to consider overtopping reservoir levels when doing the sensitivity analysis. When considering adequate protection. we are to look at current information and standards and doing so gives rise to saturated soil and runoff considerations not included in Duke's current analysis.

These issues likely require additional discussion. I know Jack said there would be another meeting but with the RIC this week and new versions being offered, I didn't want to wait to present these alternate views.

Melanie OFFICIAL USE ONLY - SCUiJ~iT-RELAT.'D IN'FOR.MATION

tb LY - SECURITYR

.- *xce.rpts from Attachments to March I.I 2000. F-Mail Showing A.lterate Paragraphsg that Could be Added to Leiter to Address Points 2. and 3. of Non-Concurrence (note that exact wording is not important but rather the concept is what is important)

Option 1: Includes Calculated Staff Values as Boundaries for Duke to Perform Sensitivity Studies In your response to the 50.54(0 letter-, Duke committed to perform inundation studies using the more advanced HEC-RAS model. The response also indicated that Duke would perform sensitivity studies using the more advanced 1-IEC-RAS model to further understand the effects on flood levels at the SSF. The NRC agrees that a study with the more advanced model and a sensitivity analysis is necessary because of the uncertainty involved in predicting dam failure and resultant flood levels at the Oconee site. Key parameters (breach size. reservoir levels including overtopping, time to dam failure. etc,) should be varied over a sufficient range (as shown in Table 1) to provide an understandine of how changes to those parameters impact the flood height estimates. These values were obtained from NRC calculations using current methods, referenced in U.S. ArmyiCorps of Engineers and U.S. Bureau of Reclamation documents. This sensitivity analysis should not be limited to one-at-a-time parameter variations. You will note that the sensitivity analysis requested includes an assessment across possible NRCS curve numbers. Variation of this parameter is included because your chosen curve number does not appear reflective of'the precipitation and runoff expected during a probable maximum precipitation (PMP) event. Should you choose rangels different from those presented in Table 1. you should provide the associated Iustification for doing SO.

ITable I Jocassee Dham Model Input Parameters Parameter Minimum Value Maximum Value Jocassee Dam base breach width (ft.) 150 430 Jocassce Dam top breach width (ft.) 1445 17'70 Jocassee Dam bottom breach elevation (ft. MSLi 730 800 Jocassee Dam time to failure (hrs.) 1 4 Jocassee Reservoir level (ft. MSL) t105 1125 Keowee Reservoir level 730 8 15 NRCS Curve number 55 80 MNSL = meancsa level Option 2: Includes Qualitative l)iscussion to Guide Duke's Sensitivit' Studies In y'our response to the 50,54(t) letter, Duke committed to perform inundation studies using thi more advanced I IF;C-RAS model. The response also indicated that Duke wouldiperform sensitivity studies using the more advanced F-IE('-RAS model to fu1rther understand the. effects on flood levels at the SSF. The NRC agrees that a study with the more advanced model and a sensiti viv analysis is necessary because of the uncertainty involved in predicting dam failure aMid resuhlant flood levels at the Oconee site. Key parameters (breach size. reservoir levels including overtopping, time to dam failure. etc.) should be varied over a sufficient range to provide an understanding of how OrFIGIAL U~ UNLI - ZECURITY RELATED INFORMATI3N

a OFFICI] L U3. GNLY-.ECURIT-RFI rE- INFO.MTIGN changes to those parameters impact the flood height estimates. The parameters selected and the ranges of those parameters should be justified and should represent a conservative range of hypothetical conditions. The NRC has reviewed the Federal E-nergy Regulatory Commission guidance regarding breach size and time to failure. The FERC guidelines represent appropriatc ranges for a sensitivity analysis. We have also conducted assessments using current methods, referenced in U.S. Army Corps of Engineers and U.S. Bureau of Reclamation documents. Our resulting calculated values for some of the critical parameters, including breach size and time to failure, for Jocassee Dam analyses are within the ranges of the FERC guidelines and confirm the appropriateness of these guidelines for a sensitivity analysis. In your sensitivity analysis, you should evaluate whether additional parameters, beyond those identified by the staff, need to be varied over appropriate ranges to estimate the inundation flood levels. Your analysis should consider variation of several parameters simultaneously. We recommend that we meet to discuss your sensitivity analysis plan before you undertake the analysis to establish mutual understanding and avoid unnecessary reiterative efforts.

9F," 'i°ewC'y -

11,'-C.. seeUR;J*'*-EAEJIFR

b NRC FORM 757 U.S. NUCLEAR REGULATORY COMMISSION NRC MD 10.158 (3-2oS) NON-CONCURRENCE PROCESS TITLE OF DOCUMENT ADAMS ACCESSION NO.

Evaluation af Duke September 26, 2008 Response Related to External Flooding at Oconee ML090570779 SECTION C - TO BE COMPLETED BY DOCUMENT SPONSOR NAME Joseph Giitter TITLE PHONE NO.

Director Division of Operating Reactor Licensing [ 301-415-1453 ORGANIZATION NRR ACTIONS TAKEN TO ADDRESS NON-CONCURRENCE (This section should be revised, as necessary, to reflect the final outcome of the non-concurrence process, Including a complete discussion of how Individual concerns were addressed.)

See the attached response, 1 CONTINUED IN SECTION D NATURE-D -P U.ENT OR DATE GNATURE-DOC NT DATE NO -CONCURRTIG ,0I6iVIDUAL(To be complted by do*uTmrlosp ror when process Ifcomplete, I.e., after document I signed):

D[] CONCURS E] WANTS NCP FORM PUBLIC I NON-CONCURS X WANTS NCP FORM NON-PUBLIC

[ WrTHDRAWS NON-CONCURRENCE (i.e.. discontinues process)

NRC FORM 757 (3-2009) Use ADAMS Template NRC-006 PRIINTED[ON RECYCLED PAPERH

Document Sponsor Response to Non-concurrence on the Evaluation of Duke September 26, 2008 Response Related to External Flooding at Oconee Background and basis for letter The potential safety significance of this Issue was the basis for the NRC's issuance of a 10 CFR 50.54(f) letter to Duke in August 2008. One of the key drivers for the NRC's letter was the recognition that the previous estimates for the probability of a random dam failure were an order of magnitude smaller than they should have been.

The purpose of the NRC's letter to Duke Energy was to convey the following key points as summarized below:

- Duke's September response to the 50.54(f) letter did not address NRC's concerns and demonstrate that Oconee will be adequately protected in the long term from external flooding events. NRC staffs position is that a Jocassee Dam failure is a credible event and needs to be addressed deterministically.

- In the short term, NRC staff has concluded that there is not an immediate safety concern necessitating prompt modification or suspension of the Oconee license for the short term based on FERC inspections, monitoring by Duke, the current low level of the Jocassee Lake, the sufficiently low estimated random failure frequency of the dam, and the timellnes in the failure sequence that would allow for mitigating actions.

- To resolve these issues, Duke must provide a technically defensible Inundation study supporting the protection of Oconee from offsite flooding with an associated sensitivity analysis. This study and sensitivity analyses were identified in Duke's 50.54(f) response.

- The sensitivity analyses must include varying key parameters that can affect the on-site flood height (e.g., breach size, reservoir levels, time to dam failure) individually and in combination over a sufficient range to provide an understanding of how changes impact the flood height estimates. The selection of parameters to be varied and the range of variability for those parameters need to be justified.

- The NRC staff expects that the analyses to establish an adequate licensing basis for external flooding be completed by November 2009.

Actions preceding the non-concurrence:

In the course of developing the letter to Duke, NRR management, including the non-concurring person, discussed issues to be addressed in the letter. At these meetings, the non-concurring person's alternate views were discussed and not successfully resolved for the non-concurring person.

The non-concurring person briefed the ET on January 14, 2009, on the safety significance of the issue and the basis for allowing continued operation while the issue was being resolved. At that meeting, the non-concurring person presented a basis for allowing continued operation of the Oconee facility for the next two years, thus defining NRC's timeline for resolution of the issues.

As a part of discussing this non-concurrence response with the document sponsor, the non-

Pb concurring person questioned whether the current plans continue to support this 2-year timeline for issue resolution.

Actions taken after the non-concurrence:

The non-concurrence references the need for the letter to address NRC's requirements and guidance as well as consideration of insights from staff and from other Federal agencies. At a meeting on April 3, 2009, and in other discussions prior to that meeting, the need to develop NRC guidelines or criteria for assessing the information provided by the licensee was discussed. Ultimately, NRR must determine the adequacy of Duke's inundation study. Given the complexity of the licensing issues in this case, there may be more than one way to evaluate the licensee's inundation study. Itis the licensee's responsibility to perform an adequate external flood analysis and provide justification for the parameters used to the NRC. NRR-DE has initiated the development of a plan to reach final resolution on this issue, including establishing an approach to judge the adequacy of the flood analysis provided by Duke. To that end, DE has engaged the Bureau of Reclamation to provide additional Input to NRC in evaluating the information that will be provided by Duke. NRR will consider this and the other developed inputs, including the considerations developed by NRO (currently in draft), to determine the adequacy of the licensee inundation study.

In addition, the non-concurrence references an email describing options for the letter to Duke to stipulate what would be needed to address NRC's concerns. The letter to Duke has been revised to reference FERC guidelines or other applicable industry standards as potential methods to represent appropriate ranges for a sensitivity analysis.

The non concurrence discusses the schedule for resolution of the issue. The letter was revised to include the staffs expectation to hold regularly scheduled meetings with Duke (e.g., monthly) to ensure the licensee is taking action to facilitate timely resolution of this issue. The goal is to reach a conclusion that Oconee is adequately protected in the event of a flood caused by the failure of the Jocassee dam. To that end, NRC will need to reach a decision on an acceptable estimate of the flood height at the site and for the licensee to provide a schedule for making any necessary physical modifications to the plant, by November 2009.

The non-concurrence and the response to the non-concurrence were provided to the individuals involved in concurrence of the letter to Duke.

Conclusion The letter is intended to be a step in the resolution of this issue, as a final NRC decision has not been made on the adequacy of Oconee's external flood protection. The technical issues raised in the non-concurrence are either addressed above, or will be considered further during final resolution of this matter. Further action to resolve the overall issue is being led by the Division of Engineering. The document sponsor agrees with the non-concurring person's supervisor, that the appropriate issues can be addressed in subsequent correspondence. Finally, in response to selected concerns in the non-concurrence, the letter has been modified to include a reference to FERC guidelines or other industry standards as potential methods to develop sensitivity analysis parameters; and the expectation that the schedule for technical resolution, including NRC review, is November 2009.

OFFCL E N'- EUIYibAwuqRATO