ML14058A015
Text
OrTiciAL USE gN.'L - 30UR1T.' ftmLATE. iNF,,"*MAT:N Oconee Nuclear Site Adequate Protection Backfit Documented Evaluation
SUMMARY
Duke Energy Carolinas, LLC, the licensee of the Oconee Nuclear Station (ONS) has not demonstrated that the ONS site has adequate protection against external floods from all sources including a random failure of the Jocassee Dam. Based on this evaluation, it is the opinion of the NRC staff that this situation qualifies for an adequate protection exception to the backfit rule under 10 CFR 50.109 (a)(4)(ii). As discussed below, if the Jocassee Dam fails and the SSF is inundated, the Oconee site has no defense-in-depth to prevent core damage and the containments are expected to subsequently fail. Following a Jocassee Dam failure, which inundates the SSF, without defense-in-depth, Duke has not shown that the public is adequately protected.
BACKGROUND Description of ONS Section 2.1.1.1, "Specification of Location," of the Updated Final Safety Analysis Report (USFAR) describes the geographic location. ONS is located in eastern Oconee County, South Carolina, approximately 8 miles northeast of Seneca, South Carolina at latitude 34o-47'-38.2"N and longitude 82o-53'-55.4"W. Duke Power Company's Lake Keowee occupies the area immediately north and west of the site. The Corps of Engineer's Hartwell Reservoir is south of the site. Duke's Lake Jocassee lies approximately 11 miles to the north of the site.
Section 2.4.1.1, "Site and Facilities," of the UFSAR describes the hydrologic description. The yard grade is 796 feet (ft.) main sea level (msl.). The mezzanine floor elevation in the turbine, auxiliary, and service buildings is 796.5 ft. msl. The exterior accesses to these buildings are also at elevation 796.5 ft. msl. All of the man-made dikes and dams forming the Keowee reservoir rise to an elevation of 815 ft. msl. including the intake channel dike. The crest of the submerged weir in the intake canal is at elevation 770 ft. msl.
Regulatory Requirements and Guidance 10 CFR 50, Appendix A, General Design Criteria (GDC) 2, "Design Bases for protection against natural phenomena," states "Systems Structures and Components (SSCs) important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, foods, tsunami, and seiches without loss of capability to perform their safety functions. The design bases for these SSCs shall reflect: (1) Appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and the surrounding area, with sufficient margin for the limited accuracy, quantity and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena, and (3) the importance of the safety functions to be performed."
Four Standard Review Plans (SRPs) are directly related to the issue of external flooding, which include: (i) SRP Section 2.4.2, "Floods," (ii) SRP Section 2.4.3, "Probable Maximum Flood (PMF) on Streams and Rivers," (iii) SRP Section 2.4.4, "Potential Dam Failures," and
eFrletAt USE ON9LT 94ECURITY- RBEIATEfIMAERMAkTIOW (iv) SRP Section 2.4.10, "Flooding Protection Requirements." All four SRP Sections, above, make reference to ANSI/ANS-2.8-1992. Although the summary, below, primarily considers potential considerations for dam failures related to non-tidal stream flooding, it should be noted that SRP 2.4.5, "Probable Maximum Surge and Seiche Flooding," also refers to ANSI/ANS-2.8-1992.
SRP Section 2.4.2, "Floods," provides guidance in performing safety reviews of historical flooding bases with respect to individual types of flood-producing phenomena and combinations thereof. Guidance related to dam failure includes consideration of stream flooding with review of the PMF with coincident wind-induced waves due to dam failure potential arising from (i) inadequate dam capacity, (ii) inadequate flood-discharge capability, or (iii) existing physical condition. For seismically-induced dam failures, specific combinations of earthquake levels and flood characteristics for review are provided.
SRP Section 2.4.3, "Probable Maximum Flood (PMF) on Streams and Rivers," provides guidance on the review of the hydro meteorological design bases with respect to the extent of any flood protection required for safety-related SSC, including applicable drainage area and runoff response characteristics. Figure 2.4.3-1 provides a schematic approach for the review of PMF that includes considerations for exit and proposed reservoirs in the region from information available from the US Corps of Engineers and the National Inventory of Dams.
SRP Section 2.4.4, "Potential Dam Failures," deals directly with guidance on the review of potential failure of onsite, upstream, and downstream water control structures. Specific areas identified with respect to dam failure include dynamic effects (flood waves), cascading failures, and failure of onsite water control or storage structures. SRP 2.4.4 also leaves open the possibility of considering other site-related evaluation criteria, specifically: "The potentialeffects of seismic and non-seismic information on the postulated design bases and how they relate to dam failures in the vicinity of the site and the site region." Note: Although no specific guidance regarding the dam breach parameters (such as breach width and time to failure) is given in the body of the SRP, references to technical literature dealing with dam breach are given in Section VI, "References," of the SRP. Duke is performing a revised flood inundation analysis using the computer code HEC-RAS, which is mentioned in Reference 9, "HEC-RAS River Analysis System," in this SRP.
SRP Section 2.4.10, "Flooding Protection Requirements," provides guidance on the comparison between the information reviewed in previous sections regarding the design-basis flood conditions and the potential effects on safety-related facilities for a given location and elevation.
Also included in the guidance are considerations of types of flood protection (e.g., "hardened facilities", sandbags, bulkhead, etc.) and emergency procedures, as outlined in RG 1.102.
Regulatory Guide (RG) 1.59, "Design Basis Floods for Nuclear Power Plants," references GDC 2, and describes acceptable methods of determining design basis floods, while RG 1.102, "Flood Protection for Nuclear Power Plants," provides guidance on acceptable design requirements for flood protection. RG 1.59 references the American National Standards Institute (ANSI) Standard N170-1976 (ANS 2.8), "Standards for Determining Design Basis Flooding at Power Reactor Sites," almost in its entirety as the source for estimating Probable Maximum Floods (PMF), with the exception of specific portions related to the evaluation of erosion failure.
In fact, ANS N170-1976 is used as a replacement for previous text included in Appendix A of RG 1.59, whereas Appendix B and C include simplified alternatives for estimating the PMF for non-tidal streams and the Probable Maximum Surge (PMS) for hurricanes at open-coast sites, respectively.
2
o-r-r-CJA646E l0 Oconee Licensing Basis Oconee's UFSAR Section 3.1.2, "Criterion 2- Performance Standards (Category A)," describes how it accounts for external flood protection. Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be designed, fabricated, and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. The design bases so established shall reflect: (a) appropriate consideration for the most severe of these natural phenomena that have been recorded for the site and the surrounding areas and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design."
Section 2.4.2.1, "Flood History," Since Oconee is located near the ridgeline between the Keowee and the Little River valleys, or more than 100 ft. above the maximum known flood in either valley, the records of past floods are not directly applicable to siting considerations.
Section 2.4.2.2, "Flood Design Consideration," flood studies show that Keowee Dam and Jocassee Dam are designed with adequate margins to contain and control floods. These floods include general flooding of the rivers and reservoirs in the area due to a rainfall in excess of the Probable Maximum Precipitation (PMP). Therefore, external flooding due to rainfall affecting rivers and reservoirs is not a problem. In summary flood studies show that the Lakes Keowee and Jocassee are designed with adequate margins to contain and control floods.
Section 2.4.4, "Potential Dam Failures, Seismically Induced," The Keowee Dam, Little River Dam, Jocassee Dam, Intake Canal Dike, and the Intake Canal Submerged Weir have also been designed to have adequate factor of safety under the same conditions of seismic loading as used for the design of Oconee.
The Jocassee Dam was evaluated for potential overtopping and seismic failures. After Duke concluded that the dam would not fail due to overtopping or a design based seismic event, the flooding scenario associated with the reservoir of water in Jocassee Lake was not included in their external flooding analysis.
History Duke performed an inundation study1 in 1992 to meet a Federal Energy Regulatory Commission (FERC) requirement for formulating an emergency action plan in the event the Jocassee Dam failed. This study showed that approximately 16.5 ft. of water would inundate the site.
In April 2006, while performing a Reactor Oversight Process (ROP) evaluation, the NRC staff questioned the licensee's maintenance of the SSF flood protection barrier. During the subsequent ROP Significance Determination Process (SDP), the NRC identified that the licensee had incorrectly calculated the Jocassee Dam failure frequency and had not adequately addressed the potential consequences of flood heights predicted at the Oconee site, based on the 1992 inundation study. The NRC staff also recognized that Duke's 1992 inundation study, "Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.
3
did not follow the guidelines for the PMF evaluation as described in Regulatory Guides 1.592 and 1.102 .
The NRC sent a 10 CFR 50.54 (f) request for information on August 15, 20084.5. In response to this letter, in 2009, Duke conducted additional inundation analyses 6 consisting of one- and two-dimensional studies. These studies indicated that the resultant flood, which results in approximately 18.5 feet of water on the site, would cause the site to be inundated with flood waters. Duke, in their response to the 10CFR50.54 (f) letter, stated that the inundation will lead to core damage, containment failure, and the loss of spent fuel pool cooling at all three units.
Thus, if a flooding event from a Jocassee Dam failure occurred at the ONS, all three units have no defense-in-depth to prevent core damage. The remaining intact element of defense-in-depth of containment integrity will be severely challenged, if unmitigated, resulting in the potential for radionuclide release highly probable. These results have led the NRC to conclude that the ONS lacks defense-in-depth to ensure that there is adequate protection at the site against such floods.
As a result, the NRC expressed via the aforementioned 10 CFR 50.54(f) letter, a concern that Duke has not demonstrated "...overall adequacy of the flood protection of Oconee given the Jocassee Hydro Project... Specifically, the NRC is seeking information ... whether Oconee lacks appropriate and adequate compensating engineering safeguards for such an event."
Subsequent to Duke's response to the 10 CFR 50.54(f) letter, the NRC, in its April 20, 2009, letter7 stated, in part, "the NRC staff remains concerned that Duke has not demonstrated that Oconee will be adequately protected in the long term from external flooding events."
By letter dated January 15, 20108, Duke submitted a letter to the NRC which provided its interim compensatory measures (ICMs) to ensure that ONS will be adequately protected from external flooding events until the final mitigating strategies have been implemented and all site modifications have been completed. The NRC staff plans to perform a further review of the ICMs and will perform a future inspection.
Then, by letter dated January 29, 2010,9 the staff issued its response to Duke regarding its November 30, 2009 response to the NRC letter dated April 30, 2009, related to external flooding at ONS. The staff indicated that although Duke provided a more accurate estimate of the flooding caused by a failure of the Jocassee Dam, the staff found that additional information was needed. The information was needed for the staff to determine ifthe analyses performed to date will demonstrate, for the entire Jocassee earthen works, that ONS will be adequately protected from external flooding events. Duke submitted a preliminary set of responses to the 2Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants," U.S. Nuclear Regulatory Commission,
ýRev. 2) August 1977.
Regulatory Guide 1.102, "Flood Protection for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Rev.
- 1) September 1976.
4Letter to D. Baxter of Duke Energy Carolinas, LLC, dated August 15, 2008, Information Request Pursuant to 10 CFR 50.54(f) related to Extemal Flooding, Including Failure of the Jocassee Dam at ONS, (ML0816402440).
5 Letter from D. Baxter of Duke Energy Carolinas, LLC, to US NRC, dated September 26, 2008.
6 See Duke presentation to NRC dated October 28, 2009.
7Letter to D. Baxter, Evaluation of Duke Energy Carolinas, LLC, September 26, 2008, Response to NRC Letter Dated August 15, 2008 Related to External Flooding at ONS (ML0905707791).
8 Letter from D. Baxter of Duke Energy Corolinas, LLC, to US NRC, dated January 15, 2010, that addresses the Interim Compensatory Measures at ONS.
9 Letter to D. Baxter of Duke Energy Carolinas, LLC, dated January 29, 2010, Evaluation of Duke's Response to NRC Letter Dated April 30, 2009 Related to Extemal Flooding at ONS (ML100271591).
4
OI~i~J.~L '2~E OI~L'.' 32~URITY RE'
- AT~fl INF~RMATIO~
staff's questions by letter dated March 5, 201010. The staff is currently reviewing Duke's responses to those questions.
DISCUSSION Adequate Protection Determination This evaluation is a backfit exception which is defined in 10 CFR 50.109 (a)(4)(ii) as, "That regulatory action is necessary to ensure that the facility provides adequate protection to the health and safety of the public and is in accord with the common defense and security." To ensure adequate protection, the ONS is required to have conservatism in its design and operation and a defense-in-depth approach to prevent accidents and mitigate their consequences.
An external flood at the Oconee site, due to the Jocassee Dam failure, will inundate the site with flood waters. This flooding scenario will cause the Keowee Dam to overtop and fail. This will render the hydro-generators, which are the emergency Alternating Current (AC) onsite power supplies, located in the dam, unavailable. The event will also render the switchyard, which is the offsite AC power source, unavailable. This drastically affects the normal mitigation methods, rendering all pumps and valves with AC motors, unavailable. The flood waters will also inundate the turbine building basement, where the emergency feedwater pump turbines are located for all three units, making them unavailable. This will leave the SSF to mitigate the flooding. The SSF was designed as an alternative means to achieve and maintain Mode 3 following postulated fire, sabotage or internal flooding events and is also credited during station blackout events. It achieves these requirements by being a source of reactor coolant makeup, decay heat removal, and associated power to shut all three Oconee units down. This will also be lost, due to the flooding waters of approximately 18.5 ft., since it is presently only protected by a 7.5 ft. wall. With the loss of the above mitigation equipment, this flooding inundation will lead to core damage, containment failure, and the loss of spent fuel pool cooling at all three units. Thus, ifa flooding event from a Jocassee Dam failure occurred at the ONS, all three units have no defense-in-depth to prevent core damage.
The licensee does not directly address the failure of Jocassee Dam in the UFSAR, nor does the UFSAR address the 1992 inundation study.
However, dams do fail and such failures are credible events. The industry failure data on dams is well-documented. The frequency of rupture of similarly constructed dams from all causes is estimated to be approximately 10-4 events per year. This failure frequency places a Jocassee Dam failure in the frequency range of other limiting fault events considered in the Oconee accident analyses and licensing basis. For those other limiting fault events, there is mitigation capability which reduces the likelihood of core damage and radionuclide release. However, in the case of a SSF inundation flood, no mitigation of core damage is possible within the design basis.
The 1992 inundation study clearly concludes that a flood with a maximum height of 16.8 ft. will exceed the 7.5-ft. SSF grade level flood protection. More recently, Duke's Case 2 inundation analysis results identified a flood height of 18.5 ft. at the SSF. Therefore, Duke currently has not demonstrated that adequate protection against flooding at the ONS is provided. To correct 10 Letter from D. Baxter of Duke Energy Corolinas, LLC, to US NRC, dated March 5, 2010, Partial Response to NRC RAI dated February 3, 2010, Related to External Flooding at ONS.
5
3FFl~ZIAL !2SE ~JI'4LT - ~CURIT'.'- RELMI ~D l~FG~r~1Ar'oN this, the NRC has statutory authority to impose additional condition(s) on the license to ensure that the licensee provides adequate protection against the effect of external floods, regardless of source. The basis for this authority has been established and communicated to the industry when evaluating licensing amendment requests as part of RIS-2001-02 which states:
When a license amendment request complies with the regulations and other license requirements, there is a presumption by the Commission of adequate protection of public health and safety (Maine Yankee, ALAB-161, 6 AEC 1003 (1973)). However, circumstances may arise in which new information reveals an unforeseen hazard or a substantially greater potential for a known hazard to occur, such as identification of a design vulnerability or an issue that substantially increases risk. In such situations, the NRC has the statutory authority to require licensee action above and beyond existing regulations to maintain the level of protection necessary to avoid undue risk to public health and safety. Section 182.a of the Atomic Energy Act of 1954, as amended, and as implemented by 10 CFR 2.102, gives the NRC the authority to require the submittal of information in connection with a license amendment request if NRC has reason to question adequate protection of public health and safety.
Assessing the safety significance will be performed by an evaluation of the impact on public safety of invoking this proposed addition to the license was performed. Two cases were developed and compared to estimate the potential decrease in risk. The first case assumes the current licensing basis which does not take into account failure of Jocassee Dam. In this case, a rupture of the dam will directly result in loss of the SSF with core damage and a potential radionuclide release. The second case models a proposed SSF modification, hardening it against external floods by installation of watertight doors at the entrances and associated re-engineering of ventilation and exhaust lines above calculated flood height. Other solutions to increase adequate protection are possible, for example raising the Keowee Dam and intake canal dike heights.
- 1. Current licensing basis not meeting adequate protection.
Under the current licensing basis, should an external flood exceed the height of flood protection, it will cause the Oconee switchyard, the Keowee Dam, and the SSF all to fail resulting in a conditional core damage probability (CCDP) of unity (1.0). Spent fuel pool cooling will also be lost. At the onset of core damage, containment integrity will be the only remaining initially intact defense-in-depth barrier. This barrier will be severely challenged under these conditions due to a lack of power to cool containment. In addition, boil-off of the spent fuel pools is assumed to occur regardless of containment status resulting in an immediate radionuclide release as the spent fuel pools are outside containment. Due to the accumulated debris and surrounding infrastructure damage, the attempt to recover the reactor building and spent fuel pool heat removal will be at best difficult to accomplish. NRC has estimated that the failure frequency of Jocassee Dam based on industry data for rockfill dams is 2.0 x 104 per year. This is the dam initiating event frequency (IEF). The resultant core damage frequency for this case is the product of the dam initiating event frequency and the conditional core damage probability, or CDF, = IEF x CCDP1
= (2.0 x 104) x 1.0
= 2.0 x 10- per year for each unit 6
- 2. Proposed change to licensing basis to include mitigation of external flood.
The proposed change would provide additional mitigation capability by improving the flood protection of the SSF from a Jocassee Dam failure. This proposed passive modification for external flood protection involves installing watertight doors at the SSF entrances and performing associated engineering to relocate lines in order to clear the highest computed flood height. In this modification, the probability of watertight door failure is estimated to be 7.4 x 10.3 per demand. 11 The licensee has computed that the random probability of failure of the SSF is 0.2712. Therefore, the resultant core damage frequency of this case is:
CDFý = IEF x CCDP 2
= (2.0 x 1 0 "4)x (7.4 x 10.' + 0.27)
= 5.4 x 10. 5 per year for each unit The calculated decrease in core damage frequency is:
= (2.0 x 10"4) - (5.4 x 10-5)
= 1.5 x 10.4 per year for each unit This calculation shows that a significant decrease in risk can be achieved with the proposed modification. The licensee believes that the dam failure frequency is somewhat lower than the value used in these calculations. A lower frequency will lower the risk reduction proportionately.
Regardless of the precise value of dam failure frequency and therefore, the risk reduction, Duke has not demonstrated the Oconee has appropriate conservatism in its design and operation and an adequate defense-in-depth approach to prevent accidents and mitigate their consequences.
In February 2009, the licensee developed and submitted a procedure1 3 to address failure of Jocassee Dam with consequential failure of the SSF. This procedure involves adapting an existing B.5.b mitigating strategy to provide decay heat removal through steam generators and spent fuel pool cooling during the period of inundation. The NRC staff has evaluated this procedure. It relies on many licensee operator actions to accomplish this goal. From a PRA perspective, any reduction in core damage frequency gained from this procedure is minimal.
Therefore, credit for using this procedure was not included in the above risk assessment.
11US NRC-RES/EPRI, "Fire PRA Methodology for Nuclear Power Facilities", NUREG/CR-6850, Rev. 0, 11/2005, Table 11-3.
12 Duke Power Company, "IPEEE Submittal", December 21, 1995. The quantified unavailability is due mostly to human error probabilities arising from several manual operator actions that need to be completed in order for the SSF to be successful to Mode 3.
13 Duke Energy ONS "Evaluations by Station Management in the TSC - Beyond Design Basis Mitigation Strategies for Jocassee Dam Failure," EM 5.3 Revision 0.
7
~rEIcIAL I'SE ~N' V - SEC'2R'~Y RELATED INFORMATIC~
License Summary and Evaluation In 2009, Duke, in response to an August 15, 200814.15 10 CFR 50.54 (f) request for information, conducted additional inundation analyses1 6 consisting of one- and two-dimensional studies.
These studies indicated that the resultant flood would cause the site to be inundated with flood waters and also exceed the flood protection barrier height for the SSF at the ONS. The licensee reiterated, in their response to the 10CFR50.54 (f) letter, that this inundation will lead to core damage, containment failure, and the loss of spent fuel pool cooling at all three units. Thus, if a flooding event from a Jocassee Dam failure occurred at the ONS, all three units have no defense-in-depth to prevent core damage.
CONCLUSION The objective of this documented evaluation (as required by MD 8.4 7 and LIC-202' 8) is to justify a backfit exception (under 10CFR50.109 (a)(4)(ii)) to modify the ONS license to ensure that there is adequate protection against all types of external floods and to maintain defense-in-depth. Duke should enhance the ONS defense-in-depth to ensure there is a means of cooling the core and maintaining containment integrity due to a failure of the Jocassee Dam. As described above, Duke has not demonstrated that the ONS is adequately protected against external floods from all sources including dam ruptures.
14 Letter to D. Baxter of Duke Energy Carolinas, LLC, dated August 15, 2008, Information Request Pursuant to 10 CFR 50.54(f) related to External Flooding, Including Failure of the Jocassee Dam at ONS, (ML0816402440).
15 Letter from D. Baxter of Duke Energy Carolinas, LLC, to US NRC, dated September 26, 2008.
16 See Duke presentation to NRC dated October 28, 2009.
17 NRC Directive 8.4, "Management of Facility-Specific Backfitting and Information Collection," October 28, 2004.
'8 NRC LIC-202 Revision 1, "Managing Plant-Specific Backfits and 50.54(f) Information Requests," December 20, 2006.
8