ML14058A016
Text
ft
,FFICIAL U&E GN"- SECURITY RELATED INXORMATIoN MEMORANDUM TO: Eric J. Leeds, Director Office of Nuclear Reactor Regulation FROM: Mark A. Cunningham, Director Division of Risk Assessment Office of Nuclear Reactor Regulation Patrick L. Hiland, Director Division of Engineering Office of Nuclear Reactor Regulation Joseph G. Gitter, Director Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation
SUBJECT:
OCONEE FLOOD PROTECTION AND THE JOCASSEE DAM HAZARD BASIS FOR NRC ALLOWING CONTINUED OPERATION The purpose of this memorandum is to document the basis for NRC allowing continued operation of the Oconee Nuclear Station for a period of 2 years to resolve issues related to their Standby Shutdown Facility (SSF) and potential vulnerabilities due to external floods. The basis was formed on current dam conditions and the risk associated with operating the site for the next 2 years.
Continued operation during this time period is not inimical to the public health and safety, therefore, we recommend that you approve and concur on this basis for NRC allowing continued operation.
Please sign below to indicate your approval. Ifyou have any questions, please contact one of us.
Approved: Date:
Eric J. Leeds, Director Office of the Nuclear Reactor Regulation
Enclosures:
- 1. Oconee Flood Protection and the Jocassee Dam Hazard Basis for NRC Allowing Continued Operation Through November 2010
~ITICIAL u~t~ ONLY ~I~Jl~T"~EL~TED IfW~ivlA I~ij
OFFIrT&I 11SF ONLY SECURITY RFI ~TEB jNrURIVIAIIUN Oconee Flood Protection and the Jocassee Dam Hazard Basis for NRC Allowing Continued Operation Through November 2010 Summary Description of Issue:
On August 15, 2008, the NRC issued a request pursuant to 10 CFR 50.54(f) for information regarding the external flooding vulnerability at ONS, including failure of the Jocassee Dam. The issue revolves around the adequacy of the SSF to mitigate an external flood given that the current assessment of the flood height exceeds the existing flood protection found around the SSF combined with NRC's discovery of a calculational error associated with dam failure. The "Jocassee Hydro Project, Dam Failure Inundation Study," postulated flood levels of the Oconee site which would render the SSF inoperable and would compromised the capability of the station to maintain needed residual heat removal and spent fuel pool cooling functions. The calculational error resulted in an order of magnitude increase in dam failure.
The NRC has concluded that an immediate shutdown of the Oconee units is not warranted because the Jocassee Dam is not likely to suffer a catastrophic failure during the next 2 years, and accident sequence progression timelines are on the order of days. Continued operation during this time period is not inimical to the public health and safety.
Name/Title Organization Telephone Mark Cunningham NRR/DRA 301-415-2884 Director Approved Date Melanie Galloway NRR/DRA 301-415-2884 Deputy Director Approved Date Jeff Mitman NRR/DRA/APOB 301-415-2843 Senior Reliability &
Risk Analyst Reviewed Date Antonios Zoulis NRR/DRAIAPOB 301-415-1209 Reliability &
Risk Analyst Preparer Date ADAMS Accession No.
WiILIAL 'JFEONL~' SEC'J9ITY RELATFfl INFORMATION
R! IN
- 1. PURPOSE The purpose of this assessment is to document the basis for NRC allowing continued operation of the Oconee Nuclear Station (ONS) for 2 years to allow issues related to external flooding of the Standby Shutdown Facility (SSF) to be adequately addressed.
- 2. BACKGROUND On August 15, 2008, the NRC issued a request pursuant to 10 CFR 50.54(f) for information regarding the external flooding vulnerability at ONS, including failure of the Jocassee Dam. The issue revolves around the adequacy of the SSF to mitigate an external flood given that the current assessment of the flood height exceeds the existing flood protection found around the SSF combined with NRC's discovery of a calculational error associated with dam failure. The "Jocassee Hydro Project, Dam Failure Inundation Study',' postulated flood levels of the Oconee site which would render the SSF inoperable and would compromised the capability of the station to maintain needed residual heat removal and spent fuel pool cooling functions. The calculational error resulted in an order of magnitude increase in dam failure.
The SSF provides capability to shutdown the Oconee units from outside the control room in the event of a fire, flood, or sabotage-related emergency. Under loss of offsite power conditions, the Keowee Dam provides backup AC power. The SSF is credited as the alternate AC (AAC) power source and the source of decay heat removal required to demonstrate safe shutdown during the required station blackout coping duration. It provides additional "defense-in-depth" by serving as a backup to safety-related systems. The SSF has the capability of maintaining Mode 3 in all three units for approximately three days following a loss of normal AC power. It is designed to maintain reactor coolant system (RCS) inventory, maintain RCS pressure, remove decay heat, and maintain shutdown margin. The SSF requires manual activation and would be activated under adverse fire, flooding or sabotage conditions when existing redundant emergency systems are not available.2 In April of 2006 the Nuclear Regulatory Commission (NRC) concluded that the licensee failed to effectively control maintenance activities associated with removing a fire suppression refill access cover (a passive NRC-committed flood protection barrier) in the SSF south wall to facilitate installation of temporary electrical power cables. The staff identified the issue during a periodic risk-informed flood inspection under the NRC's Reactor Oversight Process (ROP).
Using the ROP Significance Determination Process, the staff discovered that the licensee did not adequately address the potential consequences of flood heights predicted at the Oconee site based on the 1992 Duke Hydro/FERC Inundation Study.
The inundation study analyzed two dam failure scenarios:
" sunny day dam failure - assumes that the reservoir is at normal operating levels (determined by reviewing historical reservoir levels approximately 17 feet below the top level of the dam) and a catastrophic failure of the dam occurs
- probable maximum flood (PMF) dam failure - assumes that the reservoir is at 3 feet below the top level of the dam and a catastrophic failure of the dam occurs (piping breach).
1 "Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.
2 UFSAR Revision 15, Oconee Nuclear Station, December 2005, Chapter 9 Section 9.6.1.
2 SE ONLY-S R LATEWMO*
-OFFICA ~ NY-~Lr~R~lDIFrri The dam failures under these scenarios assumed that the flood waters would also fail the Keowee Dam. The Keowee Dam is assumed to fail as the direct result of the water forces cutting a breach in the homogeneous earth fill. Given the postulated break size and the subsequent failure of the Keowee Dam, the flood levels at ONS were calculated to be 12.5 feet and 16.8 feet for the sunny day and PMF dam failures, respectively. Flood heights of this magnitude would submerge the SSF and render it inoperable and unavailable to perform its mitigating functions. Core damage would occur in approximately 8 to 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following the dam break, and containment failure would occur in about 59 to 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br />. When containment failure occurs, significant dose to the public would result.
In 2007, the staff conducted an independent review of the Jocassee Dam failure frequency that Duke had used in the Oconee Probabilistic Risk Assessment (PRA). From that review, the staff concluded that a higher frequency estimate of Jocassee Dam failure was more accurate and that the licensee's estimate was not adequately supported by operating experience and actual performance data of similar rock-filled dam structures. The licensee excluded failure data related to earthen dams while including the dam years related to those dams thus reducing the failure probability inappropriately.
- 3. EVALUATION Deterministic Assessment The SSF provides capability to shutdown the nuclear reactors from outside the control room in the event of a fire, flood, or sabotage-related emergency. The SSF is also credited as the alternate AC (AAC) power source and the source of decay heat removal required to demonstrate safe shutdown during the required station blackout coping duration. It provides additional "defense-in-depth" by serving as a backup to safety-related systems. The SSF has the capability of maintaining Mode 3 in all three units for approximately three days following a loss of normal AC power. It is designed to maintain reactor coolant system (RCS) inventory, maintain RCS pressure, remove decay heat, and maintain shutdown margin. The SSF requires.
manual activation and would be activated under adverse fire, flooding or sabotage conditions when existing redundant emergency systems are not available.
If the postulated flood renders the SSF inoperable, the site loses its last and only line of defense to mitigate the flood and to prevent both core damage and containment failure. The flood leads to an increased vulnerability to failure of multiple components. The site does not have the ability to provide emergency power to Emergency Core Cooling Systems (ECCS), thus rendering the site without core cooling. Without core cooling, there is no method to remove decay heat and prevent core damage. Core damage would occur in approximately 8 to 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following the dam break and containment failure would occur in about 59 to 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br />. When containment failure occurs, significant dose to the public would result.
Risk Assessment When estimating parameters for probabilistic risk assessment (PRA), the Bayesian approach is the method of choice. First, data from reliable equipment are typically sparse, with few or even zero observed failures. In such cases, it is reasonable to draw on other sources of information.
The Bayesian approach provides a mechanism for incorporating such information as-from prior beliesuccesses and failures. Second, the Bayesian framework allows straightforward propagation of basic event uncertainties through a logical model, to produce an uncertainty on 3
oFi.rLU OLY iCR iiLAh ruIATN
the frequency of the undesirable end state. To do this, it assigns a probability distribution to each of the unknown parameters, draws a random sample from each, and constructs the corresponding sample for the frequency of the undesirable end state.
A Bayesian analysis of dam failures using the National Performance of Dams Program Database developed and maintained by Stanford University in conjunction with the Army Corps of Engineers Dam Database was performed (-Table 41-and-2). Both-The taWedata are-is broken down by various dam types greater than 50 feet, their failures, operating history (Dam-years), a J'*.fey. non infmative pe.t..*"O prior, a mean, and the 5%, 50%, and 95%
confidence levels. Table 2 paroc the data for dams g. ater than 50 feot.
Table 1 D..am, Fai*r= F - a A" Dam Fa-B "T Damn
-- Fa~u6 yeaf apo be mean "0 6"0 N-0%
4 All-Ai-DrnD 2 04-04 2-6 4-12.44 2.G6AE,-04 470r.06 1.793E 04 4.62E-004 2 A*ll*B*%eDams 2 O84M 2- 412862 414A6E-04 446606 44936-04 4-.3-04 3 All COncrctO Dams 4.0 41023.7 4" 443260 9.27-64.-06 6.41-7-E06 817-8E-06 4442E-04 4 A#k,---Eh 366 2233693 2626 22366 1.6396- 4 4,600-04 1.637-04 4 6 A4kwf*'-Darm, 28 122498 28 426834 2.3266E-04 61604 2238-04 3006E-04 6 A*l Ma*,cn. Dame 6 21692 6,6 2472 2-,224E--04 9-264.E-6-06 94E04 3
.7 All Muti Arch Dams 0 240 06 3M4 4-6286-04 6.006E 07 64)94E-06 &W868-04i 8 AlRlkfill De 7 66872. 7,6 68906 4-2731-04 6-4636-06 1-.27E-04 2 9 .9lStneDamns 2 14366 2M 414398 4.7366-04 3.97-8E 06 4-64-4.6-04 3-844r-.04 40 All Timber Crib Dams 3 6636 - 969 6686-4 .-.
4.32E.-0.4 043486-04 0 1 4etal 426 26 06 303 44-04 69482E-07 ME6,0.
4 R __ýý[QAAT
- 1%A ED
\flFICILU US E ONLY %TUffiW~Mf KILA'D I'M 9N Table I Dam Failure Fre uencies of Dams Greater Than 50ft All Tpes Dam-Failures years Mean 6% 50% 96%
Buttress Dams Over 50 Feet High 0 1876 2.007E-04 4.410E-05 1.736E-04 4.497E-04 Arch Dams Over 50 Feet High 2 5667 2.793E-04 1.018E-04 2.585E-04 5.280E-04 Concrete Dams Over 50 Feet High 0 19215 8.197E-05 1.801E-05 7.092E-05 1.837E-04 Earth Dams Over 50 Feet High 56 144810 3.770E-04 2.997E-04 3.749E-04 4.617E-04 Gravity Dams Over 50 Feet High 7 19542 3.173E-04 1.683E-04 3.061E-04 5.044E-04 Masonry Dams Over 50 Feet High 0 1987 1.989E-04 4.370E-05 1.721E-04 4.456E-04 Multi-Arch Dams Over 50 Feet High 0 77 2.362E-04 5.190E-05 2.044E-04 5.293E-04 Rocktill Dams Over 50 feet high 4 19900 2.135E-04 9.603E-05 2.025E-04 3.684E-04 Total 69 213074 2.380E-04 5.230E-05 2.059E-04 5.333E.04 It is important to note that the mean dam failure frequencies are on the order of 1.OE-04 Ffailure/dgam-year. As we stated in the deterministic assessment, a flood exceeding the height of the SSF flood protection would render the SSF inoperable. Therefore, the failure of the SSF is 1.0. Given the frequency of the dam failure, this results in a conditional core damage probability of 1.OE-04.
The Jocassee Dam is designed for seismic ground acceleration equal to or greater than those used in the design of ONS wa. built with the same scimc r '. quir.ments as the O.on.o site.
Given the dam is lccated ffina lowceoimic arealocation, the likelihood of a large seismic event is
- .OE-05/yr.
Accident sequence progression timelines for the subsequent containment failure would be on the order of days. Core damage would occur in approximately 8 to 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following the dam break and containment failure would occur in about 59 to 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br /> without mitigation.-When containmont fai.ur. o+G o rS, significant d*oe to the public would result. Additional strategies under consideration include use of fire trucks to maintain Spent Fuel Pool levels, controlled venting of the reactor buildings to maintain integrity, stationing and use of portable pumping equipment to spray the containment structures, and securing additional equipment for mitigation as directed by the ERO. This would give ONS time to implement the site Emergency Action Plan and evacuate the people in the surrounding vicinity. Furthermore, it is assumed, this additional time could allow recovery of flooded roadways after flood recession and the potential for alternate water sources or equipment to mitigate the accident. In addition, Duke has committed to augment its Severe Accident Management Guidelines (SAMGs) by February 2009 to include potential loss of the SSF due to external floods.
Conditioning Monitoring The ability of the NRC to accept a low likelihood of dam failure in the next 2 years is supported by the current apparent health of the dam at-and the regular monitoring of its condition:
- Duke has a diverse program of constant surveillance of the performance of the dam by means of on-site cameras and also offsite monitoring of the observed data from its headquarters office.
- Duke is performing biweekly inspection and monitoring of the condition of the dam, as required by FERC.
5 FFICA USETED INFOR I0 ..
ION
- FERC personnel inspect the dam annually, and the 2007 inspection did not identify any adverse trends in the condition of the dam.
In addition, the level of the dam is continuously monitored and is currently approximately 23 feet below the lake's full pond level due to drought conditions. This FedusesUnder current drought conditions, -the loading that is imposed on the dam is reduced and also extend6 the time available to which any needed actions could be taken is extended.
- 4. CONCLUSIONS The NRC staff believes that the Jocassee Dam is unlikely to suffer a catastrophic failure during the next 2 years for the following reasons:
- The initiating event frequency, supported by ongoing FERC and Duke monitoring and inspection of the dam, is relatively low.
- The initiating event frequency for a random failure is on the order of 1E-4/yr and for a large seismic event is 1E-5/yr.
The present level of the Jocassee Lake is about 23 feet below the lake's full pond level due to the drought conditions. This reduces the loading that is imposed on the dam.
- Duke has a diverse program of constant surveillance of the performance of the dam by means of on-site cameras and also offsite monitoring of the observed data from its headquarters office.
- Duke is performing biweekly inspection and monitoring of the condition of the dam, as required by FERC.
- FERC personnel inspect the dam annually, and the 2007 inspection did not identify any adverse trends in the condition of the dam.
" Accident sequence progression timelines to containment breach and/or fuel pool boil off at Oconee are on the order of days, allowing time to implement onsite mitigating actions and offsite emergency response actions.
- The staff assumes that recovery of flooded roadways after floodwater recession will allow for providing an alternate source of water for containment and spent fuel pool cooling.
- Duke has committed to augmenting its Severe Accident Management Guidelines (SAMGs) in February 2009 to include potential loss of the SSF due to external flood.
- The current drought level of the lake provides additional time within which any needed actions could be taken.
The NRC has concluded that an immediate shutdown of the Oconee units is not warranted because the Jocassee Dam is not likely to suffer a catastrophic failure during the next 2 years, and accident sequence progression timelines are on the order of days. Continued operation during this time period is not inimical to the public health and safety.
6 OF CU)RITY RELA
REFERENCES 1.'Joaccee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulator,'
Commiscion (FERC) Projectcs No. 2603, Deeaembc 1002.
2.T*he Atomih c Energy Act of 1954, Pub. L. 83 703, 68 Stat. 010 (1/954.
3.Maine Yankee AtomicG Power Company (Maine Yankee Nuclear Powor Plant, Unit 2). ALAB 161, 6AEC 1003. US Atomis Encrgy Commission: W~achingt9R, DG. 1973.
4.NUREG 0800, "Standard Review Plan for the Review of Safety An~alysoc for Nuclear Power Plants, Section 19.2 Appendix D,Uco of Rick Informnation InReview of NOn rick ifro Licence Amendment Requests," June 2007.
5.U.S. Nuclear Regulator,' Commission, "An Approach for Uring ProbabiliStic Risk Assessment in Risk Informned Docisionc OR Plant Specific Changer, to the Licensing Bacis," Regulator.y Guide 1.174, Revision 1, Noeme~ber 2002.
LY- ED 7